This paper first presents an impossible differential property for 5-round Advanced Encryption Standard （AES） with high probability. Based on the property and the impossible differential cryptanalytic method for the ...This paper first presents an impossible differential property for 5-round Advanced Encryption Standard （AES） with high probability. Based on the property and the impossible differential cryptanalytic method for the 5-round AES, a new method is proposed for cryptanalyzing the 8-round AES-192 and AES-256. This attack on the reduced 8-round AES-192 demands 2^121 words of memory, and performs 2^148 8-round AES-192 encryptions. This attack on the reduced 8-round AES-256 demands 2^153 words of memory, and performs 2^180 8-round AES-256 encryptions. Furthermore, both AES-192 and AES-256 require about 2^98 chosen plaintexts for this attack, and have the same probability that is only 2^-3 to fail to recover the secret key.展开更多
Impossible differential cryptanalysis is an important approach to evaluate the security of block ciphers. In EUROCRYPT 2016, Sun, et al. proved that there exists no impossible differential longer than four rounds for ...Impossible differential cryptanalysis is an important approach to evaluate the security of block ciphers. In EUROCRYPT 2016, Sun, et al. proved that there exists no impossible differential longer than four rounds for the AES structure where S-boxes are arbitrary. In DCC 2019, Wang,et al. proved that any differential is possible for 5-round AES, assuming that the round keys are independent and uniformly random. In ASIACRYPT 2020, Hu, et al. used automatic search to show that there exists no one-byte active impossible differential for 5-round AES-128 considering the relations of 3-round keys. By algebraic methods, this paper theoretically proves that there exists no one-byte active impossible differential for 5-round AES even considering the relations of all round keys. Firstly,the authors prove the independence of ten bytes in the consecutive four round keys under the key schedule of AES-128. Then 5-round AES is decomposed to three subfunctions and the propagations of the considered differences in these subfunctions are discussed. Finally, the authors prove that the considered differential trails can be connected by the ten bytes of round keys. Furthermore, for any given one-byte active differential, there are at least 2^(51) master keys such that the differential is possible for 5-round AES-128.展开更多
This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far....This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far. The designers of ARIA expected no impossible differentials exist for 4-round ARIA. However, we found some nontrivial 4-round impossible differentials, which may lead to a possible attack on 6-round ARIA. Moreover, we found some nontrivial 8-round impossible differentials for Camellia, whereas only 7-round impossible differentials were previously known. By using the 8-round impossible differentials, we presented an attack on 12-round Camellia without FL/FL^-1 layers.展开更多
CLEFIA, a new 128-bit block cipher proposed by Sony Corporation, is increasingly attracting cryptanalysts＇ attention. In this paper, we present two new impossible differential attacks on 13 rounds of CLEFIA-128. The ...CLEFIA, a new 128-bit block cipher proposed by Sony Corporation, is increasingly attracting cryptanalysts＇ attention. In this paper, we present two new impossible differential attacks on 13 rounds of CLEFIA-128. The proposed attacks utilize a variety of previously known techniques, in particular the hash table technique and redundancy in the key schedule of this block cipher. The first attack does not consider the whitening layers of CLEFIA, requires 21~9＂5 chosen plaintexts, and has a running time equivalent to about 2112.9 encryptions. The second attack preserves the whitening layers, requires 2117.8 chosen plaintexts, and has a total time complexity equivalent to about 2121.2 encryptions.展开更多
LBlock is a 32-round lightweight block cipher with 64-bit block size and 80-bit key. This paper identifies 16- round related-key impossible differentials of LBlock, which are better than the 15-round related-key impos...LBlock is a 32-round lightweight block cipher with 64-bit block size and 80-bit key. This paper identifies 16- round related-key impossible differentials of LBlock, which are better than the 15-round related-key impossible differentials used in the previous attack. Based on these 16-round related-key impossible differentials, we can attack 23 rounds of LBlock while the previous related-key impossible differential attacks could only work on 22-round LBlock. This makes our attack on LBlock the best attack in terms of the number of attacked rounds.展开更多
