The DOI matches its Crossref record; 57 of the 57 references it cites were found in a registry or an index; 14 of the 32 sources its claims cite were checked for support.
Biclique Cryptanalysis of the Full AES
Open accessOverview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper introduces biclique cryptanalysis and presents the first key-recovery attacks on the full AES-128, AES-192, and AES-256 faster than brute force, with complexities \(2^{126.1}\), \(2^{189.7}\), and \(2^{254.4}\), respectively. The attacks are in the single-key model and, because of their high computational complexity, do not threaten practical AES use.
Key findings
- First key recovery on full AES-128 with complexity \(2^{126.1}\), full AES-192 with \(2^{189.7}\), and full AES-256 with \(2^{254.4}\); the paper reports an advantage of about a factor 3 to 5 over brute force depending on version.
- Reduced-round and hash-mode results include 8-round AES-128 at \(2^{124.9}\), 9-round AES-192 at \(2^{188.8}\), 9-round AES-256 at \(2^{251.92}\), and compression-function preimages for full AES-128 (Miyaguchi-Preneel) at \(2^{125.83}\), AES-192 (Davies-Meyer) at \(2^{125.71}\), and AES-256 (Davies-Meyer) at \(2^{126.35}\), with success rate 0.632 for the preimage attacks.
- The full-AES independent-biclique attacks use data complexities of \(2^{88}\), \(2^{80}\), and \(2^{40}\) plaintext-ciphertext pairs for AES-128, AES-192, and AES-256, respectively, with memory \(2^8\) and success probability 1.
- The attacks do not assume related keys; most need only a small part of the codebook, and the paper reports practical verification of truncated differentials and the long-biclique construction for AES-256.
Methods
- Biclique cryptanalysis partitions the key space into groups of \(2^{2d}\) keys indexed as \(K[i,j]\), constructs a \(d\)-dimensional biclique satisfying \(C_i = f_{K[i,j]}(S_j)\), and uses meet-in-the-middle/matching with precomputations to test \(2^{2d}\) keys with about \(2^d\) computations.
- Two paradigms are used: long bicliques for remaining rounds via dependent related-key differential trails, and independent bicliques via independent related-key differentials plus matching with precomputations; the latter yields the full-AES key-recovery attacks.
- The analysis is theoretical cryptanalysis of AES-128/192/256 and AES-based hash modes; complexity is evaluated by counting recomputed S-boxes, MixColumns operations, and key-schedule operations, with tables summarizing parameters and complexities.
Limitations
- The paper states that the attacks are of high computational complexity and “do not threaten the practical use of AES in any way.”
- The paper states that the long-biclique paradigm has very difficult biclique construction for many rounds, limiting the total number of rounds attacked, and that its data complexity can be very large.
- Evident from the text: practical verification is partial rather than a full attack run—the authors verified truncated differentials, implemented the technically most complex long-biclique construction for AES-256, and checked super-box output differences, but did not execute the full key-recovery attacks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
101 No basis given · 49 Own interpretation · 15 Own result · 8 Own method · 6 No full text of the sources · 3 Couldn’t confirm · 2 Supported · 2 Partly supported · 1 Supported so far · 1 Mixed support · 1 Not checked yet · accuracy not yet measured
Some cited sources support this claim and some don’t — read each source’s verdict below.
In the paper
“So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [8] Biryukov, A., Dunkelman, O., Keller, N., Khovratovich, D., Shamir, A.: Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 299–319. Springer, Heidelberg (2010) source
- Partly supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe the paper’s local-collision attacks on AES-192 and AES-256 as related-key attacks. Section 4.1 explains the related-key model used. The paper does not establish the broader claim that analysis of AES with local collisions is only applicable in that model; page numbers are unavailable in our copy. (LLM, conf=0.85)
- Disputedcites [10] Biryukov, A., Khovratovich, D., Nikolić, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 231–249. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
- Partly supportedcites [11] Biryukov, A., Nikolić, I.: Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 322–344. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction describes related-key differential analysis of AES, including characteristics used in an AES-256 attack. It does not identify that analysis as using local collisions or say that local-collision analysis of AES is only applicable in the related-key model. (LLM, conf=0.78)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)
- Could not verifycites [23] Dunkelman, O., Keller, N., Shamir, A.: A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 393–410. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction and Summary discuss related-key attacks on KASUMI, not the relative strength of single-key attacks on round-reduced AES. A reference lists a reduced-round AES attack, but our copy does not compare AES attacks with those proposed ten years earlier (searched for single-key AES attacks and that comparison). (LLM, conf=0.76)
- Not checked — no full text of the sourcecites [24] Dunkelman, O., Sekar, G., Preneel, B.: Improved Meet-in-the-Middle Attacks on Reduced-Round DES. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 86–100. Springer, Heidelberg (2007) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The sources with a verdict support this claim; the rest weren’t checked yet, have no full text we could read, or their verdicts aren’t rated yet.
