The DOI matches its Crossref record; 57 of the 57 references it cites were found in a registry or an index; 14 of the 32 sources its claims cite were checked for support.
Biclique Cryptanalysis of the Full AES
Open accessOverview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper introduces biclique cryptanalysis and presents the first key-recovery attacks on the full AES-128, AES-192, and AES-256 faster than brute force, with complexities \(2^{126.1}\), \(2^{189.7}\), and \(2^{254.4}\), respectively. The attacks are in the single-key model and, because of their high computational complexity, do not threaten practical AES use.
Key findings
- First key recovery on full AES-128 with complexity \(2^{126.1}\), full AES-192 with \(2^{189.7}\), and full AES-256 with \(2^{254.4}\); the paper reports an advantage of about a factor 3 to 5 over brute force depending on version.
- Reduced-round and hash-mode results include 8-round AES-128 at \(2^{124.9}\), 9-round AES-192 at \(2^{188.8}\), 9-round AES-256 at \(2^{251.92}\), and compression-function preimages for full AES-128 (Miyaguchi-Preneel) at \(2^{125.83}\), AES-192 (Davies-Meyer) at \(2^{125.71}\), and AES-256 (Davies-Meyer) at \(2^{126.35}\), with success rate 0.632 for the preimage attacks.
- The full-AES independent-biclique attacks use data complexities of \(2^{88}\), \(2^{80}\), and \(2^{40}\) plaintext-ciphertext pairs for AES-128, AES-192, and AES-256, respectively, with memory \(2^8\) and success probability 1.
- The attacks do not assume related keys; most need only a small part of the codebook, and the paper reports practical verification of truncated differentials and the long-biclique construction for AES-256.
Methods
- Biclique cryptanalysis partitions the key space into groups of \(2^{2d}\) keys indexed as \(K[i,j]\), constructs a \(d\)-dimensional biclique satisfying \(C_i = f_{K[i,j]}(S_j)\), and uses meet-in-the-middle/matching with precomputations to test \(2^{2d}\) keys with about \(2^d\) computations.
- Two paradigms are used: long bicliques for remaining rounds via dependent related-key differential trails, and independent bicliques via independent related-key differentials plus matching with precomputations; the latter yields the full-AES key-recovery attacks.
- The analysis is theoretical cryptanalysis of AES-128/192/256 and AES-based hash modes; complexity is evaluated by counting recomputed S-boxes, MixColumns operations, and key-schedule operations, with tables summarizing parameters and complexities.
Limitations
- The paper states that the attacks are of high computational complexity and “do not threaten the practical use of AES in any way.”
- The paper states that the long-biclique paradigm has very difficult biclique construction for many rounds, limiting the total number of rounds attacked, and that its data complexity can be very large.
- Evident from the text: practical verification is partial rather than a full attack run—the authors verified truncated differentials, implemented the technically most complex long-biclique construction for AES-256, and checked super-box output differences, but did not execute the full key-recovery attacks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
101 No basis given · 49 Own interpretation · 15 Own result · 8 Own method · 6 No full text of the sources · 3 Couldn’t confirm · 2 Supported · 2 Partly supported · 1 Supported so far · 1 Mixed support · 1 Not checked yet · accuracy not yet measured
Some cited sources support this claim and some don’t — read each source’s verdict below.
In the paper
“So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [8] Biryukov, A., Dunkelman, O., Keller, N., Khovratovich, D., Shamir, A.: Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 299–319. Springer, Heidelberg (2010) source
- Partly supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe the paper’s local-collision attacks on AES-192 and AES-256 as related-key attacks. Section 4.1 explains the related-key model used. The paper does not establish the broader claim that analysis of AES with local collisions is only applicable in that model; page numbers are unavailable in our copy. (LLM, conf=0.85)
- Disputedcites [10] Biryukov, A., Khovratovich, D., Nikolić, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 231–249. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
- Partly supportedcites [11] Biryukov, A., Nikolić, I.: Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 322–344. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction describes related-key differential analysis of AES, including characteristics used in an AES-256 attack. It does not identify that analysis as using local collisions or say that local-collision analysis of AES is only applicable in the related-key model. (LLM, conf=0.78)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)
- Could not verifycites [23] Dunkelman, O., Keller, N., Shamir, A.: A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 393–410. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction and Summary discuss related-key attacks on KASUMI, not the relative strength of single-key attacks on round-reduced AES. A reference lists a reduced-round AES attack, but our copy does not compare AES attacks with those proposed ten years earlier (searched for single-key AES attacks and that comparison). (LLM, conf=0.76)
- Not checked — no full text of the sourcecites [24] Dunkelman, O., Sekar, G., Preneel, B.: Improved Meet-in-the-Middle Attacks on Reduced-Round DES. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 86–100. Springer, Heidelberg (2007) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The sources with a verdict support this claim; the rest weren’t checked yet, have no full text we could read, or their verdicts aren’t rated yet.
