Dedicated Linear Attack on ARIA Version 1.0  

作　　者：李申华 张海纳 王小云 

机构地区：[1]Key Laboratory of Cryptologic Technology and Information Security of Ministry of Education,Shandong University [2]Center for Advanced Study,Tsinghua University

出　　处：《Tsinghua Science and Technology》2009年第2期212-217,共6页清华大学学报（自然科学版（英文版）

基　　金：Supported by the National Key Basic Research and Development(973) Program of China(No.2007CB807902);the National NaturalScience Foundation of China(Nos.90604036 and 60525201)

摘　　要：ARIA is a new block cipher designed as the block cipher standard of South Korea. The current version is 1.0, which is an improvement of version 0.8 with the security using four kinds of S-boxes instead of two and an additional two rounds of encryptions. These improvements are designed to prevent the dedicated linear attack on ARIA version 0.8 by the four different kinds of S-boxes. This paper presents 12 linear approximations of a single round function that succeeds in attacking ARIA version 1.0 on 7, 9, or 9 rounds for key sizes of 128, 192, or 256 bits using any of these approximations. The corresponding data complexities are 2^87, 2^119, and 2^119, the counting complexities are 1.5×2^88, 2^119, and 2^119, the memory required for each attack on all three key versions is 2^64 bits and there are 12 weak key classes. These results are similar to the dedicated linear attack on ARIA version 0.8 and show that the improved version can also not effectively resist this type of attack.ARIA is a new block cipher designed as the block cipher standard of South Korea. The current version is 1.0, which is an improvement of version 0.8 with the security using four kinds of S-boxes instead of two and an additional two rounds of encryptions. These improvements are designed to prevent the dedicated linear attack on ARIA version 0.8 by the four different kinds of S-boxes. This paper presents 12 linear approximations of a single round function that succeeds in attacking ARIA version 1.0 on 7, 9, or 9 rounds for key sizes of 128, 192, or 256 bits using any of these approximations. The corresponding data complexities are 2^87, 2^119, and 2^119, the counting complexities are 1.5×2^88, 2^119, and 2^119, the memory required for each attack on all three key versions is 2^64 bits and there are 12 weak key classes. These results are similar to the dedicated linear attack on ARIA version 0.8 and show that the improved version can also not effectively resist this type of attack.

关 键 词：ARIA linear attack block cipher advanced encryption standard 

分 类 号：TN918.1[电子电信—通信与信息系统]