Improved Impossible Differential Attacks on Large-Block Rijndael

Zhang, Lei; Wu, Wenling; Park, Je Hong; Koo, Bon Wook; Yeom, Yongjin

doi:10.1007/978-3-540-85886-7_21

Cited by 10 publications

(20 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other hand, the variants of Rijndael with larger block sizes have got arguably less attention from the cryptographic community. Current analysis includes several multiset and integral attacks [19][20][21][22], as well as impossible differential cryptanalysis [23][24][25]. A summary of these attacks and their time and data complexities are given in Table 1.…”

Section: Introductionmentioning

confidence: 99%

Related‐key rectangle cryptanalysis of Rijndael‐160 and Rijndael‐192

Wang

Liu

Toz

et al. 2015

IET Information Security

View full text Add to dashboard Cite

In this paper we present the first related-key rectangle cryptanalysis of Rijndael-160/160 and Rijndael-192/192. Our attack on Rijndael-160/160 covers eight rounds. The attack complexities are 2 126.5 chosen plaintexts, 2 129.28 8-round Rijndael-160/160 encryptions and 2 132.82 bytes. Our attack on Rijndael-192/192 covers ten rounds. It requires 2 179 chosen plaintexts, 2 181.09 10-round Rijndael-192/192 encryptions and 2 185.59 bytes memory. These are the currently best cryptanalytic results on Rijndael-160/160 and Rijndael-192/192 in terms of the number of attacked rounds. Furthermore, our results show that the slow diffusion in the key schedule of Rijndael makes it a target for this type of analysis.

show abstract

Section: Introductionmentioning

confidence: 99%

Related‐key rectangle cryptanalysis of Rijndael‐160 and Rijndael‐192

Wang

Liu

Toz

et al. 2015

IET Information Security

View full text Add to dashboard Cite

show abstract

“…Among others, an important motivation for the study of largeblock Rijndael is the deployment of Rijndael-like permutations in the design of hash functions, Whirlwind [2] and SHA-3 finalist Grøstl [16] constituting some especially interesting instances. We mention here several multiset and integral cryptanalytic results [13,15,18,21], as well as impossible differential cryptanalysis [19,25]. In terms of the impossible differential cryptanalysis -the major object of our study in this paper -the best attack has been proposed by Zhang et al [25] which cryptanalyzes 9-round Rijndael-224 and Rijndael-256 with 2 209 and 2 208.8 encryptions, respectively.…”

Section: Introductionmentioning

confidence: 99%

“…We mention here several multiset and integral cryptanalytic results [13,15,18,21], as well as impossible differential cryptanalysis [19,25]. In terms of the impossible differential cryptanalysis -the major object of our study in this paper -the best attack has been proposed by Zhang et al [25] which cryptanalyzes 9-round Rijndael-224 and Rijndael-256 with 2 209 and 2 208.8 encryptions, respectively. Impossible differential cryptanalysis, which was proposed by [3,8], is a widely used cryptanalytic technique.…”

Section: Introductionmentioning

confidence: 99%

“…Our impossible differentials for both Rijndael-224 and Rijndael-256 have more active bytes in the output difference and, therefore, the number of subkey bytes needed to be guessed during the key recovery phase can range with more options, while the probability for a pair of plaintexts to pass the test of sieving wrong pairs is higher compared to [25].…”

Section: Introductionmentioning

confidence: 99%

“…For 9-round Rijndael-256, utilizing the new impossible differential and depending on the number of subkey bytes needed to be guessed in key recovery phase, three improved attacks can be obtained. If we guess the same number of subkey bytes as [25], an attack can be mounted with reduced data complexity of 2 229.3 Chosen Ciphertexts (CP), time complexity 2 194 encryptions and memory complexity 2 139.6 bytes respectively. In addition, if the number of subkey bytes need to guess is less than [25], given 2 237.3 CP, we can attack 9-round Rijndael-256 with 2 159.1 encryptions and 2 115.3 bytes of memory.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improved Impossible Differential Attacks on Large-Block Rijndael

Wang

Rijmen

et al. 2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we present more powerful 6-round impossible differentials for large-block Rijndael-224 and Rijndael-256 than the ones used by Zhang et al. in ISC 2008. Using those, we can improve the previous impossible differential cryptanalysis of both 9-round Rijndael-224 and Rijndael-256. The improvement can lead to 10-round attack on Rijndael-256 as well. With 2 198.1 chosen plaintexts, an attack is demonstrated on 9-round Rijndael-224 with 2 195.2 encryptions and 2 140.4 bytes memory. Increasing the data complexity to 2 216 plaintexts, the time complexity can be reduced to 2 130 encryptions and the memory requirements to 2 93.6 bytes. For 9-round Rijndael-256, we provide an attack requiring 2 229.3 chosen plaintexts, 2 194 encryptions, and 2 139.6 bytes memory. Alternatively, with 2 245.3 plaintexts, an attack with a reduced time of 2 127.1 encryptions and a memory complexity of 2 90.9 bytes can be mounted. With 2 244.2 chosen plaintexts, we can attack 10-round Rijndael-256 with 2 253.9 encryptions and 2 186.8 bytes of memory.

show abstract

And Rijndael?

Rouquette

Gerault

Minier

et al. 2022

Progress in Cryptology - AFRICACRYPT 2022

View full text Add to dashboard Cite

Finding optimal related-key differential characteristics for a given cipher is a problem that hardly scales. For the first time, we study this problem against the 25 instances of the block cipher Rijndael, which are the little brothers of the AES. To achieve this, we adapt and improve an existing approach for the AES which is based on Constraint Programming. The attacks presented here overpass all the previous cryptanalytic results of Rijndael. Among all our results, we obtain a 12-round (out of 13 rounds) related-key differential attack for Rijndael with a block size equal to 128 bits and a key size equal to 224 bits. We also obtain an 11-round related-key differential characteristic distinguisher for Rijndael with a block size equal to 160 bits and a key size equal to 256 bits leading to an attack on 12 rounds (out of 14 rounds).Keywords: Related-key differential characteristics • Constraint Programming (CP) • Automatic Tools • Rijndael 5 The code is available here: https://gitlab.inria.fr/lrouquet/ cp-differential-cryptanalysis/-/tree/AfricaCrypt22.

show abstract

Improved Impossible Differential Attacks on Large-Block Rijndael

Cited by 10 publications

References 19 publications

Related‐key rectangle cryptanalysis of Rijndael‐160 and Rijndael‐192

Related‐key rectangle cryptanalysis of Rijndael‐160 and Rijndael‐192

Improved Impossible Differential Attacks on Large-Block Rijndael

And Rijndael?

Contact Info

Product

Resources

About