In the paper
“With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) source
The Introduction identifies impossible differential cryptanalysis as the technique this paper applies to IDEA and Khufu, including its use for key elimination. The citation is attached to that method; the broader judgment about which methods are most powerful for AES is the citing authors’ framing, not a finding attributed specifically to this paper. (LLM, conf=0.87)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)
- Not checked — no full text of the sourcecites [14] Bouillaguet, C., Derbez, P., Fouque, P.-A.: Automatic Search of Attacks on Round-Reduced AES and Applications. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 169–187. Springer, Heidelberg (2011) source
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Also, as already observed in [19,37], the fact that the MixColumn transformation is omitted in the last round of AES helps to design attacks for more rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Partly supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) sourceExperimental — accuracy not yet measured
Section 2 (page unavailable) says that AES has no MixColumn operation in its final round. Section 5.2 (page unavailable) describes extending the attack to eight rounds by searching the last-round key, but does not say that omitting MixColumn enables the extension. The claimed causal link is therefore not established by our copy. (LLM, conf=0.83)
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-Preimage attacks on compression functions based on the full AES versions.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-256 with computational complexity 2 254.4 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-192 with computational complexity 2 189.7 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-128 with computational complexity 2 126.1 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We also provide complexities for finding compression function preimages for all full versions of AES when considered in hash mode.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 32
- It may state two separate claims as one. 34
- The quote only partly states this claim. 6
Every source the paper cites for this claim was checked and supports it.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) source
The Abstract states that the paper presents two related-key attacks on the full AES, one against AES-256 and the other against the full AES-192. The Introduction also explicitly describes attacks on both full variants. (LLM, conf=0.94)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“AES with its wide-trail strategy was designed to withstand differential and linear cryptanalyses [15], so pure versions of these techniques have limited applications in attacks.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [15] Chabaud, F., Joux, A.: Differential Collisions in SHA-0. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 56–71. Springer, Heidelberg (1998) sourceExperimental — accuracy not yet measured
The Conclusion discusses a differential attack on SHA-0 and the expansion of SHA-1, not AES. Searches for AES, Rijndael, the wide-trail strategy, and resistance to differential and linear cryptanalysis found no passage addressing the attributed claim in our copy. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) sourceExperimental — accuracy not yet measured
The Abstract and §1 Introduction describe impossible-differential attacks on IDEA and Khufu, not AES-128. Searches for a first 7-round AES-128 attack and its data complexity found no passage addressing that result; the 7-round impossible differential mentioned in §4 concerns DES. (LLM, conf=0.76)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“As a result, the number of rounds broken with this technique is rather small [19], which seems to prevent it from producing results on yet unbroken 8-, 9-, and 10-round (full) AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) source
The Abstract and Conclusion report meet-in-the-middle attacks on 7 rounds of AES-192 and up to 8 rounds of AES-256. The Introduction states that full AES-192 and AES-256 have 12 and 14 rounds, respectively, supporting the cited point that this technique breaks relatively few rounds. The sentence’s suggestion about future results is the citing authors’ inference, not a finding attributed to this source. (LLM, conf=0.91)
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The new approach originates from the so-called spliceand-cut framework [1,2,26] in the hash function cryptanalysis, more specifically its element called initial structure.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Partly supportedcites [1] Aoki, K., Sasaki, Y.: Preimage Attacks on One-Block MD4, 63-Step MD5 and More. In: Avanzi, R.M., Keliher, L., Sica, F. (eds.) SAC 2008. LNCS, vol. 5381, pp. 103–119. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
In the section introducing Technique 1: Splice-and-Cut (page not available), the paper proposes and explains the splice-and-cut technique for hash-function preimage attacks. Our copy does not call any element of that technique an “initial structure,” so it supports the framework connection but not that more specific attribution. (LLM, conf=0.84)
- Not checked — no full text of the sourcecites [2] Aoki, K., Sasaki, Y.: Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 70–89. Springer, Heidelberg (2009) source
- Not checked — no full text of the sourcecites [26] Gilbert, H., Minier, M.: A Collision Attack on 7 Rounds of Rijndael. In: AES Candidate Conference, pp. 230–241 (2000)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-Attacks with lower complexity on the reduced-round versions of AES not considered before, including an attack on 8-round AES-128 with complexity 2 124.9 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We have studied several block ciphers and hash functions, including different variants of AES, and it turns out that the optimal choice depends on a primitive, its diffusion properties, and features of the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 4 Two Paradigms of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacks with lowest computational complexities follow the paradigm of independent bicliques and have success rate 1.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For longer keys some bicliques are filtered out.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Regarding the forward direction, the whitening subkeys $0 differ in 4 bytes only, which makes only four S-boxes to recompute.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-192 in Davies-Meyer mode requires about 2 125.71 computations, 2 8 memory, and has success rate 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our attack always outputs the right key as soon as it belongs to one of the quartets produced in the attack.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-192 yields a key recovery with computational complexity about 2 188.8 , data complexity 2 80 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i and j, respectively, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 3.4375 SubBytes operations (i.e., 55 S-boxes), 2.3125 MixColumns operations, and a negligible amount of XORs in the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference is no longer a linear function of j as it is in the computation of ←v , but still requires only three s-boxes in the key schedule to recompute.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The precomputation of about 2 d+1 matches allows for a significant complexity gain and is the major source of the computational advantage of our attacks on AES.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-128 in Miyaguchi-Preneel mode requires about 2 125.83 computations, 2 8 memory, and has a success probability of about 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher (there are 6.5 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the longer key, we are able to construct a biclique over 4-round f , so that S 0 = #17.”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is full, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($12 0 ) = ∆ K i ($12 12 ) and ∆ K i ($12 9 ) = ∆ K i ($12 13 ), we have the following property for the ciphertext bytes: C 0 = C 12 and C 9 = C 13 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 3,6,7,10 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The areas of internal states to be recomputed (with 13 S-boxes) are depicted in Figure 6.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 8-round AES-128 yields a key recovery with computational complexity about 2 125.34 , data complexity 2 88 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The success rate of the attack is 1, since we can generate many bicliques for each key group.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The data complexity is 2 120 since one ciphertext byte is always fixed.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Evidently, the groups do not intersect and cover the full key space.”
