Algebraic Techniques in Differential Cryptanalysis Revisited

摘要: At FSE 2009, Albrecht et al. proposed a new cryptanalytic method that combines algebraic and differential cryptanalysis. They introduced three attacks, namely Attack A, B C. For they explain the time complexity is difficult to determine. The goal of Attacks C filter out wrong pairs then recover key. In this paper, we show does not provide an advantage over cryptanalysis for typical block ciphers, because it cannot be used any satisfy ciphertext differences. Furthermore, why provides no PRESENT. We verify our results PRESENT experimentally, using both PolyBoRi MiniSat. Our work helps understand which equations are important in differential-algebraic attack. Based on findings, present two attacks. Using first method, attack 15-round PRESENT-80 requires 259 chosen plaintexts has worstcase 273.79 equivalent encryptions. 14-round PRESENT-128 255 2112.83 Although these attacks have higher than their data lower.