The DOI matches its Crossref record; 57 of the 57 references it cites were found in a registry or an index; 14 of the 32 sources its claims cite were checked for support.
Biclique Cryptanalysis of the Full AES
Open accessOverview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper introduces biclique cryptanalysis and presents the first key-recovery attacks on the full AES-128, AES-192, and AES-256 faster than brute force, with complexities \(2^{126.1}\), \(2^{189.7}\), and \(2^{254.4}\), respectively. The attacks are in the single-key model and, because of their high computational complexity, do not threaten practical AES use.
Key findings
- First key recovery on full AES-128 with complexity \(2^{126.1}\), full AES-192 with \(2^{189.7}\), and full AES-256 with \(2^{254.4}\); the paper reports an advantage of about a factor 3 to 5 over brute force depending on version.
- Reduced-round and hash-mode results include 8-round AES-128 at \(2^{124.9}\), 9-round AES-192 at \(2^{188.8}\), 9-round AES-256 at \(2^{251.92}\), and compression-function preimages for full AES-128 (Miyaguchi-Preneel) at \(2^{125.83}\), AES-192 (Davies-Meyer) at \(2^{125.71}\), and AES-256 (Davies-Meyer) at \(2^{126.35}\), with success rate 0.632 for the preimage attacks.
- The full-AES independent-biclique attacks use data complexities of \(2^{88}\), \(2^{80}\), and \(2^{40}\) plaintext-ciphertext pairs for AES-128, AES-192, and AES-256, respectively, with memory \(2^8\) and success probability 1.
- The attacks do not assume related keys; most need only a small part of the codebook, and the paper reports practical verification of truncated differentials and the long-biclique construction for AES-256.
Methods
- Biclique cryptanalysis partitions the key space into groups of \(2^{2d}\) keys indexed as \(K[i,j]\), constructs a \(d\)-dimensional biclique satisfying \(C_i = f_{K[i,j]}(S_j)\), and uses meet-in-the-middle/matching with precomputations to test \(2^{2d}\) keys with about \(2^d\) computations.
- Two paradigms are used: long bicliques for remaining rounds via dependent related-key differential trails, and independent bicliques via independent related-key differentials plus matching with precomputations; the latter yields the full-AES key-recovery attacks.
- The analysis is theoretical cryptanalysis of AES-128/192/256 and AES-based hash modes; complexity is evaluated by counting recomputed S-boxes, MixColumns operations, and key-schedule operations, with tables summarizing parameters and complexities.
Limitations
- The paper states that the attacks are of high computational complexity and “do not threaten the practical use of AES in any way.”
- The paper states that the long-biclique paradigm has very difficult biclique construction for many rounds, limiting the total number of rounds attacked, and that its data complexity can be very large.
- Evident from the text: practical verification is partial rather than a full attack run—the authors verified truncated differentials, implemented the technically most complex long-biclique construction for AES-256, and checked super-box output differences, but did not execute the full key-recovery attacks.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
101 No basis given · 49 Own interpretation · 15 Own result · 8 Own method · 6 No full text of the sources · 3 Couldn’t confirm · 2 Supported · 2 Partly supported · 1 Supported so far · 1 Mixed support · 1 Not checked yet · accuracy not yet measured
Some cited sources support this claim and some don’t — read each source’s verdict below.
In the paper
“So far the most well-known attempt is the analysis of AES with local collisions [8][9][10][11], but it is only applicable to the relatedkey model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [8] Biryukov, A., Dunkelman, O., Keller, N., Khovratovich, D., Shamir, A.: Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 299–319. Springer, Heidelberg (2010) source
- Partly supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe the paper’s local-collision attacks on AES-192 and AES-256 as related-key attacks. Section 4.1 explains the related-key model used. The paper does not establish the broader claim that analysis of AES with local collisions is only applicable in that model; page numbers are unavailable in our copy. (LLM, conf=0.85)
- Disputedcites [10] Biryukov, A., Khovratovich, D., Nikolić, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 231–249. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (page not provided) says the authors use local collisions to construct a chosen-key distinguisher for AES-256, not only a related-key attack. Section 2 (page not provided) likewise presents a chosen-key distinguisher, contradicting the claimed restriction to the related-key model. (LLM, conf=0.90)
Checked by a reasoning model — may be wrong.
