Notes

References

[1] Kazumaro Aoki, Tetsuya Ichikawa, Masayuki Kanda, Mitsuru Matsui, Shiho
Moriai, Junko Nakajima, and Toshio Tokita. Camellia: a 128-bit block cipher
suitable for multiple platforms | design and analysis. In D.R. Stinson and
S.E. Tavares, editors, Proceedings of SAC '00 | The 7th Annual Workshop
on Selected Areas in Cryptography, volume 2012 of Lecture Notes in Computer
Science, pages 39{56. Springer-Verlag, 2001.

[2] Behnam Bahrak and Mohammad Reza Aref. A novel impossible di®erenital
cryptanalysis of AES, In Proceedings of WEWoRc '07 | Western European
Workshop on Research in Cryptology. 2007.

[3] Eli Biham. New types of cryptanalytic attacks using related keys. In T. Helle-
seth, editor, Advances in Cryptology - Proceedings of EUROCRYPT '93 |
Workshop on the Theory and Application of Cryptographic Techniques, volume
765 of Lecture Notes in Computer Science, pages 398{409. Springer-Verlag,
1993.

[4] Eli Biham, Alex Biryukov, and Adi Shamir. Cryptanalysis of Skipjack reduced
to 31 rounds using impossible di®erentials. In J. Stern, editor, Advances in
Cryptology - Proceedings of EUROCRYPT '99 | International Conference
on the Theory and Application of Cryptographic Techniques, volume 1592 of
Lecture Notes in Computer Science, pages 12{23. Springer-Verlag, 1999.

[5] Eli Biham, Alex Biryukov, and Adi Shamir. Miss in the middle attacks on
IDEA and Khufu. In L.R. Knudsen, editor, Proceedings of FSE '99 | The 6th
International Workshop on Fast Software Encryption, volume 1636 of Lecture
Notes in Computer Science, pages 124{138. Springer-Verlag, 1999.

[6] Eli Biham, Orr Dunkelman, and Nathan Keller. The rectangle attack |
rectangling the Serpent. In B. P¯tzmann, editor, Advances in Cryptology -
Proceedings of EUROCRYPT '01 | International Conference on the Theory
and Application of Cryptographic Techniques, volume 2045 of Lecture Notes in
Computer Science, pages 340{357. Springer-Verlag, 2001.

[7] Eli Biham, Orr Dunkelman, and Nathan Keller. Enhancing di®erential-linear
cryptanalysis. In Y. Zheng, editor, Advances in Cryptology - Proceedings of
ASIACRYPT '02 | The 8th International Conference on the Theory and
Application of Cryptology and Information Security, volume 2501 of Lecture
Notes in Computer Science, pages 254{266. Springer-Verlag, 2002.

[8] Eli Biham, Orr Dunkelman, and Nathan Keller. New results on boomerang and
rectangle attacks. In J. Daemen and V. Rijmen, editors, Proceedings of FSE
'02 | The 9th International Workshop on Fast Software Encryption, volume
2365 of Lecture Notes in Computer Science, pages 1{16. Springer-Verlag, 2002.

[9] Eli Biham, Orr Dunkelman, and Nathan Keller. Related-key boomerang and
rectangle attacks. In R. Cramer, editor, Advances in Cryptology - Proceedings
of EUROCRYPT '05 | The 24th Annual International Conference on the
Theory and Applications of Cryptographic Techniques, volume 3494 of Lecture
Notes in Computer Science, pages 507{525. Springer-Verlag, 2005.

[10] Eli Biham, Orr Dunkelman, and Nathan Keller. Related-key impossible dif-
ferential attacks on 8-round AES-192. In D. Pointcheval, editor, Proceedings
of CT-RSA '06 | Cryptographers' Track at the RSA Conference 2006, vol-
ume 3860 of Lecture Notes in Computer Science, pages 21{33. Springer-Verlag,
2006.

[11] Eli Biham and Nathan Keller. Cryptanalysis of reduced variants of Rijndael.
In Proceedings of The Third Advanced Encryption Standard Candidate Con-
ference. NIST, 2000.

[12] Eli Biham and Adi Shamir. Di®erential cryptanalysis of DES-like cryptosys-
tems. In A. Menezes and S.A. Vanstone, editors, Advances in Cryptology -
Proceedings of CRYPTO '90 | The 10th Annual International Cryptology
Conference, volume 537 of Lecture Notes in Computer Science, pages 2{21.
Springer-Verlag, 1990.

[13] Eli Biham and Adi Shamir. Di®erential cryptanalysis of the Data Encryption
Standard. Springer-Verlag, 1993.

