A Differential-Linear Attack on 12-Round Serpent

Abstract

Serpent is an SP Network block cipher submitted to the AES competition and chosen as one of its five finalists. The security of Serpent is widely acknowledged, especially as the best known attack so far is a differential-linear attack on only 11 rounds out of the 32 rounds of the cipher. In this paper we introduce a more accurate analysis of the differentiallinear attack on 11-round Serpent. The analysis involves both theoretical aspects as well as experimental results which suggest that previous attacks had overestimated complexities. Following our findings we are able to suggest an improved 11-round attack with a lower data complexity. Using the new results, we are able to devise the first known attack on 12-round Serpent.

Filtered Nonlinear Cryptanalysis of Reduced-Round Serpent, and the Wrong-Key Randomization Hypothesis

“…The various linear, differential-linear and multidimensional linear attacks on reduced-round Serpent fall into two categories; those based on Collard et al's approximations [11,12,13,30] and those based on the approximation of Dunkelman, Keller et al [2,4,20]. In Appendix A, we point out a few errors in the existing descriptions of Dunkelman et al's approximation.…”

“…In Indesteege et al's chosen-ciphertext attack on 11-round Serpent [20], two active plaintext boxes (both Serpent S4) contribute bit y 4 to the attack. Since three input differences cause this bit to flip with bias ±0.5, the attack recovers 56 key bits instead of 60.…”

“…Since three input differences cause this bit to flip with bias ±0.5, the attack recovers 56 key bits instead of 60. For the other differential-linear attacks [20], all key bits are obtainable and the effect of the bias ±0.25 parity flips on P s is negligible. 4.2 Nonlinear attacks on 11-round Serpent-192 and Serpent-256.…”

“…In later papers [4,20], after the application of S6, bit 28 is shown as active instead of bit 30. In private email correspondence, one of the authors informed us that bit 28 was correct.…”

Differential Factors: Improved Attacks on SERPENT

“…The data and time complexities of these attacks are reduced in [17] by using the following improvements:…”