Key recovery attacks of practical complexity on AES-256 variants with up to 10 rounds

摘要: AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, AES-256) differ in their key sizes (128 bits, 192 bits 256 bits) number of rounds (10, 12, 14, respectively). While for AES-128, there are no attacks faster than exhaustive search, AES-192 AES-256 were recently shown to be breakable by which require 2176 299.5 time, respectively. these complexities much they completely non-practical, do not seem pose any real threat security AES-based systems. In this paper we aim increase our understanding security, concentrate on with practical complexity, i.e., that can experimentally verified. We show reduced-round variants up 10 complexity feasible. One uses only two related keys 239 time recover complete 256-bit a 9-round version (the previous attack variant required 4 2120 time). Another break 10-round 245 but it stronger type subkey 64 2172 full cannot directly broken attacks, fact such low raises serious concerns about remaining safety margin offered AES-256.