The DOI matches its Crossref record; 57 of the 57 references it cites were found in a registry or an index; 14 of the 32 sources its claims cite were checked for support.
Biclique Cryptanalysis of the Full AES
Open accessOverview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper introduces biclique cryptanalysis and presents the first key-recovery attacks on the full AES-128, AES-192, and AES-256 faster than brute force, with complexities \(2^{126.1}\), \(2^{189.7}\), and \(2^{254.4}\), respectively. The attacks are in the single-key model and, because of their high computational complexity, do not threaten practical AES use.
Key findings
- First key recovery on full AES-128 with complexity \(2^{126.1}\), full AES-192 with \(2^{189.7}\), and full AES-256 with \(2^{254.4}\); the paper reports an advantage of about a factor 3 to 5 over brute force depending on version.
- Reduced-round and hash-mode results include 8-round AES-128 at \(2^{124.9}\), 9-round AES-192 at \(2^{188.8}\), 9-round AES-256 at \(2^{251.92}\), and compression-function preimages for full AES-128 (Miyaguchi-Preneel) at \(2^{125.83}\), AES-192 (Davies-Meyer) at \(2^{125.71}\), and AES-256 (Davies-Meyer) at \(2^{126.35}\), with success rate 0.632 for the preimage attacks.
- The full-AES independent-biclique attacks use data complexities of \(2^{88}\), \(2^{80}\), and \(2^{40}\) plaintext-ciphertext pairs for AES-128, AES-192, and AES-256, respectively, with memory \(2^8\) and success probability 1.
- The attacks do not assume related keys; most need only a small part of the codebook, and the paper reports practical verification of truncated differentials and the long-biclique construction for AES-256.
Methods
- Biclique cryptanalysis partitions the key space into groups of \(2^{2d}\) keys indexed as \(K[i,j]\), constructs a \(d\)-dimensional biclique satisfying \(C_i = f_{K[i,j]}(S_j)\), and uses meet-in-the-middle/matching with precomputations to test \(2^{2d}\) keys with about \(2^d\) computations.
- Two paradigms are used: long bicliques for remaining rounds via dependent related-key differential trails, and independent bicliques via independent related-key differentials plus matching with precomputations; the latter yields the full-AES key-recovery attacks.
- The analysis is theoretical cryptanalysis of AES-128/192/256 and AES-based hash modes; complexity is evaluated by counting recomputed S-boxes, MixColumns operations, and key-schedule operations, with tables summarizing parameters and complexities.
Limitations
- The paper states that the attacks are of high computational complexity and “do not threaten the practical use of AES in any way.”
- The paper states that the long-biclique paradigm has very difficult biclique construction for many rounds, limiting the total number of rounds attacked, and that its data complexity can be very large.
- Evident from the text: practical verification is partial rather than a full attack run—the authors verified truncated differentials, implemented the technically most complex long-biclique construction for AES-256, and checked super-box output differences, but did not execute the full key-recovery attacks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
101 No basis given · 49 Own interpretation · 15 Own result · 8 Own method · 6 No full text of the sources · 3 Couldn’t confirm · 2 Supported · 2 Partly supported · 1 Supported so far · 1 Mixed support · 1 Not checked yet · accuracy not yet measured
Some cited sources support this claim and some don’t — read each source’s verdict below.
In the paper
“So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [8] Biryukov, A., Dunkelman, O., Keller, N., Khovratovich, D., Shamir, A.: Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 299–319. Springer, Heidelberg (2010) source
- Partly supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe the paper’s local-collision attacks on AES-192 and AES-256 as related-key attacks. Section 4.1 explains the related-key model used. The paper does not establish the broader claim that analysis of AES with local collisions is only applicable in that model; page numbers are unavailable in our copy. (LLM, conf=0.85)
- Disputedcites [10] Biryukov, A., Khovratovich, D., Nikolić, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 231–249. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
- Partly supportedcites [11] Biryukov, A., Nikolić, I.: Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 322–344. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction describes related-key differential analysis of AES, including characteristics used in an AES-256 attack. It does not identify that analysis as using local collisions or say that local-collision analysis of AES is only applicable in the related-key model. (LLM, conf=0.78)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)
- Could not verifycites [23] Dunkelman, O., Keller, N., Shamir, A.: A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 393–410. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction and Summary discuss related-key attacks on KASUMI, not the relative strength of single-key attacks on round-reduced AES. A reference lists a reduced-round AES attack, but our copy does not compare AES attacks with those proposed ten years earlier (searched for single-key AES attacks and that comparison). (LLM, conf=0.76)
- Not checked — no full text of the sourcecites [24] Dunkelman, O., Sekar, G., Preneel, B.: Improved Meet-in-the-Middle Attacks on Reduced-Round DES. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 86–100. Springer, Heidelberg (2007) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The sources with a verdict support this claim; the rest weren’t checked yet, have no full text we could read, or their verdicts aren’t rated yet.
