New Observations on Impossible Differential Cryptanalysis of Reduced-Round Camellia

Abstract

International audienceCamellia is one of the widely used block ciphers, which has been selected as an international standard by ISO/IEC. In this paper, by exploiting some interesting properties of the key-dependent layer, we improve previous results on impossible differential cryptanalysis of reduced-round Camellia and gain some new observations. First, we introduce some new 7-round impossible differentials of Camellia for weak keys. These weak keys that work for the impossible differential take 3/4 of the whole key space, therefore, we further get rid of the weak-key assumption and leverage the attacks on reduced-round Camellia to all keys by utilizing the multiplied method. Second, we build a set of differentials which contains at least one 8-round impossible differential of Camellia with two FL/FL − 1 layers. Following this new result, we show that the key-dependent transformations inserted in Camellia cannot resist impossible differential cryptanalysis effectively. Based on this set of differentials, we present a new cryptanalytic strategy to mount impossible differential attacks on reduced-round Camellia

Meet-in-the-Middle Attack on Reduced Versions of the Camellia Block Cipher

“…Our results show that as far as Camellia is concerned, the semi-advanced MitM attack technique is more efficient than or at least as efficient as the advanced cryptanalytic techniques studied, except impossible differential cryptanalysis; in this latter case the MitM attacks are now one or two rounds inferior to the best newly emerging impossible differential cryptanalysis results in [2,22].…”

“…If the FL −1 function were modified to have a good avalanche effect, then those MitM properties would involve a large number of unknown 1-bit constant parameters, and the resulting MitM attacks would be ineffective for the resulting cipher, but nevertheless it does not necessarily resist the HO-MitM attack technique, for those HO-MitM attacks described in [24] work as long as that integral property of Camellia holds (canceling the FL −1 function). Actually, if the FL/FL −1 functions had had a good avalanche effect, the Camellia cipher could have withstood the best currently known cryptanalytic results that are the newly emerging impossible differential cryptanalysis results [2,22]. In this sense, the FL/FL −1 functions do play an important role in the security of Camellia.…”

“…The security of Camellia has been analysed against a variety of cryptanalytic techniques, including differential cryptanalysis [5], truncated differential cryptanalysis [17], higher-order differential cryptanalysis [17,20], linear cryptanalysis [25], integral cryptanalysis [8,15,19], boomerang attack [30], rectangle attack [4], collision attack and impossible differential cryptanalysis [3,18]; and many cryptanalytic results on Camellia have been published [2, 6, 11-13, 21-24, 27-29, 31, 32], of which impossible differential cryptanalysis is the most efficient technique in terms of the numbers of attacked rounds, that broke 11-round Camellia-128, 12-round Camellia-192 and 14-round Camellia-256 [2,22], presented most recently at FSE 2012 and ISPEC 2012.…”

Zero-Correlation Linear Cryptanalysis with FFT and Improved Attacks on ISO Standards Camellia and CLEFIA

“…As opposed to that, in this paper, we only discuss attacks on Camellia with F L/F L −1 and whitening key starting from the first round. Rather recently, some attacks on reduced-round Camellia with F L/F L −1 and whitening key have been introduced [6,11,12]. In this setting, the best attack on Camellia-128 is the impossible differential attack on 10 rounds [11].…”

“…Rather recently, some attacks on reduced-round Camellia with F L/F L −1 and whitening key have been introduced [6,11,12]. In this setting, the best attack on Camellia-128 is the impossible differential attack on 10 rounds [11]. A similar attack can break 11 rounds of Camellia-192 [11].…”