On the Resistance of Rijndael-256 Against Related-Key Boomerang and Rectangle Attacks
摘要
This paper examines the resistance of Rijndael-256 to related-key attacks by presenting robust boomerang and rectangle distinguishers. We first revisit the local collision construction method used by Biryukov et al. to find related-key differential trails for AES-192 and AES-256. Leveraging that approach, we show that local collisions cannot be constructed by separating disturbance and correction in Rijndael-256 by analyzing how differences propagate through its key schedule and their implications for related-key trails. In particular, the internal state and the key state are updated simultaneously, which makes it impossible to construct a related-key differential distinguisher based on local collisions. Our in-depth analysis yields 7-round related-key boomerang and rectangle distinguishers for Rijndael-256 without relying on local collisions. With data complexities of \(2^{108.83}\) and \(2^{167.92}\) 256-bit blocks, respectively, these distinguishers enable us to distinguish Rijndael-256 from a random oracle in the related-key setting. To the best of our knowledge, this is the first analysis of related-key boomerang and rectangle attacks on Rijndael-256 in the literature.