Automatic Search of Truncated Impossible Differentials for Word-Oriented Block Ciphers

  • Shengbao Wu
  • Mingsheng Wang
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7668)


Impossible differential cryptanalysis is a powerful technique to recover the secret key of block ciphers by exploiting the fact that in block ciphers specific input and output differences are not compatible. This paper introduces a novel tool to search truncated impossible differentials for word-oriented block ciphers with bijective Sboxes. Our tool generalizes the earlier \(\mathcal{U}\)-method and the UID-method. It allows to reduce the gap between the best impossible differentials found by these methods and the best known differentials found by ad hoc methods that rely on cryptanalytic insights. The time and space complexities of our tool in judging an r-round truncated impossible differential are about O(c·l 4·r 4) and O(c′·l 2·r 2) respectively, where l is the number of words in the plaintext and c, c′ are constants depending on the machine and the block cipher. In order to demonstrate the strength of our tool, we show that it does not only allow to automatically rediscover the longest truncated impossible differentials of many word-oriented block ciphers, but also finds new results. It independently rediscovers all 72 known truncated impossible differentials on 9-round CLEFIA. In addition, it finds new truncated impossible differentials for AES, ARIA, Camellia without FL and FL− 1 layers, E2, LBlock, MIBS and Piccolo. Although our tool does not improve the lengths of impossible differentials for existing block ciphers, it helps to close the gap between the best known results of previous tools and those of manual cryptanalysis.


