The DOI matches its Crossref record; 57 of the 57 references it cites were found in a registry or an index; 14 of the 32 sources its claims cite were checked for support.
Biclique Cryptanalysis of the Full AES
Open accessOverview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper introduces biclique cryptanalysis and presents the first key-recovery attacks on the full AES-128, AES-192, and AES-256 faster than brute force, with complexities \(2^{126.1}\), \(2^{189.7}\), and \(2^{254.4}\), respectively. The attacks are in the single-key model and, because of their high computational complexity, do not threaten practical AES use.
Key findings
- First key recovery on full AES-128 with complexity \(2^{126.1}\), full AES-192 with \(2^{189.7}\), and full AES-256 with \(2^{254.4}\); the paper reports an advantage of about a factor 3 to 5 over brute force depending on version.
- Reduced-round and hash-mode results include 8-round AES-128 at \(2^{124.9}\), 9-round AES-192 at \(2^{188.8}\), 9-round AES-256 at \(2^{251.92}\), and compression-function preimages for full AES-128 (Miyaguchi-Preneel) at \(2^{125.83}\), AES-192 (Davies-Meyer) at \(2^{125.71}\), and AES-256 (Davies-Meyer) at \(2^{126.35}\), with success rate 0.632 for the preimage attacks.
- The full-AES independent-biclique attacks use data complexities of \(2^{88}\), \(2^{80}\), and \(2^{40}\) plaintext-ciphertext pairs for AES-128, AES-192, and AES-256, respectively, with memory \(2^8\) and success probability 1.
- The attacks do not assume related keys; most need only a small part of the codebook, and the paper reports practical verification of truncated differentials and the long-biclique construction for AES-256.
Methods
- Biclique cryptanalysis partitions the key space into groups of \(2^{2d}\) keys indexed as \(K[i,j]\), constructs a \(d\)-dimensional biclique satisfying \(C_i = f_{K[i,j]}(S_j)\), and uses meet-in-the-middle/matching with precomputations to test \(2^{2d}\) keys with about \(2^d\) computations.
- Two paradigms are used: long bicliques for remaining rounds via dependent related-key differential trails, and independent bicliques via independent related-key differentials plus matching with precomputations; the latter yields the full-AES key-recovery attacks.
- The analysis is theoretical cryptanalysis of AES-128/192/256 and AES-based hash modes; complexity is evaluated by counting recomputed S-boxes, MixColumns operations, and key-schedule operations, with tables summarizing parameters and complexities.
Limitations
- The paper states that the attacks are of high computational complexity and “do not threaten the practical use of AES in any way.”
- The paper states that the long-biclique paradigm has very difficult biclique construction for many rounds, limiting the total number of rounds attacked, and that its data complexity can be very large.
- Evident from the text: practical verification is partial rather than a full attack run—the authors verified truncated differentials, implemented the technically most complex long-biclique construction for AES-256, and checked super-box output differences, but did not execute the full key-recovery attacks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
101 No basis given · 49 Own interpretation · 15 Own result · 8 Own method · 6 No full text of the sources · 3 Couldn’t confirm · 2 Supported · 2 Partly supported · 1 Supported so far · 1 Mixed support · 1 Not checked yet · accuracy not yet measured
Some cited sources support this claim and some don’t — read each source’s verdict below.
In the paper
“So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [8] Biryukov, A., Dunkelman, O., Keller, N., Khovratovich, D., Shamir, A.: Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 299–319. Springer, Heidelberg (2010) source
- Partly supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe the paper’s local-collision attacks on AES-192 and AES-256 as related-key attacks. Section 4.1 explains the related-key model used. The paper does not establish the broader claim that analysis of AES with local collisions is only applicable in that model; page numbers are unavailable in our copy. (LLM, conf=0.85)
- Disputedcites [10] Biryukov, A., Khovratovich, D., Nikolić, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 231–249. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
- Partly supportedcites [11] Biryukov, A., Nikolić, I.: Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 322–344. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction describes related-key differential analysis of AES, including characteristics used in an AES-256 attack. It does not identify that analysis as using local collisions or say that local-collision analysis of AES is only applicable in the related-key model. (LLM, conf=0.78)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)
- Could not verifycites [23] Dunkelman, O., Keller, N., Shamir, A.: A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 393–410. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction and Summary discuss related-key attacks on KASUMI, not the relative strength of single-key attacks on round-reduced AES. A reference lists a reduced-round AES attack, but our copy does not compare AES attacks with those proposed ten years earlier (searched for single-key AES attacks and that comparison). (LLM, conf=0.76)
- Not checked — no full text of the sourcecites [24] Dunkelman, O., Sekar, G., Preneel, B.: Improved Meet-in-the-Middle Attacks on Reduced-Round DES. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 86–100. Springer, Heidelberg (2007) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The sources with a verdict support this claim; the rest weren’t checked yet, have no full text we could read, or their verdicts aren’t rated yet.
