Security Bound of Biclique Attacks on AES-128

International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 286

Xiaoli Dong1 and Jie Chen2 (Corresponding author: Xiaoli Dong)

School of Cyberspace Security, Xi’an University of Posts and Telecommunications1 Xi’an 710121, China School of Telecommunication Engineering, Xidian University2 Xi’an 710071, China (Email: dxl [email protected]) (Received Aug. 24, 2019; Revised and Accepted Dec. 6, 2019; First Online Feb. 3, 2020)

Abstract a time complexity of 2128.The impossible differential attacks were proposed in [14,15] and the fastest needs a time For two future possible improvements of AES-128: en- complexity of 2117.2. The meet-in-the-middle attack was hanced subkey diffusion property or increased encryp- proposed in [7–9] and the fastest needs a time complexity tion rounds, this paper evaluates the security bound of of 299. In 2011, 10 rounds were successfully broken with a R-Round AES-128 (R > 10) and 10-Round AES-IND- data complexity 288 and a time complexity of 2126.18 when 128 (AES-128 with independent of key schedule) against the biclique attack [3] is applied to AES-128. In 2014, the biclique attack. For attacking R-round AES-128(R > 10), biclique attack [2] was once again improved with a data with the increase of several rounds R, the time complexity complexity of 264 and a time complexity of 2126.12. increases gradually, but it never reaches 2127.86, reduced The biclique attack [3] can be divided into two steps: by about 10% compared with brute force. For attack- biclique exploration from the independent related key dif- ing 10-Round AES-IND-128, a 1-round biclique is firstly ferentials, and then key recovery. In the key recovery constructed, and then the attack is proposed. The time phase of the attack, the recomputation technique is usu- complexity is no more than 2127.42, reduced by about 33% ally adopted to reduce the time complexity. There are compared with brute force. two parts separate components of recomputation: State Keywords: AES; Biclique; Block Cipher; Cryptanalysis recomputation and subkey recomputation. In [3], subkey recomputation is not considered because it is negligible compared to state recomputation. This paper considers 1 Introduction both the two parts of recomputation: State recomputation and subkey recomputation, this is because the sub- Block ciphers are the central tool in the design of pro- key recomputation cannot be ignored for R-Round AES- tocols for symmetric encryption [16]. Since Rijndael [4] 128(R > 10) and 10-Round AES-IND-128 anymore. is the winner of Advanced Encryption Standard (AES) The principle of a biclique attack is to test all the keys in 2000, it has become one of the most widely used Block to discover which is the correct key based on the biclique Ciphers. AES supports 128-bit block size with three dif- structure. Therefore, the complexity of the biclique at- ferent key lengths of 128, 192 and 256 bits, which are tack on the full rounds of any block cipher will never ex- denoted as AES-128, AES-192 and AES-256 respectively. ceed the complexity of the exhaustive key search. If the Due to the popularity of AES, cryptology researchers encryption rounds are increased for AES-128, or if the have increased their focus on its security, such as square diffusion of the key schedule is enhanced, how will the attack [5, 10], collision attack [12],impossible differential complexity of the biclique attack change? attack [14, 15], meet-in-the-middle attack [6–9], biclique In this paper,we study the biclique attack for R-Round attack [3], integral attacks [18],polytopic attacks [19], sub- AES-128(R > 10) and 10-Round AES-IND-128, where space trail cryptanalysis [11], structural-differential at- AES-IND-128 denotes AES-128 independent of the key tacks [13], yoyo tricks [17],Grassi’s Attack [1] and so on. schedule. There are many cryptanalytic results on AES-128. In 1997, the 6-round AES-128 was broken with the square 1) For attacking R-round AES-128 (R > 10),with the attack by the designer of AES [5]. Since 2000, 7-round increasing number of rounds R, the time complexity AES-128 has been broken successively by a series of at- increases gradually, yet it will never reach 2127.86. In tacks as follows. The square attack in [10] requires a data the attack,both state and subkey recomputation are complexity of 2127.997 and a time complexity of 2120. The consided.Prior to performing the attack, properties collision attack in [12]costs a data complexity of 232 and of the recomputation of R-round subkeys are discov- International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 287

