Improved Impossible Differential Cryptanalysis of 7-Round AES-128

Mala, Hamid; Dakhilalian, Mohammad; Rijmen, Vincent; Modarres-Hashemi, Mahmoud

doi:10.1007/978-3-642-17401-8_20

Cited by 80 publications

(62 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Select a set of 2 64 plaintexts which have certain fixed values in all but the bytes (0, 2,5,7,8,10,13,15). Call this special set a structure.…”

Section: New Impossible Differential Attack On 7-round Aes-128mentioning

confidence: 99%

“…They required 2 112:2 chosen plaintexts and 2 117:2 memory accesses. The latest result on impossible differential cryptanalysis of AES-128 was proposed by Mala et al [13]. They adopted some techniques to attack on AES-128 with about 2 106:2 chosen plaintexts and 2 110:2 7-round encryptions.…”

Section: Introductionmentioning

confidence: 99%

“…When it was proposed, the designers carefully considered to resist many classic attacks such as differential cryptanalysis and linear cryptanalysis. Then, during the AES process and after its selection, more and more researchers reevaluated its security under various cryptanalytic methods, e.g., algebraic attack, collision attack, meetin-the-middle, related-key attack, impossible differential attack and so on [6][7][8][9][10][11][12][13].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

New Improved Impossible Differential Attack on Reduced-Round AES-128

Liu

et al. 2011

Lecture Notes in Electrical Engineering

View full text Add to dashboard Cite

In this paper, we propose a novel impossible differential attack on 7-round AES-128. Firstly, we construct some new 2-round impossible differentials of AES, which allow us to distinguish the wrong keys from the correct key more efficiently. Based on them, we present an impossible differential attack on 7-round AES-128. The data complexity is about 2 80 chosen plaintexts. Compared to the best known result, the data complexity of our attack is reduced by nearly 2 À26:2 times.

show abstract

“…Select a set of 2 64 plaintexts which have certain fixed values in all but the bytes (0, 2,5,7,8,10,13,15). Call this special set a structure.…”

Section: New Impossible Differential Attack On 7-round Aes-128mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

New Improved Impossible Differential Attack on Reduced-Round AES-128

Liu

et al. 2011

Lecture Notes in Electrical Engineering

View full text Add to dashboard Cite

show abstract

“…For example, the truncated impossible differential and zero correlation linear hull of AES in [4,27] and Camellia in [28,29]. In other words, if these ciphers adopt some other S-boxes, these distinguishers still hold.…”

Section: Structure and Dual Structurementioning

confidence: 99%

Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Sun

Liu

Rijmen

et al. 2015

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. As two important cryptanalytic methods, impossible differential cryptanalysis and integral cryptanalysis have attracted much attention in recent years. Although relations among other important cryptanalytic approaches have been investigated, the link between these two methods has been missing. The motivation in this paper is to fix this gap and establish links between impossible differential cryptanalysis and integral cryptanalysis.Firstly, by introducing the concept of structure and dual structure, we prove that a → b is an impossible differential of a structure E if and only if it is a zero correlation linear hull of the dual structure E ⊥ . More specifically, constructing a zero correlation linear hull of a Feistel structure with SP -type round function where P is invertible, is equivalent to constructing an impossible differential of the same structure with P T instead of P . Constructing a zero correlation linear hull of an SPN structure is equivalent to constructing an impossible differential of the same structure with (P −1 ) T instead of P . Meanwhile, our proof shows that the automatic search tool presented by Wu and Wang could find all impossible differentials of both Feistel structures with SP -type round functions and SPN structures, which is useful in provable security of block ciphers against impossible differential cryptanalysis.Secondly, by establishing some boolean equations, we show that a zero correlation linear hull always indicates the existence of an integral distinguisher while a special integral implies the existence of a zero correlation linear hull. With this observation we improve the integral distinguishers of Feistel structures by 1 round, build a 24-round integral distinguisher of CAST-256 based on which we propose the best known key recovery attack on reduced round CAST-256 in the non-weak key model, present a 12-round integral distinguisher of SMS4 and an 8-round integral distinguisher of Camellia without F L/F L −1 . Moreover, this result provides a novel way for establishing integral distinguishers and converting known plaintext attacks to chosen plaintext attacks.Finally, we conclude that an r-round impossible differential of E always leads to an r-round integral distinguisher of the dual structure E ⊥ . In the case that E and E ⊥ are linearly equivalent, we derive a direct link between impossible differentials and integral distinguishers of E . Specifically, we obtain that an r-round impossible differential of an SPN structure, which adopts a bit permutation as its linear layer, always indicates the existence of an r-round integral distinguisher. Based on this newly established link, we deduce that impossible differentials of SNAKE(2), PRESENT, PRINCE and ARIA, which are independent of the choices of the S-boxes, always imply the existence of integral distinguishers.Our results could help to classify different cryptanalytic tools. Furthermore, when designing a block cipher, the designers need to demonstrate that the cipher has sufficient security margins against impo...

show abstract

“…With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,36] and Square attacks [16,22]. Impossible differential cryptanalysis yielded the first attack on the 7-round AES-128 with non-marginal data complexity.…”

Section: Introductionmentioning

confidence: 99%

Biclique Cryptanalysis of the Full AES

Bogdanov

Khovratovich

Rechberger

2011

Lecture Notes in Computer Science

363

338

View full text Add to dashboard Cite

Abstract. Since Rijndael was chosen as the Advanced Encryption Standard (AES), improving upon 7-round attacks on the 128-bit key variant (out of 10 rounds) or upon 8-round attacks on the 192/256-bit key variants (out of 12/14 rounds) has been one of the most difficult challenges in the cryptanalysis of block ciphers for more than a decade. In this paper, we present the novel technique of block cipher cryptanalysis with bicliques, which leads to the following results:-The first key recovery method for the full AES-128 with computational complexity 2 126.1 . -The first key recovery method for the full AES-192 with computational complexity 2 189.7 . -The first key recovery method for the full AES-256 with computational complexity 2 254.4 . -Key recovery methods with lower complexity for the reduced-round versions of AES not considered before, including cryptanalysis of 8-round AES-128 with complexity 2 124.9 . -Preimage search for compression functions based on the full AES versions faster than brute force. In contrast to most shortcut attacks on AES variants, we do not need to assume related-keys. Most of our techniques only need a very small part of the codebook and have low memory requirements, and are practically verified to a large extent. As our cryptanalysis is of high computational complexity, it does not threaten the practical use of AES in any way.

show abstract

Improved Impossible Differential Cryptanalysis of 7-Round AES-128

Cited by 80 publications

References 11 publications

New Improved Impossible Differential Attack on Reduced-Round AES-128

New Improved Impossible Differential Attack on Reduced-Round AES-128

Links Among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis

Biclique Cryptanalysis of the Full AES

Contact Info

Product

Resources

About