In the paper
“With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) source
The Introduction identifies impossible differential cryptanalysis as the technique this paper applies to IDEA and Khufu, including its use for key elimination. The citation is attached to that method; the broader judgment about which methods are most powerful for AES is the citing authors’ framing, not a finding attributed specifically to this paper. (LLM, conf=0.87)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)
- Not checked — no full text of the sourcecites [14] Bouillaguet, C., Derbez, P., Fouque, P.-A.: Automatic Search of Attacks on Round-Reduced AES and Applications. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 169–187. Springer, Heidelberg (2011) source
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Also, as already observed in [19,37], the fact that the MixColumn transformation is omitted in the last round of AES helps to design attacks for more rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Partly supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) sourceExperimental — accuracy not yet measured
Section 2 (page unavailable) says that AES has no MixColumn operation in its final round. Section 5.2 (page unavailable) describes extending the attack to eight rounds by searching the last-round key, but does not say that omitting MixColumn enables the extension. The claimed causal link is therefore not established by our copy. (LLM, conf=0.83)
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-Preimage attacks on compression functions based on the full AES versions.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-256 with computational complexity 2 254.4 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-192 with computational complexity 2 189.7 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-128 with computational complexity 2 126.1 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We also provide complexities for finding compression function preimages for all full versions of AES when considered in hash mode.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 32
- It may state two separate claims as one. 34
- The quote only partly states this claim. 6
Every source the paper cites for this claim was checked and supports it.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) source
The Abstract states that the paper presents two related-key attacks on the full AES, one against AES-256 and the other against the full AES-192. The Introduction also explicitly describes attacks on both full variants. (LLM, conf=0.94)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“AES with its wide-trail strategy was designed to withstand differential and linear cryptanalyses [15], so pure versions of these techniques have limited applications in attacks.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [15] Chabaud, F., Joux, A.: Differential Collisions in SHA-0. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 56–71. Springer, Heidelberg (1998) sourceExperimental — accuracy not yet measured
The Conclusion discusses a differential attack on SHA-0 and the expansion of SHA-1, not AES. Searches for AES, Rijndael, the wide-trail strategy, and resistance to differential and linear cryptanalysis found no passage addressing the attributed claim in our copy. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) sourceExperimental — accuracy not yet measured
The Abstract and §1 Introduction describe impossible-differential attacks on IDEA and Khufu, not AES-128. Searches for a first 7-round AES-128 attack and its data complexity found no passage addressing that result; the 7-round impossible differential mentioned in §4 concerns DES. (LLM, conf=0.76)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“As a result, the number of rounds broken with this technique is rather small [19], which seems to prevent it from producing results on yet unbroken 8-, 9-, and 10-round (full) AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) source
The Abstract and Conclusion report meet-in-the-middle attacks on 7 rounds of AES-192 and up to 8 rounds of AES-256. The Introduction states that full AES-192 and AES-256 have 12 and 14 rounds, respectively, supporting the cited point that this technique breaks relatively few rounds. The sentence’s suggestion about future results is the citing authors’ inference, not a finding attributed to this source. (LLM, conf=0.91)
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The new approach originates from the so-called spliceand-cut framework [1,2,26] in the hash function cryptanalysis, more specifically its element called initial structure.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Partly supportedcites [1] Aoki, K., Sasaki, Y.: Preimage Attacks on One-Block MD4, 63-Step MD5 and More. In: Avanzi, R.M., Keliher, L., Sica, F. (eds.) SAC 2008. LNCS, vol. 5381, pp. 103–119. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
In the section introducing Technique 1: Splice-and-Cut (page not available), the paper proposes and explains the splice-and-cut technique for hash-function preimage attacks. Our copy does not call any element of that technique an “initial structure,” so it supports the framework connection but not that more specific attribution. (LLM, conf=0.84)
- Not checked — no full text of the sourcecites [2] Aoki, K., Sasaki, Y.: Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 70–89. Springer, Heidelberg (2009) source
- Not checked — no full text of the sourcecites [26] Gilbert, H., Minier, M.: A Collision Attack on 7 Rounds of Rijndael. In: AES Candidate Conference, pp. 230–241 (2000)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-Attacks with lower complexity on the reduced-round versions of AES not considered before, including an attack on 8-round AES-128 with complexity 2 124.9 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We have studied several block ciphers and hash functions, including different variants of AES, and it turns out that the optimal choice depends on a primitive, its diffusion properties, and features of the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 4 Two Paradigms of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacks with lowest computational complexities follow the paradigm of independent bicliques and have success rate 1.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For longer keys some bicliques are filtered out.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Regarding the forward direction, the whitening subkeys $0 differ in 4 bytes only, which makes only four S-boxes to recompute.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-192 in Davies-Meyer mode requires about 2 125.71 computations, 2 8 memory, and has success rate 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our attack always outputs the right key as soon as it belongs to one of the quartets produced in the attack.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-192 yields a key recovery with computational complexity about 2 188.8 , data complexity 2 80 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i and j, respectively, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 3.4375 SubBytes operations (i.e., 55 S-boxes), 2.3125 MixColumns operations, and a negligible amount of XORs in the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference is no longer a linear function of j as it is in the computation of ←v , but still requires only three s-boxes in the key schedule to recompute.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The precomputation of about 2 d+1 matches allows for a significant complexity gain and is the major source of the computational advantage of our attacks on AES.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-128 in Miyaguchi-Preneel mode requires about 2 125.83 computations, 2 8 memory, and has a success probability of about 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher (there are 6.5 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the longer key, we are able to construct a biclique over 4-round f , so that S 0 = #17.”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is full, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($12 0 ) = ∆ K i ($12 12 ) and ∆ K i ($12 9 ) = ∆ K i ($12 13 ), we have the following property for the ciphertext bytes: C 0 = C 12 and C 9 = C 13 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 3,6,7,10 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The areas of internal states to be recomputed (with 13 S-boxes) are depicted in Figure 6.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 8-round AES-128 yields a key recovery with computational complexity about 2 125.34 , data complexity 2 88 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The success rate of the attack is 1, since we can generate many bicliques for each key group.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The data complexity is 2 120 since one ciphertext byte is always fixed.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Evidently, the groups do not intersect and cover the full key space.”
