A New Method for Impossible Differential Cryptanalysis of 8-Round Advanced Encryption Standard

This paper first presents an impossible differential property for 5-round Advanced Encryption Standard （AES） with high probability. Based on the property and the impossible differential cryptanalytic method for the 5-round AES, a new method is proposed for cryptanalyzing the 8-round AES-192 and AES-256. This attack on the reduced 8-round AES-192 demands 2^121 words of memory, and performs 2^148 8-round AES-192 encryptions. This attack on the reduced 8-round AES-256 demands 2^153 words of memory, and performs 2^180 8-round AES-256 encryptions. Furthermore, both AES-192 and AES-256 require about 2^98 chosen plaintexts for this attack, and have the same probability that is only 2^-3 to fail to recover the secret key.

Non-Existence of One-Byte Active Impossible Differentials for 5-Round AES in the Master-Key Setting

Impossible differential cryptanalysis is an important approach to evaluate the security of block ciphers. In EUROCRYPT 2016, Sun, et al. proved that there exists no impossible differential longer than four rounds for the AES structure where S-boxes are arbitrary. In DCC 2019, Wang,et al. proved that any differential is possible for 5-round AES, assuming that the round keys are independent and uniformly random. In ASIACRYPT 2020, Hu, et al. used automatic search to show that there exists no one-byte active impossible differential for 5-round AES-128 considering the relations of 3-round keys. By algebraic methods, this paper theoretically proves that there exists no one-byte active impossible differential for 5-round AES even considering the relations of all round keys. Firstly,the authors prove the independence of ten bytes in the consecutive four round keys under the key schedule of AES-128. Then 5-round AES is decomposed to three subfunctions and the propagations of the considered differences in these subfunctions are discussed. Finally, the authors prove that the considered differential trails can be connected by the ten bytes of round keys. Furthermore, for any given one-byte active differential, there are at least 2^(51) master keys such that the differential is possible for 5-round AES-128.

Impossible Differential Cryptanalysis of Reduced-Round ARIA and Camellia

This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far. The designers of ARIA expected no impossible differentials exist for 4-round ARIA. However, we found some nontrivial 4-round impossible differentials, which may lead to a possible attack on 6-round ARIA. Moreover, we found some nontrivial 8-round impossible differentials for Camellia, whereas only 7-round impossible differentials were previously known. By using the 8-round impossible differentials, we presented an attack on 12-round Camellia without FL/FL^-1 layers.

Impossible Differential Attacks on 13-Round CLEFIA-128

CLEFIA, a new 128-bit block cipher proposed by Sony Corporation, is increasingly attracting cryptanalysts＇ attention. In this paper, we present two new impossible differential attacks on 13 rounds of CLEFIA-128. The proposed attacks utilize a variety of previously known techniques, in particular the hash table technique and redundancy in the key schedule of this block cipher. The first attack does not consider the whitening layers of CLEFIA, requires 21~9＂5 chosen plaintexts, and has a running time equivalent to about 2112.9 encryptions. The second attack preserves the whitening layers, requires 2117.8 chosen plaintexts, and has a total time complexity equivalent to about 2121.2 encryptions.

Impossible differential cryptanalysis of advanced encryption standard

Impossible differential cryptanalysis is a method recovering secret key, which gets rid of the keys that satisfy impossible differential relations. This paper concentrates on the impossible differential cryptanalysis of Advanced Encryption Standard （AES） and presents two methods for impossible differential cryptanalysis of 7-round AES-192 and 8-round AES-256 combined with time-memory trade-off by exploiting weaknesses in their key schedule. This attack on the reduced to 7-round AES-192 requires about 294.5 chosen plaintexts, demands 2129 words of memory, and performs 2157 7-round AES-192 encryptions. Furthermore, this attack on the reduced to 8-round AES-256 requires about 2^101 chosen plaintexts, demands 2^201 words of memory, and performs 2^228 8-round AES-256 encryptions.

Searching for impossible subspace trails and improved impossible differential characteristics for SIMON-like block ciphers

In this paper,we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference,which is the precondition to ameliorate the complexity of attacks.We propose an algorithm which can greatly reduce the searching complexity to find such trails efficiently since the search space exponentially expands to find impossible differentials with multiple active bits.There is another situation leading to the contradiction in impossible differentials except for miss-in-the-middle.We show how the contradiction happens and conclude the precondition of it defined as miss-from-the-middle.It makes our results more comprehensive by applying these two approach simultaneously.This paper gives for the first time impossible differential characteristics with multiple active bits for SIMON and SIMECK,leading to a great increase in the number.The results can be verified not only by covering the state-of-art,but also by the MILP model.

11-Round Impossible Differential Algebraic Attack for Serpent Encryption Algorithm

This paper explored algebraic features of nonlinear parts in Serpent encryption algorithm and offered an 11-round Serpent-128 impossible differential algebraic attack through utilizing the method in constructing S-box algebraic equations. The new method analyzed block ll-round Serpent with 2127 selected plaintexts and 2-29 bytes memory space at the same time of giving a new design principle of S-box anti-algebraic attack.