{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T07:21:46Z","timestamp":1740122506757,"version":"3.37.3"},"reference-count":34,"publisher":"Springer Science and Business Media LLC","issue":"7","license":[{"start":{"date-parts":[[2020,5,4]],"date-time":"2020-05-04T00:00:00Z","timestamp":1588550400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2020,5,4]],"date-time":"2020-05-04T00:00:00Z","timestamp":1588550400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100001832","name":"Radboud University","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100001832","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Des. Codes Cryptogr."],"published-print":{"date-parts":[[2020,7]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Known-key distinguishers have been introduced by Knudsen and Rijmen in 2007 to better understand the security of block ciphers in situations where the key can not be considered to be secret, i.e. the \u201cthing between secret-key model and hash function use-cases\u201d. Trying to find a rigorous model to fit this intuition is still ongoing. The most recent advance by Gilbert (Asiacrypt 2014) describes a new model that\u2014even if it is well justified\u2014seemingly does not match this intuition. AES is often considered as a target of such analyses, simply because AES or its building blocks are used in many settings that go beyond classical encryption. Consider AES-128. Results in the secret-key model cover up to 6 rounds, while results in the chosen-key model reach up to 9 rounds. Gilbert however showed a result in the known-key model that goes even further, covering 10 rounds. <jats:italic>Does it mean that the use cases corresponding to the cryptanalysis of hash-function use-cases are inherently less efficient, or is it rather an artifact of the new model? In this paper we give strong evidence for the latter<\/jats:italic>. In Gilbert\u2019s work, two types of arguments or rather conjectures are put forward suggesting that the new model is meaningful. Firstly that the number of \u201cextension rounds\u201d due to the new model is limited to two. And secondly that only a distinguisher that exploits the uniform distribution property can be extended in such way. We disprove both conjectures and arrive at the following results: First, we are also able to show that more than two extension rounds are possible. As a result of this, we describe the first known-key distinguishers on 12 rounds of AES that fit into Gilbert\u2019s model. The second conjecture is disproven by showing that the technique proposed by Gilbert can also be used to extend a known-key distinguisher based on another property: truncated differentials. A potential conclusion of this work would be that the counter-intuitive gap between Gilbert\u2019s known-key model and the chosen-key model is wider than initially thought. We however conclude that results in Gilbert\u2019s model are due to an artifact in the model. To remedy this situation, we propose a refinement of the known-key model which restores its original intent to fit the original intuition.<\/jats:p>","DOI":"10.1007\/s10623-020-00756-5","type":"journal-article","created":{"date-parts":[[2020,5,4]],"date-time":"2020-05-04T16:04:51Z","timestamp":1588608291000},"page":"1401-1445","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Revisiting Gilbert\u2019s known-key distinguisher"],"prefix":"10.1007","volume":"88","author":[{"given":"Lorenzo","family":"Grassi","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christian","family":"Rechberger","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,5,4]]},"reference":[{"key":"756_CR1","unstructured":"Andreeva, E., Bogdanov, A., Mennink, B.: Towards Understanding the Known-Key Security of Block Ciphers. In: FSE 2013, volume 8424 of LNCS, pp. 348\u2013366, (2013)"},{"key":"756_CR2","unstructured":"Aumasson, J.-P., Meier, W.: Zero-sum distinguishers for reduced Keccak-f and for the core functions of Luffa and Hamsi, 2009. In: Presented at the Rump Session of Cryptographic Hardware and Embedded Systems\u2014CHES (2009)"},{"key":"756_CR3","unstructured":"Bellare, M., Micciancio, D.: A New Paradigm for Collision-Free Hashing: Incrementality at Reduced Cost. In: EUROCRYPT 1997, vol. 1233 of LNCS, pp. 163\u2013192 (1997)."