Date: 21 Jun 2002

Linear Cryptanalysis of Reduced Round Serpent


Serpent is one of the 5 AES finalists. In this paper we present a 9-round linear approximation for Serpent with probability of 1/2+2-52. We use it to attack 10-round Serpent with all key lengths with data complexity of 2118 and running time of 289. A variant of this approximation is used in the first attack against an 11-round Serpent with 192-bit and 256-bit keys, which require the same amount of data and 2187 running time.

This work was supported by the European Union fund IST-1999-12324 - NESSIE