Improved Cryptanalysis of Rijndael

Ferguson, Niels; Kelsey, John; Lucks, Stefan; Schneier, Bruce; Stay, Michael; Wagner, David; Whiting, Doug

doi:10.1007/3-540-44706-7_15

Cited by 288 publications

(322 citation statements)

References 5 publications

Supporting

Mentioning

297

Contrasting

Unclassified

Order By: Relevance

“…Also, K (3) 1,1 can derive from the knowledge of K (1) 1,1 (belongs to key path C) and K (2) 1,4 , then K (5) 1,1 is also leaked from K (3) 1,1 and K (4) 1,4 . By above observation we can reduce the memory complexity by a factor of 2 24 with a similar method mentioned in [6]. We rearrange the key bytes in the key search phase.…”

Section: Algorithm 52mentioning

confidence: 93%

Revisiting key schedule’s diffusion in relation with round function’s diffusion

Huang

Lai

2013

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Abstract. We study the weakness of key schedules from an observation: many existing attacks use the fact that the key schedules poorly distribute key bits in the diffusion path of round function. This reminds us of the importance of the diffusion's relation between key schedule and round function. We present new cryptanalysis results by exploring such diffusion relation and propose a new criterion for necessary key schedule diffusion. We discuss potential attacks and summarize the causes for key schedules without satisfying this criterion. One major cause is that overlapping between the diffusion of key schedule and round function leads to information leakage of key bits. Finally, a measure to estimate our criterion for recursive key schedules is presented. Today designing key schedule still lacks practical and necessary principles. For a practical key schedule with limited diffusion, our work adds more insight to its requirements and helps to maximize the security level.

show abstract

Section: Algorithm 52mentioning

confidence: 93%

Revisiting key schedule’s diffusion in relation with round function’s diffusion

Huang

Lai

2013

Des. Codes Cryptogr.

View full text Add to dashboard Cite

show abstract

“…It supports three different key sizes: 128, 192, and 256 bits, denoted as AES-128, AES-192, and AES-256, respectively. Various cryptanalytic results were published on AES, and until recently, the best attacks presented non-random properties of 7/10/10 rounds (out of 10/12/14 rounds) of AES-128/192/256 [14,16,23,18,22]. A breakthrough in analysis of AES have been the results [10,9].…”

Section: Aesmentioning

confidence: 99%

Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others

Biryukov

Nikolić

2010

Advances in Cryptology – EUROCRYPT 2010

107

View full text Add to dashboard Cite

Abstract. While differential behavior of modern ciphers in a single secret key scenario is relatively well understood, and simple techniques for computation of security lower bounds are readily available, the security of modern block ciphers against related-key attacks is still very ad hoc. In this paper we make a first step towards provable security of block ciphers against related-key attacks by presenting an efficient search tool for finding differential characteristics both in the state and in the key (note that due to similarities between block ciphers and hash functions such tool will be useful in analysis of hash functions as well). We use this tool to search for the best possible (in terms of the number of rounds) relatedkey differential characteristics in AES, byte-Camellia, Khazad, FOX, and Anubis. We show the best related-key differential characteristics for 5, 11, and 14 rounds of AES-128, AES-192, and AES-256 respectively. We use the optimal differential characteristics to design the best related-key and chosen key attacks on AES-128 (7 out of 10 rounds), AES-192 (full 12 rounds), byte-Camellia (full 18 rounds) and Khazad (7 and 8 out of 8 rounds). We also show that ciphers FOX and Anubis have no related-key attacks on more than 4-5 rounds.

show abstract

“…The supplied 256-bit key is divided into 8 words of 32 bits each (W [0], W [1], · · · , W [7]). To generate the 15 subkeys of 128 bits (which consist of 60 words of 32 bits), the following algorithm is used: -For i = 8 till i = 59 do the following:…”

Section: Description Of Aes-256mentioning

confidence: 99%

Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds

Biryukov

Dunkelman

Keller

et al. 2010

Advances in Cryptology – EUROCRYPT 2010

112

102

View full text Add to dashboard Cite

Abstract. AES is the best known and most widely used block cipher. Its three versions differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively). While for AES-128, there are no known attacks faster than exhaustive search, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2 176 and 2 99.5 time, respectively. While these complexities are much faster than exhaustive search, they are completely non-practical, and do not seem to pose any real threat to the security of AES-based systems.In this paper we aim to increase our understanding of AES security, and we concentrate on attacks with practical complexity, i.e., attacks that can be experimentally verified. We show attacks on reduced-round variants of AES-256 with up to 10 rounds with complexity which is feasible. One of our attacks uses only two related keys and 2 39 time to recover the complete 256-bit key of a 9-round version of AES-256 (the best previous attack on this variant required 4 related keys and 2 120 time). Another attack can break a 10-round version of AES-256 in 2 45 time, but it uses a stronger type of related subkey attack (the best previous attack on this variant required 64 related keys and 2 172 time). While the full AES-256 cannot be directly broken by these attacks, the fact that 10 rounds can be broken with such a low complexity raises serious concerns about the remaining safety margin offered by AES-256.

show abstract

Improved Cryptanalysis of Rijndael

Cited by 288 publications

References 5 publications

Revisiting key schedule’s diffusion in relation with round function’s diffusion

Revisiting key schedule’s diffusion in relation with round function’s diffusion

Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others

Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds

Contact Info

Product

Resources

About