§ Biclique Cryptanalysis of the Full AES > Step 1.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We have four active S-boxes in round 6 and two active S-boxes in round 8.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For all versions of AES, the number of cryptanalyzed rounds did not increase since then (7 for AES-128, 8 for AES-192 and AES-256), only a decrease in the computational complexity of the key recovery was achieved.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“To construct longer bicliques, we drop the differential independency requirement imposed above and reduce the dimension of the resulting biclique.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The differential trails share some active nonlinear components now.This yields conditions on values that need to be satisfied in a biclique search.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the dimension is inevitably small due to the diffusion, then we use the second advantage: the biclique construction methods based on differential cryptanalysis of block ciphers and hash functions.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the ciphers with nonlinear key schedule, like AES and most AES candidates, this requirement is apparently strong.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We show how to carry over the concept of bicliques to block cipher cryptanalysis and get even more significant results, including the first key recovery method for the full AES faster than brute-force.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“A simple meet-in-the-middle attack requires only a single plaintext/ciphertext pair.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This paradigm is best suited for ciphers with diffusion that is slow with respect to r -m rounds, surprisingly, including AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The limited use of these attacks must be attributed to the requirement for large parts of the cipher to be independent of particular key bits.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Formally introduced in [29], bicliques led to the best preimage attacks on the SHA family of hash functions, including the attack on 50 rounds of SHA-512, and the first attack on a round-reduced Skein hash function.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The independency of the related-key differentials allows one to efficiently construct higherdimensional bicliques and simplifies the coverage of the key space with such bicliques.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Biclique cryptanalysis was first introduced for hash cryptanalysis [29].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, there is little evidence so far that carrying over these techniques to the most practical single-secret-key model is feasible.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity depends on the biclique construction procedure.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also from an information-theoretic point of view, bicliques of dimension 1 are likely to exist in a cipher, regardless of the number of rounds.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We stress here that whenever we speak of differences between keys, these describe differences inside the group of keys that are guessed.We never need access to decryptions under keys that are related by those differences, i.e. the attacks we describe are always in the single-key model.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, the construction of long bicliques of high dimension appears to be a very difficult task for primitives with fast diffusion [37].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [25] Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001) source
- Not checked — no full text of the sourcecites [30] Käsper, E., Rijmen, V., Bjørstad, T.E., Rechberger, C., Robshaw, M.J.B., Sekar, G.: Correlated Keystreams in Moustique. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 246–257. Springer, Heidelberg (2008) source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The disadvantage of this paradigm is that the construction of bicliques for many rounds is very difficult.Therefore, we are limited in the total number of rounds that we can attack.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“that the local collision approach can facilitate an attack in the more practical and relevant single-key model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Secondly, the attack gets a compact and small description, since the independent trails are generally short and self-explaining.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our second paradigm lets the attacker exploit the diffusion properties rather than differential, and does not aim to construct the longest biclique.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The advantage comes from the fact that in case of high dimension the basic computation has negligible cost, and the full complexity is determined by the amount of precomputation.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast, it proposes to construct shorter bicliques with high dimension by tools like independent related-key differentials (Section 3.1).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We checked the distribution of super-box output differences.We checked that it is random enough where we require randomness, though some non-random behavior was detected and might be important for constructing bicliques of high dimension over super-boxes.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified all truncated differentials through 8-round and 10-round AES-128 key-schedules, and through 9-round AES-256 key-schedule.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The attacks with independent bicliques -which lead to the key recovery for the full AES -allow us to be very precise about the required computations.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“For the attacks with long bicliques, whenever it is difficult to be precise about certain parts of our estimates, we choose to be conservative, potentially resulting in an underestimate of the claimed improvement.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Whereas using key-schedule properties in related-key attacks is natural, there seem only a few examples in the literature where this is used in the arguably more relevant single-key setting.This includes the attack on the self-synchronized stream cipher Moustique [28], the lightweight block cipher KTANTAN [12], and recent improvements upon attacks on 8-rounds of AES-192 and AES-256 [20].”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Not checked — no full text of the sourcecites [28] Guo, J., Ling, S., Rechberger, C., Wang, H.: Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 56–75. Springer, Heidelberg (2010) source
- Not checked yetcites [12] Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique Cryptanalysis of the Full AES. Cryptology ePrint Archive, Report 2011/449 (2011), http://eprint.iacr.org/2011/449
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We implemented the technically most complex part of one of our attacks: the long-biclique construction (for the AES-256 attack).”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The AES-128 key schedule bijectively maps each key to subkey $8.
“Since the AES-128 key schedule bijectively maps each key to $8, the enumeration is well-defined.”
The paper relies on this without support.
The AES-192 key schedule bijectively maps each key to $9||$10 L.
“Since the AES-192 key schedule bijectively maps each key to $9||$10 L , the enumeration is well-defined.”
The paper relies on this without support.
The AES-256 key schedule bijectively maps each key to $12||$13.
“Since the AES-256 key schedule bijectively maps each key to $12||$13, the enumeration is well-defined.”
The paper relies on this without support.
No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
“To the best of our knowledge, there are no generic methods known that would speed-up key-recovery attacks given a part of the codebook.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 14.64 | 2 8 | 2 254.64”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“C i = f K[i,j] (S j ) for all i, j ∈ {0, . . . , 2 d -1}.(1)”
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“In other words, in a biclique, the key K[i, j] maps the internal state S i to the ciphertext C j and vice versa.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 13.68 | 2 8 | 2 189.68”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
Citations
Cites
Lecture Notes in Computer Science 1205
(1999) · Industrial Robot the international journal of robotics research and application · doi:10.1108/ir.1999.04926fae.001 · Cited by 39,228
Differential cryptanalysis of DES-like cryptosystems
Biham, E., & Shamir, A. (1991) · Journal of Cryptology · doi:10.1007/bf00630563 · Cited by 2,914
The design of Rijndael AES - the advanced encryption standard
Daemen, J., & Rijmen, V. (2002) · Cited by 2,876
Linear Cryptanalysis Method for DES Cipher
Matsui, M. (1994) · Lecture Notes in Computer Science · doi:10.1007/3-540-48285-7_33 · Cited by 2,748
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437
How to Break MD5 and Other Hash Functions
Wang, X., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11426639_2 · Cited by 1,465
Finding Collisions in the Full SHA-1
Wang, X., Yin, Y. L., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11535218_2 · Cited by 1,442
Daemen, J., Knudsen, L. R., & Rijmen, V. (1997) · Lecture notes in computer science · doi:10.1007/bfb0052343 · Cited by 726
Differential Cryptanalysis of DES-like Cryptosystems
Biham, E., & Adi Shamir, Z. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_1 · Cited by 660
Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48519-8_12 · Cited by 607
Research works printed but not linked: 1
- Bahrak, B., Aref, M.R.: A Novel Impossible Differential Cryptanalysis of AES. In: Lucks, S., Sadeghi, A.-R., Wolf, C. (eds.) WEWoRC 2007. LNCS, vol. 4945, pp. 152–156. Springer, Heidelberg (2008)
Cited by
Sorted by citations
Items 201–300 of 546
Bad Directions in Cryptographic Hash Functions
Bernstein, D. J., Hülsing, A., Lange, T., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-19962-7_28 · Cited by 10
“5 rounds, by shortcircuit evaluation and early aborts”), [29] (“biclique” attacks against various hash functions), and [13] (“biclique” attacks against AES).”