ered. Kr denotes the r-round subkey. K−1 = K as a WSK. RotByte(·) denotes the rotation of the word by one byte. 2) For attacking 10-round AES-IND-128,the time com- In this paper, #2r and #(2r + 1) are addressed as 127.42 plexity is 2 . AES-IND-128 includes the prop- the states before SB and the state after MC in round r, erty: the diffusion property is enhanced so that any respectively. subkey byte in any round affects all the subkey bytes in the other rounds in term of the difference. When Property 1. For r-round AES-128, the ratio of one Sub- the diffusion of key schedule is enhanced or the num- Bytes operation to the full AES is σ = 4/5r. ber of encryption rounds is increased, biclique attacks remain effective to AES-128. 3 Chosen-Ciphertext Biclique At- The remainder of this paper is organized as follows. The tack AES block cipher is described in Section 2 and the biclique attack is introduced in Section 3. In Sections 4 and 5, we In this section, we introduce the biclique attack proposed apply the biclique attacks to R-round AES-128 and 10- by Bogdanov et al. [3]. Before the description of the bi- round AES-IND-128, respectively. Finally in Section 6, clique attack, the biclique structure must be denoted: Let the conclusions are drawn from the results. f be subcipher that maps an internal state S to the ciphertext C : fK (S) = C.The 3-tuple [{Ci}, {Sj}, {K[i, j]}] is called a d-dimensional biclique, if Ci = fK[i,j](Sj)(, i, j ∈ 2 Description of AES-128 {0, 1, ··· , 2d − 1}). The biclique attack can be divided into two steps: bi- AES-128 [4] encrypts or decrypts data blocks of 128 bits clique exploration and key recovery. The following sec- by using keys of 128-bits. The number of rounds is 10, tions of this paper will describe both biclique exploration denoted as successively. A 128-bit plaintext and the and key recovery in further detail. interme-diate state are treated as byte matrices of size. The round transformation of AES consists of the four basic transformations: 3.1 Biclique Exploration from the Inde- pendent Related-Key Differentials SubBytes (SB): Applying the same 8-bit to 8-bit invert- ible S-box 16 times in parallel on each byte of the The d-dimensional biclique can be achieved from the in- state. dependent related-key differentials. There are two stages: key partition and then biclique construction. ShiftRows(SR): Cyclically shifting each row (the i’th row is shifted by i bytes to the left). 3.1.1 Key Partition MixColumns (MC): Multiplication of each column by a 2n keys can be divided into 2n−2d groups K(m)(m = 4 × 4 matrix over the field GF (28). 0, 1, ··· , 2n−2d −1), where K(m) is defined to be the m-th key group with 22d keys K(m)[i, j](i, j = (0, 1, ··· , 2d − AddRoundKey (ARK): XORing the state and a subkey. 1)). These keys can be obtained as follows: K K The MC operation is omitted in the last round, and an • Look for the key differentials ∆i , ∇j , such that K K additional ARK operation using a Whitening SubKey ∆i ∩ ∇j = {0}. (WSK) is performed before the first round. K K (m) The Key Schedule(KS) of AES-128 takes the 128-bit • With ∆i , ∇j , determine the base key K [0, 0] in user key and transforms it into 11 subkeys of 128-bits K(m). each.The subkey array is denoted by W ,W , ··· ,W , 0 1 43 Therefore: K(m)[i, j] = K(m)[0, 0] ⊕ ∆K ⊕ ∇K . where each word of consists of 32 bits. K = i j (W ,W ,W ,W ) is the user supplied keys. K = 0 1 2 3 r 3.1.2 Biclique Construction (W4(r+1),W4(r+1)+1,W4(r+1)+2,W4(r+1)+3)(r = 0, ··· , 9) is updated according to the following rule: In each K(m), construct the d-dimension biclique as fol- If lows:

(m) (m) K [0,0] (m) i ≡ 0 mod 4 • Base computation: S0 −−−−−−→ C0 . f then K K • Based on ∆i , ∇j , construct diﬀerentials

Wi ≡ Wi−4 ⊕ SB(RotByte(Wi−1)) ⊕ Rcon(i/4) K (m) ∆i (m) ∆i − differentials : 0 −−→ ∆i , else f K (m) (m) ∇j ∇j − differentials : ∇j −−→ 0. Wi ≡ Wi−4 ⊕ Wi−1. f International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 288

Such that they do not share the active nonlinear compo- • Subkey Recomputation. First, the adversary K (m) K (m) (m) nent, where ∆0 = 0, ∆0 = 0, ∇0 = 0, ∇0 = 0. computes and stores computations K [i, 0] and Therefore it is denoted: K(m)[0, j]. Then, for other K(m)[i, j], it is recomputed only those parts that differ from the stored (m) (m) (m) Sj = S0 ⊕ ∇j ones. C(m) = C(m) ⊕ ∆(m) i 0 i So the full time complexity of the attack is: Cfull = K(m)[i, j] = K(m)[0, 0] ⊕ ∆K ⊕ ∇K l−2d (m) l−2d (m) (m) (m) i j 2 C = 2 [Cbiclique + Cprecomp + Crecomp1 + C(m) + C(m) ], where C(m) is the com- and obtain the definition of a d-dimensional biclique recomp2 falsepos precomp (m) (m) (m) plexity of the precomputation in the key recovery; [{Ci }, {Sj }, {K [i, j]}]. (m) (m) Crecomp1 and Crecomp2 are the complexities of the state and the subkey recomputation in the matching 3.2 Key Recovery under the Chosen- stage,respectively. Ciphertext Attack 3.2.1 Key Recovery Remark 1. Subkey recomputation is ignored in [3],but cannot be ignored on attacks on R-Round AES-128 (R > (m) For each K , based on the d-dimension biclique 10) and 10-Round AES-128-IND. (m) (m) (m) [{Ci }, {Sj }, {K [i, j]}], the key recovery is as follows: • Data Collection: The adversary obtains the 2d plain- 4 Biclique Attack on R-Round (m) texts from the ciphertexts Pi through the decryp- (m) decryption oracle (m) AES-128( R > 10) tion oracle: Ci −−−−−−−−−−−−−→ Pi . e−1 The encryption rounds of AES-128 can be improved to ex- • Key Testing: The block cipher E can be decomposed ceed 10 rounds, therefore biclique attacks are investigated into E : P −→ V −→ S −→ C.For the testing key h g f for R-Round AES-128(R > 10). For the purpose of this K(m)[i, j], the adversary checks whether research a recomputation technique was adopted within (m) section III. With the rounds increased, Crecomp2 becomes (m) (m) (m) K [i,j] (m) ? ←(m) K [i,j] (m) increasingly very critical and complex, so we firstly calcu- Pi −−−−−−→ ~v = v ←−−−−−− Sj g h late the recomputation of the subkeys.Then perform the If the equation holds, the testing key is the secret key biclique attack on R−Round AES-128(R > 10). Ksecret. The full time complexity of the attack is: 4.1 Recomputation of the Subkeys