In the paper
“With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) source
The Introduction identifies impossible differential cryptanalysis as the technique this paper applies to IDEA and Khufu, including its use for key elimination. The citation is attached to that method; the broader judgment about which methods are most powerful for AES is the citing authors’ framing, not a finding attributed specifically to this paper. (LLM, conf=0.87)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)
- Not checked — no full text of the sourcecites [14] Bouillaguet, C., Derbez, P., Fouque, P.-A.: Automatic Search of Attacks on Round-Reduced AES and Applications. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 169–187. Springer, Heidelberg (2011) source
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Also, as already observed in [19,37], the fact that the MixColumn transformation is omitted in the last round of AES helps to design attacks for more rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Partly supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) sourceExperimental — accuracy not yet measured
Section 2 (page unavailable) says that AES has no MixColumn operation in its final round. Section 5.2 (page unavailable) describes extending the attack to eight rounds by searching the last-round key, but does not say that omitting MixColumn enables the extension. The claimed causal link is therefore not established by our copy. (LLM, conf=0.83)
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-Preimage attacks on compression functions based on the full AES versions.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-256 with computational complexity 2 254.4 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-192 with computational complexity 2 189.7 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-128 with computational complexity 2 126.1 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We also provide complexities for finding compression function preimages for all full versions of AES when considered in hash mode.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($10 10 ) = ∆ K i ($10 14 ), the ciphertext bytes C 10 and C 14 are also always equal.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, C recomp is equivalent to 2 16 •3.4375/12.5= 2 14.14 runs of the full AES-128.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This yields the partition of the round-8 subkey space, and hence the AES key space, into the 2 112 groups of 2 16 keys each.”
§ Biclique Cryptanalysis of the Full AES > 6.1 Key Partitioning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The AES-128 key schedule bijectively maps each key to subkey $8.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“It also dominates the complexity of other steps, so we construct 2 80 bicliques with 104 fixed key bits in 2 56+32 = 2 88 , and 2 102 bicliques in 2 88”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-256 yields a key recovery with computational complexity about 2 251.92 , data complexity 2 120 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The latter number is 10 + 2.5 = 12.5 as we have to take the key schedule nonlinearity into account.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, the data complexity does not exceed 2 80 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-256 in Davies-Meyer mode requires about 2 126.35 computations, 2 8 memory, and works with success probability 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As they share no active S-boxes, the resulting combined differentials yield a biclique of dimension 8.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“On the other hand, each quartet has equal chance to be produced.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The values C biclique and C precomp together do not exceed 2 8 calls of the full AES-128.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Again, the ∆ i -and ∇ j -differential trails share no active S-boxes (Figure 7).”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The chance of getting a false positive is 4 • 2 -8 = 2 -6 per biclique.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 0,1,4,13 .”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As the key bits are adaptively chosen in the attack, the algorithm does not guarantee that the quartets are pairwise different.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The full area to be recomputed, which includes 41 S-boxes, is depicted in Figure 5.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“It also dominates the complexity of other steps, so we construct 2 80 bicliques with 104 fixed key bits in 2 56+32 = 2 88 , and 2 102 bicliques in 2 88”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, the total complexity of the attack with 2 126 bicliques is about 2 126 4/10.5 + 2 -9 + 1.125/10.5 = 2 124.97 .with 2 32 memory and 2 127 data.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, C recomp is equivalent to 2 16 • 2.8125/14 = 2 13.68 runs of the full AES-192.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, the data complexity does not exceed 2 40 .”