Generic MitM Attack Frameworks on Sponge Constructions
Dong, X., Zhao, B., Qin, L., Hou, Q., Zhang, S., & Wang, X. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68385-5_1 · Cited by 10
Altigani, A., Hasan, S., Shamsuddin, S. M., et al. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.03.013 · Cited by 10
Attacks and countermeasures on AES and ECC
Tange, H., & Andersen, B. (2013) · Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) · Cited by 10
Biclique‐based cryptanalysis of the block cipher SQUARE
Mala, H. (2014) · IET Information Security · doi:10.1049/iet-ifs.2011.0332 · Cited by 10
What is the effective key length for a block cipher: an attack on every practical block cipher
Huang, J., & Lai, X. (2014) · Science China Information Sciences · doi:10.1007/s11432-014-5096-6 · Cited by 10
New Results in Related Key Impossible Differential Cryptanalysis on Reduced Round AES-192
Jithendra, K. B., & Shahana, T. K. (2018) · 2018 International Conference On Advances in Communication and Computing Technology (ICACCT) · doi:10.1109/icacct.2018.8529666 · Cited by 10
“The biclique cryptanalysis [10] successfully retrieves the key bytes for full rounds of AES but with a very high computational complexity.”
Method“S-Box” Implementation of AES Is Not Side Channel Resistant
Ashokkumar, C., Roy, B., Venkatesh, M. B. S., et al. (2019) · Journal of Hardware and Systems Security · doi:10.1007/s41635-019-00082-w · Cited by 10
On Some Symmetric Lightweight Cryptographic Designs
Ågren, M. (2012) · Lund University Publications (Lund University) · Cited by 10
Cryptanalysis of hardware-oriented ciphers the Knapsack generator, and SHA-1
Knellwolf, S. (2012) · Repository for Publications and Research Data (ETH Zurich) · doi:10.3929/ethz-a-007554419 · Cited by 10
“Applications include key recovery attacks on AES [23] and preimage attacks on reduced variants of the SHA-3 finalist Skein and members of the SHA-2 family [63].”
BackgroundMethodSieve-in-the-Middle: Improved MITM Attacks (Full Version)
Canteaut, A., Naya‐Plasencia, M., & Vayssière, B. (2013) · HAL · Cited by 10
Layout Graphs, Random Walks and the t-Wise Independence of SPN Block Ciphers
Liu, T., Pelecanos, A., Tessaro, S., et al. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-38548-3_23 · Cited by 9
Automated Meet-in-the-Middle Attack Goes to Feistel
Hou, Q., Dong, X., Qin, L., Zhang, G., & Wang, X. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8727-6_13 · Cited by 9
“Algorithm 3: Preimage Attack on 11-round Simpira-4 1 for à (6) MC1∥C̃ (6) MC1 [1, 6, 11, 12]∥C̃ (7) MC1 ∈ G /* |G| = 2(32) */ 2 do 3 for gr ∈ F(32) 2 do 4 V ← [ ] 5 for vR ∈ F20×8 2 in à (7) MC1[0-2, 5-8, 10-13, 15] and C̃ (6) MC1 [2-4, 7-9, 13, 14] do 6 Compute the cells in à (7) SR2 from à (7) MC1 7 Let à (7) SR2[i]…”
MethodComparative study of some symmetric ciphers in mobile systems
Jasim, K. F., & Alshaikhli, I. F. T. (2014) · doi:10.1109/ict4m.2014.7020587 · Cited by 9
Simple AEAD Hardware Interface (SÆHI) in a SoC
Saarinen, M.-J. O. (2014) · Workshop on Trustworthy Embedded Devices · doi:10.1145/2666141.2666144 · Cited by 9
Non-isomorphic biclique cryptanalysis of full-round Crypton
Shakiba, M., Dakhilalian, M., & Mala, H. (2015) · Computer Standards & Interfaces · doi:10.1016/j.csi.2015.02.002 · Cited by 9
“This technique was the first cryptanalysis method which is able to break full-round AES in a single key mode [17].”
BackgroundMethodMulti-Level Chaotic Maps for 3D Textured Model Encryption
Jin, X., Zhu, S., Wu, L., et al. (2019) · EAI/Springer Innovations in Communication and Computing · doi:10.1007/978-3-030-17763-8_10 · Cited by 9
“< μ, μ ≤ 4, x 0 , x 0 ∈ [0, 1]”
BackgroundMultiple Impossible Differentials Attack on AES-192
Jiang, Z., Jin, C., & Wang, Z. (2019) · IEEE Access · doi:10.1109/access.2019.2942960 · Cited by 9
Achieving M2M-device authentication through heterogeneous information bound with USIM card
Yang, T.-W., Ho, Y.-H., & Chou, C. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.10.042 · Cited by 9
TrustNet: Ensuring Normal-world and Trusted-world CAN-bus Networking
Kornaros, G., Bakoyiannis, D., Tomoutzoglou, O., Coppola, M., & Gherardi, G. (2019) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2019.8909715 · Cited by 9
“, [7] used biclique techniques to make key recovery attacks on full AES-128 with a marginal time complexity (2) over exhaustive search.”