§ Biclique Cryptanalysis of the Full AES > Step 1.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We have four active S-boxes in round 6 and two active S-boxes in round 8.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For all versions of AES, the number of cryptanalyzed rounds did not increase since then (7 for AES-128, 8 for AES-192 and AES-256), only a decrease in the computational complexity of the key recovery was achieved.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“To construct longer bicliques, we drop the differential independency requirement imposed above and reduce the dimension of the resulting biclique.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The differential trails share some active nonlinear components now.This yields conditions on values that need to be satisfied in a biclique search.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the dimension is inevitably small due to the diffusion, then we use the second advantage: the biclique construction methods based on differential cryptanalysis of block ciphers and hash functions.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the ciphers with nonlinear key schedule, like AES and most AES candidates, this requirement is apparently strong.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We show how to carry over the concept of bicliques to block cipher cryptanalysis and get even more significant results, including the first key recovery method for the full AES faster than brute-force.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“A simple meet-in-the-middle attack requires only a single plaintext/ciphertext pair.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This paradigm is best suited for ciphers with diffusion that is slow with respect to r -m rounds, surprisingly, including AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The limited use of these attacks must be attributed to the requirement for large parts of the cipher to be independent of particular key bits.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Formally introduced in [29], bicliques led to the best preimage attacks on the SHA family of hash functions, including the attack on 50 rounds of SHA-512, and the first attack on a round-reduced Skein hash function.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The independency of the related-key differentials allows one to efficiently construct higherdimensional bicliques and simplifies the coverage of the key space with such bicliques.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Biclique cryptanalysis was first introduced for hash cryptanalysis [29].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, there is little evidence so far that carrying over these techniques to the most practical single-secret-key model is feasible.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity depends on the biclique construction procedure.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also from an information-theoretic point of view, bicliques of dimension 1 are likely to exist in a cipher, regardless of the number of rounds.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We stress here that whenever we speak of differences between keys, these describe differences inside the group of keys that are guessed.We never need access to decryptions under keys that are related by those differences, i.e. the attacks we describe are always in the single-key model.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, the construction of long bicliques of high dimension appears to be a very difficult task for primitives with fast diffusion [37].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [25] Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001) source
- Not checked — no full text of the sourcecites [30] Käsper, E., Rijmen, V., Bjørstad, T.E., Rechberger, C., Robshaw, M.J.B., Sekar, G.: Correlated Keystreams in Moustique. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 246–257. Springer, Heidelberg (2008) source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The disadvantage of this paradigm is that the construction of bicliques for many rounds is very difficult.Therefore, we are limited in the total number of rounds that we can attack.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“that the local collision approach can facilitate an attack in the more practical and relevant single-key model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Secondly, the attack gets a compact and small description, since the independent trails are generally short and self-explaining.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our second paradigm lets the attacker exploit the diffusion properties rather than differential, and does not aim to construct the longest biclique.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The advantage comes from the fact that in case of high dimension the basic computation has negligible cost, and the full complexity is determined by the amount of precomputation.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast, it proposes to construct shorter bicliques with high dimension by tools like independent related-key differentials (Section 3.1).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We checked the distribution of super-box output differences.We checked that it is random enough where we require randomness, though some non-random behavior was detected and might be important for constructing bicliques of high dimension over super-boxes.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified all truncated differentials through 8-round and 10-round AES-128 key-schedules, and through 9-round AES-256 key-schedule.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The attacks with independent bicliques -which lead to the key recovery for the full AES -allow us to be very precise about the required computations.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“For the attacks with long bicliques, whenever it is difficult to be precise about certain parts of our estimates, we choose to be conservative, potentially resulting in an underestimate of the claimed improvement.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Whereas using key-schedule properties in related-key attacks is natural, there seem only a few examples in the literature where this is used in the arguably more relevant single-key setting.This includes the attack on the self-synchronized stream cipher Moustique [28], the lightweight block cipher KTANTAN [12], and recent improvements upon attacks on 8-rounds of AES-192 and AES-256 [20].”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Not checked — no full text of the sourcecites [28] Guo, J., Ling, S., Rechberger, C., Wang, H.: Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 56–75. Springer, Heidelberg (2010) source
- Not checked yetcites [12] Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique Cryptanalysis of the Full AES. Cryptology ePrint Archive, Report 2011/449 (2011), http://eprint.iacr.org/2011/449
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We implemented the technically most complex part of one of our attacks: the long-biclique construction (for the AES-256 attack).”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The AES-128 key schedule bijectively maps each key to subkey $8.
