Paper 2013/089

Filtered nonlinear cryptanalysis of reduced-round Serpent, and the Wrong-Key Randomization Hypothesis.

James McLaughlin and John A. Clark


We present a deterministic algorithm to find nonlinear S-box approximations, and a new nonlinear cryptanalytic technique; the “filtered” nonlinear attack, which achieves the lowest data complexity of any known-plaintext attack on reduced-round Serpent so far. We demonstrate that the Wrong-Key Randomization Hypothesis is not entirely valid for attacks on reduced-round Serpent which rely on linear cryptanalysis or a variant thereof, and survey the effects of this on existing attacks (including existing nonlinear attacks) on 11 and 12-round Serpent.

Available format(s)
Secret-key cryptography
Publication info
Published elsewhere. Updated and expanded version of a paper submitted to ACISP 2013. Graphs of attack performance, and truncated differential bias tables for Serpent S2/S4^{-1} were not in the ACISP version; furthermore a memory optimisation and a more thorough analysis of the Nguyen/Wu/Wang multidimensional attack were added after the ACISP submission. Some of the material in this paper includes revisions of results from 2013/022 in light of the new work on the WKRH.
Nonlinear cryptanalysisgeneralized linear cryptanalysismultidimensional linear cryptanalysisWKRHWrong-Key Randomization HypothesisSerpent
Contact author(s)
jmclaugh @ cs york ac uk
2013-02-20: received
Short URL
Creative Commons Attribution


      author = {James McLaughlin and John A.  Clark},
      title = {Filtered nonlinear cryptanalysis of reduced-round Serpent, and the Wrong-Key Randomization Hypothesis.},
      howpublished = {Cryptology ePrint Archive, Paper 2013/089},
      year = {2013},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.