- Partly supportedcites [11] Biryukov, A., Nikolić, I.: Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others. In: Gilbert, H. (ed.) EUROCRYPT 2010. LNCS, vol. 6110, pp. 322–344. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction describes related-key differential analysis of AES, including characteristics used in an AES-256 attack. It does not identify that analysis as using local collisions or say that local-collision analysis of AES is only applicable in the related-key model. (LLM, conf=0.78)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Though many papers have been published on the cryptanalysis of AES, the fastest single-key attacks on round-reduced AES variants [20,33] so far are only slightly more powerful than those proposed 10 years ago [23,24].”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven-round AES, but does not compare the fastest single-key attacks with attacks from ten years earlier. Searches for that comparison and for single-key attacks on reduced-round AES found no passage addressing it in our copy. (LLM, conf=0.75)
- Could not verifycites [23] Dunkelman, O., Keller, N., Shamir, A.: A Practical-Time Related-Key Attack on the KASUMI Cryptosystem Used in GSM and 3G Telephony. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 393–410. Springer, Heidelberg (2010) sourceExperimental — accuracy not yet measured
The Introduction and Summary discuss related-key attacks on KASUMI, not the relative strength of single-key attacks on round-reduced AES. A reference lists a reduced-round AES attack, but our copy does not compare AES attacks with those proposed ten years earlier (searched for single-key AES attacks and that comparison). (LLM, conf=0.76)
- Not checked — no full text of the sourcecites [24] Dunkelman, O., Sekar, G., Preneel, B.: Improved Meet-in-the-Middle Attacks on Reduced-Round DES. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 86–100. Springer, Heidelberg (2007) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The sources with a verdict support this claim; the rest weren’t checked yet, have no full text we could read, or their verdicts aren’t rated yet.
In the paper
“With respect to AES, probably the most powerful singlekey recovery methods designed so far are impossible differential cryptanalysis [5,33] and Square attacks [14,20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) source
The Introduction identifies impossible differential cryptanalysis as the technique this paper applies to IDEA and Khufu, including its use for key elimination. The citation is attached to that method; the broader judgment about which methods are most powerful for AES is the citing authors’ framing, not a finding attributed specifically to this paper. (LLM, conf=0.87)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for reduced-round AES, not single-key recovery methods. The Rebound Attack section (p. 3) discusses AES-based hash functions. Searches for impossible differential cryptanalysis, Square attacks, and AES key recovery found no passage assessing the claimed methods. (LLM, conf=0.73)
- Not checked — no full text of the sourcecites [14] Bouillaguet, C., Derbez, P., Fouque, P.-A.: Automatic Search of Attacks on Round-Reduced AES and Applications. In: Rogaway, P. (ed.) CRYPTO 2011. LNCS, vol. 6841, pp. 169–187. Springer, Heidelberg (2011) source
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Also, as already observed in [19,37], the fact that the MixColumn transformation is omitted in the last round of AES helps to design attacks for more rounds.”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Partly supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) sourceExperimental — accuracy not yet measured
Section 2 (page unavailable) says that AES has no MixColumn operation in its final round. Section 5.2 (page unavailable) describes extending the attack to eight rounds by searching the last-round key, but does not say that omitting MixColumn enables the extension. The claimed causal link is therefore not established by our copy. (LLM, conf=0.83)
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“-Preimage attacks on compression functions based on the full AES versions.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-256 with computational complexity 2 254.4 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-192 with computational complexity 2 189.7 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The first key recovery attack on the full AES-128 with computational complexity 2 126.1 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We also provide complexities for finding compression function preimages for all full versions of AES when considered in hash mode.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 32
- It may state two separate claims as one. 34
- The quote only partly states this claim. 6
Every source the paper cites for this claim was checked and supports it.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [9] Biryukov, A., Khovratovich, D.: Related-Key Cryptanalysis of the Full AES-192 and AES-256. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 1–18. Springer, Heidelberg (2009) source