“Since the AES-128 key schedule bijectively maps each key to $8, the enumeration is well-defined.”
The paper relies on this without support.
The AES-192 key schedule bijectively maps each key to $9||$10 L.
“Since the AES-192 key schedule bijectively maps each key to $9||$10 L , the enumeration is well-defined.”
The paper relies on this without support.
The AES-256 key schedule bijectively maps each key to $12||$13.
“Since the AES-256 key schedule bijectively maps each key to $12||$13, the enumeration is well-defined.”
The paper relies on this without support.
No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
“To the best of our knowledge, there are no generic methods known that would speed-up key-recovery attacks given a part of the codebook.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 14.64 | 2 8 | 2 254.64”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“C i = f K[i,j] (S j ) for all i, j ∈ {0, . . . , 2 d -1}.(1)”
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“In other words, in a biclique, the key K[i, j] maps the internal state S i to the ciphertext C j and vice versa.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 13.68 | 2 8 | 2 189.68”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
Citations
Cites
Lecture Notes in Computer Science 1205
(1999) · Industrial Robot the international journal of robotics research and application · doi:10.1108/ir.1999.04926fae.001 · Cited by 39,228
Differential cryptanalysis of DES-like cryptosystems
Biham, E., & Shamir, A. (1991) · Journal of Cryptology · doi:10.1007/bf00630563 · Cited by 2,914
The design of Rijndael AES - the advanced encryption standard
Daemen, J., & Rijmen, V. (2002) · Cited by 2,876
Linear Cryptanalysis Method for DES Cipher
Matsui, M. (1994) · Lecture Notes in Computer Science · doi:10.1007/3-540-48285-7_33 · Cited by 2,748
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437
How to Break MD5 and Other Hash Functions
Wang, X., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11426639_2 · Cited by 1,465
Finding Collisions in the Full SHA-1
Wang, X., Yin, Y. L., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11535218_2 · Cited by 1,442
Daemen, J., Knudsen, L. R., & Rijmen, V. (1997) · Lecture notes in computer science · doi:10.1007/bfb0052343 · Cited by 726
Differential Cryptanalysis of DES-like Cryptosystems
Biham, E., & Adi Shamir, Z. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_1 · Cited by 660
Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48519-8_12 · Cited by 607
Research works printed but not linked: 1
- Bahrak, B., Aref, M.R.: A Novel Impossible Differential Cryptanalysis of AES. In: Lucks, S., Sadeghi, A.-R., Wolf, C. (eds.) WEWoRC 2007. LNCS, vol. 4945, pp. 152–156. Springer, Heidelberg (2008)
Cited by
Sorted by citations
Items 401–500 of 546
An Encryption Key Management Approach for Configuration Files
Emmanuel, M. M., Nguena, I. M., & Roger, A. E. (2015) · DergiPark (Istanbul University) · Cited by 1
Biclique cryptanalysis of LBlock with modified key schedule
Ahmadi, S., Ahmadian, Z., Mohajeri, J., et al. (2015) · doi:10.1109/iscisc.2015.7387889 · Cited by 1
“The biclique cryptanalysis on block ciphers was introduced at AsiaCrypt'11 in cryptanalysis of all versions of AES and reduces the security margin of this cipher faster than brute force attack [16].”
BackgroundMethodInfluentialCryptanalysis of Reduced-Round Whirlwind (Full Version)?
Ma, B., Li, B., Hao, R., & Li, X. (2016) · Cited by 1
BITMIX: A hardware accelerated randomized symmetric encryption method
Lukács, S., Coleşa, A., & Sebestyen, G. (2016) · IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR) · doi:10.1109/aqtr.2016.7501282 · Cited by 1
Tuna, A., Da, R., & Tuna, G. (2016) · doi:10.20472/iac.2016.024.091 · Cited by 1
Khattab, A., Jeddi, Z., Amini, E., et al. (2016) · Analog circuits and signal processing/Analog circuits and signal processing series · doi:10.1007/978-3-319-47545-5_3 · Cited by 1
Biclique cryptanalysis of Twine-128
Najarkolaei, S. R. H., Ahangarkolaei, M. Z., Ahmadi, S., et al. (2016) · doi:10.1109/iscisc.2016.7736450 · Cited by 1
“In order to attack to the other rounds, we use partial matching with precomputation and recomputation technique [8].”
MethodInfluentialTechniques for Secure Data Transfer
Gardner, J. (2017) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-54978-1_12 · Cited by 1
“Bogdanov et al concludes the following results.”
