4 ms·
Maybe I'm not interpreting the results correctly, but does this mean that published attacks place AES-256 in a weaker position than AES-128?
by brl 17y ago
Maybe I'm not interpreting the results correctly, but does this mean that published attacks place AES-256 in a weaker position than AES-128?
- sp332 17y agoI'm pretty sure the cryptanalysis is equally applicable. The summary (and maybe the paper) don't mention AES-128, but the attack uses "boomerang attacks, which are based on the recent idea of finding local collisions in block ciphers". This might affect AES-256 more than AES-128 because there are more chances for local collisions, but it will still be stronger.
- sp332 17y agoPlease ignore previous post. The new attack seems specific to larger AES keys, and doesn't affect AES-128 much, if at all.
- ars 17y ago2^119 certainly seems less than 2^128. I skimmed the paper and they don't mention AES-128, and I assume that if it worked on AES-128 they would have mentioned it, but they don't. So maybe. Probably would need to email the authors and ask.
- brl 17y agoThey describe that the attack depends on "minimizing the number of active S-boxes in the key-schedule" and that AES-192 is harder to attack than AES-256 because the key schedule has "better diffusion". I'm guessing that they don't mention AES-128 because the attack simply doesn't work against the 128 bit key schedule for reasons related to the increased difficulty of attacking AES-192 with this technique.
- cperciva 17y agoIf I'm reading the paper right, this is largely an attack on the AES key schedule -- so as far as this attack is concerned, AES-256 might indeed be weaker than AES-192.
- pavel 17y agoRemember that the complexity to brute force AES-128 is 2^64 due to the birthday paradox. The complexity to break AES-256 is 2^119 and thus it is still harder to break than AES-128.
- brl 17y agoI'm not sure how you could use the birthday paradox to brute force a block cipher. You have a message you want to decrypt, and you don't know the key. A brute force attack is trying all the possible keys (2^128 for AES-128) and on average you will find the right one with 2^127 guesses.