(m) (m) (m) n−2d (m) n−2d (m) Cfull = 2 C = 2 [Cbiclique +Cmatch +Cfalsepos] The superscript (m) of K(r) [i, j] is not reﬂected in the following lemmas, so it is omitted and denoted as K [i, j]. where C(m) is the complexity of constructing biclique; (r) biclique If we know r-round subkeys K [0, 0], ∆K , ∇K and (m) (r) i j Cmatch is the complexity of the computation of the inter- K K K(r)[i, j] = K(r)[0, 0]⊕∆i ⊕∇j , evaluate recomputation d (m) nal variable v 2 times in each direction; Cfalsepos is the of the (r − 1)-round subkeys K(r−1)[i, j] by the following complexity generated by false positives. lemmas.

3.2.2 The Recomputation Technique Lemma 1. If the value of r-round subkeys K(r)[i, j] is In fact, in order to decrease the time complexity in the known, the evaluatation of the recalculation of the (r −1)- key testing, adopt the recomputation technique. In fact, round subkeys K(r−1)[i, j] is given as follows. there are two parts of recomputation as follows. 1) K(r−1) can be expressed as the linear function of K(r) • State Recomputation. and ∆K(r), so the recomputation for K(r−1) can be ignored, where ∆K = K [i, j] ⊕ K [0, 0]. – Precomputation: The adversary computes and (r) (r) (r) (m) d (m) K [i,0] stores 2 × 2 computations: ∀ i(Pi −−−−−−→ g 2) K(r−1) cannot be expressed as the linear func- (m) (m) (m) K [0,j] (m) tion of K(r) and ∆K(r), so the recomputation for ~v ) and ~v ←−−−−−− Sj . h K(r−1)cannot be ignored. – Recomputation: For particular i and j, the adversary recomputes the states which diﬀer from Proof. K(r),h(h = 0, 1, ··· , 15) denote h-th byte of K(r). the stored ones. If the subkeys in round r are known, the subkeys in round International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 289 r − 1 can be achieved as follows by the key schedule. (2)(3) = K(r),h[i, j] ⊕ S(K(r),8+(h+1) mod 4[0, 0]

⊕∆K(r),8+(h+1) mod 4 K(r−1),0 = K(r),0 ⊕ S(K(r),9 ⊕ K(r),13) ⊕K(r),12+(h+1) mod 4[0, 0] K(r−1),1 = K(r),1 ⊕ S(K(r),10 ⊕ K(r),14) ⊕∆K(r),12+(h+1) mod 4) K(r−1),2 = K(r),2 ⊕ S(K(r),11 ⊕ K(r),15) (1) K(r−1),3 = K(r),3 ⊕ S(K(r),8 ⊕ K(r),12) = K(r),h[0, 0] ⊕ ∆K(r),h

K(r−1),4 = K(r),0 ⊕ K(r),4 ⊕S(K(r),8+(h+1) mod 4[0, 0]

K(r−1),5 = K(r),1 ⊕ K(r),5 ⊕∆K(r),8+(h+1) mod 4

K(r−1),6 = K(r),2 ⊕ K(r),6 ⊕K(r),12+(h+1) mod 4[0, 0]

K(r−1),7 = K(r),3 ⊕ K(r),7 ⊕∆K(r),12+(h+1) mod 4) K(r−1),8 = K(r),4 ⊕ K(r),8 (4) = K(r−1),h[0, 0] ⊕ ∆K(r),h K(r−1),9 = K(r),5 ⊕ K(r),9 ⊕S(K(r),8+(h+1) mod 4[0, 0] K(r−1),10 = K(r),6 ⊕ K(r),10 ⊕K(r),12+(h+1) mod 4[0, 0]) K(r−1),11 = K(r),7 ⊕ K(r),11 ⊕S(K(r),8+(h+1) mod 4[0, 0] K(r−1),12 = K(r),8 ⊕ K(r),12 ⊕∆K(r),8+(h+1) mod 4 K(r−1),13 = K(r),9 ⊕ K(r),13 ⊕K(r),12+(h+1) mod 4[0, 0] K(r−1),14 = K(r),10 ⊕ K(r),14 ⊕∆K(r),12+(h+1) mod 4). K(r−1),15 = K(r),11 ⊕ K(r),15. Therefore, The equivalent but concise expressions are as follows:

K(r−1),h[i, j] = K(r−1),h[0, 0] ⊕ ∆K(r),h K(r−1),h = K(r),h ⊕ S(K(r),8+(h+1) mod 4 ⊕S(K(r),8+(h+1) mod 4[0, 0] ⊕K(r),12+(h+1) mod 4)(h = 0, 1, 2, 3) ⊕K(r),12+(h+1) mod 4[0, 0]) K(r−1),h = K(r),h−4 ⊕ K(r),h (h = 4, 5, ··· , 15). ⊕S(K(r),8+(h+1) mod 4[0, 0]

