##
**Biclique cryptanalysis of the full AES.**
*(English)*
Zbl 1227.94032

Lee, Dong Hoon (ed.) et al., Advances in cryptology – ASIACRYPT 2011. 17th international conference on the theory and application of cryptology and information security, Seoul, South Korea, December 4–8, 2011. Proceedings. Berlin: Springer (ISBN 978-3-642-25384-3/pbk). Lecture Notes in Computer Science 7073, 344-371 (2011).

Summary: Since Rijndael was chosen as the Advanced Encryption Standard (AES), improving upon 7-round attacks on the 128-bit key variant (out of 10 rounds) or upon 8-round attacks on the 192/256-bit key variants (out of 12/14 rounds) has been one of the most difficult challenges in the cryptanalysis of block ciphers for more than a decade. In this paper, we present the novel technique of block cipher cryptanalysis with bicliques, which leads to the following results:

\(\bullet\) The first key recovery method for the full AES-128 with computational complexity \(2^{126.1}\).

\(\bullet\) The first key recovery method for the full AES-192 with computational complexity \(2^{189.7}\).

\(\bullet\) The first key recovery method for the full AES-256 with computational complexity \(2^{254.4}\).

\(\bullet\) Key recovery methods with lower complexity for the reduced-round versions of AES not considered before, including cryptanalysis of 8-round AES-128 with complexity \(2^{124.9}\).

\(\bullet\) Preimage search for compression functions based on the full AES versions faster than brute force.

In contrast to most shortcut attacks on AES variants, we do not need to assume related-keys. Most of our techniques only need a very small part of the codebook and have low memory requirements, and are practically verified to a large extent. As our cryptanalysis is of high computational complexity, it does not threaten the practical use of AES in any way.

For the entire collection see [Zbl 1227.94002].

\(\bullet\) The first key recovery method for the full AES-128 with computational complexity \(2^{126.1}\).

\(\bullet\) The first key recovery method for the full AES-192 with computational complexity \(2^{189.7}\).

\(\bullet\) The first key recovery method for the full AES-256 with computational complexity \(2^{254.4}\).

\(\bullet\) Key recovery methods with lower complexity for the reduced-round versions of AES not considered before, including cryptanalysis of 8-round AES-128 with complexity \(2^{124.9}\).

\(\bullet\) Preimage search for compression functions based on the full AES versions faster than brute force.

In contrast to most shortcut attacks on AES variants, we do not need to assume related-keys. Most of our techniques only need a very small part of the codebook and have low memory requirements, and are practically verified to a large extent. As our cryptanalysis is of high computational complexity, it does not threaten the practical use of AES in any way.

For the entire collection see [Zbl 1227.94002].

### MSC:

94A60 | Cryptography |