Related-Key Rectangle Attacks on Reduced Versions of SHACAL-1 and AES-192

Abstract

Abstract. In this paper we propose a notion of related-key rectangle attack using 4 related keys. It is based on two consecutive related-key differentials which are independent of each other. Using this attack we can break SHACAL-1 with 512-bit keys up to 70 rounds out of 80 rounds and AES with 192-bit keys up to 8 rounds out of 12 rounds, which are faster than exhaustive search.

Cryptanalysis on Block Ciphers

“…• In 2005, Hong, Kim, Lee and Preneel [40] presented a related-key rectangle attack on 8-round AES-192 using four keys.…”

“…The related-key rectangle attack [9,40,53] uses something called a related-key rectangle distinguisher. Like a rectangle distinguisher, a related-key rectangle distinguisher treats a block cipher E : {0, 1} n × {0, 1} k → {0, 1} n as a cascade of two sub-ciphers E 0 and E 1 , where E = E 0 • E 1 .…”

“…what we call the impossible boomerang attack, combines the boomerang attack with impossible differential cryptanalysis. Possible combinations of cryptanalytic techniques have been proposed in the past, and have proved effective [8,9,34,40,53,67]; a good example is provided by differential-linear cryptanalysis [7,67].…”

A Unified Approach to Related-Key Attacks

“…Related-key differentials were also used as the base for the related-key boomerang and the related-key rectangle attacks [7,28,35]. These attacks use two related-key differentials, i.e., up to four related keys.…”

“…Besides related-key differentials, where the key difference is used to control the evolution of differences, this class contains variants of most of the known cryptanalytic techniques: The SQUARE attack [20] was treated in the related-key model in [23] and used to extend the best known SQUARE attack against AES into a related-key attack that uses 256 related keys. The boomerang attack [44] and the rectangle attack [5] were combined with related-key differentials to introduce the related-key boomerang and related-key rectangle attacks [7,28,35]. Finally, linear cryptanalysis [38] was also combined with related-key attacks to produce a related-key attack on 7.5-round IDEA [8].…”