Remark 2. For clarity, Rcon(•) is ignored in the key ⊕∆K(r),8+(h+1) mod 4 schedule above as it does not aﬀect the ﬁnal results. ⊕K(r),12+(h+1) mod 4[0, 0]

⊕∆K(r),12+(h+1) mod 4). (6) If the values of r-round subkeys are known: K(r)[i, j], ∆K = K [i, j] ⊕ K [0, 0]. There are 2 cases in the (r) (r) (r) Therefore, there are 2 Conditions 1), 2) from Equa- recalculation of the r − 1 round subkeys K [i, j]. (r−1) tion (6). Case 1: For 0 ≤ h ≤ 3, we consider the computation 1)∆ K(r),8+(h+1) mod 4 ⊕ ∆K(r),12+(h+1) mod 4 = 0 of K(r−1),0,K(r−1),1,K(r−1),2,K(r−1),3. As ∆K(r) = ⇒ K(r−1),h[i, j] = K(r−1),h[0, 0] ⊕ ∆K(r),h. K(r)[i, j] ⊕ K(r)[0, 0], we have K(r−1)[i, j] can be expressed as the linear func-

K(r),0[i, j] = K(r),0[0, 0] ⊕ ∆K(r),0 (1) tion of K(r−1)[0, 0] and ∆K(r).

K(r),8+(h+1) mod 4[i, j] = K(r),8+(h+1) mod 4[0, 0] 2)∆ K(r),8+(h+1) mod 4 ⊕ ∆K(r),12+(h+1) mod 4 6= 0

⊕∆K(r),8+(h+1) mod 4 (2) ⇒ K(r−1),h[i, j] 6= K(r−1),h[0, 0] ⊕ ∆K(r),h. K [i, j] cannot be expressed as the linear K(r),12+(h+1) mod 4[i, j] = K(r),12+(h+1) mod 4[0, 0] (r−1) function of K(r−1)[0, 0] and ∆K(r). ⊕∆K(r),12+(h+1) mod 4 (3)

K(r−1),h[0, 0] = K(r),h[0, 0] (4) Case 2: For 4 ≤ h ≤ 15,we consider the computation

⊕S(K(r),8+(h+1) mod 4[0, 0] of K(r−1),4,K(r−1),5, ··· K(r−1),15. Because ∆K(r) = K [i, j] ⊕ K [0, 0], we have ⊕K(r),12+(h+1) mod 4[0, 0]) (r) (r)

K(r−1),h[i, j] = K(r),h[i, j] (5) K(r),h−4[i, j] = K(r),h−4[0, 0] ⊕ ∆K(r),h−4 (7) ⊕S(K(r),8+(h+1) mod 4[i, j] K(r),h[i, j] = K(r),h[0, 0] ⊕ ∆K(r),h. (8) ⊕K(r),12+(h+1) mod 4[i, j]). By the schedule above when h = 4, ··· , 15, the equa- By Equations (1)-(5), we have tions are:

(5) K(r−1),h[i, j] = K(r),h[i, j] K(r−1),h[i, j] = K(r),h−4[i, j] ⊕ K(r),h[i, j] (9)

⊕S(K(r),8+(h+1) mod 4[i, j] K(r−1),h[0, 0] = K(r),h−4[0, 0] ⊕ K(r),h[0, 0].

⊕K(r),12+(h+1) mod 4[i, j]) (10) International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 290

R-1 R-2 R-3 R-4 R-5 R-6 R-7 R-8 R-9 KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS KS

R-10 R-11 R-12 R-13 R-14 R-15 R-16 R-17 KS KS KS KS KS KS KS KS .... KS KS KS KS KS KS KS KS .... KS KS KS KS KS KS KS KS .... KS KS KS KS KS KS KS KS ....

R-14-4n R-15-4n R-16-4n R-17-4n KS KS KS KS KS ....

DK ÑK DK

KS KS i j KS KS KS .... recomputation in subkeys KS KS KS KS KS .... not needed for matching KS KS KS KS KS ....

Figure 1: Computation in the subkeys form round -1 to round R-1

By Equations (7)-(10), we have: Proof. Based on Lemma 1 in Equation (6).