The Abstract states that the paper presents two related-key attacks on the full AES, one against AES-256 and the other against the full AES-192. The Introduction also explicitly describes attacks on both full variants. (LLM, conf=0.94)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“AES with its wide-trail strategy was designed to withstand differential and linear cryptanalyses [15], so pure versions of these techniques have limited applications in attacks.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [15] Chabaud, F., Joux, A.: Differential Collisions in SHA-0. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS, vol. 1462, pp. 56–71. Springer, Heidelberg (1998) sourceExperimental — accuracy not yet measured
The Conclusion discusses a differential attack on SHA-0 and the expansion of SHA-1, not AES. Searches for AES, Rijndael, the wide-trail strategy, and resistance to differential and linear cryptanalysis found no passage addressing the attributed claim in our copy. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“The impossible differential cryptanalysis yielded the first attack on 7-round AES-128 with non-marginal data complexity.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Could not verifycites [5] Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999) sourceExperimental — accuracy not yet measured
The Abstract and §1 Introduction describe impossible-differential attacks on IDEA and Khufu, not AES-128. Searches for a first 7-round AES-128 attack and its data complexity found no passage addressing that result; the 7-round impossible differential mentioned in §4 concerns DES. (LLM, conf=0.76)
- Could not verifycites [33] Lamberger, M., Mendel, F., Rechberger, C., Rijmen, V., Schläffer, M.: Rebound Distinguishers: Results on the Full Whirlpool Compression Function. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 126–143. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
The Introduction (p. 2) mentions known-key distinguishers for seven rounds of AES, while the paper’s own contribution concerns rebound attacks on Whirlpool. Searches for impossible differential cryptanalysis, AES-128, and the claimed data complexity found no passage addressing the asserted first attack. (LLM, conf=0.76)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“As a result, the number of rounds broken with this technique is rather small [19], which seems to prevent it from producing results on yet unbroken 8-, 9-, and 10-round (full) AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Supportedcites [19] Demirci, H., Selçuk, A.A.: A Meet-in-the-Middle Attack on 8-Round AES. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 116–126. Springer, Heidelberg (2008) source
The Abstract and Conclusion report meet-in-the-middle attacks on 7 rounds of AES-192 and up to 8 rounds of AES-256. The Introduction states that full AES-192 and AES-256 have 12 and 14 rounds, respectively, supporting the cited point that this technique breaks relatively few rounds. The sentence’s suggestion about future results is the citing authors’ inference, not a finding attributed to this source. (LLM, conf=0.91)
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The new approach originates from the so-called spliceand-cut framework [1,2,26] in the hash function cryptanalysis, more specifically its element called initial structure.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Partly supportedcites [1] Aoki, K., Sasaki, Y.: Preimage Attacks on One-Block MD4, 63-Step MD5 and More. In: Avanzi, R.M., Keliher, L., Sica, F. (eds.) SAC 2008. LNCS, vol. 5381, pp. 103–119. Springer, Heidelberg (2009) sourceExperimental — accuracy not yet measured
In the section introducing Technique 1: Splice-and-Cut (page not available), the paper proposes and explains the splice-and-cut technique for hash-function preimage attacks. Our copy does not call any element of that technique an “initial structure,” so it supports the framework connection but not that more specific attribution. (LLM, conf=0.84)
- Not checked — no full text of the sourcecites [2] Aoki, K., Sasaki, Y.: Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 70–89. Springer, Heidelberg (2009) source
- Not checked — no full text of the sourcecites [26] Gilbert, H., Minier, M.: A Collision Attack on 7 Rounds of Rijndael. In: AES Candidate Conference, pp. 230–241 (2000)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-Attacks with lower complexity on the reduced-round versions of AES not considered before, including an attack on 8-round AES-128 with complexity 2 124.9 .”
§ Biclique Cryptanalysis of the Full AES > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We have studied several block ciphers and hash functions, including different variants of AES, and it turns out that the optimal choice depends on a primitive, its diffusion properties, and features of the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 4 Two Paradigms of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The attacks with lowest computational complexities follow the paradigm of independent bicliques and have success rate 1.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For longer keys some bicliques are filtered out.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The biclique cryptanalysis successfully applies to all full versions of AES and compared to brute-force provides an advantage of about a factor 3 to 5, depending on the version, Also, it yields advantages of up to factor 15 for the key recovery of round-reduced AES variants with numbers of rounds higher than those cryptanalyed before.”