In the paper
“With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) source
The Introduction identifies impossible differential cryptanalysis as the technique this paper applies to IDEA and Khufu, including its use for key elimination. The citation is attached to that method; the broader judgment about which methods are most powerful for AES is the citing authors’ framing, not a finding attributed specifically to this paper. (LLM, conf=0.87)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)
- Not checked — no full text of the sourcecites [14] Bouillaguet, C., Derbez, P., Fouque, P.-A.: Automatic Search of Attacks on Round-Reduced AES and Applications. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 169–187. Springer, Heidelberg (2011) source
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Also, as already observed in [19,37], the fact that the MixColumn transformation is omitted in the last round of AES helps to design attacks for more rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Partly supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) sourceExperimental — accuracy not yet measured
Section 2 (page unavailable) says that AES has no MixColumn operation in its final round. Section 5.2 (page unavailable) describes extending the attack to eight rounds by searching the last-round key, but does not say that omitting MixColumn enables the extension. The claimed causal link is therefore not established by our copy. (LLM, conf=0.83)
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-Preimage attacks on compression functions based on the full AES versions.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-256 with computational complexity 2 254.4 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-192 with computational complexity 2 189.7 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-128 with computational complexity 2 126.1 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We also provide complexities for finding compression function preimages for all full versions of AES when considered in hash mode.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 32
- It may state two separate claims as one. 34
- The quote only partly states this claim. 6
Every source the paper cites for this claim was checked and supports it.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) source
The Abstract states that the paper presents two related-key attacks on the full AES, one against AES-256 and the other against the full AES-192. The Introduction also explicitly describes attacks on both full variants. (LLM, conf=0.94)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“AES with its wide-trail strategy was designed to withstand differential and linear cryptanalyses [15], so pure versions of these techniques have limited applications in attacks.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [15] Chabaud, F., Joux, A.: Differential Collisions in SHA-0. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 56–71. Springer, Heidelberg (1998) sourceExperimental — accuracy not yet measured
The Conclusion discusses a differential attack on SHA-0 and the expansion of SHA-1, not AES. Searches for AES, Rijndael, the wide-trail strategy, and resistance to differential and linear cryptanalysis found no passage addressing the attributed claim in our copy. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) sourceExperimental — accuracy not yet measured
The Abstract and §1 Introduction describe impossible-differential attacks on IDEA and Khufu, not AES-128. Searches for a first 7-round AES-128 attack and its data complexity found no passage addressing that result; the 7-round impossible differential mentioned in §4 concerns DES. (LLM, conf=0.76)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“As a result, the number of rounds broken with this technique is rather small [19], which seems to prevent it from producing results on yet unbroken 8-, 9-, and 10-round (full) AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) source
The Abstract and Conclusion report meet-in-the-middle attacks on 7 rounds of AES-192 and up to 8 rounds of AES-256. The Introduction states that full AES-192 and AES-256 have 12 and 14 rounds, respectively, supporting the cited point that this technique breaks relatively few rounds. The sentence’s suggestion about future results is the citing authors’ inference, not a finding attributed to this source. (LLM, conf=0.91)
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The new approach originates from the so-called spliceand-cut framework [1,2,26] in the hash function cryptanalysis, more specifically its element called initial structure.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Partly supportedcites [1] Aoki, K., Sasaki, Y.: Preimage Attacks on One-Block MD4, 63-Step MD5 and More. In: Avanzi, R.M., Keliher, L., Sica, F. (eds.) SAC 2008. LNCS, vol. 5381, pp. 103–119. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
In the section introducing Technique 1: Splice-and-Cut (page not available), the paper proposes and explains the splice-and-cut technique for hash-function preimage attacks. Our copy does not call any element of that technique an “initial structure,” so it supports the framework connection but not that more specific attribution. (LLM, conf=0.84)
- Not checked — no full text of the sourcecites [2] Aoki, K., Sasaki, Y.: Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 70–89. Springer, Heidelberg (2009) source
- Not checked — no full text of the sourcecites [26] Gilbert, H., Minier, M.: A Collision Attack on 7 Rounds of Rijndael. In: AES Candidate Conference, pp. 230–241 (2000)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-Attacks with lower complexity on the reduced-round versions of AES not considered before, including an attack on 8-round AES-128 with complexity 2 124.9 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We have studied several block ciphers and hash functions, including different variants of AES, and it turns out that the optimal choice depends on a primitive, its diffusion properties, and features of the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 4 Two Paradigms of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacks with lowest computational complexities follow the paradigm of independent bicliques and have success rate 1.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For longer keys some bicliques are filtered out.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Regarding the forward direction, the whitening subkeys $0 differ in 4 bytes only, which makes only four S-boxes to recompute.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-192 in Davies-Meyer mode requires about 2 125.71 computations, 2 8 memory, and has success rate 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our attack always outputs the right key as soon as it belongs to one of the quartets produced in the attack.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-192 yields a key recovery with computational complexity about 2 188.8 , data complexity 2 80 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i and j, respectively, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 3.4375 SubBytes operations (i.e., 55 S-boxes), 2.3125 MixColumns operations, and a negligible amount of XORs in the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference is no longer a linear function of j as it is in the computation of ←v , but still requires only three s-boxes in the key schedule to recompute.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The precomputation of about 2 d+1 matches allows for a significant complexity gain and is the major source of the computational advantage of our attacks on AES.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-128 in Miyaguchi-Preneel mode requires about 2 125.83 computations, 2 8 memory, and has a success probability of about 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher (there are 6.5 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the longer key, we are able to construct a biclique over 4-round f , so that S 0 = #17.”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is full, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($12 0 ) = ∆ K i ($12 12 ) and ∆ K i ($12 9 ) = ∆ K i ($12 13 ), we have the following property for the ciphertext bytes: C 0 = C 12 and C 9 = C 13 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 3,6,7,10 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The areas of internal states to be recomputed (with 13 S-boxes) are depicted in Figure 6.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 8-round AES-128 yields a key recovery with computational complexity about 2 125.34 , data complexity 2 88 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The success rate of the attack is 1, since we can generate many bicliques for each key group.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The data complexity is 2 120 since one ciphertext byte is always fixed.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Evidently, the groups do not intersect and cover the full key space.”