(9) K(r−1),h[i, j] = K(r),h−4[i, j] ⊕ K(r),h[i, j] Corollary 3. With the subkey recomputation, for r ∈ (7)(8) {−1, 0, ··· ,R − 1}), if we know K(r)[0, 0], ∆K(r) and = K(r),h−4[0, 0] ⊕ ∆K(r),h−4 K(r−1)[0, 0], the recomputation for (r − 1)-round subkeys ⊕K(r),h[0, 0] ⊕ ∆K(r),h K(r−1)[i, j], only appears in byte 0, 1, 2, 3, and they are (10) only related to the last two columns of r-round subkeys = K(r−1),h−4[0, 0] ⊕ ∆K(r),h−4 K(r)[0, 0] and ∆K(r). ⊕∆K . (11) (r),h Proof. By Corollary 2 and Lemma 1 in Equation (6). From Equation (11), there is Lemma 2. If     K(r−1),h[i, j] = K(r−1),h−4[0, 0] ⊕ ∆K(r),h−4 0 0 i i 0 0 0 0 ⊕∆K .  0 0 0 0   j 0 j 0  (r),h ∆K =   , ∇K =   , i  0 0 0 0  j  0 0 0 0  So K(r−1)[i, j] can be expressed as the linear function 0 0 0 0 0 0 0 0 of K(r−1)[0, 0] and ∆K(r).  NNN 0   0 NNN  K(m)[0, 0] ∈   in round R−3, com-  NNNN  NNNN Corollary 1. The column 1,2,3 of (r − 1)-round sub- putation K(m)[i, j] in the subkeys form round -1 to round keys K [i, j] are linear expressions of r-round subkeys (r−1) R − 1 is depicted in Figure 1 (i, j ∈ GF (28), N denotes K [0, 0] and ∆K . (r−1) (r) non-zero byte and 0 denotes zero byte). Proof. Based on Lemma 1 in Equation (11). Proof. The ﬁrst, the second and fourth lines of Figure 1 Corollary 2. Only column 0 of (r − 1)-round sub- above can be derived by the computer experiments based keys is a nonlinear expression of r-round subkeys on the key schedule. The third line of Figure 1 can be K(r−1)[0, 0],K(r)[0, 0] and ∆K(r). derived by Lemma 1 and Corollarys 1, 2 and 3. International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 291

1) In the ﬁrst line of Figure 1, ∆K is depicted, and Base computation D - Ñ - i i differentials j differentials (m) (m) K ʿ(2R-6) K [i, 0] = K [0, 0] ⊕ ∆ . (m ) (m ) i (m ) S0 S0 S j 2) In the second line of Figure 1, ∇K is depicted, and SB SB SB j SR SR SR (m) (m) K MC MC MC K [0, j] = K [0, 0] ⊕ ∇j . (m ) ʿ(2R-5) K [0, 0] DK ÑK 3) In the third line of Figure 1, the recomputation in the i j subkeys of K(m)[i, j] is depicted, where white cells $(R-3) Å Å Å need no recomputation because they are only related K K ʿ(2R-4) to ∆i or ∇j ; Dark gray cells need recomputa-tion based on the Lemma 1 and Corollarys 1, 2 and 3; SB SB SB SR SR

key SR key light gray cells are not required for matching. MC MC key MC schedule schedule schedule ʿ(2R-3) 4) In the fourth line of Figure 1, ∆K = K(m)[i, j] ⊕ (m) K [0, 0] is depicted based on the first line and the $(R-2) Å Å Å second line, where white cells denote zero difference. ʿ(2R-2) SB SB SB key key SR SR key SR schedule schedule Remark 3. Our key partition in Round R − 3 is the schedule ʿ(2R-1) same as key partition in Round 8 [3], the computation of the subkeys in Figure 1 from R − 11 to R is the same as $(R-1) Å Å Å Figure 9 [3] from -1 to 10. (m ) (m ) (m ) C Ci C0 Lemma 3. In Figure 1, the current equations are: 0 Figure 2: Biclique for R-round AES-128(R >10) [3] 1) P osu(1) = P osu−4v(1)(u ≤ R − 14, v = 0, 1, ··· ) in K K ∆i and ∇j ,where P osu(1) denotes the position of non-zero differential in Round u.

#(2R-6) #(2R-7) #(2R-8) #(2R-9) #(2R-10) #(2R-11)

2) P os (2) = P os (2) in recomputation of subkeys C u u−4v C SR SR SB SB SR SB AK AK MC MC MC M AK MC MC M ... in Round u,where P osu(2) denotes the position of

recomputation in Round u. (m ) S j #7 #6 Proof. biclique AK SR SB AK MC MC

1) In the ﬁrst, second and the fourth lines of Figure recomputed K D i 1,it can be seen, the regularity from Round R − 4 to #5 #4 C AK SR SB MC MC Round -1, the position of non-zero diﬀerential byte M v (m ) in ∆K , ∇K and ∆K repeats every 4 rounds. i j Figure 3: Recomputation in the forward direction for R- 2) Similarly, in the third line of Figure 1, it can be round AES-128(R>10) shown (2) holds.

Theorem 1. With the subkey recomputation technique, where N denotes non-zero byte and 0 denotes zero for r ∈ {−1, 0, ··· ,R − 1}), if we know r-round subkeys byte. Then by the key schedule, K(r)[0, 0], ∆K(r), K(r)[i, j] = K(r)[0, 0] ⊕ ∆K(r) and (r −     NND1 D2 NNNN 1)-round subkeys K(r−1)[0, 0], there are (2R − 16) S-boxes  NNNN   NND5 D6  to be recomputed at most for the (r − 1)-round subkeys ∆Kr=  or    NND3 D4   NNNN  K(r−1)[i, j] (Figure 1). NNNN NND7 D8 Proof. We assume that we know r-round subkeys It can therefore be demonstrated that: D = D ,D = K [0, 0], ∆K and K [i, j] = K [0, 0] ⊕ ∆K . 1 2 3 (r) (r) (r) (r) (r) D ,D = D ,D = D . Based on Corollary 2 (i.e. When r is from round R − 1 to round R − 8,it is ob- 4 5 6 7 8 Lemma 1 in Equation (4.6)), 2 S-boxes required to be viously there are all 2 S-boxes required to be recomputed recomputed at most in each round r. for K(r−1)[i, j]. When r ∈ {−1, ··· ,R − 9}, in the fourth line in Fig- So, there are 2(R − 9) + 2 S-boxes be recomput-uted ure 1 based on Lemmas 2 and 3. at most from round -1 to R − 1 for K(r−1)[i, j]. N 0 N 0   NNNN  (m) NNNN   N 0 N 0  Therefore, for the subkeys Kr [i, j](r ∈ ∆Kr−1=  or   N 0 N 0   NNNN  {−1, 0, ··· ,R − 1}), there are 2R − 16 S-boxes to NNNN N 0 N 0 be recomputed at most. International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 292

