{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T13:42:21Z","timestamp":1767966141791,"version":"3.49.0"},"reference-count":26,"publisher":"International Association for Cryptologic Research","issue":"4","license":[{"start":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T00:00:00Z","timestamp":1759968000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001665","name":"Agence Nationale de la Recherche","doi-asserted-by":"publisher","award":["ANR-22-CE39-0015"],"award-info":[{"award-number":["ANR-22-CE39-0015"]}],"id":[{"id":"10.13039\/501100001665","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001665","name":"Agence Nationale de la Recherche","doi-asserted-by":"publisher","award":["ANR-22-PECY-0010"],"award-info":[{"award-number":["ANR-22-PECY-0010"]}],"id":[{"id":"10.13039\/501100001665","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000781","name":"European Research Council","doi-asserted-by":"publisher","award":["101125450"],"award-info":[{"award-number":["101125450"]}],"id":[{"id":"10.13039\/501100000781","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,12,2]]},"abstract":"\n In this paper, we revisit the differential meet-in-the-middle attack and classical differential attack on AES-256 under the related-key setting, as introduced in Boura et al.'s ToSC 2023 and Song et al.'s Asiacrypt 2024 works. We propose new attacks against 13-round AES-256, all with significantly lower complexities. This is achieved through an efficient method for identifying weak keys, which enables a better utilization of differential propagation. Furthermore, we present multiple attack scenarios and their complexities by considering various weak keys derived from the key generation process. Our attacks have data complexity between\n \n \n \n 2<\/mml:mn>\n \n 89<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n and\n \n \n \n 2<\/mml:mn>\n \n 112<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n and time complexity between\n \n \n \n 2<\/mml:mn>\n \n 189.9<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n and\n \n \n \n 2<\/mml:mn>\n \n 233.9<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n depending on the proportion of weak keys that varies from\n \n \n \n 2<\/mml:mn>\n \n \u2212<\/mml:mo>\n 11<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n to\n \n \n \n 2<\/mml:mn>\n \n \u2212<\/mml:mo>\n 2<\/mml:mn>\n <\/mml:mrow>\n <\/mml:msup>\n <\/mml:mrow>\n <\/mml:math>\n , marking a substantial advance over previous approaches.\n <\/jats:p>","DOI":"10.62056\/a0qjmpgxq","type":"journal-article","created":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:39:47Z","timestamp":1767915587000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":0,"title":["Improved Related-Key Differential Attacks against AES-256"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5639-7372","authenticated-orcid":false,"given":"Anubhab","family":"Baksi","sequence":"first","affiliation":[{"name":"Lund University","place":["Lund, Sweden"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ajay","family":"Das","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology","place":["Bhilai, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1841-0936","authenticated-orcid":false,"given":"Smita","family":"Das","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology","place":["Kharagpur, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0478-8483","authenticated-orcid":false,"given":"Patrick","family":"Derbez","sequence":"additional","affiliation":[{"name":"Univ Rennes, Inria, CNRS, IRISA","place":["Rennes, France"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2514-074X","authenticated-orcid":false,"given":"Chandan","family":"Dey","sequence":"additional","affiliation":[{"name":"TCG CREST","place":["Kolkata, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0069-6146","authenticated-orcid":false,"given":"Mattia","family":"Formenti","sequence":"additional","affiliation":[{"name":"Technology Innovation Institute","place":["Abu Dhabi, United Arab Emirates"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4171-0650","authenticated-orcid":false,"given":"Amit","family":"Jana","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology","place":["Kharagpur, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5160-6032","authenticated-orcid":false,"given":"Goutam","family":"Paul","sequence":"additional","affiliation":[{"name":"Indian Statistical Institute","place":["Kolkata, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2026,1,8]]},"reference":[{"key":"ref1:DBLP:conf\/crypto\/BihamS90","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/3-540-38424-3_1","article-title":"Differential Cryptanalysis of DES-like Cryptosystems","volume":"537","author":"Eli Biham","year":"1990"},{"key":"ref2:BihamS91","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-46416-6_1","article-title":"Differential Cryptanalysis of Feal and N-Hash","volume":"547","author":"Eli Biham","year":"1991"},{"key":"ref3:BihamS91b","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"156","DOI":"10.1007\/3-540-46766-1_11","article-title":"Differential Cryptanalysis of Snefru, Khafre, REDOC-II,\n LOKI and Lucifer","volume":"576","author":"Eli Biham","year":"1991"},{"key":"ref4:BihamS92","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"487","DOI":"10.1007\/3-540-48071-4_34","article-title":"Differential Cryptanalysis of the Full 16-Round DES","volume":"740","author":"Eli Biham","year":"1992"},{"key":"ref5:Ben-AroyaB93","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1007\/3-540-48329-2_17","article-title":"Differential Cryptanalysis of Lucifer","volume":"773","author":"Ishai Ben-Aroya","year":"1993"},{"key":"ref6:DBLP:conf\/asiacrypt\/KnellwolfMN10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"130","DOI":"10.1007\/978-3-642-17373-8_8","article-title":"Conditional Differential Cryptanalysis of NLFSR-Based\n