§ Biclique Cryptanalysis of the Full AES > Step 1.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We have four active S-boxes in round 6 and two active S-boxes in round 8.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For all versions of AES, the number of cryptanalyzed rounds did not increase since then (7 for AES-128, 8 for AES-192 and AES-256), only a decrease in the computational complexity of the key recovery was achieved.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“To construct longer bicliques, we drop the differential independency requirement imposed above and reduce the dimension of the resulting biclique.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The differential trails share some active nonlinear components now.This yields conditions on values that need to be satisfied in a biclique search.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the dimension is inevitably small due to the diffusion, then we use the second advantage: the biclique construction methods based on differential cryptanalysis of block ciphers and hash functions.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the ciphers with nonlinear key schedule, like AES and most AES candidates, this requirement is apparently strong.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We show how to carry over the concept of bicliques to block cipher cryptanalysis and get even more significant results, including the first key recovery method for the full AES faster than brute-force.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“A simple meet-in-the-middle attack requires only a single plaintext/ciphertext pair.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This paradigm is best suited for ciphers with diffusion that is slow with respect to r -m rounds, surprisingly, including AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The limited use of these attacks must be attributed to the requirement for large parts of the cipher to be independent of particular key bits.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Formally introduced in [29], bicliques led to the best preimage attacks on the SHA family of hash functions, including the attack on 50 rounds of SHA-512, and the first attack on a round-reduced Skein hash function.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The independency of the related-key differentials allows one to efficiently construct higherdimensional bicliques and simplifies the coverage of the key space with such bicliques.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Biclique cryptanalysis was first introduced for hash cryptanalysis [29].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, there is little evidence so far that carrying over these techniques to the most practical single-secret-key model is feasible.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity depends on the biclique construction procedure.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also from an information-theoretic point of view, bicliques of dimension 1 are likely to exist in a cipher, regardless of the number of rounds.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We stress here that whenever we speak of differences between keys, these describe differences inside the group of keys that are guessed.We never need access to decryptions under keys that are related by those differences, i.e. the attacks we describe are always in the single-key model.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, the construction of long bicliques of high dimension appears to be a very difficult task for primitives with fast diffusion [37].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [25] Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001) source
- Not checked — no full text of the sourcecites [30] Käsper, E., Rijmen, V., Bjørstad, T.E., Rechberger, C., Robshaw, M.J.B., Sekar, G.: Correlated Keystreams in Moustique. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 246–257. Springer, Heidelberg (2008) source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The disadvantage of this paradigm is that the construction of bicliques for many rounds is very difficult.Therefore, we are limited in the total number of rounds that we can attack.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“that the local collision approach can facilitate an attack in the more practical and relevant single-key model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Secondly, the attack gets a compact and small description, since the independent trails are generally short and self-explaining.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our second paradigm lets the attacker exploit the diffusion properties rather than differential, and does not aim to construct the longest biclique.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The advantage comes from the fact that in case of high dimension the basic computation has negligible cost, and the full complexity is determined by the amount of precomputation.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast, it proposes to construct shorter bicliques with high dimension by tools like independent related-key differentials (Section 3.1).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We checked the distribution of super-box output differences.We checked that it is random enough where we require randomness, though some non-random behavior was detected and might be important for constructing bicliques of high dimension over super-boxes.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified all truncated differentials through 8-round and 10-round AES-128 key-schedules, and through 9-round AES-256 key-schedule.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The attacks with independent bicliques -which lead to the key recovery for the full AES -allow us to be very precise about the required computations.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“For the attacks with long bicliques, whenever it is difficult to be precise about certain parts of our estimates, we choose to be conservative, potentially resulting in an underestimate of the claimed improvement.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Whereas using key-schedule properties in related-key attacks is natural, there seem only a few examples in the literature where this is used in the arguably more relevant single-key setting.This includes the attack on the self-synchronized stream cipher Moustique [28], the lightweight block cipher KTANTAN [12], and recent improvements upon attacks on 8-rounds of AES-192 and AES-256 [20].”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Not checked — no full text of the sourcecites [28] Guo, J., Ling, S., Rechberger, C., Wang, H.: Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 56–75. Springer, Heidelberg (2010) source
- Not checked yetcites [12] Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique Cryptanalysis of the Full AES. Cryptology ePrint Archive, Report 2011/449 (2011), http://eprint.iacr.org/2011/449
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We implemented the technically most complex part of one of our attacks: the long-biclique construction (for the AES-256 attack).”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The AES-128 key schedule bijectively maps each key to subkey $8.
“Since the AES-128 key schedule bijectively maps each key to $8, the enumeration is well-defined.”
The paper relies on this without support.
The AES-192 key schedule bijectively maps each key to $9||$10 L.
“Since the AES-192 key schedule bijectively maps each key to $9||$10 L , the enumeration is well-defined.”
The paper relies on this without support.
The AES-256 key schedule bijectively maps each key to $12||$13.
“Since the AES-256 key schedule bijectively maps each key to $12||$13, the enumeration is well-defined.”
The paper relies on this without support.
No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
“To the best of our knowledge, there are no generic methods known that would speed-up key-recovery attacks given a part of the codebook.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 14.64 | 2 8 | 2 254.64”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“C i = f K[i,j] (S j ) for all i, j ∈ {0, . . . , 2 d -1}.(1)”
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“In other words, in a biclique, the key K[i, j] maps the internal state S i to the ciphertext C j and vice versa.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 13.68 | 2 8 | 2 189.68”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
Citations
Cites
Lecture Notes in Computer Science 1205
(1999) · Industrial Robot the international journal of robotics research and application · doi:10.1108/ir.1999.04926fae.001 · Cited by 39,228
Differential cryptanalysis of DES-like cryptosystems
Biham, E., & Shamir, A. (1991) · Journal of Cryptology · doi:10.1007/bf00630563 · Cited by 2,914
The design of Rijndael AES - the advanced encryption standard
Daemen, J., & Rijmen, V. (2002) · Cited by 2,876
Linear Cryptanalysis Method for DES Cipher
Matsui, M. (1994) · Lecture Notes in Computer Science · doi:10.1007/3-540-48285-7_33 · Cited by 2,748
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437
How to Break MD5 and Other Hash Functions
Wang, X., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11426639_2 · Cited by 1,465
Finding Collisions in the Full SHA-1
Wang, X., Yin, Y. L., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11535218_2 · Cited by 1,442
Daemen, J., Knudsen, L. R., & Rijmen, V. (1997) · Lecture notes in computer science · doi:10.1007/bfb0052343 · Cited by 726
Differential Cryptanalysis of DES-like Cryptosystems
Biham, E., & Adi Shamir, Z. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_1 · Cited by 660
Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48519-8_12 · Cited by 607
Research works printed but not linked: 1
- Bahrak, B., Aref, M.R.: A Novel Impossible Differential Cryptanalysis of AES. In: Lucks, S., Sadeghi, A.-R., Wolf, C. (eds.) WEWoRC 2007. LNCS, vol. 4945, pp. 152–156. Springer, Heidelberg (2008)
Cited by
Sorted by citations
Items 301–400 of 546
Generalized MitM attacks on full TWINE
Tolba, M. F., & Youssef, A. (2015) · Information Processing Letters · doi:10.1016/j.ipl.2015.09.011 · Cited by 4
“The re-computation technique utilized in the biclique cryptanalysis [4] provides a natural solution to this problem; we compute and store the nibbles that depend on each subset, then nibbles that depend on more than one subsets are recomputed.”
