SQUARE attack on AES128 requires a single delta set for 4-round variant, or I assume single delta set is enough since keyspace is reduced to few keys which can be easily brute-forced. However, as we increase round number to 5, we need 5 delta sets approximately, as proposed by AES proposal. And further, for 6-round variant, we need about 10 delta sets. Is there a mathematical relation between the number of rounds and required delta sets, or is this pure heuristic? If there are any underlying mathematical relations, I couldn't spotted.

I am not able to execute a 5-round attack, since I'm following up the attack mentioned at the proposal, which requires a search on $ 2^{40}$ bits, and I'm not sure about the size of the resulting keyspace after using only one delta set. I mean, if we use a single delta set, is brute force still infeasible so that we want to use multiple delta sets, or is there any other reason?

Answers appreciated. Thanks


Found an answer here:

For each group of 256 plaintexts, this filter rejects 255/256 of all wrong key guesses. As we guess a total of nine key bytes, we will need 10 or so groups of 256 encryptions to find the key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.