[14] Eli Biham and Adi Shamir. Di®erential cryptanalysis of the full 16-round DES.
In E.F. Brickell, editor, Advances in Cryptology - Proceedings of CRYPTO
'92 | The 12th Annual International Cryptology Conference, volume 740 of
Lecture Notes in Computer Science, pages 487{496. Springer-Verlag, 1993.

[15] Alex Biryukov. The boomerang attack on 5 and 6-round reduced AES. In
H. Dobbertin, V. Rijmen, and A. Sowa, editors, Proceedings of AES '04 |
The 4th International Conference on Advanced Encryption Standard, volume
3373 of Lecture Notes in Computer Science, pages 11{15. Springer-Verlag,
2005.

[16] Jung Hee Cheon, MunJu Kim, Kwangjo Kim, Jung-Yeun Lee, and SungWoo
Kang. Improved impossible di®erential cryptanalysis of Rijndael and Cryp-
ton. In K. Kim, editor, Proceedings of ICISC '01 | The 4th International
Conference on Information Security and Cryptology, volume 2288 of Lecture
Notes in Computer Science, pages 39{49. Springer-Verlag, 2001.

[17] Nicolas Courtois. Feistel schemes and bi-linear cryptanalysis. In M.K.
Franklin, editor, Advances in Cryptology - Proceedings of CRYPTO '04 |
The 24th Annual International Cryptology Conference, volume 3152 of Lec-
ture Notes in Computer Science, pages 23{40. Springer-Verlag, 2004.

[18] Nicolas Courtois and Josef Pieprzyk. Cryptanalysis of block ciphers with
overdelned systems of equations. In Y. Zheng, editor, Advances in Cryptology
- Proceedings of ASIACRYPT '02 | The 8th International Conference on the
Theory and Application of Cryptology and Information Security, volume 2501
of Lecture Notes in Computer Science, pages 267{287. Springer-Verlag, 2002.

[19] CRYPTREC | Cryptography Research and Evaluatin Committees, report
2002. http://www.ipa.go.jp/security/enc/CRYPTREC/index-e.html.

[20] Joan Daemen, Lars R. Knudsen, and Vincent Rijmen. The block cipher Square.
In E. Biham, editor, Proceedings of FSE '97 | The 4th International Work-
shop on Fast Software Encryption, volume 1267 of Lecture Notes in Computer
Science, pages 149{165. Springer-Verlag, 1997.

[21] Joan Daemen and Vincent Rijmen. AES proposal: Rijndael. In Proceedings of
The First Advanced Encryption Standard Candidate Conference. NIST, 1998.

[22] Huseyin Demirci and Ali Aydin Selcuk. A meet-in-the-middle attack on 8-
round AES. In K. Nyberg, editor, Proceedings of FSE '08 | The 15th Inter-
national Workshop on Fast Software Encryption, volume ? of Lecture Notes
in Computer Science, pages ?{? Springer-Verlag, 2008.

[23] Whit¯eld Di±e and Martin Hellman. New directions in cryptography. IEEE
Transactions on Information Theory, IT-22:644{654, 19767.

[24] Lei Duo, Chao Li, and Keqin Feng. New observation on Camellia. In B. Pre-
neel and S.E. Tavares, editors, Proceedings of SAC '05 | The 12th Annual
Workshop on Selected Areas in Cryptography, volume 3897 of Lecture Notes
in Computer Science, pages 51{64. Springer-Verlag, 2006.

[25] Niels Ferguson, John Kelsey, Stefan Lucks, Bruce Schneier, Mike Stay,
David Wagner, and Doug Whiting. Improved cryptanalysis of Rijndael. In
B. Schneier, editor, Proceedings of FSE '00 | The 7th International Work-
shop on Fast Software Encryption, volume 1978 of Lecture Notes in Computer
Science, pages 213{230. Springer-Verlag, 2001.

[26] Henri Gilbert and Marine Minier. A collision attack on 7 rounds of Rijn-
dael. In Proceedings of The Third Advanced Encryption Standard Candidate
Conference. NIST, 2000.

[27] Nick D. Goots, Boris V. Izotov, Alexander A. Moldovyan, and Nick A.
Moldovyan. Fast ciphers for cheap hardware: di®erential analysis of SPECTR-
H64. In Vladimir Gorodetsky, Igor V. Kotenko, and Victor A. Skormin, edi-
tors, Proceedings of MMM-ACNS '03 | The Second International Workshop
on Mathematical Methods, Models, and Architectures for Computer Network
Security, volume 2776 of Lecture Notes in Computer Science, pages 449{452.
Springer-Verlag, 2003.

