AES is the most widely used symmetric cipher, and the mixture-differential cryptanalysis is a structural cryptanalysis technique that has yielded the best key-recovery attack on 5-round AES in the chosen-plaintext setting. In this paper, we propose a generalized 4-round mixture-differential distinguisher for AES, called extended-mixture-differential distinguisher. The new 4-round distinguisher for AES improves upon previous mixture-differential distinguishers in both data and time complexity. Furthermore, we introduce the mixture boomerang method to analyze the exact distribution of mixtures among different plaintext structures after 1-round encryption, based on which we reinterpret the “multiple-of-8” property and revisit the mixture-differential attacks on 5-, 6-, and 7-round AES. In particular, some errors on the success probability of the previous mixture-differential attack against 7-round AES are corrected. As an application of our techniques, we present a new mixture-differential attack on 6-round AES-128 with time complexity <InlineEquation ID="IEq1"> <EquationSource Format="TEX">$2^{70.74}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mrow> <mn>70.74</mn> </mrow> </msup> </math></EquationSource> </InlineEquation> and data complexity <InlineEquation ID="IEq2"> <EquationSource Format="TEX">$2^{22.88}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mrow> <mn>22.88</mn> </mrow> </msup> </math></EquationSource> </InlineEquation>, which significantly enhances the previous best-known mixture-differential attacks both in time and data complexity. Besides, we also give a new attack against 7-round AES-192 and AES-256. Our attacks on reduced-round AES-128/192/256 exceed prior mixture-differential attacks by a factor of <InlineEquation ID="IEq3"> <EquationSource Format="TEX">$2^{8}$</EquationSource> <EquationSource Format="MATHML"><math> <msup> <mn>2</mn> <mn>8</mn> </msup> </math></EquationSource> </InlineEquation> in time complexity. To demonstrate the versatility of the new distinguisher construction against AES-like ciphers, we apply our method to Saturnin, a second-round candidate in the NIST lightweight cryptography standardization process, providing an improved mixture-differential attack against Saturnin with 6 super-rounds.

Revisiting mixture-differential cryptanalysis on AES: new techniques and results

期刊论文
发表日期：

2026年6月29日

查看全文

Fan Yang,
Tian Tian

摘要

AES is the most widely used symmetric cipher, and the mixture-differential cryptanalysis is a structural cryptanalysis technique that has yielded the best key-recovery attack on 5-round AES in the chosen-plaintext setting. In this paper, we propose a generalized 4-round mixture-differential distinguisher for AES, called extended-mixture-differential distinguisher. The new 4-round distinguisher for AES improves upon previous mixture-differential distinguishers in both data and time complexity. Furthermore, we introduce the mixture boomerang method to analyze the exact distribution of mixtures among different plaintext structures after 1-round encryption, based on which we reinterpret the “multiple-of-8” property and revisit the mixture-differential attacks on 5-, 6-, and 7-round AES. In particular, some errors on the success probability of the previous mixture-differential attack against 7-round AES are corrected. As an application of our techniques, we present a new mixture-differential attack on 6-round AES-128 with time complexity $2^{70.74}$ $2^{70.74}$ and data complexity $2^{22.88}$ $2^{22.88}$ , which significantly enhances the previous best-known mixture-differential attacks both in time and data complexity. Besides, we also give a new attack against 7-round AES-192 and AES-256. Our attacks on reduced-round AES-128/192/256 exceed prior mixture-differential attacks by a factor of $2^{8}$ $2^{8}$ in time complexity. To demonstrate the versatility of the new distinguisher construction against AES-like ciphers, we apply our method to Saturnin, a second-round candidate in the NIST lightweight cryptography standardization process, providing an improved mixture-differential attack against Saturnin with 6 super-rounds.