BackgroundRanking Cryptographic Algorithms
Kieselmann, O., Kopal, N., & Wacker, A. (2014) · Springer eBooks · doi:10.1007/978-3-319-05044-7_9 · Cited by 1
“This difference in the number of cycles is even enough to counteract the marginal reduced key size introduced by the biclique attack discovered in 2011 [8].”
BackgroundAgrawal, M., Chang, D., Ghosh, M., et al. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-16745-9_19 · Cited by 1
“[5] to successfully cryptanalyze full round AES and has been subsequently adopted to break many other block ciphers such as ARIA [33], SQUARE [19], TWINE [7], HIGHT [12], PRESENT [1] etc.”
BackgroundMethodInfluentialKhair, M. G., Moucary, C. E., & Zakhem, W. (2018) · Research Journal of Applied Sciences Engineering and Technology · doi:10.19026/rjaset.15.5925 · Cited by 1
“Finally, the U.S. Government announced that AES could be used to protect classified information in June 2003 and in 2011, Bogdanov et al. (2011) completed the first key-recovery biclique attack on full AES, which is faster than brute force by a factor of about four and concluded that theoretical…”
MethodSecuring Informative Text using Color Visual Cryptography
Bali, A., Ansari, S., Khan, K., et al. (2016) · International Journal of Computer Applications · doi:10.5120/ijca2016908418 · Cited by 1
“A newly discovered technique known as biclique cryptanalysis helps attackers to remove about two bits from 128, 192, and 256-bit keys and recover AES secret keys up to five times faster than previously possible [8].”
MethodTowards Understanding the Known-Key Security of Block Ciphers
Andreeva, E., Bogdanov, A., & Mennink, B. (2013) · Cited by 1
Self-citationMultiTLS: Secure Communication Channels with Cipher Suite Diversity
Moura, R., Matos, D. R., Pardal, M. L., et al. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-58201-2_5 · Cited by 1
“[2] published a biclique attack against AES, though only with slight advantage over brute force.”
BackgroundEnhanced Cryptcoding: Joint Security and Advanced Dual-Step Quasi-Cyclic LDPC Coding
Pisek, E., Abu‐Surra, S., Taori, R., et al. (2014) · Globecom · doi:10.1109/glocom.2014.7417284 · Cited by 1
“Finally, as applied to AES, the meet-inthe-middle attacks and specifically the biclique cryptanalysis [21] show that for 8-round AES-128 security level, the total complexity can be reduced to 2, as compared to the full AES-128 complexity of 2, which is still impossible to cryptanalyze in current days processing techno…”
MethodBas, P., Furon, T., Cayre, F., et al. (2016) · Springer briefs in electrical and computer engineering · doi:10.1007/978-981-10-0506-0_3 · Cited by 1
Blankson, H., & Chattamvelli, R. (2022) · International Journal of Computer Applications · doi:10.5120/ijca2022922278 · Cited by 1
Plaintext recovery and tag guessing attacks on authenticated encryption algorithm COLM
Ulusoy, S. E., Kara, O., & Efe, M. Ö. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103342 · Cited by 1
Methods of crypto-stable symmetric encryption in the residual number system
Zawiślak, S., Kasianchuk, M. M., Iakymenko, I., et al. (2022) · Procedia Computer Science · doi:10.1016/j.procs.2022.09.045 · Cited by 1
Implementasi Algoritme Clefia 128-Bit untuk Pengamanan Modul Komunikasi Lora
Iman, M. F., Kusyanti, A., & Primananda, R. (2022) · Jurnal Teknologi Informasi dan Ilmu Komputer · doi:10.25126/jtiik.2022976766 · Cited by 1
Ferry, N., Dossou, P.-E., Ihowa, G., et al. (2023) · Journal of Software Engineering and Applications · doi:10.4236/jsea.2023.1612037 · Cited by 1
Lower data attacks on Advanced Encryption Standard
Kara, O. (2024) · TURKISH JOURNAL OF ELECTRICAL ENGINEERING & COMPUTER SCIENCES · doi:10.55730/1300-0632.4072 · Cited by 1
Pusuluri, V. B., & Bugatha, M. (2025) · National Conference on Communications · doi:10.1109/ncc63735.2025.10983402 · Cited by 1
A Simplified AES with Field Characteristic 7
Craig, S. (2014) · ScholarWorks (Boise State University) · Cited by 1
Using static analysis tools to detect and correct non-compliant cryptography
Langsworth, A. (2011) · ACM SIGSOFT Software Engineering Notes · doi:10.1145/2047414.2047427 · Cited by 1
Linear cryptanalysis of Baby Rijndael
Kokeš, J., & Lórencz, R. (2015) · doi:10.1109/icend.2015.7328533 · Cited by 1
“However, it seems that differential cryptanalysis [2] is the more successful – not only in itself, but also in its various modifications such as impossible differential cryptanalysis [4][3][15], boomerang attacks [17], related key attacks [5][6] or biclique attacks [7], which often represent the state-of-the-art in cr…”
BackgroundImproving Block Cipher Design by Rearranging Internal Operations
Lerman, L., Nakahara, J., & Veshchikov, N. (2013) · International Conference on Security and Cryptography · doi:10.5220/0004498200270038 · Cited by 1
Biclique Cryptanalysis of Full Round AES-128 Based Hashing Modes
Chang, D., Ghosh, M., & Sanadhya, S. K. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-38898-4_1 · Cited by 1
“For the sake of clarity, we will follow the same notation used for description of AES-128 as used in [14].”