[28] Nick D. Goots, Boris V. Izotov, Alexander A. Moldovyan, and Nick A.
Moldovyan. Modern cryptography: protect your data with fast block ciphers.
A-LIST Publishing, 2003.

[29] Nick D. Goots, Alexander A. Moldovyan, and Nick A. Moldovyan. Fast encryp-
tion algorithm SPECTR-H64. In Vladimir I. Gorodetski, Victor A. Skormin,
and Leonard J. Popyack, editors, Proceedings of MMM-ACNS '01 | Interna-
tional Workshop on Information Assurance in Computer Networks: Methods,
Models, and Architectures for Network Security, volume 2052 of Lecture Notes
in Computer Science, pages 275{286. Springer-Verlag, 2001.

[30] Nick D. Goots, Alexander A. Moldovyan, Nick A. Moldovyan, and D.H. Sum-
merville. Fast DDP-based ciphers: from hardware to software. In Proceedings
of the 46th IEEE Midwest International Symposium on Circuits and Systems,
pages 770{773, 2003.

[31] Helena Handschuh and David Naccache. SHACAL. In Proceedings of The First
Open NESSIE Workshop, 2000. Archive available at https://www.cosic.esat.
kuleuven.be/nessie/workshop/submissions.html.

[32] Helena Handschuh and David Naccache. SHACAL. NESSIE, 2001. Archive
available at https://www.cosic.esat.kuleuven.be/nessie/tweaks.html.

[33] Yasuo Hatano, Hiroki Sekine, and Toshinobu Kaneko. Higher order di®erential
attack of Camellia(II). In K. Nyberg and H.M. Heys, editors, Proceedings of
SAC '02 | The 9th Annual Workshop on Selected Areas in Cryptography,
volume 2595 of Lecture Notes in Computer Science, pages 39{56. Springer-
Verlag, 2003.

[34] Philip Hawkes. Di®erential-linear weak key classes of IDEA. In K. Nyberg,
editor, Advances in Cryptology - Proceedings of EUROCRYPT '98 | Interna-
tional Conference on the Theory and Application of Cryptographic Techniques,
volume 1403 of Lecture Notes in Computer Science, pages 112{126. Springer-
Verlag, 1998.

[35] Yeping He and Sihan Qing. Square attack on reduced Camellia cipher. In
S. Qing, T. Okamoto, and J. Zhou, editors, Proceedings of ICICS '01 | The
Third International Conference on Information and Communications Security,
volume 2229 of Lecture Notes in Computer Science, pages 238{245. Springer-
Verlag, 2001.

[36] Martin E. Hellman. A cryptanalytic time-memory trade-o®. IEEE Transac-
tions on Information Theory, IT-26(4):401{406, 1980. IEEE Press.

[37] Deukjo Hong, Jaechul Sung, Seokhie Hong, Jongin Lim, Sangjin Lee, Bon-Seok
Koo, Changhoon Lee, Donghoon Chang, Jesang Lee, Kitae Jeong, Hyun Kim,
Jongsung Kim, and Seongtaek Chee. HIGHT: a new block cipher suitable
for low-resource device. In L. Goubin and M. Matsui, editors, Proceedings
of CHES '06 | The 8th International Workshop on Cryptographic Hardware
and Embedded Systems, volume 4249 of Lecture Notes in Computer Science,
pages 46{59. Springer-Verlag, 2006.

[38] Seokhie Hong, Deukjo Hong, Youngdai Ko, Donghoon Chang, Wonil Lee, and
Sangjin Lee. Di®erential cryptanalysis of TEA and XTEA. In J. Lim and
D. Lee, editors, Proceedings of ICISC '03 | The 6th International Confer-
ence on Information Security and Cryptology, volume 2791 of Lecture Notes
in Computer Science, pages 402{417. Springer-Verlag, 2003.

[39] Seokhie Hong, Jongsung Kim, Guil Kim, Jaechul Sung, Changhoon Lee, ,
and Sangjin Lee. Impossible di®erential attack on 30-round SHACAL-2. In
T. Johansson and S. Maitra, editors, Proceedings of INDOCRYPT '03 | The
4th International Conference on Cryptology in India, volume 2904 of Lecture
Notes in Computer Science, pages 97{106. Springer-Verlag, 2003.