P(m ) (m) i #0 #1 #2 #3 #4 Sj . As shown in Figure 3, 41 + 16(R − 10) SR SB AK AK SB SR AK MC MC S-boxes should be recomputed. K(m)[i,j] (m ) Forward direction: Recompute P (m) −−−−−−→ v i

biclique g oracle&

decryption (m) (a) R=14+4n(n=-1,0,Ă ) (m) (m) K [i,0] (m ) ~v which is different from Pi −−−−−−→ Pi #0 #1 #2 #3 #4 g SR SB AK AK SB SB SR AK MC (m) MC ~vi , therefore at most 13 S-boxes should be (m ) recomputed because the whitening subkeys of v (m) (m) biclique oracle& K [i, j] and K [i, 0] differ in at most 9 bytes decryption (b) R=15+4n(n=-1,0,Ă ) as shown in the line 2 of Figure 1. As shown P(m ) #1 #2 #3 #4 i #0 in Figure4, for whitening subkeysK−1, there SR SB AK AK SB SB SR AK MC MC are 4 kinds of difference between K(m)[i, j] and (m) (m ) K [i, 0] when R = 14 + 4n, R = 15 + 4n, R = v

biclique 16 + 4n, R = 17 + 4n(n = −1, 0, ··· ).At most oracle& decryption (c) R=16+4n(n=-1,0,Ă ) 13 S-boxes should be recomputed because the (m ) (m) (m) Pi #0 #1 #2 #3 #4 whitening subkeys of K [i, j] and K [i, 0] SR SB AK AK SB SR AK MC MC diﬀer in at most 9 bytes in four cases.

(m ) • The amount of subkey recomputation is evaluated. biclique oracle& v decryption With the round increased, the recomputation of the (d) R=17+4n(n=-1,0,Ă ) subkeys cannot be ignored. First, the adversary ÑK computes and stores computations K(m)[i, 0] and recomputed j K(m)[0, j]. Then, for other K(m)[i, j], he recomputes Figure 4: Recomputation in the forward direction for R- only those parts that differ from the stored ones. round AES-128(R>10) According to the Theorem 1, for the subkeys (m) Kr [i, j](r ∈ {−1, 0, ··· ,R − 1}), there are 2R − 16 4.2 Biclique Attack S-boxes to be recomputed at most. In summary, for each K(m), 41 + 16(R − 10) + 9 + Theorem 2. For attacking R rounds of AES-128(R ≥ (2R−16) = 18R−126 S-box should be recomputed at 10), the complexity of biclique attack most. The full time complexity of attacking R-round 752.4 AES-128 is C ≤ 2121(− + 26.86). full R 1 4 C ≤ 2112{27+27+216×[18R−126]× × +28} full 16 5R 121 752.4 6.86 127.86 Proof. For R-Round AES-128, biclique attack can be de- = 2 (− R + 2 ) < 2 scribed in the following two steps: 3-round biclique con- Theorem 2 shows: For attacking R rounds of AES-128 struction and key recovery. (R ≥ 10), with the increase of number of rounds R, the complexity of biclique attack increases gradually, but it 1) 3-round biclique construction. The 3-round biclique 127.86 (m) (m) (m) can never reach 2 . of dimension 8 [{Ci }, {Sj }, {K [i, j]}] is constructed for AES-128 as shown in Figure 2,similar with Figure 4 [3]. 5 Biclique Attack on 10-Round 2) Key recovery. We recover the secret key with recom- AES-IND-128 putation technique. AES-IND-128 denotes AES-128 independent of the key (m) (m) (m) K [i,0] (m) (m) K [0,j] schedule. The AES key scheme can also be improved, so Precompute Pi −−−−−−→ ~vi and ~vj ←−−−−−− g h we need consider the AES-IND-128. In this paper, we (m) Sj . Then, store intermediate states and subkeys, where assume the key schedule of AES-IND-128 satisfies: The (m) ←(m) diffusion property is enhanced so that any subkey byte in ~vi and v j are state #4. any round affects all the subkey bytes in the other rounds • The amount of state recomputation in both direc- in terms of the difference. tions is evaluated, where S(m) is the input of the j Theorem 3. The time complexity of the biclique attack round R − 3. on 10-round AES-IND-128 is 2127.42. K(m)[i,j] Backward direction: Recompute ~v(m) ←−−−−−− Proof. For 10-round AES-IND-128, the biclique attack h (m) can be described in the following two steps: biclique con- (m) (m) K [0,j] Sj which is different from ~vj ←−−−−−− h struction and key recovery. International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 293

