Security Analysis on the Full-Round SCO-1

In this paper we show that the full-round SCO-1[12] is vulnerable to the related-key differential attack. The attack on the full-round SCO-1 requires related-key chosen ciphertexts and full-round SCO-1 decryptions. This work is the first known attack on SCO-1.