[40] Seokhie Hong, Jongsung Kim, Sangjin Lee, , and Bart Preneel. Related-
key rectangle attacks on reduced versions of SHACAL-1 and AES-192. In
H. Gilbert and H. Handschuh, editors, Proceedings of FSE '05 | The 12th
International Workshop on Fast Software Encryption, volume 3557 of Lecture
Notes in Computer Science, pages 368{383. Springer-Verlag, 2005.

[41] The Institute of Electrical and Electronics Engineers (IEEE). http://grouper.
ieee.org/groups/802/11.

[42] International Standardization of Organization (ISO), International Standard {
ISO/IEC 18033-3, Information technology { Security techniques { Encryption
algorithms { Part 3: Block ciphers, July, 2005.

[43] International Standardization of Organization (ISO), International Standard{
ISO/IEC 8802-11: Wireless LAN Medium Access Control (MAC) and Physical
Layer (PHY) speci¯cations. http://www.iso.org/iso/en/CatalogueDetailPage.
CatalogueDetail?CSNUMBER=39777.

[44] The Internet Engineering Task Force (IETF), RFC 4301 { Security Architec-
ture for the Internet Protocol, December, 2005.

[45] Goce Jakimoski and Yvo Desmedt. Related-key di®erential cryptanalysis of
192-bit key AES variants. In M. Matsui and R.J. Zuccherato, editors, Pro-
ceedings of SAC '03 | The 10th Annual Workshop on Selected Areas in Cryp-
tography, volume 3006 of Lecture Notes in Computer Science, pages 208{221.
Springer-Verlag, 2004.

[46] Burton S. Kaliski Jr. and Matthew J.B. Robshaw. Linear cryptanalysis using
multiple approximations. In Y. Desmedt, editor, Advances in Cryptology -
Proceedings of CRYPTO '94 | The 14th Annual International Cryptology
Conference, volume 839 of Lecture Notes in Computer Science, pages 26{39.
Springer-Verlag, 1994.

[47] Ari Juels. RFID security and privacy: a research survey. IEEE Journal on
Selected Areas in Communications, 24(2):381{394, 2006.

[48] John Kelsey, Tadayoshi Kohno, and Bruce Schneier. Ampli¯ed boomerang
attacks against reduced-round MARS and Serpent. In B. Schneier, editor,
Proceedings of FSE '00 | The 7th International Workshop on Fast Software
Encryption, volume 1978 of Lecture Notes in Computer Science, pages 75{93.
Springer-Verlag, 2001.

[49] John Kelsey, Bruce Schneier, and David Wagner. Key-schedule cryptanaly-
sis of IDEA, G-DES, GOST, SAFER, and Triple-DES. In N. Koblitz, editor,
Advances in Cryptology - Proceedings of CRYPTO '96 | The 16th Annual In-
ternational Cryptology Conference, volume 1109 of Lecture Notes in Computer
Science, pages 237{251. Springer-Verlag, 1996.

[50] John Kelsey, Bruce Schneier, and David Wagner. Related-key cryptanalysis of
3-WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA. In Y. Han,
T. Okamoto, and S. Qing, editors, Proceedings of ICICS '97 | The First In-
ternational Conference on Information and Communications Security, volume
1334 of Lecture Notes in Computer Science, pages 233{246. Springer-Verlag,
1997.

[51] Auguste Kerckho®s. La cryptographie militaire. Journal des sciences mili-
taires, IX:5{83, 1883.

[52] Jongsung Kim, Seokhie Hong, and Bart Preneel. Related-key rectangle attacks
on reduced AES-192 and AES-256. In A. Biryukov, editor, Proceedings of FSE
'07 | The 14th International Workshop on Fast Software Encryption, volume
4593 of Lecture Notes in Computer Science, pages 225{241. Springer-Verlag,
2007.

[53] Jongsung Kim, Guil Kim, Seokhie Hong, Sangjin Lee, and Dowon Hong.
The related-key rectangle attack | application to SHACAL-1. In H. Wang,
J. Pieprzyk, and V. Varadharajan, editors, Proceedings of ACISP '04 | The
9th Australasian Conference on Information Security and Privacy, volume
3108 of Lecture Notes in Computer Science, pages 123{136. Springer-Verlag,
2004.

[54] Jongsung Kim, Guil Kim, Sangjin Lee, Jongin Lim, and Junghwan Song.
Related-key attacks on reduced rounds of SHACAL-2. In A. Canteaut and
K. Viswanathan, editors, Proceedings of INDOCRYPT '04 | The 5th Inter-
national Conference on Cryptology in India, volume 3348 of Lecture Notes in
Computer Science, pages 175{190. Springer-Verlag, 2004.