MethodHighly secure communication service architecture using SDN switch
Furukawa, M., Kuroda, K., Ogawa, T., et al. (2015) · Asia-Pacific Symposium on Information and Telecommunication Technologies · doi:10.1109/apsitt.2015.7217098 · Cited by 9
“As the number of divisions and duplications is adjustable, it is possible to strengthen the security level according to user requests.”
BackgroundRevisiting key schedule’s diffusion in relation with round function’s diffusion
Huang, J., & Lai, X. (2013) · Designs Codes and Cryptography · doi:10.1007/s10623-013-9804-9 · Cited by 9
“A poor key schedule can break a perfectly good cipher [1,6,10,33,34].”
BackgroundsPECTRA: A precise framEwork for analyzing CrypTographic vulneRabilities in Android apps
Gajrani, J., Tripathi, M., Laxmi, V., Gaur, M. S., Conti, M., & Rajarajan, M. (2017) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc.2017.7983245 · Cited by 9
“In [19], researchers shown the first key recovery attack on full AES128 with computational complexity 2.”
BackgroundPersistent Fault Analysis with Few Encryptions
Carré, S., Guilley, S., & Rioul, O. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-68773-1_1 · Cited by 9
Too Much Crypto.Preprint
Aumasson, J.-P. (2019) · IACR Cryptology ePrint Archive · Cited by 9
Secret sharing scheme with dynamic size of shares for distributed storage system
Wang, B., Chen, J., Jia, S., et al. (2013) · Security and Communication Networks · doi:10.1002/sec.856 · Cited by 8
“It is reported that AES has been broken, which allows attackers to recover keys up to five times faster than brute-force [8].”
BackgroundBays, L. R., Oliveira, R. R., Buriol, L. S., et al. (2016) · Computer Communications · doi:10.1016/j.comcom.2016.02.007 · Cited by 8
FourierSAT: A Fourier Expansion-Based Algebraic Framework for Solving Hybrid Boolean Constraints
Kyrillidis, A., Shrivastava, A., Vardi, M. Y., et al. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i02.5515 · Cited by 8
“Non-CNF constraints are playing important roles in theoretical computer science and other engineering areas, e.g. , XOR constraints in cryptography [17] as well as cardinality constraints ( CARD ) and Not-all-equal ( NAE ) constraints in discrete optimization [18, 19].”
BackgroundOn Security of Key Derivation Functions in Password-based Cryptography
Kodwani, G., Arora, S., & Atrey, P. K. (2021) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr51186.2021.9527961 · Cited by 8
CryptAttackTester: high-assurance attack analysis
Bernstein, D. J., & Chou, T. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68391-6_5 · Cited by 10
A Message Authentication and Key Distribution Mechanism Secure Against CAN bus Attack
Cho, A.-R., Jo, H. J., Woo, S., Son, Y. D., & Lee, D. H. (2012) · 정보보호학회논문지 · Cited by 8
Kabir, K. S., Chakraborty, T., & Islam, A. B. M. A. A. (2016) · International Conference on Networking, Systems and Security (NSysS) · doi:10.1109/nsyss.2016.7400693 · Cited by 8
“Additionally, as our focus in this paper is on cryptography, we briefly present basics of quantum cryptography in this section.”
BackgroundAn Encryption Model for Data Processing in WSN
Elhoseny, M., & Hassanien, A. E. (2018) · Studies in systems, decision and control · doi:10.1007/978-3-319-92807-4_7 · Cited by 8
Barthe, G., Betarte, G., Campo, J. D., Luna, C., & Pichardie, D. (2020) · Journal of Automated Reasoning · doi:10.1007/s10817-020-09548-x · Cited by 8
“This assumption is widely used in the provable security analysis of schemes that build on AES, and best-known cryptanalyses on AES only marginally improve on brute force attacks (the estimated complexity of the biclique attack from [31] is 2126.”
MethodNew Biclique Cryptanalysis on Full-Round PRESENT-80 Block Cipher
Jithendra, K. B., & Shahana, T. K. (2020) · SN Computer Science · doi:10.1007/s42979-020-0103-z · Cited by 8
A Meet-in-the-Middle Attack on Round-Reduced mCrypton Using the Differential Enumeration Technique
Hao, Y., Bai, D., & Li, L. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-11698-3_13 · Cited by 8
“k0[2]|4,3,2 = k8[3]|3,2,1 (5) k0[6]|4,3,2 = k8[7]|3,2,1 (6) k0[6]|1 = k8[4]|4 (7) k0[14]|1 = k8[12]|4 (8)”
BackgroundInfluentialOn Multiple Symmetric Fixed Points in GOST
Courtois, N. T. (2015) · Cryptologia · doi:10.1080/01611194.2014.988362 · Cited by 8
“This is different from bicliques studied in cryptanalysis of AES [4], as our bicliques occur for one single key, and multiple connections on the graph mean that each pair is similar in the sense it shares a common substring of 50 bits.”
BackgroundNew security features in DLMS/COSEM — A comparison to the smart meter gateway
Hoffmann, S. G., Massink, R., & Bumiller, G. (2015) · IEEE Innovative Smart Grid Technologies-Asia · doi:10.1109/isgt-asia.2015.7387098 · Cited by 8
“AES is a secure [16] block cipher with an elegant structure that allows for a high-performace implementation both in Hard- and Software, see [17] for some benchmarks in comparison with other modern block ciphers.”