(m) D - Ñ - construct the biclique (Figure 5(a)). Fix C0 = Base computation i differentials j differentials ʿ18 (m) −1 (m) (m ) (m ) 0 and computes S = f (m) (C ). (m ) 0 K [0,0] 0 S0 S0 S j (m) SB SBSB SBSB Then, construct ∆i −differentials and SSR SR SR (m) ∇j −differentials. Finally, get the 1-round (m ) ʿ19 K [0, 0] DK ÑK biclique of dimension 8. i j Because ∆i-differentials influence the 1 bytes Å Å Å $9 of the ciphertext, all the ciphertexts share the

(m ) same values except bytes C0.Therefore, the data C C (m ) C (m ) 0 i 0 complexity does not exceed 28. (a) Biclique (a) Biclique 2) Key Recovery. #18 #17 #16 #15 SR SB SR SB AK • The amount of state recomputation in both direc- AK MC MC ... tions is evaluated. S (m ) j #7 #6 #5 #4 Backward Direction: Because of the high diffusion biclique AK L of the AES-IND-128 key schedule, the subkeys 9 of SR SB SR SB AK AK MC MC #18 K(m)[i, j] and K(m)[0, j] differ in all 16 bytes. As v (m ) shown in Figure 5(b), 85 S-boxes should be recom- DK puted. recomputed i (b)(b) RecomputationRecomputation inin thethe backwardbackward directiondirection Forward Direction: The Whitening Subkey of (m) (m) (m ) K [i, j] and K [i, 0] differ in all 16 bytes. As Pi #0 #1 #2 #3 #4 demonstrated in Figure 5(c), 20 S-boxes should be SR SB AK SR SB AK AK MC MC recomputed. (m ) biclique oracle& v • The amount of subkey recomputation is evaluated. decryption recomputed ÑK j The diffusion of key schedule is enhanced: Any sub- (c)(c) RecomputationRecomputation inin thethe forwardforward directiondirection Figure 5: Recomputation of subkey in biclique attacks on key byte in any round affects all the subkey bytes in 10-round AES-128-IND the other rounds in terms of the difference. In the following, it is assumed that the nonlinear transform of the subkey generation does not change, Wi ≡ Wi−4 ⊕ SB(RotByte(W )) ⊕ Rcon(i/4)(i ≡ 0 mod 4), S- 1) 1-Round Biclique of Dimension 8. For 10-round AES- i−1 boxes in subkey recomputation occurs in the first col- IND-128, it may fail to construct the 3-round or even umn of each round. 2-round biclique due to the diffusion properties of the internal rounds. Fortunately, it is feasible to con- Recomputations of the subkey in each round is lo- struct 1-round biclique. In fact, what we should do cated within TABLE 1.It is evident from the data K K within Table 1 that the following is true: is to find ∆i ∩ ∆j = {0} in round-9 subkey space. • Key Partition. With the strategy of the key Backward Direction: 4 S-boxes should be recom- partition inside the biclique, define the key puted in round 3,4,5,6,7,8, respectively. groups with respect to round-9 subkey space Forward Direction: There are 4 S-boxes, 1S-box and enumerate the 2112 groups of 216 keys: should be recomputed in round -1,0 respectively. (m) (m) K K K [i, j] = K [0, 0] ⊕ ∆i ⊕ ∇j (m) 8 112 So, for the subkeys Kr [i, j](r ∈ {−1, 0, ··· ,R−1}), (i, j = 0, 1, ··· , 2 − 1; m = 0, 1, ··· 2 − 1), K K where when ∆i , ∇j are computed,there are 29 S-boxes  i 0 0 0  to be recomputed at most. Complexities: For each (m) 0 0 0 0 K ,105+29=134 S-box should be recomputed, so ∆K =  , i  0 0 0 0  (m) 16 −1 −1 15.42   Crecomp = 2 × 134 × 16 × 12.5 ≈ 2 0 0 0 0  0 j 0 0  The time complexity of attacking10-round AES-IND- 128 is K  0 0 0 0  ∇j =  , 112 7 7 15.07 8 127.42  0 0 0 0  Cfull = 2 (2 + 2 + 2 + 2 ) = 2 0 0 0 0  0 0 NN   NNNN  K(m)[0, 0] ∈   Theorem 3 shows: It can be demonstrated that al-  NNNN  though the emphasis was focused on the improvement of NNNN the AES-128 key schedule, the full time complexity of bi- • 1-Round Biclique Construction. For each K(m), clique attack on 10-round AES-128 cannot exceed 2127.42. International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 294