[55] Lars R. Knudsen. Cryptanalysis of LOKI91. In J. Seberry and Y. Zheng, edi-
tors, Advances in Cryptology - Proceedings of ASIACRYPT '92 | Workshop
on the Theory and Application of Cryptographic Techniques, volume 718 of
Lecture Notes in Computer Science, pages 196{208. Springer-Verlag, 1993.

[56] Lars R. Knudsen. Trucated and higher order di®erentials. In B. Preneel, editor,
Proceedings of FSE '94 | The Second International Workshop on Fast Soft-
ware Encryption, volume 1008 of Lecture Notes in Computer Science, pages
196{211. Springer-Verlag, 1995.

[57] Lars R. Knudsen. DEAL | a 128-bit block cipher. Technical report, Depart-
ment of Informatics, University of Bergen, Norway, 1998.

[58] Lars R. Knudsen and John E. Mathiassen. A chosen-plaintext linear attack
on DES. In B. Schneier, editor, Proceedings of FSE '00 | The 7th Interna-
tional Workshop on Fast Software Encryption, volume 1978 of Lecture Notes
in Computer Science, pages 262{272. Springer-Verlag, 2001.

[59] Lars R. Knudsen and Matthew J.B. Robshaw. Non-linear approximations
in linear cryptoanalysis. In U.M. Maurer, editor, Advances in Cryptology -
Proceedings of EUROCRYPT '96 | International Conference on the Theory
and Application of Cryptographic Techniques, volume 1070 of Lecture Notes in
Computer Science, pages 224{236. Springer-Verlag, 1996.

[60] Lars R. Knudsen and David Wagner. Integral cryptanalysis. In J. Daemen and
V. Rijmen, editors, Proceedings of FSE '02 | The 9th International Work-
shop on Fast Software Encryption, volume 2365 of Lecture Notes in Computer
Science, pages 112{127. Springer-Verlag, 2002.

[61] Youngdai Ko, Seokhie Hong, Wonil Lee, Sangjin Lee, and Ju-Sung Kang. Re-
lated key di®erential attacks on 27 rounds of XTEA and full-round GOST. In
B. Roy and W. Meier, editors, Proceedings of FSE '04 | The 11th Interna-
tional Workshop on Fast Software Encryption, volume 3017 of Lecture Notes
in Computer Science, pages 299{316. Springer-Verlag, 2004.

[62] Youngdai Ko, Changhoon Lee, Seokhie Hong, and Sangjin Lee. Related key
di®erential cryptanalysis of full-round SPECTR-H64 and CIKS-1. In H.Wang,
J. Pieprzyk, and V. Varadharajan, editors, Proceedings of ACISP '04 | The
9th Australasian Conference on Information Security and Privacy, volume
3108 of Lecture Notes in Computer Science, pages 137{148. Springer-Verlag,
2004.

[63] Youngdai Ko, Changhoon Lee, Seokhie Hong, Jaechul Sung, and Sangjin Lee.
Related-key attacks on ddp based ciphers: CIKS-128 and CIKS-128H. In
A. Canteaut and K. Viswanathan, editors, Proceedings of INDOCRYPT '04
| The 5th International Conference on Cryptology in India, volume 3348 of
Lecture Notes in Computer Science, pages 191{205. Springer-Verlag, 2004.

[64] Ulrich KÄuhn. Cryptanalysis of reduced-round MISTY. In B. P¯tzmann, ed-
itor, Advances in Cryptology - Proceedings of EUROCRYPT '01 | Interna-
tional Conference on the Theory and Application of Cryptographic Techniques,
volume 2045 of Lecture Notes in Computer Science, pages 325{339. Springer-
Verlag, 2001.

[65] Xuejia Lai. Higher order derivatives and di®erential cryptanalysis. Communi-
cations and Cryptography, pages 227{233, 1994. Kluwer Academic Publishers.

[66] Xuejia Lai and James L. Massey. A proposal for a new block encryption
standard. In I. Damgard, editor, Advances in Cryptology - Proceedings of EU-
ROCRYPT '90 | Workshop on the Theory and Application of Cryptographic
Techniques, volume 473 of Lecture Notes in Computer Science, pages 389{404.
Springer-Verlag, 1991.

[67] Suzan K. Langford and Martin E. Hellman. Di®erential-linear cryptanalysis.
In Y. Desmedt, editor, Advances in Cryptology - Proceedings of CRYPTO
'94 | The 14th Annual International Cryptology Conference, volume 839 of
Lecture Notes in Computer Science, pages 17{25. Springer-Verlag, 1994.