BackgroundThe DBlock family of block ciphers
Wu, W., Zhang, L., & Yu, X. (2015) · Science China Information Sciences · doi:10.1007/s11432-014-5219-0 · Cited by 8
Enhanced Cryptcoding: Joint Security and Advanced Dual-Step Quasi-Cyclic LDPC Coding
Pisek, E., Abu‐Surra, S., Taori, R., et al. (2015) · Globecom · doi:10.1109/glocom.2015.7417284 · Cited by 8
FPGA-Based High-Performance Computing Platform for Cryptanalysis of AES Algorithm
Zodpe, H. D., & Sapkal, A. M. (2019) · Advances in intelligent systems and computing · doi:10.1007/978-981-32-9515-5_60 · Cited by 8
STFTP: Secure TFTP Protocol for Embedded Multi-Agent Systems Communication
Horvat, G., Žagar, D., & Martinović, G. (2013) · Advances in Electrical and Computer Engineering · doi:10.4316/aece.2013.02004 · Cited by 8
Selective Authenticated Pilot Location Disclosure for Remote ID-enabled Drones
Tedeschi, P., Ganti, S. G., & Sciancalepore, S. (2024) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2024-0091 · Cited by 7
Hacking Cryptographic Protocols with Advanced Variational Quantum Attacks
Aizpurua, B., Bermejo, P., Martínez, J. E., & Orús, R. (2025) · ACM Transactions on Quantum Computing · doi:10.1145/3718349 · Cited by 13
Meet-in-the-Middle Preimage Attacks Revisited - New Results on MD5 and HAVAL
Sasaki, Y., Komatsubara, W., Sakai, Y., Wang, L., Iwamoto, M., Sakiyama, K., & Ohta, K. (2013) · International Conference on Security and Cryptography · doi:10.5220/0004521101110122 · Cited by 7
Generalized Meet in the Middle Cryptanalysis of Block Ciphers With an Automated Search Algorithm
Ahmadi, S., & Aref, M. R. (2019) · IEEE Access · doi:10.1109/access.2019.2962101 · Cited by 7
“ciphers such as [2]–[4], [13]–[15], [17], but, only some of them have automation approach just like generalized MITM attack.”
BackgroundDesign and Analysis of Logic Encryption Based 128-Bit AES Algorithm: A Case Study
Chhabra, S., & Lata, K. (2018) · IEEE India Council International Conference (INDICON) · doi:10.1109/indicon45594.2018.8987098 · Cited by 7
“Some of the attacks are Brute Force Attacks [11], Key-based Attacks [12], Biclique Attacks [13], Side-Channel Attacks [14] etc.”
BackgroundA Review on Evolution of Symmetric Key Block Ciphers and Their Applications
Tentu, A. N. (2020) · IETE Journal of Education · doi:10.1080/09747338.2020.1769508 · Cited by 7
“In this following, we present the generation of AES 8 × 8 S-box for illustration.”
InfluentialMeet-in-the-Middle Attacks on Reduced-Round Hierocrypt-3
Abdelkhalek, A., AlTawy, R., Tolba, M. F., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-22174-8_11 · Cited by 7
“x6[6, 10, 14] are other positions that would require the same number of key bytes.”
BackgroundMethodCryptanalysis of block cipher Piccolo suitable for cloud computing
Jeong, K. (2013) · The Journal of Supercomputing · doi:10.1007/s11227-013-0902-2 · Cited by 7
“In [1], two methods to construct bicliques were proposed.”
BackgroundMethodInfluentialBiclique key recovery for ARIA‐256
Chen, S., & Xu, T. (2014) · IET Information Security · doi:10.1049/iet-ifs.2012.0353 · Cited by 7
Moving Objects Encryption of High Efficiency Video Coding (HEVC) using AES Algorithm
Saleh, M. A., Tahir, N. M., & Hashim, H. (2016) · Journal of Telecommunication Electronic and Computer Engineering (JTEC) · Cited by 7
On determining optimal parameters for testing devices against laser fault attacks
Breier, J., & Chen, C.-N. (2016) · International Symposium on Integrated Circuits · doi:10.1109/isicir.2016.7829727 · Cited by 7
“I. INTRODUCTION When it comes to breaking the ciphers, there is a huge gap between theory and real world.”
BackgroundCryptanalytic Attacks on International Data Encryption Algorithm Block Cipher
Sahu, H. K., Jadhav, V., & Sonavane, S. P. (2016) · Cited by 7
Improved impossible differential and biclique cryptanalysis of HIGHT
Azimi, S. A., Ahmadi, S., Ahmadian, Z., et al. (2017) · International Journal of Communication Systems · doi:10.1002/dac.3382 · Cited by 7
“To do this test in an efficient way, we make use of the partial matching with pre-computation technique, used in Bogdanov et al, 19 which is a variant of Meet in the Middle attack and we will refer to that by MITM.”
BackgroundMethodAttacks and Defenses for Single-Stage Residue Number System PRNGs
Vennos, A., George, K. B., & Michaels, A. J. (2021) · IoT · doi:10.3390/iot2030020 · Cited by 7
“Though attacks now exist for AES (such as side-channel attacks and biclique attacks [5,6]), it is still deemed secure enough to encrypt top-secret information in the U.S. federal government [3,7].”
BackgroundAttack on AES Implementation Exploiting Publicly-visible Partial Result.Preprint
Diehl, W. (2017) · IACR Cryptology ePrint Archive · Cited by 7
A Survey on the Quantum Security of Block Cipher-Based Cryptography
Bootsma, S. E., & Vries, M. D. (2024) · IEEE Access · doi:10.1109/access.2024.3520364 · Cited by 6
Chaos-Based Interleave Division Multiple Access Scheme with Physical Layer Security
Okumura, M., Kaga, T., Okamoto, E., et al. (2021) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc49032.2021.9369489 · Cited by 6
“Because the security in the proposed scheme is ensured by the difficulty of having an identical common key, it is based on computational security [6].”