§ Biclique Cryptanalysis of the Full AES > Two key modifications for AES-256 biclique
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We construct a 3-round biclique from combined related-key differentials as described in Section 3.1.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This gives the time complexity 2 32 and the memory complexity 2 16 .”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This yields the partition of the AES-256 key space into the 2 240 groups of 2 16 keys each.”
§ Biclique Cryptanalysis of the Full AES > 8.1 Key Partitioning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The AES-256 key schedule bijectively maps each key to $12||$13.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For a success probability of 63% the second variant of the attack produces 2 125.33 bicliques in 2 124.3 time, and needs 2 126.33 chosen ciphertexts.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference in the subkey $5 is non-zero in only one byte, so we have to recompute as few as four S-boxes in round 5 (state #13).”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, only six (instead of eight) S-boxes needs recomputing in state #15 (round 8).”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-256 in Davies-Meyer mode requires about 2 126.35 computations, 2 8 memory, and works with success probability 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For a success probability of 63% the second variant of the attack produces 2 125.33 bicliques in 2 124.3 time, and needs 2 126.33 chosen ciphertexts.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-256 in Davies-Meyer mode requires about 2 126.35 computations, 2 8 memory, and works with success probability 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This gives the time complexity 2 32 and the memory complexity 2 16 .”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“By a careful choice of key groups, one is able to reduce the precomputation proportion to a very small factor, e.g.factor 1/15 in attacks on reduced-round versions of AES-256.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“If we keep track of quartets in the loop after the guess of three bytes of K 5 , then the memory complexity grows to 2 102 .”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“As a result, the data complexity does not exceed 2 88 .”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Solutions for the Super-boxes are constructed online by substituting 2 32 input pairs to the super-box transformation and filtering out incorrect quartets.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-256 yields a key recovery with computational complexity about 2 251.92 , data complexity 2 120 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, Step 2 (c) has complexity 2 32 .”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The ∆ i -differential affects only 7 bytes of the ciphertext, and the key difference is equal in all non-zero bytes of $14.”
§ Biclique Cryptanalysis of the Full AES > Two key modifications for AES-256 biclique
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, the total complexity of the attack with 2 126 bicliques is about 2 126 4/10.5 + 2 -9 + 1.125/10.5 = 2 124.97 .with 2 32 memory and 2 127 data.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-256 yields a key recovery with computational complexity about 2 251.92 , data complexity 2 120 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The memory requirement is upper-bounded by the storage of 2 8 full computations of g.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-C recomp is the complexity of the recomputation of the internal variable v 2 2d times.It strongly depends on the diffusion properties of the cipher.For AES this value varies from 2 2d-1.5 to 2 2d-4 .”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The full computational complexity amounts to about 2 112 2 8 + 2 14.14 + 2 8 = 2 126.18 .”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: The AES-192 key schedule bijectively maps each key to $9||$10 L.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 2.8125 SubBytes operations compared to the equivalent of 14 in the full cipher (there are 8 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we estimate that the algorithm generates a natural proportion of (1-1/e) = 63% quartets.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The memory requirement is upper-bounded by the storage of 2 8 full computations of g.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-256 yields a key recovery with computational complexity about 2 251.92 , data complexity 2 120 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The memory requirement is upper bounded by the storage of 2 8 full computations of g.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of false positives require only round 2 to recompute, which gives 2 -9 AES calls overhead on average, which is negligible compared to the matching phase.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, the total complexity of the attack with 2 126 bicliques is about 2 126 4/10.5 + 2 -9 + 1.125/10.5 = 2 124.97 .with 2 32 memory and 2 127 data.”