BackgroundMethodInfluentialA Study: Cryptology Techniques and Methodologies
Safitri, C., Ali, H. S., & Ibrahim, J. (2013) · The International Islamic University Malaysia Repository (The International Islamic University Malaysia) · Cited by 1
Random Cladding with Feedback Mechanism for encrypting mobile messages
Huang, Y., Leu, F., You, I., et al. (2016) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infcomw.2016.7562221 · Cited by 1
“AES (128bit block, 128-bit key) [2] (AddRoundKey) 176 ⊕s (8 bits) The number of operations is the same as the sum of the numbers of those operations employed by the encryption process for three stages, including AddRoundKey, SubBytes, and ShiftRows (SubBytes) 160 Substitutions (8 bit) [14]”
BackgroundMethodAsymmetric Biclique cryptanalysis of lightweight block ciphers MIBS and I-PRESENT
Cui, J., Haifeng, Z. U. O., & Zhong, H. (2017) · Scientia Sinica Informationis · doi:10.1360/n112017-00015 · Cited by 1
“2011 年 , Bogdanov 等 [16] 对 AES 进行了 Biclique 攻击 后 , 他们的工作就受到了广泛的关注 , 因为这是第一次针对单密钥模型分组密码的全轮攻击 .”
Single key MITM attack and biclique cryptanalysis of full round Khudra
Dey, P., Rohit, R. S., & Adhikari, A. (2018) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2018.06.005 · Cited by 1
Decentralized Identifier Distribution for Moving Target Defense and Beyond
Krohmer, D., & Schotten, H. D. (2020) · International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA) · doi:10.1109/cybersa49311.2020.9139717 · Cited by 1
“Besides, hypothetical scenarios of the respective encryption standard must be considered, such as Biclique attack [18] or XSL attack in AES [19].”
BackgroundOn the Cost of ASIC Hardware Crackers: A SHA-1 Case Study
Chattopadhyay, A., Khairallah, M., Leurent, G., et al. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-75539-3_27 · Cited by 1
ANN Based Security Analysis of Block Ciphers with Focus on Non-linear Component
Varshney, N., Saxena, G., & Mishra, G. (2021) · Advances in intelligent systems and computing · doi:10.1007/978-981-16-2712-5_28 · Cited by 1
Fully encrypted high-speed microprocessor architecture: the secret computer in simulation
Bowen, J. P., & Breuer, P. (2019) · International Journal of Critical Computer-Based Systems · doi:10.1504/ijccbs.2019.10020015 · Cited by 1
Huang, J. (2012) · Research Online (University of Wollongong) · Cited by 1
Mitigating Differential Power Analysis Attacks on AES using NeuroMemristive Hardware
Donahue, C. (2014) · RIT Scholar Works (Rochester Institute of Technology) · Cited by 1
Data security in multi-tenant environments in the cloud
Waizenegger, T. (2012) · OPUS Publication Server of the University of Stuttgart (University of Stuttgart) · doi:10.18419/opus-2899 · Cited by 1
Biclique cryptanalysis of MIBS-80 and PRESENT-80.Preprint
Sereshgi, M. H. F., Dakhilalian, M., & Shakiba, M. (2015) · IACR Cryptology ePrint Archive · Cited by 1
Bicliques with Minimal Data and Time Complexity for AES (Extended Version).Preprint
Bogdanov, A., Chang, D., Ghosh, M., & Sanadhya, S. K. (2014) · IACR Cryptology ePrint Archive · Cited by 1
Self-citationA Framework for Property-preserving Encryption in Wide Column Store Databases
Waage, T. (2017) · doi:10.53846/goediss-6439 · Cited by 1
Low Data Complexity Biclique Cryptanalysis of Block Ciphers with Application to Piccolo and HIGHT.Preprint
Ahmadi, S., Ahmadian, Z., Mohajeri, J., et al. (2013) · IACR Cryptology ePrint Archive · Cited by 1
Computer Science & Information Technology
(2018) · doi:10.5121/csit.2018.80400 · Cited by 1
Hybrid Encryption for Smart Home Healthcare: Ensuring Data Confidentiality and SecurityPreprint
Popoola, O. J., Rodrigues, M., Marchang, J., Shenfield, A., Ikpehai, A., & Popoola, J. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4839240 · Cited by 1
Lemes-Perera, S., R. Alarcon, M., Caballero-Gil, P., & Serra-Ricart, M. (2026) · Astronomy and Computing · doi:10.1016/j.ascom.2026.101153 · Cited by 1
Towards Efficient Algorithms in Algebraic Cryptanalysis
Schilling, T. (2012) · NORA - Norwegian Open Research Archives
Digital forensics in the Cloud: encrypted data evidence tracking
Tian, Z. (2014) · Tuwhera (Auckland University of Technology)
Secure Delete Object Store - sicheres Löschen auf nicht vertrauenswürdigen Speichersystemen
Mormul, M. (2014) · OPUS Publication Server of the University of Stuttgart (University of Stuttgart) · doi:10.18419/opus-3427
Formal modelling and analysis of mix net implementations.