§ Biclique Cryptanalysis of the Full AES > Results on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Regarding the forward direction, the whitening subkeys $0 differ in 4 bytes only, which makes only four S-boxes to recompute.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-192 in Davies-Meyer mode requires about 2 125.71 computations, 2 8 memory, and has success rate 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Our attack always outputs the right key as soon as it belongs to one of the quartets produced in the attack.”
§ Biclique Cryptanalysis of the Full AES > 9.3 Success rate
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 9-round AES-192 yields a key recovery with computational complexity about 2 188.8 , data complexity 2 80 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i and j, respectively, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 3.4375 SubBytes operations (i.e., 55 S-boxes), 2.3125 MixColumns operations, and a negligible amount of XORs in the key schedule.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that the difference in the relevant subkeys is a linear function of i, and hence can be precomputed and stored.”
§ Biclique Cryptanalysis of the Full AES > Backward direction.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The difference is no longer a linear function of j as it is in the computation of ←v , but still requires only three s-boxes in the key schedule to recompute.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The precomputation of about 2 d+1 matches allows for a significant complexity gain and is the major source of the computational advantage of our attacks on AES.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Similarly, preimage search for the compression function of the full AES-128 in Miyaguchi-Preneel mode requires about 2 125.83 computations, 2 8 memory, and has a success probability of about 0.6321.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher (there are 6.5 key schedule rounds).”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Thanks to the longer key, we are able to construct a biclique over 4-round f , so that S 0 = #17.”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is full, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Furthermore, since ∆ K i ($12 0 ) = ∆ K i ($12 12 ) and ∆ K i ($12 9 ) = ∆ K i ($12 13 ), we have the following property for the ciphertext bytes: C 0 = C 12 and C 9 = C 13 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Since the ∆ i -differential affects only 12 bytes of the ciphertext, all the ciphertexts share the same values in bytes C 3,6,7,10 .”
§ Biclique Cryptanalysis of the Full AES > 7.2 4-Round Biclique
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The areas of internal states to be recomputed (with 13 S-boxes) are depicted in Figure 6.”
§ Biclique Cryptanalysis of the Full AES > 6.2 3-Round Biclique of Dimension 8
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This approach for 8-round AES-128 yields a key recovery with computational complexity about 2 125.34 , data complexity 2 88 , memory complexity 2 8 , and success probability 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The success rate of the attack is 1, since we can generate many bicliques for each key group.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The data complexity is 2 120 since one ciphertext byte is always fixed.”
§ Biclique Cryptanalysis of the Full AES > Step 6.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The use of bicliques in combination with the technique of matching with precomputation, results in a surprisingly low recomputation in the innermost loop, varying from about 1/3 to approximately 1/5 of the cipher depending on the key size, while having data complexities of 2 88 , 2 80 and 2 40 plaintext-ciphertext pairs, respectively.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Evidently, the groups do not intersect and cover the full key space.”
§ Biclique Cryptanalysis of the Full AES > Step 1.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“We have four active S-boxes in round 6 and two active S-boxes in round 8.”
§ Biclique Cryptanalysis of the Full AES > Step 2 (b).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent.”
§ Biclique Cryptanalysis of the Full AES > Abstract
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For all versions of AES, the number of cryptanalyzed rounds did not increase since then (7 for AES-128, 8 for AES-192 and AES-256), only a decrease in the computational complexity of the key recovery was achieved.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“To construct longer bicliques, we drop the differential independency requirement imposed above and reduce the dimension of the resulting biclique.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The differential trails share some active nonlinear components now.This yields conditions on values that need to be satisfied in a biclique search.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the dimension is inevitably small due to the diffusion, then we use the second advantage: the biclique construction methods based on differential cryptanalysis of block ciphers and hash functions.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the ciphers with nonlinear key schedule, like AES and most AES candidates, this requirement is apparently strong.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“We show how to carry over the concept of bicliques to block cipher cryptanalysis and get even more significant results, including the first key recovery method for the full AES faster than brute-force.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“A simple meet-in-the-middle attack requires only a single plaintext/ciphertext pair.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This paradigm is best suited for ciphers with diffusion that is slow with respect to r -m rounds, surprisingly, including AES.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The limited use of these attacks must be attributed to the requirement for large parts of the cipher to be independent of particular key bits.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Formally introduced in [29], bicliques led to the best preimage attacks on the SHA family of hash functions, including the attack on 50 rounds of SHA-512, and the first attack on a round-reduced Skein hash function.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The independency of the related-key differentials allows one to efficiently construct higherdimensional bicliques and simplifies the coverage of the key space with such bicliques.”
