Following the Chow et al paper and Muir's tutorial, I was able to implement the AES algorithm using tables embedding keys of 128, 192 and 256-bit sizes, later extended to 1024, 2048 and 4096-bit sizes.

The original AES-128 WBC from Chow et al or Karroumi papers have a known BGE attack consisting $2^{22}$ work-steps (Yoni et al), so this implementation also suffers from the same weakness considering that the attacker knows the key is 128-bit.

My question is: what if the key size is extended to 512/1024/2048/4096 bits following Jaeik Cho et al ($Nr = Nk + 6$); is it going to add any considerable complexity to the BGE attack? My point is: the attacker will need to know in advance the key length in order to obtain it, right?

And If the number of rounds is also unknown?

Is there some other known type of attack in the situation I'm proposing here?

  • $\begingroup$ Generally knowing the key size (and number of rounds) is considered a presumption. It is part of the protocol description; only the key itself should provide the required security as per Kerckhoff's principle. The reason is that there are only a few choices a available, it is not practical for a protocol to switch key sizes all the time. $\endgroup$
    – Maarten Bodewes
    Oct 3 '19 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.