Impossible differential cryptanalysis is a method recovering secret key, which gets rid of the keys that satisfy impossible differential relations. This paper concentrates on the impossible differential cryptanalysis ...Impossible differential cryptanalysis is a method recovering secret key, which gets rid of the keys that satisfy impossible differential relations. This paper concentrates on the impossible differential cryptanalysis of Advanced Encryption Standard （AES） and presents two methods for impossible differential cryptanalysis of 7-round AES-192 and 8-round AES-256 combined with time-memory trade-off by exploiting weaknesses in their key schedule. This attack on the reduced to 7-round AES-192 requires about 294.5 chosen plaintexts, demands 2129 words of memory, and performs 2157 7-round AES-192 encryptions. Furthermore, this attack on the reduced to 8-round AES-256 requires about 2^101 chosen plaintexts, demands 2^201 words of memory, and performs 2^228 8-round AES-256 encryptions.展开更多
This paper explored algebraic features of nonlinear parts in Serpent encryption algorithm and offered an 11-round Serpent-128 impossible differential algebraic attack through utilizing the method in constructing S-box...This paper explored algebraic features of nonlinear parts in Serpent encryption algorithm and offered an 11-round Serpent-128 impossible differential algebraic attack through utilizing the method in constructing S-box algebraic equations. The new method analyzed block ll-round Serpent with 2127 selected plaintexts and 2-29 bytes memory space at the same time of giving a new design principle of S-box anti-algebraic attack.展开更多
In this paper,we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference,which is the precondition to ameliorate the complexity of at...In this paper,we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference,which is the precondition to ameliorate the complexity of attacks.We propose an algorithm which can greatly reduce the searching complexity to find such trails efficiently since the search space exponentially expands to find impossible differentials with multiple active bits.There is another situation leading to the contradiction in impossible differentials except for miss-in-the-middle.We show how the contradiction happens and conclude the precondition of it defined as miss-from-the-middle.It makes our results more comprehensive by applying these two approach simultaneously.This paper gives for the first time impossible differential characteristics with multiple active bits for SIMON and SIMECK,leading to a great increase in the number.The results can be verified not only by covering the state-of-art,but also by the MILP model.展开更多
基金Supported by the Foundation of National Labora-tory for Modern Communications (51436030105DZ0105)
文摘This paper first presents an impossible differential property for 5-round Advanced Encryption Standard （AES） with high probability. Based on the property and the impossible differential cryptanalytic method for the 5-round AES, a new method is proposed for cryptanalyzing the 8-round AES-192 and AES-256. This attack on the reduced 8-round AES-192 demands 2^121 words of memory, and performs 2^148 8-round AES-192 encryptions. This attack on the reduced 8-round AES-256 demands 2^153 words of memory, and performs 2^180 8-round AES-256 encryptions. Furthermore, both AES-192 and AES-256 require about 2^98 chosen plaintexts for this attack, and have the same probability that is only 2^-3 to fail to recover the secret key.
基金supported by the National Cryptography Development Fund of China under Grant Nos.MMJJ20170103 and MMJJ20180204.
文摘Impossible differential cryptanalysis is an important approach to evaluate the security of block ciphers. In EUROCRYPT 2016, Sun, et al. proved that there exists no impossible differential longer than four rounds for the AES structure where S-boxes are arbitrary. In DCC 2019, Wang,et al. proved that any differential is possible for 5-round AES, assuming that the round keys are independent and uniformly random. In ASIACRYPT 2020, Hu, et al. used automatic search to show that there exists no one-byte active impossible differential for 5-round AES-128 considering the relations of 3-round keys. By algebraic methods, this paper theoretically proves that there exists no one-byte active impossible differential for 5-round AES even considering the relations of all round keys. Firstly,the authors prove the independence of ten bytes in the consecutive four round keys under the key schedule of AES-128. Then 5-round AES is decomposed to three subfunctions and the propagations of the considered differences in these subfunctions are discussed. Finally, the authors prove that the considered differential trails can be connected by the ten bytes of round keys. Furthermore, for any given one-byte active differential, there are at least 2^(51) master keys such that the differential is possible for 5-round AES-128.
