The (related-key) impossible boomerang attack and its application to the AES block cipher

Abstract

The Advanced Encryption Standard (AES) is a 128-bit block cipher with a user key of 128, 192 or 256 bits, released by NIST in 2001 as the next-generation data encryption standard for use in the USA. It was adopted as an ISO international standard in 2005. Impossible differential cryptanalysis and the boomerang attack are powerful variants of differential cryptanalysis for analysing the security of a block cipher. In this paper, building on the notions of impossible differential cryptanalysis and the boomerang attack, we propose a new cryptanalytic technique, which we call the impossible boomerang attack, and then describe an extension of this attack which applies in a related-key attack scenario. Finally, we apply the impossible boomerang attack to break 6-round AES with 128 key bits and 7-round AES with 192/256 key bits, and using two related keys we apply the related-key impossible boomerang attack to break 8-round AES with 192 key bits and 9-round AES with 256 key bits. In the two-key related-key attack scenario, our results, which were the first to achieve this amount of attacked rounds, match the best currently known results for AES with 192/256 key bits in terms of the numbers of attacked rounds. The (related-key) impossible boomerang attack is a general cryptanalytic technique, and can potentially be used to cryptanalyse other block ciphers.

Impossible Boomerang Attacks Revisited

“…Building upon the foundations of the impossible differential attack and the boomerang attack, we think it is an interesting idea to combine them together, with the name impossible boomerang attack. The impossible boomerang (IB) attack was firstly proposed by Lu in his doctoral thesis [Lu08] and subsequently published in [Lu11]. In [Lu08,Lu11], the author introduced the definition and extended its application to the related-key scenario.…”

“…The impossible boomerang (IB) attack was firstly proposed by Lu in his doctoral thesis [Lu08] and subsequently published in [Lu11]. In [Lu08,Lu11], the author introduced the definition and extended its application to the related-key scenario. With this new technique, Lu proposed several single-key attacks on 6-round AES-128 and 7-round AES-192/AES-256, and related-key attacks on 8-round AES-192 and 9-round AES-256.…”

“…• We revisit the impossible boomerang attack proposed in [Lu11] and introduce the applicable Generalized Boomerang Framework (GBF). For the impossible boomerang, we introduce the generation of contradictions and its advantages over the impossible [SZY + 22] † Some attacks listed are beyond full-codebook attacks.…”

Related-key Impossible Boomerang Cryptanalysis on LBlock-s

“…The basic idea of boomerang cryptanalysis is to use short differential characteristics with relatively large probabilities to form long differential characteristics with high probability. Related-key impossible boomerang cryptanalysis [19] is obtained by using these three attacks in combination. Until now, many satisfying analysis results are obtained on AES and LBlock by using this cryptanalytic technique [19][20].…”

“…Related-key impossible boomerang cryptanalysis [19] is obtained by using these three attacks in combination. Until now, many satisfying analysis results are obtained on AES and LBlock by using this cryptanalytic technique [19][20].…”