International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Paper: Subspace Trail Cryptanalysis and its Applications to AES

Authors:
Lorenzo Grassi , IAIK, Graz University of Technology
Christian Rechberger , DTU Compute, Technical University of Denmark; IAIK, Graz University of Technology
Sondre Rønjom , Nasjonal sikkerhetsmyndighet; Department of Informatics, University of Bergen
Download:
DOI: 10.13154/tosc.v2016.i2.192-225
URL: http://tosc.iacr.org/index.php/ToSC/article/view/571
Search ePrint
Search Google
Abstract: We introduce subspace trail cryptanalysis, a generalization of invariant subspace cryptanalysis. With this more generic treatment of subspaces we do no longer rely on specific choices of round constants or subkeys, and the resulting method is as such a potentially more powerful attack vector. Interestingly, subspace trail cryptanalysis in fact includes techniques based on impossible or truncated differentials and integrals as special cases. Choosing AES-128 as the perhaps most studied cipher, we describe distinguishers up to 5-round AES with a single unknown key. We report (and practically verify) competitive key-recovery attacks with very low data-complexity on 2, 3 and 4 rounds of AES. Additionally, we consider AES with a secret S-Box and we present a (generic) technique that allows to directly recover the secret key without finding any information about the secret S-Box. This approach allows to use e.g. truncated differential, impossible differential and integral attacks to find the secret key. Moreover, this technique works also for other AES-like constructions, if some very common conditions on the S-Box and on the MixColumns matrix (or its inverse) hold. As a consequence, such attacks allow to better highlight the security impact of linear mappings inside an AES-like block cipher. Finally, we show that our impossible differential attack on 5 rounds of AES with secret S-Box can be turned into a distinguisher for AES in the same setting as the one recently proposed by Sun, Liu, Guo, Qu and Rijmen at CRYPTO 2016
BibTeX
@article{tosc-2016-28122,
  title={Subspace Trail Cryptanalysis and its Applications to AES},
  journal={IACR Trans. Symmetric Cryptol.},
  publisher={Ruhr-Universit├Ąt Bochum},
  volume={2016, Issue 2},
  pages={192-225},
  url={http://tosc.iacr.org/index.php/ToSC/article/view/571},
  doi={10.13154/tosc.v2016.i2.192-225},
  author={Lorenzo Grassi and Christian Rechberger and Sondre Rønjom},
  year=2016
}