Stathakidis, E. (2015) · Surrey Research Insight Open Access (The University of Surrey)
Security Analysis of Block Cipher Piccolo-128 Applicable to Various Environments
Jeong, K. (2012) · The Journal of Advanced Navigation Technology · doi:10.12673/jkoni.2012.16.5.787
“Biclique 공격은 중간 일치 공격에 biclique 개념을 적용한 개념으로서 , Asiacrypt 2011 에서 처음 소개되 었다 [5].”
A random wrapping encryption method
Huang, Y., Leu, F., Liu, J., et al. (2014) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc.2014.6866563
“Rijmen also proved the effectiveness of the above attacks [6], even if not yet currently practical, but there is a possibility of cracking AES.”
BackgroundMethodBart Preneel, A. (2013) · International Conference on Security of Information and Networks (SIN) · doi:10.1145/2523514.2523592
Implementation of Mobile DICOM Image Retrieval Application with QR-Code Authentication
Chang, Y. Y., Zhong, H. B., & Wang, M. L. (2014) · International Symposium on Computer, Consumer and Control · doi:10.1109/is3c.2014.103
An Improvement Crypton Protocol with Higher Security Margin
Wang, X., Chen, D., Liu, Q., et al. (2014) · Journal of Networks · doi:10.4304/jnw.9.10.2788-2795
Cryptanalysis of Symmetric Cryptographic Primitives
Kircanski, A. (2013) · Spectrum Research Repository (Concordia University)
Timing Attack on a Modified Dynamic S-box Implementation of the AES InvSubBytes Operation
Obermaier, J., Laas, T., & Roner, M. (2014)
Practical Cryptography for a Peer-to-Peer Web Browsing System
Pokluda, A. (2012)
Research of Cryptographic Algorithms Applied in Electronic Commerce
Zengping, C., & Yanshou, C. (2014) · Research Journal of Applied Sciences Engineering and Technology · doi:10.19026/rjaset.7.334
“However, in the most recent result about AES, Rijndael has been theoretical broken by Bogdanov et al .”
BackgroundRelated-key cryptanalysis of AES, Hierocrypt-3, and CipherUnicorn-A
Khovratovich, D. (2012)
Self-citationRecent Advances in Meet-in-the-Middle Attacks
Guo, J. (2012)
Análise do AES e sua criptoanálise diferencial
Rinaldi, G. D. (2012)
Novel block ciphers for real time Multimedia applications
Radha, N. (2014) · Shodhganga
Cryptography for the Forensics Investigator
Martin, T. (2013) · Advances in information security, privacy, and ethics book series · doi:10.4018/978-1-4666-4030-6.ch003
Der Advanced Encryption Standard
Pelzl, J., & Paar, C. (2016) · eXamen.press · doi:10.1007/978-3-662-49297-0_4
Meet-in-the-Middle Attack on Rijndael-256 Algorithm
Chong-Mao, S. (2012) · Jisuanji gongcheng
Facolt a di Scienze Matematiche Fisiche e Naturali Synthesis of Graduation Thesis in Mathematics
Todisco, S., & Pedicini, M. (2013)
Rao, M. R., Pratap Reddy, L., Narayana Murthy, B. H. V. S., et al. (2017) · doi:10.5121/csit.2017.71107
“Key recovery was practically performed on 10 rounds AES algorithm [40], which is considered to be the strongest cryptosystem.”
MethodInfluential[Paper] Practical Update of Scrambling Scheme and its Security Analysis
Ogawa, K., & Inoue, T. (2017) · ITE Transactions on Media Technology and Applications · doi:10.3169/mta.6.110
[Invited Paper] Security Technologies for Enriched Broadcasting Services
Ogawa, K. (2017) · ITE Transactions on Media Technology and Applications · doi:10.3169/mta.6.53
EAES: Extended Advanced Encryption Standard with Extended Security
Azad, A. K., & Mollah, M. Y. (2018) · Advances in Science Technology and Engineering Systems Journal · doi:10.25046/aj030307
“In 2011 [4], the first key-recovery attack on full AES was developed.”
