Note on Impossible Differential Attacks

While impossible di erential cryptanalysis is a well-known and popular cryptanalytic method, errors in the analysis are often discovered and many papers in the literature present aws. Wishing to solve that, Boura et al. [1] presented at ASIACRYPT'14 a generic vision of impossible di erential attacks with the aim of simplifying and helping the construction and veri cation of this type of cryptanalysis. In particular, they gave generic complexity analysis formulas for mounting such attacks and develop new ideas for optimizing them. In this paper we carefully study this generic formula and show impossible di erential attacks for which the real time complexity is much higher than estimated by it. In particular, we show that the impossible differential attack against 25-round TWINE-128, presented at FSE'15 by Biryukov et al. [2], actually has a complexity higher than the natural bound of exhaustive search.