[68] Changhoon Lee, Jongsung Kim, Seokhie Hong, Jaechul Sung, and Sangjin
Lee. Related-key di®erential attacks on Cobra-S128, Cobra-F64a and Cobra-
F64b. In E. Dawson and S. Vaudenay, editors, Proceedings of Mycrypt '05 |
The First International Conference on Cryptology in Malaysia, volume 3715
of Lecture Notes in Computer Science, pages 244{262. Springer-Verlag, 2005.

[69] Changhoon Lee, Jongsung Kim, Jaechul Sung, Seokhie Hong, Sangjin Lee, and
Dukjae Moon. Related-key di®erential attacks on Cobra-H64 and Cobra-H128.
In N.P. Smart, editor, Proceedings of IMA Cryptography and Coding '05 |
The 10th IMA International Conference on Cryptography and Coding, volume
3796 of Lecture Notes in Computer Science, pages 201{219. Springer-Verlag,
2005.

[70] Eunjin Lee, Deukjo Hong, Donghoon Chang, Seokhie Hong, and Jongin Lim.
A weak key class of XTEA for a related-key rectangle attack. In P.Q. Nguyen,
editor, Proceedings of Vietcrypt '06 | The First International Conferenceon
Cryptology in Vietnam, volume 4341 of Lecture Notes in Computer Science,
pages 286{297. Springer-Verlag, 2006.

[71] Seonhee Lee, Seokhie Hong, Sangjin Lee, Jongin Lim, and Seonhee Yoon.
Truncated di®erential cryptanalysis of Camellia. In K. Kim, editor, Proceed-
ings of ICISC '01 | The 4th International Conference on Information Secu-
rity and Cryptology, volume 2288 of Lecture Notes in Computer Science, pages
32{38. Springer-Verlag, 2002.

[72] B.W. Lindgren and G.W. Mcelrath. Introduction to PROBABILITY and
STATISTICS | third edition. The Macmillan Company, 1969.

[73] Helger Lipmaa and Shiho Moriai. E±cient algorithms for computing di®eren-
tial properties of addition. In M. Matsui, editor, Proceedings of FSE '01 |
The 8th International Workshop on Fast Software Encryption, volume 2355 of
Lecture Notes in Computer Science, pages 336{350. Springer-Verlag, 2001.

[74] Jiqiang Lu. Cryptanalysis of reduced versions of the HIGHT block cipher from
CHES 2006. In K. Nam and G. Rhee, editors, Proceedings of ICISC '07 |
The 10th International Conference on Information Security and Cryptology,
volume 4817 of Lecture Notes in Computer Science, pages 11{26. Springer-
Verlag, 2007.

[75] Jiqiang Lu. Related-key rectangle attack on 36 rounds of the XTEA block
cipher. International Journal of Information Security, ?:?{?, 2008.

[76] Jiqiang Lu and Jongsung Kim. Attacking 44 rounds of the SHACAL-2 block
cipher using related-key rectangle cryptanalysis. IEICE Transactions on Fun-
damentals of Electronics, Communications and Computer Sciences, 91-A:?{?,
2008.

[77] Jiqiang Lu, Jongsung Kim, Nathan Keller, and Orr Dunkelman. Di®eren-
tial and rectangle attacks on reduced-round SHACAL-1. In R. Barua and
T. Lange, editors, Progress in Cryptology - INDOCRYPT '06 | The 7th In-
ternational Conference on Cryptology in India, volume 4329 of Lecture Notes
in Computer Science, pages 17{31. Springer-Verlag, 2006.

[78] Jiqiang Lu, Jongsung Kim, Nathan Keller, and Orr Dunkelman. Related-
key rectangle attack on 42-round SHACAL-2. In S.K. Katsikas, J. Lopez,
M. Backes, and B. Preneel, editors, Proceedings of ISC '06 | The 9th Inter-
national Conference on Information Security, volume 4176 of Lecture Notes in
Computer Science, pages 85{100. Springer-Verlag, 2006.

[79] Jiqiang Lu, Jongsung Kim, Nathan Keller, and Orr Dunkelman. Improving
the e±ciency of impossible di®erential cryptanalysis of reduced Camellia and
MISTY1. In T. Malkin, editor, Proceedings of CT-RSA '08 | Cryptographers'
Track at the RSA Conference 2008, volume 4964 of Lecture Notes in Computer
Science, pages 370{386. Springer-Verlag, 2008.