},{"key":"756_CR4","unstructured":"Bertoni, G., Daemen, J., Peeters, M., Van Assche, G.: Note on zero-sum distinguishers of Keccak-f. 2010. Unpublished, http:\/\/keccak.noekeon.org\/NoteZeroSum.pdf."},{"key":"756_CR5","unstructured":"Biryukov, A., Khovratovich, D., Nikoli\u0107, I.: Distinguisher and Related-Key Attack on the Full AES-256. In: CRYPTO 2009, volume 5677 of LNCS, pp. 231\u2013249, (2009)"},{"key":"756_CR6","first-page":"2488","volume":"2010","author":"C Boura","year":"2010","unstructured":"Boura C., Canteaut A.: A zero-sum property for the KECCAK-$$f$$ permutation with 18 rounds. IEEE Int. Symp. Inf. Theory 2010, 2488\u20132492 (2010).","journal-title":"IEEE Int. Symp. Inf. Theory"},{"key":"756_CR7","unstructured":"Boura, C., Canteaut, A., De Canni\u00e8re, C.: Higher-Order Differential Properties of Keccak and Luffa. In:\u2018 FSE 2011, volume 6733 of LNCS, pp.\u00a0252\u2013269 (2011)."},{"issue":"3","key":"756_CR8","doi-asserted-by":"publisher","first-page":"859","DOI":"10.1007\/s00145-016-9237-5","volume":"30","author":"C Blondeau","year":"2017","unstructured":"Blondeau C., Leander G., Nyberg K.: Differential-linear cryptanalysis revisited. J. Cryptol. 30(3), 859\u2013888 (2017).","journal-title":"J. Cryptol."},{"key":"756_CR9","unstructured":"Blondeau, C., Peyrin, T., Wang, L.: Known-Key Distinguisher on Full PRESENT. In: CRYPTO 2015, volume 9215 of LNCS, pp. 455\u2013474, (2015)"},{"key":"756_CR10","unstructured":"Cui, T., Sun, L., Chen, H., Wang, M.: Statistical Integral Distinguisher with Multi-structure and Its Application on AES. In: ACISP 2017, volume 10342 of LNCS, pp.\u00a0402\u2013420, (2017)"},{"key":"756_CR11","unstructured":"Daemen, J., Knudsen, L.R., Rijmen, V.: The Block Cipher Square. In: FSE 1997, volume 1267 of LNCS, pp. 149\u2013165, (1997)"},{"issue":"6","key":"756_CR12","doi-asserted-by":"publisher","first-page":"694","DOI":"10.1007\/s11434-011-4909-x","volume":"57","author":"M Duan","year":"2012","unstructured":"Duan M., Lai X.J.: Improved zero-sum distinguisher for full round Keccak-$$f$$ permutation. Chin. Sci. Bull. 57(6), 694\u2013697 (2012).","journal-title":"Chin. Sci. Bull."},{"key":"756_CR13","doi-asserted-by":"crossref","unstructured":"Daemen, J., Rijmen, V.: The Design of Rijndael: AES\u2014The Advanced Encryption Standard. Information Security and CryptographySpringer, New York (2002).","DOI":"10.1007\/978-3-662-04722-4"},{"key":"756_CR14","unstructured":"Fouque, P.-A., Jean, J., Peyrin, T.: Structural Evaluation of AES and Chosen-Key Distinguisher of 9-Round AES-128. In: textitCRYPTO 2013, volume 8042 of LNCS, pp. 183\u2013203, (2013)"},{"key":"756_CR15","unstructured":"Ferguson, N., Kelsey, J., Lucks, S., Schneier, B., Stay, M., Wagner, D., Whiting, D.: Improved Cryptanalysis of Rijndael. In: FSE 2000, volume 1978 of LNCS, pages 213\u2013230, (2001)"},{"key":"756_CR16","unstructured":"Gilbert, H.: A Simplified Representation of AES. In: ASIACRYPT 2014, volume 8873 of LNCS, pp. 200\u2013222, (2014)"},{"key":"756_CR17","unstructured":"Gilbert, H., Peyrin, T.: Super-Sbox Cryptanalysis: Improved Attacks for AES-Like Permutations. In: FSE 2010, volume 6147 of LNCS, pp.\u00a0365\u2013383, (2010)"},{"issue":"2","key":"756_CR18","doi-asserted-by":"crossref","first-page":"192","DOI":"10.46586\/tosc.v2016.i2.192-225","volume":"2016","author":"L Grassi","year":"2017","unstructured":"Grassi L., Rechberger C., R\u00f8njom S.: Subspace trail cryptanalysis and its applications to AES. IACR Trans. Symmetric Cryptol. 2016(2), 192\u2013225 (2017).","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"756_CR19","unstructured":"Jean, J., Naya-Plasencia, M., Peyrin, T.: Multiple limited-birthday distinguishers and applications. In: SAC 2013, volume 8282 of LNCS, pp. 533\u2013550, (2014)"},{"key":"756_CR20","unstructured":"Knudsen, L.R., Rijmen, V.: Known-Key Distinguishers for Some Block Ciphers. In: ASIACRYPT 2007, volume 4833 of LNCS, pp. 315\u2013324, (2007)"},{"key":"756_CR21","unstructured":"Knudsen, L., Wagner, D.: Integral Cryptanalysis. In: FSE 2002, volume 2365 of LNCS, pp. 112\u2013127, (2002)"},{"issue":"2","key":"756_CR22","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s00145-013-9166-5","volume":"28","author":"M Lamberger","year":"2015","unstructured":"Lamberger M., Mendel F., Schl\u00e4ffer M., Rechberger C., Rijmen V.: The rebound attack and subspace distinguishers: application to whirlpool. J. Cryptol. 