MethodInfluentialShakiba, M., Dakhilalian, M., & Mala, H. (2014) · International Journal of Communication Systems · doi:10.1002/dac.2721 · Cited by 4
“Full-round Advanced Encryption Standard (AES) was the first block cipher analyzed by the biclique cryptanalysis method in a single key mode [9].”
BackgroundMethodSR3: secure resilient reputation-based routing
Altisen, K., Devismes, S., Jamet, R., et al. (2016) · Wireless Networks · doi:10.1007/s11276-016-1273-4 · Cited by 4
“Here, we use AES-128 [13], which outputs 128 bits”
BackgroundMethodNew results in biclique cryptanalysis of full round GIFT
Jithendra, K. B., & Kassim, S. T. (2021) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-189875 · Cited by 4
Improving Security in Optical Networks with Random Forwarding and Parallel Transmission
Engelmann, A., Zhao, S., & Jukan, A. (2014) · Globecom · doi:10.1109/glocom.2014.7417629 · Cited by 4
“, see [7], while encryption does not hide the identity of source and destination during encrypted communications.”
BackgroundMondal, S. K., Rahman, M., Sarkar, S., et al. (2023) · IACR Transactions on Symmetric Cryptology · doi:10.46586/tosc.v2023.i4.28-57 · Cited by 4
“…of these attacks include impossible differential [LDKK08], boomerang attack [Bir04], related-key boomerang attack [BK09], mixture-differential [Gra18], subspace attack [GRR16], yoyo [RBH17], biclique cryptanalysis [BKR11], truncated differentials [Knu94], integral cryptanalysis [DKR97], etc.”
BackgroundImproved preimage attacks on hash modes of 8-round AES-256
Hong, D., Kim, D.-C., Kwon, D., & Kim, J. (2015) · Multimedia Tools and Applications · doi:10.1007/s11042-015-2769-0 · Cited by 4
“’s bicliquebased preimage attack [7] on AES-256, which is applicable up to full rounds but has the computational complexity more than 2126.”
BackgroundLinear Distinguishers in the Key-less Setting: Application to PRESENT
Lauridsen, M. M., & Rechberger, C. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48116-5_11 · Cited by 4
“It will be interesting to see how this approach compares to other such methods [9,42].”
ResultSelf-citationWHIRLBOB, the Whirlpool Based Variant of STRIBOB
Saarinen, M.-J. O., & Brumley, B. B. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26502-5_8 · Cited by 4
“Indeed some of the more successful attacks on AES and Whirlpool have been based on their deep structural self-similarities and simplistic key schedules [14,15,17], so STRIBOBr1 may have some security advantages against “unknown” attacks.”
BackgroundBhaumik, R., Dutta, A., Guo, J., Jean, J., Mouha, N., & Nikolić, I. (2015) · Cited by 4
Secure algorithms for SAKA protocol in the GSM network
Saxena, N., & Chaudhari, N. S. (2017) · IFIP Wireless and Mobile Networking Conference (WMNC) · doi:10.1109/wmnc.2017.8248853 · Cited by 4
“However, previously a key recovery-based attack has been found on AES with partial rounds ([26]).”
BackgroundUnbalanced biclique cryptanalysis of a full round Midori
Han, G., Zhang, W., Xing, Z., et al. (2018) · IET Communications · doi:10.1049/iet-com.2018.5343 · Cited by 4
“We choose cells K[1], K[2] and K[4] as active keys.”
BackgroundMethodInfluentialAlgebraic properties of generalized Rijndael-like ciphers
Babinkostova, L., Bombardier, K. W., Cole, M. C., Morrell, T., & Scott, C. B. (2014) · journal of Groups complexity cryptology · doi:10.1515/gcc-2014-0004 · Cited by 4
“Since then there have been several other theoretical attacks on these versions of AES and AES-128 (see, e.g. [7]) as well as on reduced-round instances of these versions of AES (see, e.g. [21]).”
BackgroundQuantum Demiric-Selcuk Meet-in-the-Middle Attacks on Reduced-Round AES
Wang, P., Chen, X., & Jiang, G. (2022) · International Journal of Theoretical Physics · doi:10.1007/s10773-022-05003-2 · Cited by 4
“Other ideas are the impossible differential attack [9–11], the Bicliques attack [12] that can attack the full of AES, and the attack that uses the multiple-of-8 AES [13, 14].”
BackgroundThe First Biclique Cryptanalysis of Serpent-256
de Carvalho, G. C., & Kowada, L. A. B. (2020) · doi:10.5753/sbseg.2020.19225 · Cited by 4
“We presented here two attacks to the full round Serpent-256 using the same method applied to Rijindael [Bogdanov et al. 2011], since both ciphers are similar in many ways.”
BackgroundMethodInfluentialIoETTS: A Decentralized Blockchain-based Trusted Time-stamping Scheme for Internet of Energy
Qian, B. Q. B., Qian, Y. L. B., Luo, J. O. Y., et al. (2023) · 網際網路技術學刊 · doi:10.53106/160792642023032402027 · Cited by 4
Meet-in-the-middle attacks on AES with value constraints
Dong, X., Liu, J., Wei, Y., Gao, W., & Chen, J. (2024) · Designs Codes and Cryptography · doi:10.1007/s10623-024-01396-9 · Cited by 4
Finding Impossible Differentials for Rijndael-like and 3D-like Structures
Cui, T., & Jin, C. (2013) · KSII Transactions on Internet and Information Systems · doi:10.3837/tiis.2013.03.006 · Cited by 4
“Although impossible differential cryptanalysis does not give the best attack on these two ciphers[18,16], impossible differential properies still need to be sufficiently considered.”
