Paper 2019/652

The Exchange Attack: How to Distinguish Six Rounds of AES with $2^{88.2}$ chosen plaintexts

Navid Ghaedi Bardeh and Sondre Rønjom


In this paper we present exchange-equivalence attacks which is a new cryptanalytic attack technique suitable for SPN-like block cipher designs. Our new technique results in the first secret-key chosen plaintext distinguisher for 6-round AES. The complexity of the distinguisher is about $2^{88.2}$ in terms of data, memory and computational complexity. The distinguishing attack for AES reduced to six rounds is a straight-forward extension of an exchange attack for 5-round AES that requires $2^{30}$ in terms of chosen plaintexts and computation. This is also a new record for AES reduced to five rounds. The main result of this paper is that AES up to at least six rounds is biased when restricted to exchange-invariant sets of plaintexts.

Available format(s)
Secret-key cryptography
Publication info
Published by the IACR in ASIACRYPT 2019
SPNAESExchange Equivalence AttacksExchange Invariant SetsExchange Equivalence ClassSecret-Key modelDifferential Cryptanalysis
Contact author(s)
Navid bardeh @ uib no
2019-09-14: revised
2019-06-04: received
See all versions
Short URL
Creative Commons Attribution


      author = {Navid Ghaedi Bardeh and Sondre Rønjom},
      title = {The Exchange Attack: How to Distinguish Six Rounds of AES with $2^{88.2}$ chosen plaintexts},
      howpublished = {Cryptology ePrint Archive, Paper 2019/652},
      year = {2019},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.