BackgroundShimeall, T. J., & Spring, J. (2013) · Elsevier eBooks · doi:10.1016/b978-1-59749-969-9.00008-0 · Cited by 10
Key Structures: Improved Related-Key Boomerang Attack Against the Full AES-256
Guo, J., Song, L., & Wang, H. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22301-3_1 · Cited by 7
“5 Besides those optimized brute-force style attacks, such as [12].”
BackgroundYan, S. Y. (2018) · Springer eBooks · doi:10.1007/978-3-319-72536-9_4 · Cited by 7
Direct construction of quasi-involutory recursive-like MDS matrices from 2-cyclic codes
Cauchois, V., Loidreau, P., & Merkiche, N. (2017) · IACR Transactions on Symmetric Cryptology · doi:10.46586/tosc.v2016.i2.80-98 · Cited by 6
Biclique Attack of Block Cipher SKINNY
Zheng, Y., & Wu, W. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-54705-3_1 · Cited by 6
Generating Dynamic Box by Using an Input String
Liu, J., Huang, Y., Leu, F., et al. (2018) · Communications in computer and information science · doi:10.1007/978-981-13-3732-1_2 · Cited by 6
Secure Framework for Internet of Things Based e-Health System
Bashir, A., & Mir, A. H. (2019) · International Journal of E-Health and Medical Communications · doi:10.4018/ijehmc.2019100102 · Cited by 6
Sutar, S., & Mekala, P. (2022) · INTERNATIONAL JOURNAL OF NEXT-GENERATION COMPUTING · doi:10.47164/ijngc.v13i1.424 · Cited by 6
Taming energy cost of disk encryption software on data-intensive mobile devices
Hu, Y., Lui, J. C. S., Hu, W., et al. (2017) · Future Generation Computer Systems · doi:10.1016/j.future.2017.09.025 · Cited by 6
“Biclique attack is a distinguished chosen-plaintext attac k that can theoretically attack full AES-128 with the computational complexity2 [37].”
BackgroundApproaching Encryption through Complex Number Logarithms
Stergiopoulos, G., Kandias, M., & Gritzalis, D. A. (2013) · International Conference on Security and Cryptography · doi:10.5220/0004604005740579 · Cited by 6
“We provide an implementation of a possible encryption method that utilises the 1-to-many relation found inside the properties of a complex logarithm.”
BackgroundMethodGreen Cryptanalysis: Meet-in-the-Middle Key-Recovery for the Full KASUMI Cipher ?
Jia, K., Rechberger, C., & Wang, X. (2013) · Cited by 6
Self-citationLighter, Faster, and Constant-Time: WhirlBob, the Whirlpool variant of StriBob.Preprint
Saarinen, M.-J. O., & Brumley, B. B. (2014) · IACR Cryptology ePrint Archive · Cited by 6
Abu-Ain, T., Ahmad, R., & Sundararajan, E. A. (2021) · Research Square · doi:10.21203/rs.3.rs-446269/v1 · Cited by 6
Speeding Up Preimage and Key-Recovery Attacks with Highly Biased Differential-Linear Approximations
Niu, Z., Hu, K. S., Sun, S., et al. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68385-5_3 · Cited by 5
Affine Cipher Encryption Technique Using Residue Number System
Kasianchuk, M. M., Shevchuk, R., Adamyk, B., Benson, V., Shylinska, I., & Holembiovskyi, M. (2025) · Cryptography · doi:10.3390/cryptography9020026 · Cited by 5
“According to [49,50], it is known that 2 n − 1 bit operations are required for cryptanalysis of the modern symmetric AES cryptographic algorithm with an n -bit key (the maximum key length of the AES algorithm is 256 bits). key length of the AES algorithm is 256 Then, due to the equality O ( n , k ,…”
A Fair Comparison Between Several Ciphers in Characteristics, Safety and Speed Test
Harmouch, Y., & Kouch, R. E. (2016) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-46568-5_54 · Cited by 5
Chaturvedi, S. P., Mukherjee, R., Kumar, S., et al. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3484394 · Cited by 5
Unbalanced Biclique Cryptanalysis of Full-Round GIFT
Han, G., Zhao, H., & Zhao, C. (2019) · IEEE Access · doi:10.1109/access.2019.2945006 · Cited by 5
“The detailed steps of the attack and the basic principle of the biclique attack are presented in [7].”
BackgroundImproving Data Security, Privacy, and Interoperability for the IEEE Biometric Open Protocol Standard
Filho, E. M. D. L., Filho, G. P. R., de Sousa, R. T., et al. (2020) · IEEE Access · doi:10.1109/access.2020.3046630 · Cited by 5
“Moreover, the computational cost effort for a biclique key recovery is over 2 250 -bit, under 14-rounds for 2 40 data, and a preimage attack, it is over 2 120 - bit, under 14-rounds [46]–[48].”
BackgroundImproved meet-in-the-middle attack on 10 rounds of the AES-256 block cipher
Lu, J., & Zhou, W. (2023) · Designs Codes and Cryptography · doi:10.1007/s10623-023-01323-4 · Cited by 5
Some aspects of practical implementation of AES 256 crypto algorithm
Orlic, V. D., Peric, M. V., Banjac, Z., et al. (2012) · Telecommunications Forum (TELFOR) · doi:10.1109/telfor.2012.6419278 · Cited by 5
Cryptography based on Color Substitution
Patil, D., Nayak, V., Sanghavi, A., et al. (2014) · International Journal of Computer Applications · doi:10.5120/15967-5355 · Cited by 5
“A newly discovered technique known as biclique cryptanalysis helps attackers to remove about two bits from 128-, 192-, and 256-bit keys and recover AES secret keys up to five times faster than previously possible [2].”