BackgroundBiclique Cryptanalysis on the Full Crypton-256 and mCrypton-128
Song, J., Lee, K., & Lee, H. (2014) · Journal of Applied Mathematics · doi:10.1155/2014/529736 · Cited by 4
“In this paper, we focus on the first of two methods, to construct biclique as described in [8].”
MethodA New Design of Cryptographic Hash Function: Gear
Alkandari, A. M., Alkandari, K. I., Alshaikhli, I. F. T., & AlAhmad, M. A. (2016) · International Journal on Perceptive and Cognitive Computing · doi:10.31436/ijpcc.v1i1.14 · Cited by 4
“…to point out that the deviation “significantly lower” from “lower” is introduced to annulate the analysis based on the recently discovered bicliques[7] – the latest results suggest that such analytical results are most likely applicable to all cryptographic primitives, thus one cannot expect the…”
BackgroundStrong Security Measures Implemented in ISA100.11a Wireless System
北野, 欽., & Yamamoto, S. (2014) · Cited by 4
The New Approach of AES Key Schedule for Lightweight Block Ciphers
Pehli̇vanoğlu, M. K., Sakallı, M. T., Duru, N. J., & Sakallı, F. B. (2017) · IOSR Journal of Computer Engineering · doi:10.9790/0661-1903042126 · Cited by 4
“The first key recovery attacks on the full keys AES-128, AES192, AES-256 given in [27].”
BackgroundLinear Cryptanalysis Reduced Round of Piccolo-80
Ashur, T., Dunkelman, O., & Masalha, N. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-20951-3_2 · Cited by 4
“Biclique cryptanalysis [6] of the full Piccolo-80 without postwhitening keys and a 28-round Piccolo-128 without prewhitening keys was introduced in [18].”
MethodSecurity analysis for pseudo-random number generators
Ruhault, S. (2015) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 4
Systematic Literature Review of Security Schemes for Data Exchange in Wireless Sensor NetworkPreprint
Ali, S., Ashraf, H., Ullah, A., et al. (2024) · doi:10.36227/techrxiv.170492367.76189095/v1 · Cited by 4
A New Design of Substitution Box with Ideal Strict Avalanche Criterion
Esa, N. F. M., Abdul‐Latip, S. F., & Abu, N. A. (2022) · Malaysian Journal of Mathematical Sciences · doi:10.47836/mjms.16.4.04 · Cited by 3
Cryptanalysis of full round FUTURE with multiple biclique structures
Roy, H. S., Dey, P., Mondal, S. K., et al. (2023) · Peer-to-Peer Networking and Applications · doi:10.1007/s12083-023-01600-y · Cited by 3
“…S r If the trails of Δ i -differentials do not share active non-linear components (such as active S-boxes) with the trails of ∇ j -dif- ferentials [2, 22], then we have the biclique k [ i , j ] In this case k [0, 0] is said to be the base key and S r 0 is said to be the base computation for the…”
Cryptanalysis of AES and Camellia with Related S-boxes
Macchetti, M. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38553-7_12 · Cited by 3
“We also note that the recent biclique attacks which have been shown to work on the full AES [8] and are the most successful attack to date, combine the biclique concept with the use of meet-in-the-middle structures, for which known differentials must be used.”
BackgroundPractically secure update of scrambling scheme
Ogawa, K., & Inoue, T. (2015) · IEEE International Symposium on Broadband Multimedia Systems and Broadcasting (BMSB) · doi:10.1109/bmsb.2015.7177195 · Cited by 3
“(In the following, we use the words ‘encryption and decryption’ instead of ‘scrambling and descrambling’) If a cryptanalysis is developed [1], [2], [3], the scheme and the decryption modules should be updated.”
BackgroundMethodOn the specification of symmetric key management parameters for secure space missions
Juliato, M., Gebotys, C. H., & Sanchez, I. (2012) · IEEE AESS European Conference on Satellite Telecommunications · doi:10.1109/estel.2012.6400149 · Cited by 3
“efficient technique based on bicliques is proposed in [17].”
MethodA note on an infeasible linearization of some block ciphers
Aragona, R., Rimoldi, A., & Sala, M. (2018) · Journal of Discrete Mathematical Sciences and Cryptography · doi:10.1080/09720529.2016.1197598 · Cited by 3
“It represents the state-of-the-art in block cipher design and the only known attack on its full version is the biclique attack [4], which still requires an amount of cryptanalytic effort slightly less than the brute-force key-search.”
BackgroundLayer-2 security for PLC - a comparison between ITU-T G.9903 and IEEE 1901.2
Hoffmann, S. G. (2016) · International Symposium on Power Line Communications and Its Applications · doi:10.1109/isplc.2016.7476278 · Cited by 3
“Both standards use AES, which can be considered to be secure [27].”
BackgroundOn Forging SPHINCS$$^{+}$$-Haraka Signatures on a Fault-Tolerant Quantum Computer
Berger, R., & Tiepelt, M. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88238-9_3 · Cited by 4
Tillah, A. M., Ogi, D., Febriyanto, M., et al. (2021) · International Workshop on Big Data and Information Security (IWBIS) · doi:10.1109/iwbis53353.2021.9631847 · Cited by 3
NEW KEY EXPANSION FUNCTION OF RIJNDAEL 128-BIT RESISTANCE TO THE RELATED-KEY ATTACKS
Hussien, H. M., Muda, Z., & Yasin, S. M. (2018) · Journal of Information and Communication Technology · doi:10.32890/jict2018.17.3.2 · Cited by 3
Generator sets for the selection of key differences in the Biclique Attack
de Carvalho, G. C., & Kowada, L. A. B. (2022) · doi:10.5753/sbseg.2022.224083 · Cited by 3
“The original attack, as presented by Bogdanov et al. [Bogdanov et al. 2011], is a d − dimension biclique.”