§ Biclique Cryptanalysis of the Full AES > 9.2 Complexity
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the low diffusion of the AES key schedule and sparsity of the key difference in round 8, the whitening subkeys of K[i, j] and K[i, 0] differ in 9 bytes only.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we have 72 neutral bits in $7, and 136 neutral bits in total.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we have 128 -32 -32 = 64 neutral bits in $6.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In total we need 4.75 AES rounds per biclique, i.e. 2 -0.92 9-round AES-256 calls.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we have 2 64 solutions for each guess in the inbound phase, or 2 120 solutions in total.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (c).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the matching part we compute a single byte in two directions, thus spending 9/16 of a round in rounds 1-3, and full round 4, i.e. 3.125 full rounds per biclique.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The workload/success rate ratio is thus 2 124.97 .”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We need 2 254 bicliques, so the total complexity is 2 253.1 .”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we have 72 neutral bits in $7, and 136 neutral bits in total.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we get a 84-bit filter, and leave with 2 36 bicliques.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (d).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we have 2 64 solutions for each guess in the inbound phase, or 2 120 solutions in total.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (c).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We need 2 254 bicliques, so the total complexity is 2 253.1 .”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For a success probability of 63% the second variant of the attack produces 2 125.33 bicliques in 2 124.3 time, and needs 2 126.33 chosen ciphertexts.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In total we make 2 7•(4+2•2) = 2 56 guesses.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The complexity generated by false positives is at most 2 -6 rounds per biclique.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Therefore, we get a 84-bit filter, and leave with 2 36 bicliques.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (d).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This is a 16-bit filter, which reduces the number of bicliques to 2 20 .”
§ Biclique Cryptanalysis of the Full AES > Step 2 (e).
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In total we need 4.75 AES rounds per biclique, i.e. 2 -0.92 9-round AES-256 calls.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As our attacks are of high computational complexity, they do not threaten the practical use of AES in any way.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In this paper we present a novel technique of block cipher cryptanalysis with bicliques, which leads to the following results:”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, the block cipher standard AES is almost as secure as it was 10 years ago in the strongest and most practical model with a single unknown key.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast to most shortcut attacks on AES variants, we do not need to assume related-keys.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The relatively slow diffusion in the AES key schedule allows the adversary to skip most recomputations of the key schedule operations.”
§ Biclique Cryptanalysis of the Full AES > 3.3 Matching with Precomputations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since ∆ i -and ∇ j -trails share no active non-linear elements, a boomerang based on them returns from the ciphertext with probability 1 as the quartet of states forms the boomerang rectangle at every step.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, the computational complexity of matching is upper bounded by 2 d computations of the cipher.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If we match on a single byte, the number of false positives is about 2 2d-8 .”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The basic meet-in-the-middle attack has clear limitations in the block cipher cryptanalysis since an internal variable with the properties listed above can be found for a very small number of rounds only.”
§ Biclique Cryptanalysis of the Full AES > 2.1 Basic Meet-in-the-Middle Attacks
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If all ∆ i = ∇ j , then all keys K[i, j] are different.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For |v| close to d and larger an attack has advantage of about 2 d over brute force search as it tests 2 2d keys with less than 2 d calls of the full cipher.”
§ Biclique Cryptanalysis of the Full AES > 2.1 Basic Meet-in-the-Middle Attacks
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In this paper we demonstrate that the meet-in-the-middle attacks on block ciphers have great potential if enhanced by a new concept called bicliques.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boostedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the full key recovery is merely the application of Steps 1-3 2 n-2d times, we get the following equation:”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Though this approach turns out to be effective in case of AES, it is exactly the independency of differentials that limits the length of the biclique constructed.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the trails of ∆ i -differentials do not share active nonlinear components (such as active S-boxes in AES) with the trails of ∇ j -differentials, then the tuple also conforms to 2 2d combined (∆ i , ∇ j )differentials:”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The first advantage of this approach is that theoretically we can get the same advantage as the basic attack if we manage to construct a biclique of appropriate dimension.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Furthermore, the data complexity can be very large since we use all the degrees of freedom to construct a biclique and may have nothing left to impose restrictions on the plaintexts or ciphertexts.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We are also able to amortize the construction cost of a biclique by producing many more out of a single one.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Having found a biclique, we produce new ones out of it for other key groups.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The amount of recalculation depends on the diffusion properties of both internal rounds and the key schedule of the cipher.”
§ Biclique Cryptanalysis of the Full AES > 3.3 Matching with Precomputations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Here we describe the idea of matching with precomputations that can provide significant computational advantage due to amortized complexity.”
