I am reading about some cryptanalysis attacks on AES. Most of the attacks reduces AES to 4. 5 or 6 rounds. What does that mean?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
5
The proper statement is usually something like "we demonstrate an attack on 6 rounds of AES of such and such complexity".
Standard 128 bit key length AES is an iteration of 10 rounds, each round uses a round key derived from the randomly chosen AES key and is made up of AddRoundKey, SubBytes, ShiftRows, MixColumns operations.
If AES is run for less than 10, say 6 rounds, it is obviously weaker. So this means the demonstrated attack would fail (typically would require more computational effort than a brute force search for the key) if more rounds were added, and thus the given attack can't break the full cipher.
Such reduced round attacks are still of interest on strong ciphers like the AES since they tell us that some partial cryptanalytic progress has been made.
Edit: There is an attack on the full 10 round 128 bit key length AES with complexity $2^{126.1}$ by Bogdanov et al, where the authors state "In contrast to most shortcut attacks on AES variants, we do not need to assume any related-keys. Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent. As our attacks are of high computational complexity, they do not threaten the practical use of AES in any way."
-
$\begingroup$ Thanks for your input. So does that mean there is currently no attack that can break the 10-round AES-128? As I saw on AES Lounge, the best they can do is 7 rounds. @kodlu $\endgroup$ Sep 10, 2016 at 11:32
-
$\begingroup$ @KhoiTran Full AES has been broken with an advantage of about 4 (eg 2 bits less safety) in "Biclique Cryptanalysis of the Full AES" by Bogdanov, Khovratovich and Rechberger in 2011. $\endgroup$– SEJPMSep 10, 2016 at 17:11
-
$\begingroup$ @SEJPM thanks. For the OPs benefit the attack complexity in that reference for 128 bit key length AES is $2^{126.1}$, and the authors state "In contrast to most shortcut attacks on AES variants, we do not need to assume any related-keys. Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent. As our attacks are of high computational complexity, they do not threaten the practical use of AES in any way." $\endgroup$– kodluSep 11, 2016 at 1:37
-
$\begingroup$ @KhoiTran, does the updated answer answer your question? $\endgroup$– kodluSep 11, 2016 at 23:47
-
$\begingroup$ Note that the number of rounds in AES depends on the key size. 10 rounds is for 128-bit. For 192-bit keys there are 12 rounds, and for 256-bit there are 14. So larger key sizes also give you more margin on the number of rounds that might be broken. $\endgroup$ Sep 12, 2016 at 20:44
$\begingroup$
$\endgroup$
It is common practise in cryptanalysis to start designing an attack on reduced round versions of a cryptographic primitive (whenever applicable). So if you can break p rounds out of n, with p < n, you have an (n - p) round security margin as an indication for the security of the primitive, with the attack model of the attacker.
Regarding the "Biclique Cryptanalysis of the full AES", the break, although real, is considered theoretical at this stage as it still has a 2^126.1 complexity.
There are also attacks on AES implementations that enable full key recovery, see "Cache-timing attacks" on AES by Daniel J. Bernstein.
