CoChat
Sign Up
Cited by 159Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

Rebound Distinguishers: Results on the Full Whirlpool Compression Function

Open access
Lamberger, Mario, Mendel, Florian, Rechberger, Christian, Rijmen, Vincent, Schläffer, Martin·2009·Lecture Notes in Computer Science
DOI 10.1007/978-3-642-10366-7_8
Open this paper in CoChat — free accountOpen PDF

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/978-3-642-10366-7_8

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The fastest single-key attacks on round-reduced AES variants so far are only slightly more powerful than those proposed 10 years ago.

    “Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”

    From Biclique Cryptanalysis of the Full AES (2011) · cites this paper as [33]

    The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)

    Experimental — accuracy not yet measured

  • With respect to AES, the most powerful single-key recovery methods designed so far are impossible differential cryptanalysis and Square attacks.

    “With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”

    From Biclique Cryptanalysis of the Full AES (2011) · cites this paper as [33]

    The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)

    Experimental — accuracy not yet measured

  • Impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.

    “The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”

    From Biclique Cryptanalysis of the Full AES (2011) · cites this paper as [33]

    The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 18

  1. [3]3. Black, J., Rogaway, P., Shrimpton, T.: Black-Box Analysis of the Block-CipherBased Hash-Function Constructions from PGV. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 320-335. Springer, Heidelberg (2002)
  2. [4]4. Daemen, J., Rijmen, V.: The Wide Trail Design Strategy. In: Honary, B. (ed.) Cryptography and Coding 2001. LNCS, vol. 2260, pp. 222-238. Springer, Heidelberg (2001)
  3. [5]5. Daemen, J., Rijmen, V.: The Design of Rijndael. Information Security and Cryptography. Springer, Heidelberg (2002), ISBN 3-540-42580-2
  4. [6]6. De Canni` ere, C., Mendel, F., Rechberger, C.: Collisions for 70-Step SHA-1: On the Full Cost of Collision Search. In: Adams, C.M., Miri, A., Wiener, M.J. (eds.) SAC 2007. LNCS, vol. 4876, pp. 56-73. Springer, Heidelberg (2007)
  5. [7]7. De Canni` ere, C., Rechberger, C.: Finding SHA-1 Characteristics: General Results and Applications. In: Lai, X., Chen, K. (eds.) ASIACRYPT 2006. LNCS, vol. 4284, pp. 1-20. Springer, Heidelberg (2006)
  6. [9]9. Fisher, S.D.: Classroom Notes: Matrices over a Finite Field. Amer. Math. Monthly 73(6), 639-641 (1966)
  7. [10]10. Knudsen, L.R.: Truncated and Higher Order Differentials. In: Preneel, B. (ed.) FSE 1994. LNCS, vol. 1008, pp. 196-211. Springer, Heidelberg (1995)
  8. [12]12. Knudsen, L.R., Rijmen, V.: Known-key distinguishers for some block ciphers. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 315-324. Springer, Heidelberg (2007)
  9. [13]13. Lidl, R., Niederreiter, H.: Finite Fields, Encyclopedia of Mathematics and its Applications, 2nd edn., vol. 20. Cambridge University Press, Cambridge (1997); with a foreword by P. M. Cohn
  10. [14]14. Matusiewicz, K., Naya-Plasencia, M., Nikoli´ c, I., Sasaki, Y., Schl¨ affer, M.: Rebound Attack on the Full LANE Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 106-125. Springer, Heidelberg (2009)
  11. [15]15. Mendel, F., Peyrin, T., Rechberger, C., Schl¨ affer, M.: Improved Cryptanalysis of the Reduced Grøstl Compression Function, ECHO Permutation and AES Block Cipher. In: Jacobson Jr., M.J., Rijmen, V., Safavi-Naini, R. (eds.) SAC 2009. LNCS, vol. 5867, pp. 16-35. Springer, Heidelberg (2009)
  12. [16]16. Mendel, F., Rechberger, C., Schl¨ affer, M., Thomsen, S.S.: The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl. In: Dunkelman, O. (ed.) FSE 2009. LNCS, vol. 5665, pp. 260-276. Springer, Heidelberg (2009)
  13. [17]17. Mendel, F., Rijmen, V.: Cryptanalysis of the Tiger Hash Function. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 536-550. Springer, Heidelberg (2007)
  14. [18]18. Menezes, A.J., van Oorschot, P.C., Vanstone, S.A.: Handbook of Applied Cryptography. CRC Press, Boca Raton (1997), http://www.cacr.math.uwaterloo.ca/hac/
  15. [21]21. Peyrin, T.: Cryptanalysis of Grindahl. In: Kurosawa, K. (ed.) ASIACRYPT 2007. LNCS, vol. 4833, pp. 551-567. Springer, Heidelberg (2007)
  16. [24]24. Wang, X., Lai, X., Feng, D., Chen, H., Yu, X.: Cryptanalysis of the Hash Functions MD4 and RIPEMD. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 1-18. Springer, Heidelberg (2005)
  17. [25]25. Wang, X., Yin, Y.L., Yu, H.: Finding Collisions in the Full SHA-1. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 17-36. Springer, Heidelberg (2005)
  18. [26]26. Wang, X., Yu, H.: How to Break MD5 and Other Hash Functions. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 19-35. Springer, Heidelberg (2005)

Cited by

Sorted by citations

Authors
Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., & Schläffer, M.
Affiliations
  • Graz University of Technology (AT)
  • iMinds (BE)
Corresponding author
Lamberger, Mario
ORCID
Venue
Lecture Notes in Computer Science
Publisher
Springer Berlin Heidelberg
Published
2009
Pages
126-143
ISSN
  • 0302-9743 (ISSN-L)
  • 1611-3349
DOI
10.1007/978-3-642-10366-7_8
OpenAlex
W2136320902
Cited by
159
References
2
Citations by year
2026: 3 · 2025: 3 · 2024: 5 · 2023: 8 · 2022: 5 · 2021: 4 · 2020: 2 · 2019: 4 · 2018: 6 · 2017: 1 · 2016: 8 · 2015: 20 · 2014: 21 · 2013: 11 · 2012: 13
FWCI
13.61
Type
conference paper
Language
en
Open access
Locations
  • Lecture notes in computer science (publishedVersion)
  • Lirias (submittedVersion, other-oa)
Funders
European Commission
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
whirlpools, rebound attack, distinguishing attacks, key schedule, hash function cryptanalysis

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review