§ Biclique Cryptanalysis of the Full AES > 3.3 Matching with Precomputations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Generally, the complexity is dominated by C match and hence has an advantage of at least 2 d over brute-force.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-C match is the complexity of the computation of the internal variable v 2 d times in each direction.It is upper bounded by 2 d calls of E.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the meet-in-the-middle attack is no longer applicable to the E 2 • E 1 , we apply the matching with precomputations (Section 3.3).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity of the key recovery is upper-bounded by storing 2 d full computations of the cipher.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-C precomp is the complexity of the precomputation in Step 3. It is equivalent to less than 2 d runs of the subcipher g.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the biclique area is small, the attack designer has more freedom to impose constraints on the ciphertext and hence restrict it to a particular set.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As in the long biclique paradigm, 2 2d keys are tested using only 2 d intermediate cipher states.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, the full key recovery complexity is dominated by 2 n-2d • C recomp .”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique construction is quite cheap in this paradigm.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“First, the data complexity can be made quite low.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We notice that the data complexity of key recovery can be significantly reduced by sacrificing only a small factor of computational advantage.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The round transformation of AES is not designed to have strong resistance against several classes of attacks for a smaller number of rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Again, in all cases we arrive at a computational complexity that is considerably lower than generic attacks.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our approach heavily relies on the existence of high-probability related-key differentials over a part of the cipher.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We verified the complexity estimate, and also give an example of a biclique in Table 7 in the Appendix.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In all cases we arrive at a computational complexity that is considerably lower than generic attacks.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified that some difference guesses must be equal like in the AES-256 attack due to the branch number of MixColumns that results in the correlation of differences in the outbound phase.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“In the key schedule, we especially take advantage of the relatively slow backwards diffusion.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
- Probably not a substantial claim. 32
- It may state two separate claims as one. 34
- The quote only partly states this claim. 6
Every source the paper cites for this claim was checked and supports it.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) source
The Abstract states that the paper presents two related-key attacks on the full AES, one against AES-256 and the other against the full AES-192. The Introduction also explicitly describes attacks on both full variants. (LLM, conf=0.94)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“AES with its wide-trail strategy was designed to withstand differential and linear cryptanalyses [15], so pure versions of these techniques have limited applications in attacks.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [15] Chabaud, F., Joux, A.: Differential Collisions in SHA-0. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 56–71. Springer, Heidelberg (1998) sourceExperimental — accuracy not yet measured
The Conclusion discusses a differential attack on SHA-0 and the expansion of SHA-1, not AES. Searches for AES, Rijndael, the wide-trail strategy, and resistance to differential and linear cryptanalysis found no passage addressing the attributed claim in our copy. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) sourceExperimental — accuracy not yet measured
The Abstract and §1 Introduction describe impossible-differential attacks on IDEA and Khufu, not AES-128. Searches for a first 7-round AES-128 attack and its data complexity found no passage addressing that result; the 7-round impossible differential mentioned in §4 concerns DES. (LLM, conf=0.76)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“As a result, the number of rounds broken with this technique is rather small [19], which seems to prevent it from producing results on yet unbroken 8-, 9-, and 10-round (full) AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) source
The Abstract and Conclusion report meet-in-the-middle attacks on 7 rounds of AES-192 and up to 8 rounds of AES-256. The Introduction states that full AES-192 and AES-256 have 12 and 14 rounds, respectively, supporting the cited point that this technique breaks relatively few rounds. The sentence’s suggestion about future results is the citing authors’ inference, not a finding attributed to this source. (LLM, conf=0.91)
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The new approach originates from the so-called spliceand-cut framework [1,2,26] in the hash function cryptanalysis, more specifically its element called initial structure.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Partly supportedcites [1] Aoki, K., Sasaki, Y.: Preimage Attacks on One-Block MD4, 63-Step MD5 and More. In: Avanzi, R.M., Keliher, L., Sica, F. (eds.) SAC 2008. LNCS, vol. 5381, pp. 103–119. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