[80] Jiqiang Lu, Changhoon Lee, and Jongsung Kim. Related-key attacks on the
full-round Cobra-F64a and Cobra-F64b. In R.D. Prisco and M. Yung, editors,
Proceedings of SCN '06 | The Fifth International Conference on Security
and Cryptography for Networks, volume 4116 of Lecture Notes in Computer
Science, pages 95{110. Springer-Verlag, 2006.

[81] Stefan Lucks. Attacking seven rounds of Rijndael under 192-bit and 256-bit
keys. In Proceedings of The Third Advanced Encryption Standard Candidate
Conference. NIST, 2000.

[82] Stefan Lucks. The saturation attack|a bait for Two¯sh. In M. Matsui, editor,
Proceedings of FSE '01 | The 8th International Workshop on Fast Software
Encryption, volume 2355 of Lecture Notes in Computer Science, pages 1{15.
Springer-Verlag, 2002.

[83] Mitsuru Matsui. Linear cryptanalysis method for DES cipher. In T. Helleseth,
editor, Advances in Cryptology - Proceedings of EUROCRYPT '93 | Work-
shop on the Theory and Application of Cryptographic Techniques, volume 765
of Lecture Notes in Computer Science, pages 386{397. Springer-Verlag, 1994.

[84] Mitsuru Matsui and Atsuhiro Yamagishi. A new method for known plaintext
attack of FEAL cipher. In R.A. Rueppel, editor, Advances in Cryptology -
Proceedings of EUROCRYPT '92 | Workshop on the Theory and Applica-
tion of Cryptographic Techniques, volume 658 of Lecture Notes in Computer
Science, pages 81{91. Springer-Verlag, 1993.

[85] Alexander A. Moldovyan and Nick A. Moldovyan. A cipher based on data-
dependent permutations. Journal of Cryptology, 15(1):61{72, 2002. Springer.

[86] Dukjae Moon, Kyungdeok Hwang, Wonil Lee, Sangjin Lee, and Jongin Lim.
Impossible di®erential cryptanalysis of reduced round XTEA and TEA. In
J. Daemen and V. Rijmen, editors, Proceedings of FSE '02 | The 9th In-
ternational Workshop on Fast Software Encryption, volume 2365 of Lecture
Notes in Computer Science, pages 49{60. Springer-Verlag, 2002.

[87] Sean Murphy. The cryptanalysis of FEAL-4 with 20 chosen plaintexts. Journal
of Cryptology, 2(3):145{154, 1990. Springer.

[88] Roger M. Needham and David J. Wheeler. TEA extensions. Technical report,
the Computer Laboratory, University of Cambridge, 1997. Archive available
at http://www.cl.cam.ac.uk/ftp/users/djw3/xtea.ps.

[89] NESSIE | New European Schemes for Signatures, Integrity, and Encryption,
¯nal report. https://www.cosic.esat.kuleuven.be/nessie/Bookv015.pdf.

[90] NIST | National Institute of Standards and Technology, Advanced Encryp-
tion Standard (AES), FIPS-197, 2001.

[91] NIST | National Institute of Standards and Technology, Data Encryption
Standard (DES), FIPS-46, 1977.

[92] NIST | National Institute of Standards and Technology, Secure Hash Stan-
dard, FIPS 180-1, 1995.

[93] NIST | National Institute of Standards and Technology, Secure Hash Stan-
dard, FIPS 180-2, 2002.

[94] Kaisa Nyberg. Linear approximation of block ciphers. In A.D. Santis, editor,
Advances in Cryptology - Proceedings of EUROCRYPT '94 | Workshop on
the Theory and Application of Cryptographic Techniques, volume 950 of Lecture
Notes in Computer Science, pages 439{444. Springer-Verlag, 1994.

[95] Kaisa Nyberg and Lars R. Knudsen. Provable security against di®erential
cryptanalysis. In E.F. Brickell, editor, Advances in Cryptology - Proceedings of
CRYPTO '92 | the 12th Annual International Cryptology Conference, volume
740 of Lecture Notes in Computer Science, pages 566{574. Springer-Verlag,
1993.

[96] Raphael C.-W. Phan. Impossible di®erential cryptanalysis of 7-round Ad-
vanced Encryption Standard (AES). Information Processing Letters, 91:33{38,
2004. Elsevier Science.

[97] Akihiro Shimizu and Shoji Miyaguchi. Fast data encipherment algorithm
FEAL. In D. Chaum and W.L. Price, editors, Advances in Cryptology - Pro-
ceedings of EUROCRYPT '87 | Workshop on the Theory and Application of
Cryptographic Techniques, volume 304 of Lecture Notes in Computer Science,
pages 267{278. Springer-Verlag, 1988.