BackgroundMethodInfluentialNEW KEY EXPANSION FUNCTION OF RIJNDAEL 128-BIT RESISTANCE TO THE RELATED-KEY ATTACKS
Hussien, H. M., Muda, Z., & Yasin, S. M. (2018) · Journal of Information and Communication Technology · doi:10.32890/jict2018.17.3.2802 · Cited by 3
“In addition, the improvement for seven-, eight-, and twelve-round attacks on the 128-bit, 192-bit, and 256-bit key variants respectively was carried out on Rijndael based on the omission of MixColumns from the last round using the Biclique cryptanalysis in the Meet-in-the-middle Technique Attack (Bogdanov et al., 2011…”
BackgroundMethodInfluentialOn Continuous Local BDD-Based Search for Hybrid SAT Solving
Kyrillidis, A., Vardi, M. Y., & Zhang, Z. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16502 · Cited by 3
“Non-CNF constraints are playing important roles in computer science and other engineering areas, e.g. , XOR constraints in cryptography [20], as well as Pseudo-Boolean constraints and Not-all-equal (NAE) constraints in discrete optimization [21, 22].”
BackgroundFast Software Encryption Attacks on AES
Gstir, D., & Schläffer, M. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38553-7_21 · Cited by 3
“To evaluate the biclique attack [3] in hardware, Bogdanov et al.”
BackgroundMethodBy-design vulnerabilities in the ANSI C12.22 protocol specification
Rrushi, J. L., Farhangi, H., Nikolic, R., et al. (2015) · ACM Symposium on Applied Computing · doi:10.1145/2695664.2695835 · Cited by 3
“Bogdanov et al. [3] devised a novel technique of block cipher cryptanalysis based on bicliques.”
MethodMultilaterally secure pervasive cooperation
Weber, S. G. (2012) · Journal of Ambient Intelligence and Smart Environments · doi:10.3233/ais-2012-0140 · Cited by 3
“In [26, 25], a key recovery attack on AES-128 with computational complexity 2126.”
Biclique cryptanalysis using balanced complete bipartite subgraphs
Gong, Z., Liu, S., Wen, Y., et al. (2016) · Science China Information Sciences · doi:10.1007/s11432-016-5540-x · Cited by 3
A 3D encryption with shifting mapping substitution mechanism
Huang, Y., Leu, F., You, I., et al. (2017) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc.2017.8013422 · Cited by 3
“It will be insecure in the near future since AES has been partially solved [6,7,8].”
BackgroundScrambled prime key encryption
Haidar, I. M., Haidar, A. M., & Haraty, R. A. (2018) · International Conference on Management of Digital EcoSystems (MEDES) · doi:10.1145/3281375.3281376 · Cited by 3
“However, the novel techniques using bicliques has led to a new cryptanalysis for AES [7].”
MethodJean, J., Nikolić, I., Peyrin, T., et al. (2013) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 3
Biclique Cryptanalysis of the Full-Round KLEIN Block Cipher.
Ahmadian, Z., Salmasizadeh, M., & Aref, M. R. (2013) · Cited by 3
An Efficient Parallel Implementation of Impossible-Differential Cryptanalysis for Five-Round AES-128
Pal, D., Agrawal, D., Das, A., & Chowdhury, D. R. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-35869-3_9 · Cited by 3
Improved Meet-in-the-Middle Attacks on Reduced-Round Tweakable Block Cipher Deoxys-BC
Li, M., & Chen, S. (2021) · The Computer Journal · doi:10.1093/comjnl/bxab076 · Cited by 3
Secure Data Sharing with Interplanetary File System for Pharmaceutical Data
Abraham, N., & Ramalakshmi, R. (2021) · Studies in computational intelligence · doi:10.1007/978-3-030-72236-4_11 · Cited by 3
Federated Learning is Better with Non-Homomorphic Encryption
Burlachenko, K., Alrowithi, A., Albalawi, F., & Richtárik, P. (2023) · doi:10.1145/3630048.3630182 · Cited by 5
Increased Safety of Data Transmission for "Smart" Applications in the Intelligent Transport Systems
Kamenchenko, S., & Grakovski, A. (2015) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-19216-1_18 · Cited by 3
Secure and Efficient IP Mobility Support for Aeronautical Communications
Bauer, C. (2013) · Repository KITopen (Karlsruhe Institute of Technology) · doi:10.5445/ksp/1000033939 · Cited by 3
Automated Techniques for Hash Function and Block Cipher Cryptanalysis
Doctoral, A. (2012) · Cited by 3
Post-quantum attacks against symmetric-key cryptography systems
Pham, T. M. P. (2024) · DR-NTU (Nanyang Technological University) · doi:10.32657/10356/174201 · Cited by 3
Security analysis of contactless communication protocols
Gérault, D. (2018) · doi:10.70675/79f468e5zf6faz490ezb058zfcf856e4dd5d · Cited by 3
Schwenk, J. (2022) · Information security and cryptography · doi:10.1007/978-3-031-19439-9_2 · Cited by 2
Extracts from the SHA-3 Competition
Rijmen, V. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-35999-6_6 · Cited by 2
Securing Communication in a Peer-to-Peer Messaging Middleware
Szilágyi, P. (2013) · International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC) · doi:10.1109/synasc.2013.50 · Cited by 2
“By applying a clever trick, these attacks can be circumvented without the need to pass the whole message payload through AES twice.”
BackgroundInfluentialA Scrambling Scheme Updating Method in Broadcasting Services
Ogawa, K., & Inoue, T. (2015) · The Journal of The Institute of Image Information and Television Engineers · doi:10.3169/itej.69.j344 · Cited by 2
Improved Key Recovery Attacks on Reduced-Round AES in the Single-Key Setting.
