This paper examines the resistance of Rijndael-256 to related-key attacks by presenting robust boomerang and rectangle distinguishers. We first revisit the local collision construction method used by Biryukov et al. to find related-key differential trails for AES-192 and AES-256. Leveraging that approach, we show that local collisions cannot be constructed by separating disturbance and correction in Rijndael-256 by analyzing how differences propagate through its key schedule and their implications for related-key trails. In particular, the internal state and the key state are updated simultaneously, which makes it impossible to construct a related-key differential distinguisher based on local collisions. Our in-depth analysis yields 7-round related-key boomerang and rectangle distinguishers for Rijndael-256 without relying on local collisions. With data complexities of \(2^{108.83}\) and \(2^{167.92}\) 256-bit blocks, respectively, these distinguishers enable us to distinguish Rijndael-256 from a random oracle in the related-key setting. To the best of our knowledge, this is the first analysis of related-key boomerang and rectangle attacks on Rijndael-256 in the literature.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

On the Resistance of Rijndael-256 Against Related-Key Boomerang and Rectangle Attacks

  • Namil Kim,
  • Wonwoo Song,
  • Seungjun Baek,
  • Yongjin Jeon,
  • Jongsung Kim,
  • Kihyo Nam

摘要

This paper examines the resistance of Rijndael-256 to related-key attacks by presenting robust boomerang and rectangle distinguishers. We first revisit the local collision construction method used by Biryukov et al. to find related-key differential trails for AES-192 and AES-256. Leveraging that approach, we show that local collisions cannot be constructed by separating disturbance and correction in Rijndael-256 by analyzing how differences propagate through its key schedule and their implications for related-key trails. In particular, the internal state and the key state are updated simultaneously, which makes it impossible to construct a related-key differential distinguisher based on local collisions. Our in-depth analysis yields 7-round related-key boomerang and rectangle distinguishers for Rijndael-256 without relying on local collisions. With data complexities of \(2^{108.83}\) and \(2^{167.92}\) 256-bit blocks, respectively, these distinguishers enable us to distinguish Rijndael-256 from a random oracle in the related-key setting. To the best of our knowledge, this is the first analysis of related-key boomerang and rectangle attacks on Rijndael-256 in the literature.