CoChat
Sign Up
Cited by 329Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

Distinguisher and Related-Key Attack on the Full AES-256

Open access
Biryukov, Alex, Khovratovich, Dmitry, Nikolić, Ivica·2009·Lecture Notes in Computer Science
DOI 10.1007/978-3-642-03356-8_14
Open this paper in CoChat — free accountOpen PDF

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/978-3-642-03356-8_14

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The analysis of AES with local collisions is only applicable to the related-key model.

    “So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”

    From Biclique Cryptanalysis of the Full AES (2011) · cites this paper as [10]

    The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)

    Checked by a reasoning model — may be wrong.

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 12

  1. Biham, E., Dunkelman, O., Keller, N.: Related-key boomerang and rectangle at- tacks. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 507-525. Springer, Heidelberg (2005)
  2. Black, J.: The ideal-cipher model, revisited: An uninstantiable blockcipher-based hash function. In: Robshaw, M.J.B. (ed.) FSE 2006. LNCS, vol. 4047, pp. 328-340. Springer, Heidelberg (2006)
  3. Black, J., Rogaway, P., Shrimpton, T.: Black-box analysis of the block-cipher-based hash-function constructions from PGV. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 320-335. Springer, Heidelberg (2002)
  4. Canetti, R., Goldreich, O., Halevi, S.: The random oracle methodology, revisited. J. ACM 51(4), 557-594 (2004)
  5. Daemen, J., Rijmen, V.: The Design of Rijndael. AES -the Advanced Encryption Standard. Springer, Heidelberg (2002)
  6. Jaulmes, É., Joux, A., Valette, F.: On the security of randomized cbc-mac beyond the birthday paradox limit: A new construction. In: Daemen, J., Rijmen, V. (eds.) FSE 2002. LNCS, vol. 2365, pp. 237-251. Springer, Heidelberg (2002)
  7. Joux, A.: Multicollisions in iterated hash functions. Application to cascaded con- structions. In: Franklin, M. (ed.) CRYPTO 2004. LNCS, vol. 3152, pp. 306-316. Springer, Heidelberg (2004)
  8. Khovratiovich, D., Biryukov, A., Nikolić, I.: Speeding up collision search for byte- oriented hash functions. In: CT-RSA 2009. LNCS, vol. 5473, pp. 164-181. Springer, Heidelberg (2009)
  9. Kim, J., Hong, S., Preneel, B.: Related-key rectangle attacks on reduced AES-192 and AES-256. In: Biryukov, A. (ed.) FSE 2007. LNCS, vol. 4593, pp. 225-241. Springer, Heidelberg (2007)
  10. Knudsen, L.R., Rijmen, V.: Known-key distinguishers for some block ciphers. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 315-324. Springer, Heidelberg (2007)
  11. Patarin, J.: A proof of security in O(2 n ) for the xor of two random permutations. In: Safavi-Naini, R. (ed.) ICITS 2008. LNCS, vol. 5155, pp. 232-248. Springer, Heidelberg (2008)
  12. Suzuki, K., Tonien, D., Kurosawa, K., Toyota, K.: Birthday paradox for multi- collisions. IEICE Transactions 91-A(1), 39-45 (2008)

Cited by

Sorted by citations

Authors
Biryukov, A., Khovratovich, D., & Nikolić, I.
Affiliations
University of Luxembourg (LU)
ORCID
Venue
Lecture Notes in Computer Science
Publisher
Springer Berlin Heidelberg
Published
2009
Pages
231-249
ISSN
  • 0302-9743 (ISSN-L)
  • 1611-3349
DOI
10.1007/978-3-642-03356-8_14
OpenAlex
W1554865288
Cited by
329
References
1
Citations by year
2026: 5 · 2025: 8 · 2024: 11 · 2023: 11 · 2022: 8 · 2021: 11 · 2020: 9 · 2019: 17 · 2018: 19 · 2017: 20 · 2016: 12 · 2015: 35 · 2014: 30 · 2013: 30 · 2012: 28
FWCI
24.17
Type
conference paper
Language
en
Open access
Licence
Locations
  • Lecture notes in computer science (publishedVersion)
  • Open Repository and Bibliography (University of Luxembourg) (submittedVersion, other-oa)
Funders
  • Université du Luxembourg
  • Fonds National de la Recherche Luxembourg
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
AES-256, related-key attacks, ideal cipher model, key recovery attack, block cipher cryptanalysis

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review