Derbez, P., Fouque, P.-A., & Jean, J. (2012) · Cited by 2
Chhabra, S., & Lata, K. (2022) · Security and Privacy · doi:10.1002/spy2.233 · Cited by 2
New Security Proofs and Complexity Records for Advanced Encryption Standard
Kara, O. (2023) · IEEE Access · doi:10.1109/access.2023.3335271 · Cited by 3
WAS: improved white-box cryptographic algorithm over AS iteration
Yang, Y., Zhai, Y., Dong, H. F., et al. (2023) · Cybersecurity · doi:10.1186/s42400-023-00192-7 · Cited by 2
Revisiting the Biclique Attack on the AES
de Carvalho, G. C., & Kowada, L. A. B. (2023) · doi:10.5753/sbseg.2023.232855 · Cited by 2
Square impossible differential attack and security of AES in known plaintext scenario
Kara, O. (2024) · Cryptologia · doi:10.1080/01611194.2024.2320362 · Cited by 2
“…et al., 2010; 2015; Derbez et al., 2013; Li et al., 2014; Wang and Zhu, 2017), square attacks (e.g., Ferguson et al., 2000), biclique attacks (e.g., Bogdanov et al., 2011; Tao and Wu, 2015), algebraic attacks (e.g., Courtois and Pieprzyk, 2002), mixture differential attacks (e.g., Grassi, 2019),…”
Secure Lightweight Data Communication Between the IoT Devices and Cloud Service
Phuong, T. V. X., Le, T. T. N., & Ngoc, H. L. (2024) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-3-031-57853-3_34 · Cited by 2
Secure Archival is Hard... Really Hard
Smith, C., Tabassum, M., Daruru, S. C., Kulhare, G., Wang, A., Miller, E. L., & Zadok, E. (2024) · ACM Workshop on Hot Topics in Storage and File Systems (HotStorage) · doi:10.1145/3655038.3666093 · Cited by 2
“…assumes the hardness of factoring RSA moduli [54], several post-quantum cryptographic schemes assume the hardness of the Module Learning with Errors (MLWE) problem [11], and AES is simply assumed to be secure because two decades of cryptanalysis have failed to produce practical attacks [9].”
BackgroundIn-memory encryption using the advanced encryption standard
Kovats, T., Rameshan, N., Karunaratne, K. G., Giannopoulos, I., & Sebastian, A. (2025) · Philosophical Transactions of the Royal Society A Mathematical Physical and Engineering Sciences · doi:10.1098/rsta.2023.0396 · Cited by 2
“Originally submitted by Rijndael et al . in 1997 to the NIST standardization process for cryptography, AES has since been the standard algorithm for symmetric key encryption [14,15].”
A novel scheme to encrypting autonomous driving scene point clouds based on optical chaos
Ye, S., Li, L., Liu, Y., et al. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104166 · Cited by 2
Cracking the Anonymous IoT Routing Networks: A Deep Learning Approach
Bansal, G., Chamola, V., Hussain, A., et al. (2023) · IEEE Internet of Things Magazine · doi:10.1109/iotm.001.2200194 · Cited by 2
Towards an augmented authenticator in the Cloud
Pitropakis, N., Yfantopoulos, N., Geneiatakis, D., & Lambrinoudakis, C. (2014) · IEEE International Symposium on Signal Processing and Information Technology (ISSPIT) · doi:10.1109/isspit.2014.7300603 · Cited by 2
Security analysis of CLEFIA-128
Ahmadi, S., Delavar, M., Mohajeri, J., & Aref, M. R. (2014) · International ISC Conference on Information Security and Cryptology (ISCISC) · doi:10.1109/iscisc.2014.6994027 · Cited by 2
New criterion for diffusion property and applications to improved GFS and EGFN
Wang, Y., & Wu, W. (2015) · Designs Codes and Cryptography · doi:10.1007/s10623-015-0161-8 · Cited by 2
“Similar to the biclique cryptanalysis [21], searching for the best sliced-biclique attack on hash function is a time-consuming process.”
BackgroundImproving Security in Optical Networks with Random Forwarding and Parallel Transmission
Engelmann, A., Zhao, S., & Jukan, A. (2015) · Globecom · doi:10.1109/glocom.2015.7417629 · Cited by 2
A novel key scheduling scheme for AES algorithm
Hu, Z., & Xiong, K. J. (2016) · Wuhan University Journal of Natural Sciences · doi:10.1007/s11859-016-1145-x · Cited by 2
Analysis of Confidentiality Algorithms in Different Mobile Generations
Jasim, K. F., & Alshaikhli, I. F. T. (2017) · Cihan University-Erbil Scientific Journal · doi:10.24086/cuesj.si.2017.n1a11 · Cited by 2
Chaskey: a Lightweight MAC Algorithm for Microcontrollers
Mouha, N. (2015) · HAL · Cited by 2
Low-Data Complexity Attacks on Camellia
Koie, T., Isobe, T., Todo, Y., et al. (2017) · Communications in computer and information science · doi:10.1007/978-981-10-5421-1_11 · Cited by 2
New Results in Reduced Round AES - 256 Impossible Differential Cryptanalysis
Jithendra, K. B., Shahana, T. K., & Lacy, F. (2020) · International Journal of Computing and Digital Systems · doi:10.12785/ijcds/090422 · Cited by 2
“applied biclique attack on full round AES [9].”
MethodMultidimensional Meet-in-the-Middle Attack and Its Applications to KATAN32/48/64
Zhu, B., & Gong, G. (2011) · Cited by 2
Key‐dependent side‐channel cube attack on CRAFT
Pang, K., & Abdul‐Latip, S. F. (2021) · ETRI Journal · doi:10.4218/etrij.2019-0539 · Cited by 2
Statistics on Encrypted Cloud Data
Tseng, F.-K., Liu, Y.-H., Chen, R.-J., et al. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-41383-4_9 · Cited by 2
“The recovery of AES-128 key requires a computational complexity of 2 which is computation-infeasible [25].”