基金This work is supported by the National Natural Science Foundation of China under Grant No.90604036the National Grand Fundamental Research 973 Program of China under Grant No.2004CB318004.
文摘This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far. The designers of ARIA expected no impossible differentials exist for 4-round ARIA. However, we found some nontrivial 4-round impossible differentials, which may lead to a possible attack on 6-round ARIA. Moreover, we found some nontrivial 8-round impossible differentials for Camellia, whereas only 7-round impossible differentials were previously known. By using the 8-round impossible differentials, we presented an attack on 12-round Camellia without FL/FL^-1 layers.
文摘CLEFIA, a new 128-bit block cipher proposed by Sony Corporation, is increasingly attracting cryptanalysts＇ attention. In this paper, we present two new impossible differential attacks on 13 rounds of CLEFIA-128. The proposed attacks utilize a variety of previously known techniques, in particular the hash table technique and redundancy in the key schedule of this block cipher. The first attack does not consider the whitening layers of CLEFIA, requires 21~9＂5 chosen plaintexts, and has a running time equivalent to about 2112.9 encryptions. The second attack preserves the whitening layers, requires 2117.8 chosen plaintexts, and has a total time complexity equivalent to about 2121.2 encryptions.
基金supported by the National Basic Research 973 Program of China under Grant No.2013CB834205the National Natural Science Foundation of China under Grant Nos.61133013,61070244,and 61103237+1 种基金the Program for New Century Excellent Talents in University of China under Grant No.NCET-13-0350the Interdisciplinary Research Foundation of Shandong University of China under Grant No.2012JC018
文摘LBlock is a 32-round lightweight block cipher with 64-bit block size and 80-bit key. This paper identifies 16- round related-key impossible differentials of LBlock, which are better than the 15-round related-key impossible differentials used in the previous attack. Based on these 16-round related-key impossible differentials, we can attack 23 rounds of LBlock while the previous related-key impossible differential attacks could only work on 22-round LBlock. This makes our attack on LBlock the best attack in terms of the number of attacked rounds.
基金the National Natural Science Foundation of China (Grant No. 60673072)Foundation of National Laboratory for Modern Communications (Grant No. 51436030105DZ0105)
文摘Impossible differential cryptanalysis is a method recovering secret key, which gets rid of the keys that satisfy impossible differential relations. This paper concentrates on the impossible differential cryptanalysis of Advanced Encryption Standard （AES） and presents two methods for impossible differential cryptanalysis of 7-round AES-192 and 8-round AES-256 combined with time-memory trade-off by exploiting weaknesses in their key schedule. This attack on the reduced to 7-round AES-192 requires about 294.5 chosen plaintexts, demands 2129 words of memory, and performs 2157 7-round AES-192 encryptions. Furthermore, this attack on the reduced to 8-round AES-256 requires about 2^101 chosen plaintexts, demands 2^201 words of memory, and performs 2^228 8-round AES-256 encryptions.
基金Supported by the Natural Science Foundation of Hubei Province(Q20102905)
文摘This paper explored algebraic features of nonlinear parts in Serpent encryption algorithm and offered an 11-round Serpent-128 impossible differential algebraic attack through utilizing the method in constructing S-box algebraic equations. The new method analyzed block ll-round Serpent with 2127 selected plaintexts and 2-29 bytes memory space at the same time of giving a new design principle of S-box anti-algebraic attack.
基金the National Natural Science Foundation of China(61972393,61872359).
文摘In this paper,we greatly increase the number of impossible differentials for SIMON and SIMECK by eliminating the 1-bit constraint in input/output difference,which is the precondition to ameliorate the complexity of attacks.We propose an algorithm which can greatly reduce the searching complexity to find such trails efficiently since the search space exponentially expands to find impossible differentials with multiple active bits.There is another situation leading to the contradiction in impossible differentials except for miss-in-the-middle.We show how the contradiction happens and conclude the precondition of it defined as miss-from-the-middle.It makes our results more comprehensive by applying these two approach simultaneously.This paper gives for the first time impossible differential characteristics with multiple active bits for SIMON and SIMECK,leading to a great increase in the number.The results can be verified not only by covering the state-of-art,but also by the MILP model.
