impossible differential cryptanalysis of reduced-round aria and camellia

This paper studies the security of the block ciphers ARIA and Camellia against impossible differential cryptanalysis. Our work improves the best impossible differential cryptanalysis of ARIA and Camellia known so far. The designers of ARIA expected no impossible differentials exist for 4-round ARIA. However, we found some nontrivial 4-round impossible differentials, which may lead to a possible attack on 6-round ARIA. Moreover, we found some nontrivial 8-round impossible differentials for Camellia, whereas only 7-round impossible differentials were previously known. By using the 8-round impossible differentials, we presented an attack on 12-round Camellia without FL/FL 1 layers.

低轮Camellia的碰撞攻击

Camellia是欧洲密码大计划NESSIE的最终获胜者, 首先构造了Camellia的4轮区分器, 然后利用这些区分器和碰撞搜索技术分析Camellia的安全性. 在密钥长度为128比特的情况下, 攻击6轮Camellia的数据复杂度小于210个选择明文, 时间复杂度小于215次加密; 攻击7轮Camellia的数据复杂度小于212个选择明文, 时间复杂度小于254.5次加密; 攻击8轮Camellia的数据复杂度小于213个选择明文, 时间复杂度小于2112.1次加密; 攻击9轮Camellia的数据复杂度小于2113.6个选择明文, 时间复杂度小于2121次加密. 在密钥长度为192/256比特的情况下, 攻击8轮Camellia的数据复杂度小于213个选择明文, 时间复杂度小于2111.1次加密; 攻击9轮Camellia的数据复杂度小于213个选择明文, 时间复杂度小于2175.6次加密; 攻击10轮Camellia的数据复杂度小于214个选择明文, 时间复杂度小于2239.9次加密. 结果显示碰撞攻击是目前对低轮Camellia最有效的攻击方法.

对于5轮Camellia密码的Square攻击

中国计算机学会