[5] J. Daemen, L. Knudsen, V. Rijmen, “The block ci- Table 1: Recomputation of subkey in biclique attacks on pher SQUARE,” in International Workshop on Fast 10-round AES-128-IND Software Encryption, pp. 149-165, 1997. Round Recomputation in subkey [6] H. Demiric, A. Selcuk, “A meet in the middle attack -1 4 on 8-round AES,” in International Workshop on Fast 0 1 Software Encryption, pp.116-126, 2008. 1 0 2 0 [7] P. Derbez, P. A. Fouque, J. Jean, “Improved key re- 3 4 covery attacks on reduced-round AES in the single- 4 4 key setting,” in Annual International Conference on 5 4 the Theory and Applications of Cryptographic Tech- 6 4 niques, pp. 371-387, 2013. 7 4 [8] P. Derbez, P. A. Fouque, “Exhausting demirci-seluk 8 4 meet-in-the-middle attacks against reduced-round AES,” in Computer Science, pp. 541-560, 2013. [9] O. Dunkelman, N. Keller, A. Shamir, “Improved 6 Conclusions single-key attacks on 8-round AES,” in International Conference on the Theory and Application of Cryp- In this paper, the application of chosen ciphertext biclique tology and Information Security, pp. 158-176, 2010. attacks to AES-128 have been performed. Attacks on 10- [10] N. Ferguson, J. Kelsey, S. Lucks, B. Schneier, M. Round AES-IND-128 and R-Round AES-128 (R > 10) Stay, D. Wagner, D. Whiting, “Improved cryptanal- are considered. 10-Round AES-IND-128 and R-Round ysis of Rijndael,” in International Workshop on Fast AES-128 (R > 10) are more secure than 10-Round AES- Software Encryption, pp. 213-230, 2002. IND-128 and 10-Round AES-128 in terms of the biclique attacks. Yet, it is evident that when the diffusion of key [11] L. Grassi, C. Rechberger, S. Ronjom, “Subspace trail schedule is enhanced or the number of encryption rounds cryptanalysis and its applications to AES,” in IACR is increased, the biclique attacks remain effective to AES- Transactions on Symmetric Cryptology, vol. 2, pp. 128. So in order to make the biclique attack approximate 192-225, 2017. exhaustive key attack in theory, we need not only enhance [12] H. Gilbert, M. Minier, “A collision attack on 7 the diffusion of key schedule, but also increase the number rounds of Rijndael,” in AES Candidate Confer- of encryption rounds. ence, 2000. (https://pdfs.semanticscholar.org/ 7405/c463a0d8477396c3a60408fb3ead0917bfb4. pdf) Acknowledgment [13] L. Grassi, C. Rechberger, S. Ronjom,“A new structural-differential property of 5-round AES,” in This work was supported by the National Natural Sci- Advances in Cryptology, pp.289-317, 2017. ence Foundation of China (No.61772418), Natural Sci- ence Basic Research Plan in Shaanxi Province of China [14] J. Lu, O. Dunkelman, N. Keller, J. Kim, “New im- (No.2017JQ6010) and National Cryptography Develop- possible differential attacks on AES,” in Interna- ment Fund(No.MMJJ20180219) tional Conference on Cryptology in India, pp. 279- 293, 2008. [15] H. Mala, M. Dakhilalian, V. Rijmen, M. Modarres- References Hashemi, “Improved impossible differential cryptanalysis of 7-round AES-128,” in International Con- [1] A. Bar-On, O. Dunkelman, N. Keller, E. Ronen, A. ference on Cryptology in India, pp. 282-291, 2010. Shamir, “Improved key recovery attacks on reduced- [16] A. Mirsaid, T. Gulom, “The encryption algo- round AES with practical data and memory com- rithm AES-RFWKIDEA32-1 based on network plexities,” in Advances in Cryptology, pp 187-212, RFWKIDEA32-1,” International Journal of Elec- 2018. tronics and Information Engineering, vol. 4, no. 1, [2] A. Bogdanov, D. Chang, M. Ghosh, S. K. Sanadhya, pp. 1-11, 2016. “Bicliques with minimal data and time complexity [17] S. Ronjom, N. Bardeh, T. Helleseth, “Yoyo tricks for AES,” in International Conference on Informa- with AES,” in Advances in Cryptology, pp. 217-243, tion Security and Cryptology, pp. 160-174, 2014. 2017. [3] A. Bogdanov, D. Khovratovich, C. Rechberger, “Bi- clique cryptanalysis of the full AES,” in Advances in [18] B. Sun, M. Liu, J. Guo, L. Qu, V. Rijmen, “New Cryptology, pp. 344-371, 2011. insights on AES-like SPN ciphers,” in Advances in [4] J. Daemen, V. Rijmen, ”The design of Rijndael,” In- Cryptology, pp.605-624, 2016. formation Security and Cryptography, 2002. (https: [19] T. Tiessen, “Polytopic cryptanalysis,” in Advancesin //autonome-antifa.org/IMG/pdf/Rijndael.pdf) Cryptology, pp. 214-239, 2016. International Journal of Network Security, Vol.23, No.2, PP.286-295, Mar. 2021 (DOI: 10.6633/IJNS.202103 23(2).12) 295

Biography digital processing.

Dong Xiaoli is now a lecturer at Xian university Chen Jie is now an associate professor at School of posts and telecommunications,China. She received of Telecommunication Engineering, Xidian Univer- the B.S. degree and the M.S. degree in mathematics sity,China. She received the M.S. and Ph.D.degrees in major from Xi’an University of Technology in 2005 and cryptology from Xidian University in2005 and 2007, 2008, and the Ph.D. degrees in cryptography science respectively. Her research ﬁelds include cryptography from Xidian University in 2011, respectively. Her main and network security. research ﬁelds include block cipher in cryptography, applied mathematics, and optimization algorithm in