In the section introducing Technique 1: Splice-and-Cut (page not available), the paper proposes and explains the splice-and-cut technique for hash-function preimage attacks. Our copy does not call any element of that technique an “initial structure,” so it supports the framework connection but not that more specific attribution. (LLM, conf=0.84)
- Not checked — no full text of the sourcecites [2] Aoki, K., Sasaki, Y.: Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 70–89. Springer, Heidelberg (2009) source
- Not checked — no full text of the sourcecites [26] Gilbert, H., Minier, M.: A Collision Attack on 7 Rounds of Rijndael. In: AES Candidate Conference, pp. 230–241 (2000)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-Attacks with lower complexity on the reduced-round versions of AES not considered before, including an attack on 8-round AES-128 with complexity 2 124.9 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We have studied several block ciphers and hash functions, including different variants of AES, and it turns out that the optimal choice depends on a primitive, its diffusion properties, and features of the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 4 Two Paradigms of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacks with lowest computational complexities follow the paradigm of independent bicliques and have success rate 1.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For longer keys some bicliques are filtered out.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Regarding the forward direction, the whitening subkeys $0 differ in 4 bytes only, which makes only four S-boxes to recompute.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-192 in Davies-Meyer mode requires about 2 125.71 computations, 2 8 memory, and has success rate 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our attack always outputs the right key as soon as it belongs to one of the quartets produced in the attack.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-192 yields a key recovery with computational complexity about 2 188.8 , data complexity 2 80 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i and j, respectively, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 3.4375 SubBytes operations (i.e., 55 S-boxes), 2.3125 MixColumns operations, and a negligible amount of XORs in the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference is no longer a linear function of j as it is in the computation of ←v , but still requires only three s-boxes in the key schedule to recompute.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The precomputation of about 2 d+1 matches allows for a significant complexity gain and is the major source of the computational advantage of our attacks on AES.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-128 in Miyaguchi-Preneel mode requires about 2 125.83 computations, 2 8 memory, and has a success probability of about 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher (there are 6.5 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the longer key, we are able to construct a biclique over 4-round f , so that S 0 = #17.”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is full, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($12 0 ) = ∆ K i ($12 12 ) and ∆ K i ($12 9 ) = ∆ K i ($12 13 ), we have the following property for the ciphertext bytes: C 0 = C 12 and C 9 = C 13 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 3,6,7,10 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The areas of internal states to be recomputed (with 13 S-boxes) are depicted in Figure 6.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 8-round AES-128 yields a key recovery with computational complexity about 2 125.34 , data complexity 2 88 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The success rate of the attack is 1, since we can generate many bicliques for each key group.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The data complexity is 2 120 since one ciphertext byte is always fixed.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Evidently, the groups do not intersect and cover the full key space.”
§ Biclique Cryptanalysis of the Full AES > Step 1.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We have four active S-boxes in round 6 and two active S-boxes in round 8.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For all versions of AES, the number of cryptanalyzed rounds did not increase since then (7 for AES-128, 8 for AES-192 and AES-256), only a decrease in the computational complexity of the key recovery was achieved.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“To construct longer bicliques, we drop the differential independency requirement imposed above and reduce the dimension of the resulting biclique.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The differential trails share some active nonlinear components now.This yields conditions on values that need to be satisfied in a biclique search.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the dimension is inevitably small due to the diffusion, then we use the second advantage: the biclique construction methods based on differential cryptanalysis of block ciphers and hash functions.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the ciphers with nonlinear key schedule, like AES and most AES candidates, this requirement is apparently strong.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We show how to carry over the concept of bicliques to block cipher cryptanalysis and get even more significant results, including the first key recovery method for the full AES faster than brute-force.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“A simple meet-in-the-middle attack requires only a single plaintext/ciphertext pair.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This paradigm is best suited for ciphers with diffusion that is slow with respect to r -m rounds, surprisingly, including AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The limited use of these attacks must be attributed to the requirement for large parts of the cipher to be independent of particular key bits.