Related-Key Boomerang and Rectangle Attacks

This paper introduces the related-key boomerang and the related-key rectangle attacks. These new attacks can expand the cryptanalytic toolbox, and can be applied to many block ciphers. The main advantage of these new attacks, is the ability to exploit the related-key model twice. Hence, even ciphers which were considered resistant to either boomerang or related-key differential attacks may be broken using the new techniques. ⋆ This paper is partially based on the papers [9, 10, 27] which appeared at EUROCRYPT 2005, ASIACRYPT 2005 and FSE 2007, respectively. ⋆⋆ This paper was submitted to a Journal on October 2009. ⋆ ⋆ ⋆ The fifth author was partially supported by the Clore scholarship programme and in part by the Concerted Research Action (GOA) Ambiorics 2005/11 of the Flemish Government and by the IAP Programme P6/26 BCRYPT of the Belgian State (Belgian Science Policy). † The sixth author was partially supported by the Adams Fellowship Program of the Israel Academy of Sciences and Humanities. In this paper we present a rigorous treatment of the related-key boomerang and the related-key rectangle distinguishers. Following this treatment, we devise optimal distinguishing algorithms using the LLR (Logarithmic Likelihood Ratio) statistics. We then analyze the success probability under reasonable independence assumptions, and verify the computation experimentally by implementing an actual attack on a 6-round variant of KASUMI. The paper ends with a demonstration of the strength of our new proposed techniques with attacks on 10-round AES-192 and the full KASUMI.