§ Biclique Cryptanalysis of the Full AES > 3.1 Bicliques from Independent Related-Key Differentials
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Biclique cryptanalysis was first introduced for hash cryptanalysis [29].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [29] Isobe, T.: A Single-Key Attack on the Full GOST Block Cipher. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 290–305. Springer, Heidelberg (2011) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“However, there is little evidence so far that carrying over these techniques to the most practical single-secret-key model is feasible.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The memory complexity depends on the biclique construction procedure.”
§ Biclique Cryptanalysis of the Full AES > Complexity of Key Recovery
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also from an information-theoretic point of view, bicliques of dimension 1 are likely to exist in a cipher, regardless of the number of rounds.”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“We stress here that whenever we speak of differences between keys, these describe differences inside the group of keys that are guessed.We never need access to decryptions under keys that are related by those differences, i.e. the attacks we describe are always in the single-key model.”
§ Biclique Cryptanalysis of the Full AES > 3.2 Bicliques from Interleaving Related-Key Differential Trails
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“The Square attack and its variations such as integral attack and multiset attack resulted in the cryptanalysis of round-reduced AES variants with lowest computational complexity to date, while the first attack on 8-round AES-192 with non-marginal data complexity has appeared only recently [20].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, the construction of long bicliques of high dimension appears to be a very difficult task for primitives with fast diffusion [37].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [37] Matsui, M.: Linear Cryptanalysis Method for DES Cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994) source
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A claim is checked only against the cited paper’s full text, never its abstract, and none is available for its sources.
In the paper
“The situation is different in weaker attack models, where the related-key cryptanalysis was applied to the full versions of AES-192 and AES-256 [9], and the rebound attack demonstrated a non-random property in 8-round AES-128 [25,30].”
§ Biclique Cryptanalysis of the Full AES > State of the art for attacks on AES.
What the sources say
- Not checked — no full text of the sourcecites [25] Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 213–230. Springer, Heidelberg (2001) source
- Not checked — no full text of the sourcecites [30] Käsper, E., Rijmen, V., Bjørstad, T.E., Rechberger, C., Robshaw, M.J.B., Sekar, G.: Correlated Keystreams in Moustique. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 246–257. Springer, Heidelberg (2008) source
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The disadvantage of this paradigm is that the construction of bicliques for many rounds is very difficult.Therefore, we are limited in the total number of rounds that we can attack.”
§ Biclique Cryptanalysis of the Full AES > 4.1 Long Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“that the local collision approach can facilitate an attack in the more practical and relevant single-key model.”
§ Biclique Cryptanalysis of the Full AES > 1 Introduction
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Secondly, the attack gets a compact and small description, since the independent trails are generally short and self-explaining.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Since the coverage of the key space by groups around base keys is complete, the success probability is 1.”
§ Biclique Cryptanalysis of the Full AES > 6.4 Complexities
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Our second paradigm lets the attacker exploit the diffusion properties rather than differential, and does not aim to construct the longest biclique.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The advantage comes from the fact that in case of high dimension the basic computation has negligible cost, and the full complexity is determined by the amount of precomputation.”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In contrast, it proposes to construct shorter bicliques with high dimension by tools like independent related-key differentials (Section 3.1).”
§ Biclique Cryptanalysis of the Full AES > 4.2 Independent Bicliques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We checked the distribution of super-box output differences.We checked that it is random enough where we require randomness, though some non-random behavior was detected and might be important for constructing bicliques of high dimension over super-boxes.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We verified all truncated differentials through 8-round and 10-round AES-128 key-schedules, and through 9-round AES-256 key-schedule.”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“-The attacks with independent bicliques -which lead to the key recovery for the full AES -allow us to be very precise about the required computations.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“For the attacks with long bicliques, whenever it is difficult to be precise about certain parts of our estimates, we choose to be conservative, potentially resulting in an underestimate of the claimed improvement.”