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Formally introduced in [29], bicliques led to the best preimage attacks on the SHA family of hash functions, including the attack on 50 rounds of SHA-512, and the first attack on a round-reduced Skein hash function.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The independency of the related-key differentials allows one to efficiently construct higherdimensional bicliques and simplifies the coverage of the key space with such bicliques.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Biclique cryptanalysis was first introduced for hash cryptanalysis [29].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, there is little evidence so far that carrying over these techniques to the most practical single-secret-key model is feasible.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity depends on the biclique construction procedure.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also from an information-theoretic point of view, bicliques of dimension 1 are likely to exist in a cipher, regardless of the number of rounds.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We stress here that whenever we speak of differences between keys, these describe differences inside the group of keys that are guessed.We never need access to decryptions under keys that are related by those differences, i.e. the attacks we describe are always in the single-key model.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, the construction of long bicliques of high dimension appears to be a very difficult task for primitives with fast diffusion [37].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [25] Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001) source
- Not checked — no full text of the sourcecites [30] Käsper, E., Rijmen, V., Bjørstad, T.E., Rechberger, C., Robshaw, M.J.B., Sekar, G.: Correlated Keystreams in Moustique. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 246–257. Springer, Heidelberg (2008) source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The disadvantage of this paradigm is that the construction of bicliques for many rounds is very difficult.Therefore, we are limited in the total number of rounds that we can attack.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“that the local collision approach can facilitate an attack in the more practical and relevant single-key model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Secondly, the attack gets a compact and small description, since the independent trails are generally short and self-explaining.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our second paradigm lets the attacker exploit the diffusion properties rather than differential, and does not aim to construct the longest biclique.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The advantage comes from the fact that in case of high dimension the basic computation has negligible cost, and the full complexity is determined by the amount of precomputation.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast, it proposes to construct shorter bicliques with high dimension by tools like independent related-key differentials (Section 3.1).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We checked the distribution of super-box output differences.We checked that it is random enough where we require randomness, though some non-random behavior was detected and might be important for constructing bicliques of high dimension over super-boxes.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified all truncated differentials through 8-round and 10-round AES-128 key-schedules, and through 9-round AES-256 key-schedule.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The attacks with independent bicliques -which lead to the key recovery for the full AES -allow us to be very precise about the required computations.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“For the attacks with long bicliques, whenever it is difficult to be precise about certain parts of our estimates, we choose to be conservative, potentially resulting in an underestimate of the claimed improvement.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Whereas using key-schedule properties in related-key attacks is natural, there seem only a few examples in the literature where this is used in the arguably more relevant single-key setting.This includes the attack on the self-synchronized stream cipher Moustique [28], the lightweight block cipher KTANTAN [12], and recent improvements upon attacks on 8-rounds of AES-192 and AES-256 [20].”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Not checked — no full text of the sourcecites [28] Guo, J., Ling, S., Rechberger, C., Wang, H.: Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 56–75. Springer, Heidelberg (2010) source
- Not checked yetcites [12] Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique Cryptanalysis of the Full AES. Cryptology ePrint Archive, Report 2011/449 (2011), http://eprint.iacr.org/2011/449
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We implemented the technically most complex part of one of our attacks: the long-biclique construction (for the AES-256 attack).”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The AES-128 key schedule bijectively maps each key to subkey $8.
“Since the AES-128 key schedule bijectively maps each key to $8, the enumeration is well-defined.”
The paper relies on this without support.
The AES-192 key schedule bijectively maps each key to $9||$10 L.
“Since the AES-192 key schedule bijectively maps each key to $9||$10 L , the enumeration is well-defined.”
The paper relies on this without support.
The AES-256 key schedule bijectively maps each key to $12||$13.
“Since the AES-256 key schedule bijectively maps each key to $12||$13, the enumeration is well-defined.”
The paper relies on this without support.