MethodSun, S., Hu, L., Qiao, K., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-22425-1_7 · Cited by 5
Taming Energy Cost of Disk Encryption Software on Data-Intensive Mobile Devices
Hu, Y., Lui, J. C. S., Hu, W., et al. (2016) · Procedia Computer Science · doi:10.1016/j.procs.2016.08.015 · Cited by 5
Dynamic embedding strategy of VQ-based information hiding approach
Huang, C.-T., Lin, L.-C., Yang, C.-H., et al. (2018) · Journal of Visual Communication and Image Representation · doi:10.1016/j.jvcir.2018.12.018 · Cited by 5
Fully encrypted high-speed microprocessor architecture: the secret computer in simulation
Breuer, P., & Bowen, J. P. (2019) · International Journal of Critical Computer-Based Systems · doi:10.1504/ijccbs.2019.098797 · Cited by 5
“Brute force key search for AES-128 has complexity 2126.1 operations using the bi-clique attack (Bogdanov et al., 2011), which is the best known.”
BackgroundInfluentialSuper-Linear Time-Memory Trade-Offs for Symmetric Encryption
Dai, W., Tessaro, S., & Zhang, X. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-64381-2_12 · Cited by 5
Dynamic Reduced-Round Cryptography for Energy-Efficient Wireless Communication of Smart IoT Devices
Lardier, W., Varo, Q., & Yan, J. (2020) · International Conference on Communications · doi:10.1109/icc40277.2020.9149305 · Cited by 5
“The most well-known attack against the full AES-128 is the Biclique attack led by A. Bogdanov et al. [19] which reduced the initial algorithmic Finally, these attacks do not completely compromise the security.”
BackgroundSecurity-Aware Design of Cyber-Physical Systems for Control Applications
Mahfouzi, R. (2021) · Linköping studies in science and technology. Dissertations · doi:10.3384/diss.diva-178320 · Cited by 5
Exploiting Short Application Lifetimes for Low Cost Hardware Encryption in Flexible Electronics
Bleier, N., Mubarik, M. H., Balaji, S., et al. (2023) · Design, Automation, and Test in Europe · doi:10.23919/date56975.2023.10137258 · Cited by 5
Lightweight encryption algorithm in wireless body area network for e-health monitoring
Alshamsi, A. Z., Barka, E. S., & Serhani, M. A. (2016) · International Conference on Innovations in Information Technology · doi:10.1109/innovations.2016.7880042 · Cited by 5
On-The-Fly Key Generation Based VLSI Implementation of Advanced Encryption Standard
Valasa, S., Avunoori, S., & Shinde, J. R. (2021) · International Conference on Communication and Electronics Systems (ICCES) · doi:10.1109/icces51350.2021.9489090 · Cited by 5
“It is hard to break the remaining 2 rounds in sufficient time to make the threat on the system relevant to the attacker [11].”
BackgroundSecurity Amplification against Meet-in-the-Middle Attacks Using Whitening
Fouque, P.-A., & Karpman, P. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-45239-0_15 · Cited by 5
“Again, this leads to more powerful attacks, and this technique has successfully been used to analyze several hash functions and block ciphers such as Skein [23], AES [7], or IDEA [22].”
MethodInfluentialMemoryless Unbalanced Meet-in-the-Middle Attacks: Impossible Results and Applications
Sasaki, Y. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-07536-5_16 · Cited by 5
Double-Hashing Operation Mode for Encryption
Almuhammadi, S., & Amro, A. (2017) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc.2017.7868481 · Cited by 5
Cryptanalysis of Hash Functions
Toz, D. (2013) · Lirias (KU Leuven) · Cited by 5
Ferguson, N., Schneier, B., & Kohno, T. (2015) · Wiley eBooks · doi:10.1002/9781118722367.ch4 · Cited by 6
A Key-Independent Distinguisher for 6-round AES in an Adaptive Setting.Preprint
Bardeh, N. G. (2019) · IACR Cryptology ePrint Archive · Cited by 5
A Comparative Evaluation of Symmetric Cryptography Algorithms for Resource-Constrained Devices
Ramalho, M., Sampaio, G., Neves, N., Porto, R., Sobral, V. A. M., Rezende, M., & Medeiros, D. S. V. (2025) · Journal of Internet Services and Applications · doi:10.5753/jisa.2025.4903 · Cited by 4
The McEliece Cryptosystem Based on the Redundant Residue Number System
Васильович, Я. В., Yatskiv, N., Ivasiev, S., Kulyna, S., Григорович, Ц. Т., & Yatskiv, I. (2025) · International Conference on Advanced Computer Information Technologies (ACIT) · doi:10.1109/acit65614.2025.11185887 · Cited by 4
Differential Sieving for 2-Step Matching Meet-in-the-Middle Attack with Application to LBlock
AlTawy, R., & Youssef, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-16363-5_8 · Cited by 4
“It is worth noting that most MitM attacks are low data complexity attacks except when used with bicliques [6], which represent a more formal description of the initial structure and can be constructed from related key differentials.”
BackgroundMethodResultInfluential
Metadata
- Authors
- Bogdanov, A., Khovratovich, D., & Rechberger, C.
- Affiliations
- KU Leuven (BE)
- Microsoft (United States) (US)
- Orange (France) (FR)
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Berlin Heidelberg
- Published
- 2011
- Volume
- 2011
- Pages
- 344-371
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W1515595447
- Cited by
- 546
- References
- 56
- Citations by year
- 2026: 9 · 2025: 15 · 2024: 23 · 2023: 25 · 2022: 22 · 2021: 36 · 2020: 33 · 2019: 41 · 2018: 29 · 2017: 36 · 2016: 38 · 2015: 71 · 2014: 53 · 2013: 54 · 2012: 55
- FWCI
- 42.07
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Licence
- other-oa
- Locations
- Lecture notes in computer science (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- IACR Cryptology ePrint Archive (submittedVersion)
- Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion)
- Funders
- European Commission
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Advanced Encryption Standard, AES-128, AES-192, AES-256, key recovery, block cipher cryptanalysis, compression function, Rijndael
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-23, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-23 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
