The first 9-round meet-in-the-middle (MITM) attack and improved 8-round impossible differential (ID) attacks on Rijndael-160 are studied here. For the first 9-round MITM attack, a new effective attack path is explored by using the generalised δ-set and the generalised multiset, which are based on the property that the difference branch number of MixColumns is 5. With this attack path, a 5-round MITM distinguisher with a technique of the truncated differential characteristic is proposed, and then the attack on 9-round Rijndael-160 is performed. For the improved 8-round ID attacks, to take advantage of the key-schedule weaknesses for Rijndael-160 under key sizes of 160 and 256 bits, some new attack paths are found. With these attack paths, the 5-round IDs are proposed based on the property of MixColumns above, and then the attacks on the 8-round Rijndael-160 under key sizes of 160 and 256 bits are performed. When compared with the currently known attacks, the proposed attacks have lower data, time, and memory complexities.
| INTRODUCTIONThe Rijndael block cipher was designed in the late 1990s by Daemen and Rijmen [1]. In the original design of Rijndael, both block and key size can independently range from 128 to 256 bits in steps of 32 bits. The 128-bit block version with key sizes of 128, 192, and 256 bits was selected as the Advanced Encryption Standard (AES) by the NIST. The other versions with block sizes larger than 128 bits are usually called large-block Rijndael.Owing to the importance and popularity of the AES, many cryptanalytic results on its security have been published so far. Two types of work including constructions of distinguishers and key-recovery attacks on round-reduced AES have recently gained more interest in the literature. The goal of the distinguishers is to distinguish the block cipher from random permutations. Previous public results on the AES included 3/4/ 5-round integral distinguishers [2, 3], 4/5-round impossible differential distinguishers [4,5], 3-round truncated differential distinguishers [5,6], 5-round structure differential distinguishers [7], 3/4/5-round yoyo distinguishers [8], 5/6-round exchange attacks [9], weak-key distinguishers [10], and 4/5/6-round expectation-based distinguishers [11]. As far as key-recovery attacks are concerned, two kinds have been considered. One was committed to maximising the number of rounds that can be broken, such as square attacks [2, 12], collision attacks [13], ID attacks [4, 14-16], meet-in-the-middle (MITM) attacks [17-23], and biclique attacks [24]. The other focussed on practical data, time, or memory complexities, such as boomerang attacks [25], integral attacks [3], polytopic attacks [26], subspace trail cryptanalysis [5], structural-differential attacks [7], yoyo tricks [8], MITM attacks [21], and Grassi attacks [27].However, there has been less focus on the security analysis of the large-block Rijndael. At FSE 2000, Ferguson et al. [2] gave partial sum attacks on 7-round Rijndael-192/224/256 and 8round Rijndael-192. At MYCRYPT 2005, ...