No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
“To the best of our knowledge, there are no generic methods known that would speed-up key-recovery attacks given a part of the codebook.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 14.64 | 2 8 | 2 254.64”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“C i = f K[i,j] (S j ) for all i, j ∈ {0, . . . , 2 d -1}.(1)”
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“In other words, in a biclique, the key K[i, j] maps the internal state S i to the ciphertext C j and vice versa.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 13.68 | 2 8 | 2 189.68”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
Citations
Cites
Lecture Notes in Computer Science 1205
(1999) · Industrial Robot the international journal of robotics research and application · doi:10.1108/ir.1999.04926fae.001 · Cited by 39,228
Differential cryptanalysis of DES-like cryptosystems
Biham, E., & Shamir, A. (1991) · Journal of Cryptology · doi:10.1007/bf00630563 · Cited by 2,914
The design of Rijndael AES - the advanced encryption standard
Daemen, J., & Rijmen, V. (2002) · Cited by 2,876
Linear Cryptanalysis Method for DES Cipher
Matsui, M. (1994) · Lecture Notes in Computer Science · doi:10.1007/3-540-48285-7_33 · Cited by 2,748
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437
How to Break MD5 and Other Hash Functions
Wang, X., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11426639_2 · Cited by 1,465
Finding Collisions in the Full SHA-1
Wang, X., Yin, Y. L., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11535218_2 · Cited by 1,442
Daemen, J., Knudsen, L. R., & Rijmen, V. (1997) · Lecture notes in computer science · doi:10.1007/bfb0052343 · Cited by 726
Differential Cryptanalysis of DES-like Cryptosystems
Biham, E., & Adi Shamir, Z. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_1 · Cited by 660
Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48519-8_12 · Cited by 607
Research works printed but not linked: 1
- Bahrak, B., Aref, M.R.: A Novel Impossible Differential Cryptanalysis of AES. In: Lucks, S., Sadeghi, A.-R., Wolf, C. (eds.) WEWoRC 2007. LNCS, vol. 4945, pp. 152–156. Springer, Heidelberg (2008)
Cited by
Sorted by citations
PRINCE – A Low-Latency Block Cipher for Pervasive Computing Applications
Borghoff, J., Canteaut, A., Güneysu, T. E., Kavun, E. B., Knežević, M., Knudsen, L. R., Leander, G., Nikov, V., Paar, C., Rechberger, C., et al. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34961-4_14 · Cited by 785
Self-citationMidori: A Block Cipher for Low Energy
Banik, S., Bogdanov, A., Isobe, T., Shibutani, K., Hiwatari, H., Akishita, T., & Regazzoni, F. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48800-3_17 · Cited by 500
“The condition for the initial structure (IS) [30], also called independent biclique [11], is that key differential trails in the forward direction and those in the backward direction do not share active non-linear components.”
BackgroundSelf-citationThakor, V. A., Razzaque, M. A., & Khandaker, M. R. A. (2021) · IEEE Access · doi:10.1109/access.2021.3052867 · Cited by 424
A review of lightweight block ciphers
Hatzivasilis, G., Fysarakis, K., Papaefstathiou, I., & Manifavas, C. (2017) · Journal of Cryptographic Engineering · doi:10.1007/s13389-017-0160-y · Cited by 260
LEA: A 128-Bit Block Cipher for Fast Encryption on Common Processors
Hong, D., Lee, J., Kim, D.-C., Kwon, D., Ryu, K. H., & Lee, D. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-05149-9_1 · Cited by 244
“In [14], Bogdanov et al.”
BackgroundMethod
Metadata
- Authors
- Bogdanov, A., Khovratovich, D., & Rechberger, C.
- Affiliations
- KU Leuven (BE)
- Microsoft (United States) (US)
- Orange (France) (FR)
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Berlin Heidelberg
- Published
- 2011
- Volume
- 2011
- Pages
- 344-371
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W1515595447
- Cited by
- 546
- References
- 56
- Citations by year
- 2026: 9 · 2025: 15 · 2024: 23 · 2023: 25 · 2022: 22 · 2021: 36 · 2020: 33 · 2019: 41 · 2018: 29 · 2017: 36 · 2016: 38 · 2015: 71 · 2014: 53 · 2013: 54 · 2012: 55
- FWCI
- 42.07
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Licence
- other-oa
- Locations
- Lecture notes in computer science (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- IACR Cryptology ePrint Archive (submittedVersion)
- Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion)
- Funders
- European Commission
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Advanced Encryption Standard, AES-128, AES-192, AES-256, key recovery, block cipher cryptanalysis, compression function, Rijndael
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-23, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-23 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
