Meet-in-the-middle attacks on AES with value constraints

In meet-in-the-middle (MITM) attacks, the sizes of the precomputation tables determine the effectiveness. In this paper, value constraints are presented to reduce the size of the precomputation table in MITM attacks on AES. Based on a differential property of linear combinations of multiple S-boxes, value constraints related to input or output in four and five rounds of AES are explored. Meanwhile, with these value constraints, a method of setting up non-linear equations is proposed to reduce the sizes of the precomputation tables by decreasing the number of byte parameters. Compared with the existing results, their sizes can be reduced by \(2^8\) $2^8$ , \(2^{16}\) $2^{16}$ , or \(2^{24}\) $2^{24}$ . Finally, some attacks are improved with lower time and memory complexities.