### Mixture Integral Attacks on Reduced-Round AES with a Known/Secret S-Box

Lorenzo Grassi and Markus Schofnegger

##### Abstract

In this work, we present new low-data secret-key distinguishers and key-recovery attacks on reduced-round AES. The starting point of our work is “Mixture Differential Cryptanalysis” recently introduced at FSE/ToSC 2019, a way to turn the “multiple-of-8” 5-round AES secret-key distinguisher presented at Eurocrypt 2017 into a simpler and more convenient one (though, on a smaller number of rounds). By reconsidering this result on a smaller number of rounds, we present as our main contribution a new secret-key distinguisher on 3-round AES with the smallest data complexity in the literature (that does not require adaptive chosen plaintexts/ciphertexts), i.e. approximately half of the data necessary to set up a 3-round truncated differential distinguisher (which is currently the distinguisher in the literature with the lowest data complexity). E.g. for a probability of success of 95%, our distinguisher requires just 10 chosen plaintexts versus 20 chosen plaintexts necessary to set up the truncated differential one. Besides that, we present new competitive low-data key-recovery attacks on 3- and 4-round AES, both in the case in which the S-Box is known and in the case in which it is secret.

Available format(s)
Category
Secret-key cryptography
Publication info
Published elsewhere. MINOR revision.INDOCRYPT 2020
Keywords
AESMixture Differential CryptanalysisSecret-Key DistinguisherLow-Data AttackSecret S-Box
Contact author(s)
lgrassi @ science ru nl
History
2020-12-16: revised
See all versions
Short URL
https://ia.cr/2019/772

CC BY

BibTeX

@misc{cryptoeprint:2019/772,
author = {Lorenzo Grassi and Markus Schofnegger},
title = {Mixture Integral Attacks on Reduced-Round AES with a Known/Secret S-Box},
howpublished = {Cryptology ePrint Archive, Paper 2019/772},
year = {2019},
note = {\url{https://eprint.iacr.org/2019/772}},
url = {https://eprint.iacr.org/2019/772}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.