§ Biclique Cryptanalysis of the Full AES > 12.2 On the computational advantage of the biclique techniques
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“Whereas using key-schedule properties in related-key attacks is natural, there seem only a few examples in the literature where this is used in the arguably more relevant single-key setting.This includes the attack on the self-synchronized stream cipher Moustique [28], the lightweight block cipher KTANTAN [12], and recent improvements upon attacks on 8-rounds of AES-192 and AES-256 [20].”
§ Biclique Cryptanalysis of the Full AES > 12.1 What properties of the AES allowed to obtain these new results
What the sources say
- Not checked — no full text of the sourcecites [28] Guo, J., Ling, S., Rechberger, C., Wang, H.: Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 56–75. Springer, Heidelberg (2010) source
- Not checked yetcites [12] Bogdanov, A., Khovratovich, D., Rechberger, C.: Biclique Cryptanalysis of the Full AES. Cryptology ePrint Archive, Report 2011/449 (2011), http://eprint.iacr.org/2011/449
- Not checked — no full text of the sourcecites [20] Demirci, H., Taşkın, İ., Çoban, M., Baysal, A.: Improved Meet-in-the-Middle Attacks on AES. In: Roy, B., Sendrier, N. (eds.) INDOCRYPT 2009. LNCS, vol. 5922, pp. 144–156. Springer, Heidelberg (2009) source
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“-We implemented the technically most complex part of one of our attacks: the long-biclique construction (for the AES-256 attack).”
§ Biclique Cryptanalysis of the Full AES > 11 On practical verification
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper relies on this without support.
The AES-128 key schedule bijectively maps each key to subkey $8.
“Since the AES-128 key schedule bijectively maps each key to $8, the enumeration is well-defined.”
The paper relies on this without support.
The AES-192 key schedule bijectively maps each key to $9||$10 L.
“Since the AES-192 key schedule bijectively maps each key to $9||$10 L , the enumeration is well-defined.”
The paper relies on this without support.
The AES-256 key schedule bijectively maps each key to $12||$13.
“Since the AES-256 key schedule bijectively maps each key to $12||$13, the enumeration is well-defined.”
The paper relies on this without support.
No generic methods are known that would speed up key-recovery attacks given a part of the codebook.
“To the best of our knowledge, there are no generic methods known that would speed-up key-recovery attacks given a part of the codebook.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
The cited source says what the claim attributes to it.
In the citing paper
“AES-128 is preferred over AES-256 for the threat model of scientific archives with embargo periods of months to a few years: the best known cryptanalysis, the biclique attack of Bogdanov et al. (2011), requires approximately 2 126 operations, which remains computationally infeasible by orders of magnitude.”
From A high-throughput AES-GCM implementation on GPUs for secure, policy-based access to massive astronomical catalogs (2026) · cites this paper as Bogdanov et al. (2011)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated major: it would touch a result — a value a result rests on, reported and recomputed p-values on opposite sides of the significance level, two passages that conflict with no sign which is right, or a cited work retracted before this paper was published.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“The full computational complexity amounts to about 2 240 • 2 9 + 2 14.383 = 2 254.42 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 14.64 | 2 8 | 2 254.64”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“C i = f K[i,j] (S j ) for all i, j ∈ {0, . . . , 2 d -1}.(1)”
§ Biclique Cryptanalysis of the Full AES > 2.2 Bicliques
“In other words, in a biclique, the key K[i, j] maps the internal state S i to the ciphertext C j and vice versa.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“Altogether, we need an equivalent of 5.4375 SubBytes operations compared to the equivalent of 17.25 in the full cipher”
§ Biclique Cryptanalysis of the Full AES > 8.4 Complexities
“As a result, C recomp is equivalent to 2 16 • 5.625/17.25 = 2 14.383 runs of the full AES-256.”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 12.3 Open Problems
“2 13 | 2 7 | 2 7 | 2 13.68 | 2 8 | 2 189.68”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Biclique Cryptanalysis of the Full AES > 7.3 Matching over 8 Rounds
“The full computational complexity amounts to about 2 172 • 2 9 + 2 13.68 = 2 189.74 .”
§ Biclique Cryptanalysis of the Full AES > 7.1 Key Partitioning
“This yields the partition of the AES-192 key space by the 2 176 groups of 2 16 keys each.”
