<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>2010 Reports</title>
    <link>http://eprint.iacr.org/forum/list.php?10</link>
    <description><![CDATA[Discussion forum for Cryptology ePrint Archive reports posted in 2010.
Please put the report number in the subject.

]]></description>
    <language>EN</language>
    <pubDate>Thu, 17 Jun 2010 14:19:49 -0600</pubDate>
    <lastBuildDate>Thu, 17 Jun 2010 14:19:49 -0600</lastBuildDate>
    <category>2010 Reports</category>
    <generator>Phorum 5.1.22</generator>
    <ttl>600</ttl>
    <item>
      <title>Re: 2010/337</title>
      <link>http://eprint.iacr.org/forum/read.php?10,258,261#msg-261</link>
      <author>jmclaugh</author>
      <description><![CDATA[I'm afraid I don't follow all of dsds's post above.

dsds, are you describing a modified attack model where the attacker does not need to know \delta, but does need to be able to xor it with the post-round-1 state several times, and in which the attack's effectiveness is reduced if any bytes of \epsilon are zero?

If so, you don't explain how the adversary can deduce the value of \delta, so noting that you attack each S-box independently, I'd like to borrow some ideas from integral cryptanalysis to suggest the following:

Step 0. Given any p, the adversary obtains p* by, as described, xoring the value \delta with the state after the first round, and then reversing the first round.

Step 1. Adversary chooses p.

(The adversary not knowing \delta may correspond to it being a block of data situated somewhere else on the target machine that the adversary had a limited amount of access to, I don't know. It doesn't sound very plausible if I'm honest.)

2. For each of the sixteen S-boxes in turn:

2.1 The adversary chooses a set of plaintexts p_i (0 ]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,258,261#msg-261</guid>
      <pubDate>Thu, 17 Jun 2010 14:19:49 -0600</pubDate>
    </item>
    <item>
      <title>2010/337</title>
      <link>http://eprint.iacr.org/forum/read.php?10,258,259#msg-259</link>
      <author>dsds</author>
      <description><![CDATA[I think this new attak could be seen as a special kind of differential fault analysis on AES-128, where the adversary can choose a special concrete value of the fault (\delta) in an appropriate position. In fact, in this situation, such attack could be mounted in either the encryption or decryption direction. 

   For example, in the decryption procedure, as the author described, the key point is the following differential equation:
           R_k(P)+R_k(P*) = \delta, 
which is equivalent to
  SB(P+k)+SB(P*+k)=SR^{-1}\circ MC^{-1}(\delte)=\epsilon.
   Now, assume the fault is \delta, such that after applying the inverse transformation InvMixColumns, all bytes of the result valuse are non-zero. Then, once \delta is known for the adversary, by applying the differential attack to each s-box independently, he could obtain at most 4^16=2^32 possible round key candidates.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,258,259#msg-259</guid>
      <pubDate>Tue, 15 Jun 2010 09:19:33 -0600</pubDate>
    </item>
    <item>
      <title>2010/337</title>
      <link>http://eprint.iacr.org/forum/read.php?10,258,258#msg-258</link>
      <author>Orr</author>
      <description><![CDATA[Without entering to the question whether the related-subkey model is &quot;legitimate&quot;, the attack of 2010/337 assumes that the adversary is given two plaintexts which are related in a very strong manner (and not two subkeys which are related in a very strong manner).

Of course, if you can identify two plaintexts which have a very strong relation, you could deduce information concerning the key (if you could identify the plaintext which is encrypted after one round to the all zero value, you could deduce the key easily). The problem is how to identify these two plaintexts, a fact which is not communicated in the paper. Of course, one can take many plaintexts, and try about 2^128 such pairs, ...]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,258,258#msg-258</guid>
      <pubDate>Mon, 14 Jun 2010 03:29:00 -0600</pubDate>
    </item>
  </channel>
</rss>
