Reference : Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
http://hdl.handle.net/10993/17518
Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds
English
Biryukov, Alex mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Dunkelman, Orr [Ecole Normale Superieure]
Keller, Nathan [Institute of Mathematics, Hebrew University]
Khovratovich, Dmitry mailto [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Shamir, Adi [Weizmann Institute of Science, Israel]
2010
EUROCRYPT 2010
Springer
299-319
Yes
International
978-3-642-13189-9
EUROCRYPT 2010
May 30 - June 3
French Riviera
France
[en] AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively). While for AES-128, there are no known attacks faster than exhaustive search, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^99.5 time, respectively. While these complexities are much faster than exhaustive search, they are completely non-practical, and do not seem to pose any real threat to the security of AES-based systems. In this paper we aim to increase our understanding of AES security, and we concentrate on attacks with practical complexity, i.e., attacks that can be experimentally verified. We show attacks on reduced-round variants of AES-256 with up to 10 rounds with complexity which is feasible. One of our attacks uses only two related keys and 239 time to recover the complete 256-bit key of a 9-round version of AES-256 (the best previous attack on this variant required 4 related keys and 2^120 time). Another attack can break a 10-round version of AES-256 in 2^45 time, but it uses a stronger type of related subkey attack (the best previous attack on this variant required 64 related keys and 2^172 time). While the full AES-256 cannot be directly broken by these attacks, the fact that 10 rounds can be broken with such a low complexity raises serious concerns about the remaining safety margin offered by AES-256.
http://hdl.handle.net/10993/17518
6110
Advances in Cryptology - EUROCRYPT 2010, 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Lecture Notes in Computer Science

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Open access
Practical-AES-RK.pdfPublisher postprint352.95 kBView/Open

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.