论文信息 - Structural Cryptanalysis of SASAS

Structural Cryptanalysis of SASAS

In this paper we consider the security of block ciphers which contain alternate layers of invertible S-boxes and affine mappings (there are many popular cryptosystems which use this structure, including the winner of the AES competition, Rijndael). We show that a five layer scheme with 128 bit plaintexts and 8 bit S-boxes is surprisingly weak even when all the S-boxes and affine mappings are key dependent (and thus completely unknown to the attacker). We tested the attack with an actual implementation, which required just 216 chosen plaintexts and a few seconds on a single PC to find the 217 bits of information in all the unknown elements of the scheme.

Alex Biryukov | Adi Shamir | A. Shamir | A. Biryukov

[1] Vincent Rijmen,et al. The Design of Rijndael: AES - The Advanced Encryption Standard , 2002 .

[2] Stefan Lucks,et al. Attacking Seven Rounds of Rijndael under 192-bit and 256-bit Keys , 2000, AES Candidate Conference.

[3] Eli Biham. Cryptanalysis of Patarin's 2-Round Public Key System with S Boxes (2R) , 2000, EUROCRYPT.

[4] Marine Minier,et al. A Collision Attack on 7 Rounds of Rijndael , 2000, AES Candidate Conference.

[5] Joos Vandewalle,et al. Linear Cryptanalysis of Reduced-Round Versions of the SAFER Block Cipher Family , 2000, FSE.

[6] Louis Goubin,et al. Asymmetric cryptography with S-Boxes , 1997, ICICS.

[7] G. G. Stokes. "J." , 1890, The New Yale Book of Quotations.

[8] Vincent Rijmen,et al. The Block Cipher Square , 1997, FSE.