Cryptosystems","volume":"6477","author":"Simon Knellwolf","year":"2010"},{"key":"ref7:DBLP:conf\/fse\/Wagner99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"156","DOI":"10.1007\/3-540-48519-8_12","article-title":"The Boomerang Attack","volume":"1636","author":"David A. Wagner","year":"1999"},{"key":"ref8:DBLP:conf\/eurocrypt\/BihamDK01","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"340","DOI":"10.1007\/3-540-44987-6_21","article-title":"The Rectangle Attack - Rectangling the Serpent","volume":"2045","author":"Eli Biham","year":"2001"},{"key":"ref9:BihamDK02","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-45661-9_1","article-title":"New Results on Boomerang and Rectangle Attacks","volume":"2365","author":"Eli Biham","year":"2002"},{"key":"ref10:Knudsen1998-KNUDBB","article-title":"Deal-a 128-Bit Block Cipher","volume":"258","author":"Lars Knudsen","year":"1998","journal-title":"Complexity"},{"key":"ref11:DBLP:conf\/eurocrypt\/BihamBS99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1007\/3-540-48910-X_2","article-title":"Cryptanalysis of Skipjack Reduced to 31 Rounds Using\n Impossible Differentials","volume":"1592","author":"Eli Biham","year":"1999"},{"key":"ref12:DBLP:conf\/crypto\/BouraDDLN23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"240","DOI":"10.1007\/978-3-031-38548-3_9","article-title":"Differential Meet-In-The-Middle Cryptanalysis","volume":"14083","author":"Christina Boura","year":"2023"},{"key":"ref13:DBLP:conf\/eurocrypt\/AhmadianKMMN24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"280","DOI":"10.1007\/978-3-031-58716-0_10","article-title":"Improved Differential Meet-in-the-Middle Cryptanalysis","volume":"14651","author":"Zahra Ahmadian","year":"2024"},{"key":"ref14:DBLP:books\/sp\/DaemenR02","series-title":"Information Security and Cryptography","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-04722-4","volume-title":"The Design of Rijndael: AES - The Advanced Encryption\n Standard","author":"Joan Daemen","year":"2002","ISBN":"https:\/\/id.crossref.org\/isbn\/3540425802"},{"key":"ref15:DBLP:conf\/asiacrypt\/BiryukovK09","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-642-10366-7_1","article-title":"Related-Key Cryptanalysis of the Full AES-192 and\n AES-256","volume":"5912","author":"Alex Biryukov","year":"2009"},{"key":"ref16:DBLP:conf\/asiacrypt\/DerbezEFN22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"68","DOI":"10.1007\/978-3-031-22969-5_3","article-title":"Revisiting Related-Key Boomerang Attacks on AES Using\n Computer-Aided Tool","volume":"13793","author":"Patrick Derbez","year":"2022"},{"key":"ref17:DBLP:conf\/eurocrypt\/BiryukovDKKS10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"299","DOI":"10.1007\/978-3-642-13190-5_15","article-title":"Key Recovery Attacks of Practical Complexity on AES-256\n Variants with up to 10 Rounds","volume":"6110","author":"Alex Biryukov","year":"2010"},{"key":"ref18:DBLP:journals\/tosc\/BouraDF23","doi-asserted-by":"publisher","first-page":"215","DOI":"10.46586\/TOSC.V2023.I4.215-243","article-title":"Related-Key Differential Analysis of the AES","volume":"2023","author":"Christina Boura","year":"2023","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref19:DBLP:conf\/asiacrypt\/SongLYCHW24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"361","DOI":"10.1007\/978-981-96-0941-3_12","article-title":"Generic Differential Key Recovery Attacks and Beyond","volume":"15490","author":"Ling Song","year":"2024"},{"key":"ref20:DBLP:conf\/asiacrypt\/BrollCFLN21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"453","DOI":"10.1007\/978-3-030-92062-3_16","article-title":"Generic Framework for Key-Guessing Improvements","volume":"13090","author":"Marek Broll","year":"2021"},{"key":"ref21:DBLP:conf\/eurocrypt\/BouraDDBN24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"217","DOI":"10.1007\/978-3-031-58716-0_8","article-title":"A Generic Algorithm for Efficient Key Recovery in\n Differential Attacks - and its Associated Tool","volume":"14651","author":"Christina Boura","year":"2024"},{"key":"ref22:DBLP:conf\/fse\/MendelRST09","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"260","DOI":"10.1007\/978-3-642-03317-9_16","article-title":"The Rebound Attack: Cryptanalysis of Reduced Whirlpool and\n Gr\u00f8stl","volume":"5665","author":"Florian Mendel","year":"2009"},{"key":"ref23:BihamS90","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/3-540-38424-3_1","article-title":"Differential Cryptanalysis of DES-like Cryptosystems","volume":"537","author":"Eli Biham","year":"1990"},{"key":"ref24:DBLP:conf\/asiacrypt\/SongZYSZHW22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"410","DOI":"10.1007\/978-3-031-22963-3_14","article-title":"Optimizing Rectangle Attacks: A Unified and Generic\n Framework for Key Recovery","volume":"13791","author":"Ling Song","year":"2022"},{"key":"ref25:DBLP:books\/daglib\/0032320","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4613-9314-6","volume-title":"Differential Cryptanalysis of the Data Encryption Standard","author":"Eli Biham","year":"1993","ISBN":"https:\/\/id.crossref.org\/isbn\/9781461393160"},{"key":"ref26:SSL15","isbn-type":"print","doi-asserted-by":"crossref","DOI":"10.1002\/9781118660027","volume-title":"Security of Block Ciphers - From Algorithm Design to\n Hardware Implementation","author":"Kazuo Sakiyama","year":"2015","ISBN":"https:\/\/id.crossref.org\/isbn\/9781118660010"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:40:05Z","timestamp":1767915605000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/4\/39"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,8]]},"references-count":26,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,1,8]]}},"URL":"https:\/\/doi.org\/10.62056\/a0qjmpgxq","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,8]]},"assertion":[{"value":"2025-10-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-4-84"}}