Citations
Cites
Lecture Notes in Computer Science 1205
(1999) · Industrial Robot the international journal of robotics research and application · doi:10.1108/ir.1999.04926fae.001 · Cited by 39,228
Differential cryptanalysis of DES-like cryptosystems
Biham, E., & Shamir, A. (1991) · Journal of Cryptology · doi:10.1007/bf00630563 · Cited by 2,914
The design of Rijndael AES - the advanced encryption standard
Daemen, J., & Rijmen, V. (2002) · Cited by 2,876
Linear Cryptanalysis Method for DES Cipher
Matsui, M. (1994) · Lecture Notes in Computer Science · doi:10.1007/3-540-48285-7_33 · Cited by 2,748
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437
How to Break MD5 and Other Hash Functions
Wang, X., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11426639_2 · Cited by 1,465
Finding Collisions in the Full SHA-1
Wang, X., Yin, Y. L., & Yu, H. (2005) · Lecture notes in computer science · doi:10.1007/11535218_2 · Cited by 1,442
Daemen, J., Knudsen, L. R., & Rijmen, V. (1997) · Lecture notes in computer science · doi:10.1007/bfb0052343 · Cited by 726
Differential Cryptanalysis of DES-like Cryptosystems
Biham, E., & Adi Shamir, Z. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_1 · Cited by 660
Wagner, D. A. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48519-8_12 · Cited by 607
Research works printed but not linked: 1
- Bahrak, B., Aref, M.R.: A Novel Impossible Differential Cryptanalysis of AES. In: Lucks, S., Sadeghi, A.-R., Wolf, C. (eds.) WEWoRC 2007. LNCS, vol. 4945, pp. 152–156. Springer, Heidelberg (2008)
Cited by
Sorted by citations
PRINCE – A Low-Latency Block Cipher for Pervasive Computing Applications
Borghoff, J., Canteaut, A., Güneysu, T. E., Kavun, E. B., Knežević, M., Knudsen, L. R., Leander, G., Nikov, V., Paar, C., Rechberger, C., et al. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-34961-4_14 · Cited by 785
Self-citationMidori: A Block Cipher for Low Energy
Banik, S., Bogdanov, A., Isobe, T., Shibutani, K., Hiwatari, H., Akishita, T., & Regazzoni, F. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48800-3_17 · Cited by 500
“The condition for the initial structure (IS) [30], also called independent biclique [11], is that key differential trails in the forward direction and those in the backward direction do not share active non-linear components.”
BackgroundSelf-citationThakor, V. A., Razzaque, M. A., & Khandaker, M. R. A. (2021) · IEEE Access · doi:10.1109/access.2021.3052867 · Cited by 424
A review of lightweight block ciphers
Hatzivasilis, G., Fysarakis, K., Papaefstathiou, I., & Manifavas, C. (2017) · Journal of Cryptographic Engineering · doi:10.1007/s13389-017-0160-y · Cited by 260
LEA: A 128-Bit Block Cipher for Fast Encryption on Common Processors
Hong, D., Lee, J., Kim, D.-C., Kwon, D., Ryu, K. H., & Lee, D. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-05149-9_1 · Cited by 244
“In [14], Bogdanov et al.”
BackgroundMethod
Metadata
- Authors
- Bogdanov, A., Khovratovich, D., & Rechberger, C.
- Affiliations
- KU Leuven (BE)
- Microsoft (United States) (US)
- Orange (France) (FR)
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Berlin Heidelberg
- Published
- 2011
- Volume
- 2011
- Pages
- 344-371
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W1515595447
- Cited by
- 546
- References
- 56
- Citations by year
- 2026: 9 · 2025: 15 · 2024: 23 · 2023: 25 · 2022: 22 · 2021: 36 · 2020: 33 · 2019: 41 · 2018: 29 · 2017: 36 · 2016: 38 · 2015: 71 · 2014: 53 · 2013: 54 · 2012: 55
- FWCI
- 42.07
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Licence
- other-oa
- Locations
- Lecture notes in computer science (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- IACR Cryptology ePrint Archive (submittedVersion)
- Technical University of Denmark, DTU Orbit (Technical University of Denmark, DTU) (submittedVersion)
- Funders
- European Commission
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Mathematics › Discrete Mathematics and Combinatorics › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- Advanced Encryption Standard, AES-128, AES-192, AES-256, key recovery, block cipher cryptanalysis, compression function, Rijndael
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-23, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-23 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
