New Impossible Differential Attacks of Reduced-Round Camellia-192 and Camellia-256

Chen, Jiazhe; Jia, Keting; Yu, Haiyan; Wang, Xiaoyun

doi:10.1007/978-3-642-22497-3_2

Cited by 18 publications

(22 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The output immediately before the FL/FL −1 functions is as follows, where 6,8 ; and e 1 , e 2 , · · · , e 8 are 8-bit constants completely determined by a 1 , a 2 , · · · , a 8 and…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Meet-in-the-Middle Attack on Reduced Versions of the Camellia Block Cipher

Wei

Pašalić

et al. 2012

Advances in Information and Computer Security

View full text Add to dashboard Cite

Abstract. The Camellia block cipher has a 128-bit block length and a user key of 128, 192 or 256 bits long, which employs a total of 18 rounds for a 128-bit key and 24 rounds for a 192 or 256-bit key. It is a Japanese CRYPTREC-recommended e-government cipher, a European NESSIE selected cipher, and an ISO international standard. In this paper, we describe a few 5 and 6-round properties of Camellia and finally use them to give meet-in-the-middle attacks on 10-round Camellia under 128 key bits, 11-round Camellia under 192 key bits and 12-round Camellia under 256 key bits, all of which include the FL/FL −1 functions but do not include whitening operations.

show abstract

Section: Discussionmentioning

confidence: 99%

“…Below is the procedure for attacking Rounds 2 to 11, where the 5-round property with ω = 0 is used from Rounds 4 to 8, and the approach used to choose plaintexts with δ was introduced in [23]. 6 , and define a secret parameter δ to be…”

Section: Property 1 For Camellia-128 Given a Value Ofmentioning

confidence: 99%

Meet-in-the-Middle Attack on Reduced Versions of the Camellia Block Cipher

Wei

Pašalić

et al. 2012

Advances in Information and Computer Security

View full text Add to dashboard Cite

show abstract

“…As opposed to that, in this paper, we only discuss attacks on Camellia with F L/F L −1 and whitening key starting from the first round. Rather recently, some attacks on reduced-round Camellia with F L/F L −1 and whitening key have been introduced [6,11,12]. In this setting, the best attack on Camellia-128 is the impossible differential attack on 10 rounds [11].…”

Section: Introductionmentioning

confidence: 99%

Zero-Correlation Linear Cryptanalysis with FFT and Improved Attacks on ISO Standards Camellia and CLEFIA

Bogdanov

Geng

Wang

et al. 2014

Selected Areas in Cryptography -- SAC 2013

View full text Add to dashboard Cite

Abstract. Zero-correlation linear cryptanalysis is based on the linear approximations with correlation exactly zero, which essentially generalizes the integral property, and has already been applied to several block ciphers -among others, yielding best known attacks to date on round-reduced TEA and CAST-256 as published in FSE'12 and ASI-ACRYPT'12, respectively.In this paper, we use the FFT (Fast Fourier Transform) technique to speed up the zero-correlation cryptanalysis. First, this allows us to improve upon the state-of-the-art cryptanalysis for the ISO/IEC standard and CRYPTREC-portfolio cipher Camellia. Namely, we present zero-correlation attacks on 11-round Camellia-128 and 12-round Camellia-192 with F L/F L −1 and whitening key starting from the first round, which is an improvement in the number of attacked rounds in both cases. Moreover, we provide multidimensional zero-correlation cryptanalysis of 14-round CLEFIA-192 and 15-round CLEFIA-256 that are attacks on the highest numbers of rounds in the classical single-key setting, respectively, with improvements in memory complexity.

show abstract

“…Recently, some attacks involved in the study of the original structure of Camellia. For instance, Chen et al constructed a 6-round impossible differential with the F L/F L −1 layer to attack 10-round Camellia-192 and 11-round Camellia-256 [3], Lu, Liu and Li independently improved Chen's results to attack on reduced-round Camellia [12,14,17], Lu et al proposed higher order meet-in-the-middle attacks on 10-round Camellia-128, 11-round Camellia-192 and 12-round Camellia-256 [18]. Impossible differential cryptanalysis was independently proposed by Knudsen [7] and Biham [2].…”

Section: Introductionmentioning

confidence: 99%

New Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia

Liu

et al. 2012

Fast Software Encryption

Self Cite

View full text Add to dashboard Cite

International audienceCamellia is one of the widely used block ciphers, which has been selected as an international standard by ISO/IEC. In this paper, by exploiting some interesting properties of the key-dependent layer, we improve previous results on impossible differential cryptanalysis of reduced-round Camellia and gain some new observations. First, we introduce some new 7-round impossible differentials of Camellia for weak keys. These weak keys that work for the impossible differential take 3/4 of the whole key space, therefore, we further get rid of the weak-key assumption and leverage the attacks on reduced-round Camellia to all keys by utilizing the multiplied method. Second, we build a set of differentials which contains at least one 8-round impossible differential of Camellia with two FL/FL − 1 layers. Following this new result, we show that the key-dependent transformations inserted in Camellia cannot resist impossible differential cryptanalysis effectively. Based on this set of differentials, we present a new cryptanalytic strategy to mount impossible differential attacks on reduced-round Camellia

show abstract

New Impossible Differential Attacks of Reduced-Round Camellia-192 and Camellia-256

Cited by 18 publications

References 14 publications

Meet-in-the-Middle Attack on Reduced Versions of the Camellia Block Cipher

Meet-in-the-Middle Attack on Reduced Versions of the Camellia Block Cipher

Zero-Correlation Linear Cryptanalysis with FFT and Improved Attacks on ISO Standards Camellia and CLEFIA

New Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia

Contact Info

Product

Resources

About