Impossible differential cryptanalysis on cipher E2. (10th May 2013)

• Record Type: Journal Article
• Authors: Wei, Yuechuan; Yang, Xiaoyuan; Li, Chao; Xu, Li; Bertino, Elisa; Mu, Yi
• Is Part Of: Concurrency and computation. Volume 26:Number 8(2014:Jun.)
• Page Start: 1477
• Page End: 1489
• Publication Date: 2013-05-10
• Subjects: Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.3043
• Languages: English
• ISSNs: 1532-0626

Abstract

<abstract abstract-type="main" id="cpe3043-abs-0001"> <title>SUMMARY</title> <p>E2, a block cipher, is an Advanced Encryption Standard candidate designed and submitted by Nippon Telegraph and Telephone Corporation. It employs a Feistel structure as global structure and two‐layer substitution–permutation network structure in round function. The conservative structure makes E2 immune to kinds of current cryptanalysis. Previously, there is no result of impossible differential attacks on E2 because it was once supposed to have no more than five‐round impossible differential characteristic. In this paper, we present a series of six‐round impossible differential characteristics of E2 with/without initial transformation (IT)/ final transformation (FT) functions. Based on these impossible differentials, the immunity of E2 against impossible differential cryptanalysis is evaluated. We perform a seven‐round attack on tweaked E2 (E2 without IT and FT ) with 128, 192, and 256 bits key and an eight‐round attack on tweaked E2 with 256 bits key. The seven‐round attack requires about 2<sup>120</sup> chosen plaintexts and 2<sup>115.5</sup> seven‐round encryptions; the eight‐round attack needs 2<sup>121</sup> chosen plaintexts and less than 2<sup>214</sup> eight‐round encryptions. We also discuss the seven‐round attack on E2 with IT or FT, and the result shows that the attack has the same complexities with the seven‐round attack on tweaked E2. Copyright © 2013 John Wiley & Sons, Ltd.</p> </abstract>