What is the effective key length for a block cipher: an attack on every practical block cipher

作     者：HUANG JiaLin LAI XueJia 

作者机构：Cryptography and Information Security LabDepartment of Computer ScienceShanghai Jiaotong University 

出 版 物：《Science China(Information Sciences)》 (中国科学:信息科学(英文版))

年 卷 期：2014年第57卷第7期

页      面：138-148页

核心收录：

学科分类：11[军事学] 1105[军事学-军队指挥学] 0839[工学-网络空间安全] 08[工学] 110505[军事学-密码学] 110503[军事学-军事通信学] 

基　　金：supported by National Natural Science Foundation of China (Grant Nos.61073149,61272440) Research Fund for the Doctoral Program of Higher Education of China (Grant No.20090073110027) State Key Laboratory of ASIC & System (Grant No.11KF002) Key Lab of Information Network Security,Ministry of Public Security (Grant No.C11603) 

主　　题：block cipher effective key bits meet-in-the-middle brute-force attack 

摘      要：Recently,several important block ciphers are considered to be broken by the brute-force-like cryptanalysis,with a time complexity faster than the exhaustive key search by going over the entire key space but performing less than a full encryption for each possible *** by this observation,we describe a meetin-the-middle attack that can always be successfully mounted against any practical block ciphers with success probability *** data complexity of this attack is the smallest according to the unicity *** time complexity can be written as 2k(1-),where0 for all practical block ***,the security bound that is commonly accepted is the length k of the given master *** our result we point out that actually this k-bit security is always overestimated and can never be reached because of the inevitable loss of the key *** amount of clever design can prevent it,but increments of the number of rounds can reduce this key loss as much as *** give more insight into the problem of the upper bound of effective key bits in block ciphers,and show a more accurate bound.A suggestion about the relationship between the key size and block size is *** is,when the number of rounds is fixed,it is better to take a key size equal to the block ***,effective key bits of many well-known block ciphers are calculated and analyzed,which also confirms their lower security margins than thought *** results in this article motivate us to reconsider the real complexity that a valid attack should compare to.