The famous Square attacks against the Rijndael algorithm have taken advantage of the change of the balance of some bytes. Further study shows that the change of activity always happens before the change of balance, wh...The famous Square attacks against the Rijndael algorithm have taken advantage of the change of the balance of some bytes. Further study shows that the change of activity always happens before the change of balance, which builds the foundation for a new activity attack presented in this paper. In the activity attack, the round in which the activity changes is executed in an equivalent form to avoid the obstructive restriction of the subkeys of that round.The existence of the birthday paradox guarantees much fewer plaintexts necessary for activity attacks comparing with that for corresponding Square attacks. But no benefit may result from the new attacks performed independently because the activity attacks guess four instead of one key byte once. Only when both the balance property and the activity property are exploited at the same time can much better performance be obtained. The better performance in the simulation shows that the consuming time and chosen plaintexts necessary are both reduced to one tenth of those of the corresponding Square attacks. So the activity attacks could be viewed as an efficient supplement to the Square attacks.展开更多
基金the National 973 Project(G1999035803)National 863 Grand Project(2002AA143021)and the National Cryptography Development Funds for the Tenth Five-year Project
文摘The famous Square attacks against the Rijndael algorithm have taken advantage of the change of the balance of some bytes. Further study shows that the change of activity always happens before the change of balance, which builds the foundation for a new activity attack presented in this paper. In the activity attack, the round in which the activity changes is executed in an equivalent form to avoid the obstructive restriction of the subkeys of that round.The existence of the birthday paradox guarantees much fewer plaintexts necessary for activity attacks comparing with that for corresponding Square attacks. But no benefit may result from the new attacks performed independently because the activity attacks guess four instead of one key byte once. Only when both the balance property and the activity property are exploited at the same time can much better performance be obtained. The better performance in the simulation shows that the consuming time and chosen plaintexts necessary are both reduced to one tenth of those of the corresponding Square attacks. So the activity attacks could be viewed as an efficient supplement to the Square attacks.
