## Cryptology ePrint Archive: Report 2019/095

Variants of the AES Key Schedule for Better Truncated Differential Bounds

Patrick Derbez and Pierre-Alain Fouque and Jérémy Jean and Baptiste Lambin

Abstract: Differential attacks are one of the main ways to attack block ciphers. Hence, we need to evaluate the security of a given block cipher against these attacks. One way to do so is to determine the minimal number of active S-boxes, and use this number along with the maximal differential probability of the S-box to determine the minimal probability of any differential characteristic. Thus, if one wants to build a new block cipher, one should try to maximize the minimal number of active S-boxes. On the other hand, the related-key security model is now quite important, hence, we also need to study the security of block ciphers in this model.

In this work, we search how one could design a key schedule to maximize the number of active S-boxes in the related-key model. However, we also want this key schedule to be efficient, and therefore choose to only consider permutations. Our target is AES, and along with a few generic results about the best reachable bounds, we found a permutation to replace the original key schedule that reaches a minimal number of active S-boxes of 20 over 6 rounds, while no differential characteristic with a probability larger than $2^{-128}$ exists. We also describe an algorithm which helped us to show that there is no permutation that can reach 18 or more active S-boxes in 5 rounds. Finally, we give several pairs $(P_s, P_k)$, replacing respectively the ShiftRows operation and the key schedule of the AES, reaching a minimum of 21 active S-boxes over 6 rounds, while again, there is no differential characteristic with a probability larger than $2^{-128}$.

Category / Keywords: secret-key cryptography / AES · Key schedule · Related-key · Truncated Differential

Original Publication (with minor differences): SAC 2018
DOI:
10.1007/978-3-030-10970-7_2

Date: received 30 Jan 2019

Contact author: baptiste lambin at irisa fr

Available format(s): PDF | BibTeX Citation

Short URL: ia.cr/2019/095

[ Cryptology ePrint archive ]