word-oriented block ciphers truncated impossible differentials difference propagation system \(\mathcal{U}\)-method UID-method 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Aoki, K., Ichikawa, T., Kanda, M., Matsui, M., Moriai, S., Nakajima, J., Tokita, T.: Camellia: A 128-Bit Block Cipher Suitable for Multiple Platforms - Design and Analysis. In: Stinson, D.R., Tavares, S. (eds.) SAC 2000. LNCS, vol. 2012, pp. 39–56. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  2. 2.
    Bahrak, B., Aref, M.R.: Impossible differential attack on seven-round AES-128. IET Information Security 2, 28–32 (2008)CrossRefGoogle Scholar
  3. 3.
    Bay, A., Nakahara Jr., J., Vaudenay, S.: Cryptanalysis of Reduced-Round MIBS Block Cipher. In: Heng, S.-H., Wright, R.N., Goi, B.-M. (eds.) CANS 2010. LNCS, vol. 6467, pp. 1–19. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  4. 4.
    Biham, E., Biryukov, A., Shamir, A.: Cryptanalysis of Skipjack Reduced to 31 Rounds Using Impossible Differentials. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 12–23. Springer, Heidelberg (1999)Google Scholar
  5. 5.
    Biham, E., Biryukov, A., Shamir, A.: Miss in the Middle Attacks on IDEA and Khufu. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 124–138. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  6. 6.
    Biham, E., Keller, N.: Cryptanalysis of Reduced Variants of Rijndael. In: The ThirdAES Candidate Conference (2000)Google Scholar
  7. 7.
    Biham, E., Shamir, A.: Differential Cryptanalysis of DES-like Cryptosystems. Journal of Cryptology 4(1), 3–72 (1991)MathSciNetMATHCrossRefGoogle Scholar
  8. 8.
    Daemen, J., Rijmen, V.: The Design of Rijndael: AES – The Advanced Encryption Standard. Springer (2002)Google Scholar
  9. 9.
    Du, C., Chen, J.: Impossible Differential Cryptanalysis of ARIA Reduced to 7 rounds. In: Heng, S.-H., Wright, R.N., Goi, B.-M. (eds.) CANS 2010. LNCS, vol. 6467, pp. 20–30. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  10. 10.
    Izadi, M.I., Sadeghiyan, B., Sadeghian, S.S., Khanooki, H.A.: MIBS: A New Lightweight Block Cipher. In: Garay, J.A., Miyaji, A., Otsuka, A. (eds.) CANS 2009. LNCS, vol. 5888, pp. 334–348. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  11. 11.
    Kanda, M., Moriai, S., Aoki, K., Ueda, H., Takashima, Y., Ohta, K., Matsumoto, T.: E2 — A new 128-bit block cipher. IEICE Transactions Fundamentals – SpecialSection on Cryptography and Information Security E83–A (1), 48–59 (2000)Google Scholar
  12. 12.
    Kim, J., Hong, S., Sung, J., Lee, S., Lim, J., Sung, S.: Impossible Differential Cryptanalysis for Block Cipher Structures. In: Johansson, T., Maitra, S. (eds.) INDOCRYPT 2003. LNCS, vol. 2904, pp. 82–96. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  13. 13.
    Knudsen, L.R.: DEAL—A 128-bit block cipher. Technical Report 151, Department of Informatrics, University of Bergen, Bergen, Norway (1998)Google Scholar
  14. 14.
    Kwon, D., Kim, J., Park, S., et al.: New Block Cipher: ARIA. In: Lim, J.-I., Lee, D.-H. (eds.) ICISC 2003. LNCS, vol. 2971, pp. 432–445. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  15. 15.
    Li, R., Sun, B., Li, C.: Impossible differential cryptanalysis of SPN ciphers. IET Information Security 5(2), 111–120 (2011)CrossRefGoogle Scholar
  16. 16.
    Li, S., Song, C.: Improved Impossible Differential Cryptanalysis of ARIA. In: ISA 2008, pp. 129–132. IEEE Computer Society, Los Alamitos (2008)Google Scholar
  17. 17.
    Luo, Y., Wu, Z., Lai, X., Gong, G.: A Unified Method for Finding Impossible Differentials of Block Cipher Structures. Cryptology ePrint Archive: Report 2009/627,
  18. 18.
    Mala, H., Dakhilalian, M., Rijmen, V., Modarres-Hashemi, M.: Improved Impossible Differential Cryptanalysis of 7-Round AES-128. In: Gong, G., Gupta, K.C. (eds.) INDOCRYPT 2010. LNCS, vol. 6498, pp. 282–291. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  19. 19.
    Phan, R.C.-W., Siddiqi, M.U.: Generalised Impossible Differentialsof Advanced Encryption Standard. Electronics Letters 37(14), 896–898 (2001)CrossRefGoogle Scholar
  20. 20.
    Phan, R.C.-W.: Classes of Impossible Differentials of AdvancedEncryption Standard. Electronics Letters 38(11), 508–510 (2002)CrossRefGoogle Scholar
  21. 21.
    Shibutani, K., Isobe, T., Hiwatari, H., Mitsuda, A., Akishita, T., Shirai, T.: Piccolo: An Ultra-Lightweight Blockcipher. In: Preneel, B., Takagi, T. (eds.) CHES 2011. LNCS, vol. 6917, pp. 342–357. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  22. 22.
    Shirai, T., Shibutani, K., Akishita, T., Moriai, S., Iwata, T.: The 128-Bit Blockcipher CLEFIA (Extended Abstract). In: Biryukov, A. (ed.) FSE 2007. LNCS, vol. 4593, pp. 181–195. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  23. 23.
    Tsunoo, Y., Tsujihara, E., Shigeri, M., Suzaki, T., Kawabata, T.: Cryptanalysis of CLEFIA Using Multiple Impossible Differentials. In: International Symposium on Information Theory and its Applications, ISITA 2008, pp. 1–6 (2008)Google Scholar
  24. 24.
    Wei, Y., Li, P., Sun, B., Li, C.: Impossible Differential Cryptanalysis on Feistel Ciphers with SP and SPS Round Functions. In: Zhou, J., Yung, M. (eds.) ACNS 2010. LNCS, vol. 6123, pp. 105–122. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  25. 25.
    Wu, W., Zhang, L.: LBlock: A Lightweight Block Cipher. In: Lopez, J., Tsudik, G. (eds.) ACNS 2011. LNCS, vol. 6715, pp. 327–344. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  26. 26.
    Wu, W., Zhang, W., Deng, D.: Impossible Diffrential Cryptanalysis of ARIA and Camellia. Journal of Computer Science and Technology 22(3), 449–456 (2007)MathSciNetCrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Shengbao Wu
    • 1
    • 2
  • Mingsheng Wang
    • 3
  1. 1.Institute of SoftwareChinese Academy of SciencesBeijingChina
  2. 2.Graduate School of Chinese Academy of SciencesBeijingChina
  3. 3.State Key Laboratory of Information Security, Institute of Information EngineeringChinese Academy of SciencesBeijingChina

Personalised recommendations