BackgroundHuman Genome Data Protection Using PostgreSQL DBMS
Lehotay–Kéry, P., & Kiss, A. (2018) · Communications in computer and information science · doi:10.1007/978-3-319-92270-6_10
Ensuring Security in Sharing of Information Using Cryptographic Technique
Priya, J. S., Krithikaa, V., Monika, S., et al. (2018) · Advances in intelligent systems and computing · doi:10.1007/978-981-13-2182-5_3
Cryptanalysis of Some Block Cipher Constructions
Abdelkhalek, A. (2017) · Spectrum Research Repository (Concordia University)
Hussien, H. M., Muda, Z., & Yasin, S. M. (2017) · Universiti Putra Malaysia Institutional Repository (Universiti Putra Malaysia)
Nation-State Attackers and their Effects on Computer Security
Springall, A. (2018) · Deep Blue (University of Michigan)
Improving MDC-4 to Be More Secure
Hong, D., Kim, D.-C., & Kwon, D. (2018) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1587/transfun.e102.a.278
Haidar, I. M., Haidar, A. M., & Haraty, R. A. (2018) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa.2018.8612814
“However, the novel techniques using bicliques has led to a new cryptanalysis for AES [7].”
MethodAttack on Trace Buffer: A Study on Observability versus Security in Post-Silicon Debug
Rajendran, A., & Rajappa, M. (2019) · doi:10.1109/iccsp.2019.8698022
“It is better than the brute-force attack [1].”
BackgroundBicliques for permutations: collision and preimage attacks in stronger settings.
Khovratovich, D. (2012)
Self-citationSurvey and Benchmark of Lightweight Block Ciphers for Wireless Sensor Networks
Cazorla, M., Marquet, K., & Minier, M. (2013)
Key Recovery Attacks on 3-round Even-Mansour, 8-step LED-128, and Full AES 2 .
Dinur, I., Dunkelman, O., Keller, N., & Adi Shamir, Z. (2013)
Agrawal, M., Chang, D., Ghosh, M., et al. (2015)
Static power analysis of cryptographic devices
Xu, J. (2019) · Memorial University Research Repository (Memorial University)
Biclique Cryptanalysis of TWINE.
Çoban, M., Karakoç, F., & Boztaş, Ö. (2012)
Improved "Partial Sums"-based Square Attack on AES.
Tunstall, M. (2012)
Robust Pseudo-Random Number Generators with Input Secure Against Side-Channel Attacks.
Abdalla, M. F., Belaïd, S., Pointcheval, D., et al. (2015)
Linear Distinguishers in the Key-less Setting: Application to PRESENT.
Lauridsen, M. M., & Rechberger, C. (2015)
Self-citationSimple AEAD Hardware Interface (SÆHI) in a SoC: Implementing an On-Chip Keyak/WhirlBob Coprocessor.
Saarinen, M.-J. O. (2014)
A Two-Stage Customer Journey Analytical Model in Single House Business
Thammaboosadee, S., Chinomi, B., & Mohamed, E. K. A. (2020) · ECTI Transactions on Computer and Information Technology (ECTI-CIT) · doi:10.37936/ecti-cit.2020142.240239
“Note that all attributes related to customer information and contacts, which are Personally Identifiable Information (PII) [21], are encrypted with the Advanced Encryption Standard (AES) [22].”
MethodTravel Shop Service System with Identity Key
Shen, S., Jian, C.-F., Lin, S.-H., et al. (2020) · IEEE Eurasia Conference on IOT, Communication and Engineering (ECICE) · doi:10.1109/ecice50847.2020.9301930
“Also, many countries have their strict application, review, and verification process by usibg 4G/5G mobile subscription numbers to make sure user legitimacy, privacy, identification, and security [1-3].”
BackgroundWHIRLBOB, the Whirlpool based Variant of STRIBOB Lighter, Faster, and Constant Time
Saarinen, M.-J. O., & Brumley, B. B. (2014)
A Meet-in-the-Middle Attack on Round-Reduced mCrypton Using the Differential Enumeration Technique
Hao, Y., Bai, D., & Li, L. (2015)
Khanas, Y., & Borecki, M. (2021) · Informatyka Automatyka Pomiary w Gospodarce i Ochronie Środowiska · doi:10.35784/iapgos.2591
Hong, S. (2019) · MDPI eBooks · doi:10.3390/books978-3-03921-001-5
Cryptanalysis of symmetric-key primitives and its application to backdoor design
Wang, H. (2021) · DR-NTU (Nanyang Technological University) · doi:10.32657/10356/146046
Metadata
- Authors
- Bogdanov, A., Khovratovich, D., & Rechberger, C.
- Affiliations
- KU Leuven (BE)
- Microsoft (United States) (US)
- Orange (France) (FR)
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Berlin Heidelberg
- Published
- 2011
- Volume
- 2011
- Pages
- 344-371
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W1515595447
- Cited by
- 546
- References
- 56
- Citations by year
- 2026: 9 · 2025: 15 · 2024: 23 · 2023: 25 · 2022: 22 · 2021: 36 · 2020: 33 · 2019: 41 · 2018: 29 · 2017: 36 · 2016: 38 · 2015: 71 · 2014: 53 · 2013: 54 · 2012: 55
- FWCI
- 42.07
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Licence
- other-oa
- Locations
- Lecture notes in computer science (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- IACR Cryptology ePrint Archive (submittedVersion)
- Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion)
- Funders
- European Commission
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Advanced Encryption Standard, AES-128, AES-192, AES-256, key recovery, block cipher cryptanalysis, compression function, Rijndael
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-23, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-23 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
