Multiple Impossible Differentials Cryptanalysis on 7-Round ARIA-192

Abstract

This paper studies the security of 7-round ARIA-192 against multiple impossible differentials cryptanalysis. We propose six special 4-round impossible differentials which have the same input difference and different output difference with the maximum number of nonzero common bytes. Based on these differentials, we construct six attack trails including the maximum number of common subkey bytes. Under such circumstances, we utilize an efficient sieving process to improve the efficiency of eliminating common subkeys; therefore, both data and time complexities are reduced. Furthermore, we also present an efficient algorithm to recover the master key via guess-and-determine technique. Taking advantage of the above advances, we have obtained the best result so far for impossible differential cryptanalysis of ARIA-192, with time, data, and memory complexities being 2 189.8 7-round ARIA encryptions, 2 116.6 chosen plaintexts, and 2 139.3 bytes, respectively.

Multiple Impossible Differentials Attack on AES-192

“…As shown in Fig. 3, for each attack trail, sixteen subkey bytes (k 0, (2,3,4,7,8,9,13,14) , k 1,(4,6,9,11) , k 7,(0,7,10,13) ) and (k 0, (2,3,4,7,8,9,13,14) , k 1,(5,7,8,10) , k 7,(0,7,10,13) ) need to be attacked, respectively. These two trails have the same subkey bytes of whitening keys k 0 and 7-th round subkey k 7 but different subkey bytes of first round subkey k 1 .…”

“…Using the key schedule considerations, k 1,(10) = k 0,(2) ⊕ SB(k 1,( 7) ) ⊕ a and k 1,(11) = k 0,(3) ⊕ SB(k 1,( 4) ) ⊕ a can be derived (where a and a are constants), so only 15-byte subkeys need to be guessed for each attack trail. Because the same subkey bytes of whitening key k 0 and 7-th subkey k 7 are attacked, the number of wrong subkeys of (k 0, (2,3,4,7,8,9,13,14) , k 7,(0,7,10,13) ) can be reduced after sieving through the first attack trail. Therefore, the time complexity of the second attack trail can be neglected compared with the time complexity of the first attack trail.…”

“…Table 3 : we compute all (x 1 , y 3 , y 0 , x 2 ) with one of (u 0 , v 2 ), (u 1 , v 3 ), (u 2 , v 0 ), (u 3 , v 1 ) being zero and store them in table 3 , where (u 0 , u 1 , u 2 , u 3 ) = MC(0, x 1 , x 2 , 0) and satisfying the expected difference of our attack. Table 3 should be used to attack subkeys k 1, (5,7,8,10) .…”

“…For each of the 2 n−7 the serial number in table T 2 , access table T 0 and obtain the difference x AK 0,(2,7,8,13) = P (2,7,8,13) . Guessing all the non-zero values of x MC 1,(9,11) , 2 16 (2,7,8,13) . Thus 2 n−7 × 2 16 = 2 n+9 values of k 0,(2,7,8,13) can be obtained.…”

“…In paper [3], [7], these multiple attack trails have different plaintext or ciphertext difference, so the attacks have to select multiple types of structure in order to meet these differences. Different from preceding attacks, we construct two 7-round impossible differential attack trails with the same plaintext and ciphertext difference.…”