28(2), 257\u2013296 (2015).","journal-title":"J. Cryptol."},{"key":"756_CR23","doi-asserted-by":"crossref","unstructured":"Leander, G., Tezcan, C., Wiemer, F.: Searching for subspace trails and truncated differentials. IACR Trans. Symmetric Cryptol. 2018(1), 74\u2013100 (2018).","DOI":"10.46586\/tosc.v2018.i1.74-100"},{"key":"756_CR24","unstructured":"Lorenzo, G., Christian, R., R\u00f8njom, S.: A New Structural-Differential Property of 5-Round AES. In: EUROCRYPT 2017, volume 10211 of LNCS, pp. 289\u2013317, (2017)"},{"key":"756_CR25","unstructured":"Mendel, F., Peyrin, T., Rechberger, C., Schl\u00e4ffer, M.: Improved Cryptanalysis of the Reduced Gr\u00f8stl Compression Function, ECHO Permutation and AES Block Cipher. In: SAC 2009, volume 5867 of LNCS, pages 16\u201335, (2009)"},{"key":"756_CR26","unstructured":"Mendel, F., Rechberger, C., Schl\u00e4ffer, M., Thomsen, S.S.: The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Gr\u00f8stl. I:n FSE 2009, volume 5665 of LNCS, pp.\u00a0260\u2013276, (2009)"},{"key":"756_CR27","doi-asserted-by":"crossref","unstructured":"Mennink, B., Preneel, B.: On the impact of known-key attacks on hash functions. In: ASIACRYPT 2015, volume 9453 of LNCS, pp.\u00a059\u201384 (2015)","DOI":"10.1007\/978-3-662-48800-3_3"},{"key":"756_CR28","unstructured":"R\u00f8njom, S., Bardeh, N.G., Helleseth, T.: Yoyo Tricks with AES. In: ASIACRYPT 2017, volume 10624 of LNCS, pp. 217\u2013243, (2017)"},{"key":"756_CR29","unstructured":"Sasaki, Y., Yasuda, K.: Known-Key Distinguishers on 11-Round Feistel and Collision Attacks on Its Hashing Modes. In: FSE 2011, volume 6733 of LNCS, pp. 397\u2013415, (2011)"},{"key":"756_CR30","first-page":"25","volume":"2012","author":"M Tunstall","year":"2012","unstructured":"Tunstall M.: Improved \u201cPartial Sums\u201d-based Square Attack on AES. SECRYPT 2012, 25\u201334 (2012).","journal-title":"SECRYPT"},{"key":"756_CR31","unstructured":"Wagner, D.: A Generalized Birthday Problem. In: CRYPTO 2002, volume 2442 of LNCS, pages 288\u2013303, (2002)"},{"key":"756_CR32","unstructured":"Meiqin, W., Tingting, C., Huaifeng, C., Ling, S., Long, W., Andrey, B.: Integrals Go Statistical: Cryptanalysis of Full Skipjack Variants. In: FSE 2016, volume 9783 of LNCS, pp. 399\u2013415, 2016."},{"key":"756_CR33","unstructured":"Wang, Q., Grassi, L., Rechberger, C.: Zero-Sum Partitions of PHOTON Permutations. In: Topics in Cryptology - CT-RSA 2018, volume 10808 of LNCS, pp. 279\u2013299, (2018)"},{"key":"756_CR34","unstructured":"Wei, L., Peyrin, T., Soko\u0142owski, P., Ling, S., Pieprzyk, J., Wang, H.: On the (In)Security of IDEA in Various Hashing Modes. In: FSE 2012, volume 7549 of LNCS, pp. 163\u2013179, (2012)"}],"container-title":["Designs, Codes and Cryptography"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10623-020-00756-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10623-020-00756-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10623-020-00756-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,3]],"date-time":"2021-05-03T23:45:00Z","timestamp":1620085500000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10623-020-00756-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,5,4]]},"references-count":34,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2020,7]]}},"alternative-id":["756"],"URL":"https:\/\/doi.org\/10.1007\/s10623-020-00756-5","relation":{},"ISSN":["0925-1022","1573-7586"],"issn-type":[{"type":"print","value":"0925-1022"},{"type":"electronic","value":"1573-7586"}],"subject":[],"published":{"date-parts":[[2020,5,4]]},"assertion":[{"value":"8 October 2018","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 March 2020","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"31 March 2020","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 May 2020","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}