Can neural cryptanalysis be applied to AES?

Question

In this Wikipedia article about Neural cryptography (section applications) it states:

In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how to invert the S-tables of the DES. The bias in DES studied through Differential Cryptanalysis by Adi Shamir is highlighted. The experiment shows about 50% of the key bits can be found, allowing the complete key to be found in a short time.

It could very well be that I misunderstood something, but I think that the same "attack" can't be used for AES, since the Inverse Rijndael S-box is public knowledge or am I wrong? Is AES designed this way to prevent an attack by inverting the S-box?

Answer 1

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES.

Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. Applied to Unix crypt (section 5.4.4), it memorizes passwords/hash pairs (by a training requiring "from several days to several years") and then merely performs a quick retrieval; something a hash table does routinely and quickly! Neither is relevant to cryptanalysis.

Mohammed M. Alani's Neuro-Cryptanalysis of DES and Triple-DES (in proceedings of ICONIP 2012) claims cryptanalysis of DES or 3DES from 2048 or 4096 examples in an hour of Matlab on a standard PC; but there is no indication that it recovers the key or is otherwise capable of predicting more input/output mappings than supplied in training (even though the later is a stated objective). My guess is that - at best - it performs similar plaintext/ciphertext memorization thru training.

---

Update: The above remains true, despite recent and noteworthy progress in the field of neuro cryptanalysis of weakened ciphers, with Aron Gohr's Improving Attacks on Round-Reduced Speck32/64 using Deep Learning, in proceedings of Crypto 2019. It's further analysed by Adrien Benamira, David Gerault, Thomas Peyrin and Quan Quan Tan in A Deeper Look at Machine Learning-Based Cryptanalysis (eprint, March 2021).

Answer 2

The problem of applied machine learning techniques on serious ciphers is that you don't have some good property like continuity which tells you when you are too far, a bit far or close to your solution. Take a look of this polynomial curve over a finite, How do you get the order of this polynomial based on the shape of this graph?

By the way, block ciphers like AES are very indistinguishable from random functions. Therefore, they leak almost no information. I think that in order to train any type of neural network architecture, you would require an enormous amount of input and output data to model a pseudo-random construction. It is practically as expensive as a brute force attack.