# What does AES round reduce in attacks mean?

I am reading about some cryptanalysis attacks on AES. Most of the attacks reduces AES to 4. 5 or 6 rounds. What does that mean?

The proper statement is usually something like "we demonstrate an attack on 6 rounds of AES of such and such complexity".

Standard 128 bit key length AES is an iteration of 10 rounds, each round uses a round key derived from the randomly chosen AES key and is made up of AddRoundKey, SubBytes, ShiftRows, MixColumns operations.

If AES is run for less than 10, say 6 rounds, it is obviously weaker. So this means the demonstrated attack would fail (typically would require more computational effort than a brute force search for the key) if more rounds were added, and thus the given attack can't break the full cipher.

Such reduced round attacks are still of interest on strong ciphers like the AES since they tell us that some partial cryptanalytic progress has been made.

Edit: There is an attack on the full 10 round 128 bit key length AES with complexity $2^{126.1}$ by Bogdanov et al, where the authors state "In contrast to most shortcut attacks on AES variants, we do not need to assume any related-keys. Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent. As our attacks are of high computational complexity, they do not threaten the practical use of AES in any way."

• Thanks for your input. So does that mean there is currently no attack that can break the 10-round AES-128? As I saw on AES Lounge, the best they can do is 7 rounds. @kodlu Sep 10, 2016 at 11:32
• @KhoiTran Full AES has been broken with an advantage of about 4 (eg 2 bits less safety) in "Biclique Cryptanalysis of the Full AES" by Bogdanov, Khovratovich and Rechberger in 2011. Sep 10, 2016 at 17:11
• @SEJPM thanks. For the OPs benefit the attack complexity in that reference for 128 bit key length AES is $2^{126.1}$, and the authors state "In contrast to most shortcut attacks on AES variants, we do not need to assume any related-keys. Most of our attacks only need a very small part of the codebook and have small memory requirements, and are practically verified to a large extent. As our attacks are of high computational complexity, they do not threaten the practical use of AES in any way." Sep 11, 2016 at 1:37