BackgroundA new data hiding method via revision history records on collaborative writing platforms
Lee, Y.-L., & Tsai, W. (2014) · ACM Transactions on Multimedia Computing Communications and Applications · doi:10.1145/2534408 · Cited by 2
“The Advanced Encryption Standard (AES) is one of the most popular ciphers and provides very high security; the public known attacks up to now have all been shown to be computational infeasible [Bogdanov et al. 2011; Biryukov and Khovratovich 2009].”
BackgroundTwo Kinds of Biclique Attacks on Lightweight Block Cipher PRINCE.
Yuan, Z., Peng, Z., & Ou, H. (2015) · Cited by 2
Solving hybrid Boolean constraints in continuous space via multilinear Fourier expansions
Kyrillidis, A., Shrivastava, A., Vardi, M. Y., et al. (2021) · Artificial Intelligence · doi:10.1016/j.artint.2021.103559 · Cited by 2
“Non-CNF constraints are playing important roles in theoretical computer science and other engineering areas, e.g. , XOR constraints in cryptography [27] as well as cardinality constraints ( CARD ) and Not-All-Equal ( NAE ) constraints in discrete optimization [28,29 .”
BackgroundStudy and Design of Energy Efficient Block Cipher for Wireless Body Area Networks (WBANs)
Datta, N. N. (2018) · Cited by 2
Secured Traffic Monitoring in VANETPreprint
Roy, A., & Madria, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.10057 · Cited by 2
“51 pentaflops performing around 1000 checks per second approximately takes around 1 billion years to brute-force the key [29] while the biclique attack [30] requires a computational complexity of 2126.”
BackgroundKasianchuk, M. M., Karpiński, M., Кочан, Р. В., et al. (2020) · IACR Cryptology ePrint Archive · Cited by 2
Kumari, V. V., Reddy, B. D., & Raju, K. V. S. V. N. (2020) · doi:10.1109/hydcon48903.2020.9242820 · Cited by 1
Lightweight Security Protocols for Securing IoT Devices in Smart Cities
Joshi, M., Mazumdar, B., & Dey, S. (2021) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-030-72139-8_5 · Cited by 1
Improved Truncated Differential Distinguishers of AES with Concrete S-Box
Chang, C., Wang, M., Sun, L., & Wang, W. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22912-1_19 · Cited by 1
Improved Meet-in-the-Middle Attacks on Nine Rounds of the AES-192 Block Cipher
Lu, J., & Zhou, W. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-58868-6_6 · Cited by 1
Triangulating Meet-in-the-Middle Attack
Zhao, B., Hou, Q., Qin, L., & Dong, X. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-01901-1_9 · Cited by 1
BAKSHEESH: Similar Yet Different From GIFT (and ZORRO)
Baksi, A., Breier, J., Chattopadhyay, A., et al. (2026) · IACR Communications in Cryptology · doi:10.62056/ae890lmol · Cited by 1
Zhang, L., Yang, Y., Pang, K., et al. (2026) · Journal of Cloud Computing Advances Systems and Applications · doi:10.1186/s13677-026-00899-1 · Cited by 1
“However, cryptanalysis by Bogda-nov et al. showed that AES could be compromised using only one-fifth to one-third of the time required for brute-force attacks, implying that its security is not absolutely reliable [21].”
Polynomial-Advantage Cryptanalysis of 3D Cipher and 3D-Based Hash Function
Wang, L., Sasaki, Y., Sakiyama, K., et al. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34117-5_11 · Cited by 1
“Biclique attack on AES [5] is a typical polynomial-advantage attack.”
BackgroundMethodLim, H.-C., Park, T., & Kwon, G. (2012) · Journal of the Korea Society of Computer and Information · doi:10.9708/jksci/2012.17.10.079 · Cited by 1
“이러한 문제 해결을 위해 IEEE 802.15.4 MAC과 같은 표준 규격에서는 AES기반의 보안모 드를 지원한다.”
InfluentialIPSec Provisioning in WiMAX Networks to Enhance the Security
Shibi, S. R., Kaliappan, M., & Julus, L. J. (2012) · Cited by 1
Design and Analysis of a New Hash Function Gear
AlAhmad, M. A., & Alshaikhli, I. F. T. (2014) · International Conference on Security of Information and Networks (SIN) · doi:10.1145/2659651.2659652 · Cited by 1
“…to point out that the deviation “significantly lower” from “lower” is introduced to annulate the analysis based on the recently discovered bicliques[7] – the latest results suggest that such analytical results are most likely applicable to all cryptographic primitives, thus one cannot expect the…”
A Higher Order Key Partitioning Attack with Application to LBlock
AlTawy, R., Tolba, M. F., & Youssef, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-18681-8_17 · Cited by 1
“The absence of the biclique results in a low data complexity related key MitM attack in the single key setting in which the whole key space is searched efficiently through partial matching by recomputation [5].”
BackgroundMethodInfluential
Metadata
- Authors
- Bogdanov, A., Khovratovich, D., & Rechberger, C.
- Affiliations
- KU Leuven (BE)
- Microsoft (United States) (US)
- Orange (France) (FR)
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Berlin Heidelberg
- Published
- 2011
- Volume
- 2011
- Pages
- 344-371
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W1515595447
- Cited by
- 546
- References
- 56
- Citations by year
- 2026: 9 · 2025: 15 · 2024: 23 · 2023: 25 · 2022: 22 · 2021: 36 · 2020: 33 · 2019: 41 · 2018: 29 · 2017: 36 · 2016: 38 · 2015: 71 · 2014: 53 · 2013: 54 · 2012: 55
- FWCI
- 42.07
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Licence
- other-oa
- Locations
- Lecture notes in computer science (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- IACR Cryptology ePrint Archive (submittedVersion)
- Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion)
- Funders
- European Commission
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Advanced Encryption Standard, AES-128, AES-192, AES-256, key recovery, block cipher cryptanalysis, compression function, Rijndael
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-23, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-23 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