[98] Yongsup Shin, Jongsung Kim, Guil Kim, Seokhie Hong, and Sangjin Lee.
Di®erential-linear type attacks on reduced rounds of SHACAL-2. In H. Wang,
J. Pieprzyk, and V. Varadharajan, editors, Proceedings of ACISP '04 | The
9th Australasian Conference on Information Security and Privacy, volume
3108 of Lecture Notes in Computer Science, pages 110{122. Springer-Verlag,
2004.

[99] Taizo Shirai. Di®erential, linear, boomerang and rectangle cryptanalysis of
reduced-round Camellia. In Proceedings of The Third NESSIE Workshop,
2002.

[100] Nicolas Sklavos, Nick A. Moldovyan, and Odysseas G. Koufopavlou. A new
DDP-based cipher CIKS-128H: architecture, design and VLSI implementation
optimization of CBC-encryption and hashing over 1 GBPS. In Proceedings of
The 46th IEEE Midwest International Symposium on Circuits and Systems,
pages 463{466, 2003.

[101] Nicolas Sklavos, Nick A. Moldovyan, and Odysseas G. Koufopavlou. High
speed networking security: design and implementation of two new DDP-based
ciphers. Mobile Networks and Applications, 10(1{2):219{231, 2005. Kluwer
Academic Publishers.

[102] Makoto Sugita, Kazukuni Kobara, and Hideki Imai. Security of reduced ver-
sion of the block cipher Camellia against truncated and impossible di®erential
cryptanalysis. In C. Boyd, editor, Advances in Cryptology - Proceedings of
ASIACRYPT '01 | The 7th International Conference on the Theory and
Application of Cryptology and Information Security, volume 2248 of Lecture
Notes in Computer Science, pages 193{207. Springer-Verlag, 2001.

[103] David Wagner. The boomerang attack. In L.R. Knudsen, editor, Proceedings
of FSE '99 | The 6th International Workshop on Fast Software Encryption,
volume 1636 of Lecture Notes in Computer Science, pages 156{170. Springer-
Verlag, 1999.

[104] GaoliWang. Related-key rectangle attack on 43-round SHACAL-2. In E. Daw-
son and D.S. Wong, editors, Proceedings of ISPEC '07 | The Third Interna-
tional Conference on Information Security Practice and Experience, volume
4464 of Lecture Notes in Computer Science, pages 33{42. Springer-Verlag,
2007.

[105] Gaoli Wang, Nathan Keller, and Orr Dunkelman. The delicate issues of addi-
tion with respect to XOR di®erences. In C. Adams, A. Miri, and M. Wiener,
editors, Proceedings of SAC '07 | The 14th Annual Workshop on Selected
Areas in Cryptography, volume 4876 of Lecture Notes in Computer Science,
pages 212{231. Springer-Verlag, 2008.

[106] David J. Wheeler and Roger M. Needham. TEA, a tiny encryption algo-
rithm. In B. Preneel, editor, Proceedings of FSE '94 | The Second Interna-
tional Workshop on Fast Software Encryption, volume 1008 of Lecture Notes
in Computer Science, pages 363{366. Springer-Verlag, 1995.

[107] Wenling Wu, Dengguo Feng, and Hua Chen. Collision attack and pseudo-
randomness of reduced-round Camellia. In H. Handschuh and M.A. Hasan,
editors, Proceedings of SAC '04 | The 11th Annual Workshop on Selected
Areas in Cryptography, volume 3357 of Lecture Notes in Computer Science,
pages 256{270. Springer-Verlag, 2005.

[108] Wenling Wu, Wentao Zhang, and Dengguo Feng. Impossible di®erential crypt-
analysis of reduced-round ARIA and Camellia. Journal of Computer Science
and Technology, 22(3):449{456, 2007. Springer.

[109] Yongjin Yeom, Sangwoo Park, and Iljun Kim. On the security of Camellia
against the square attack. In J. Daemen and V. Rijmen, editors, Proceedings
of FSE '02 | The 9th International Workshop on Fast Software Encryption,
volume 2356 of Lecture Notes in Computer Science, pages 89{99. Springer-
Verlag, 2002.

[110] Yongjin Yeom, Sangwoo Park, and Iljun Kim. A study of integral type crypt-
analysis on Camellia. In Proceedings of The 2003 Symposium on Cryptography
and Information Security, pages 453{456, 2003.

[111] Wentao Zhang, Wenling Wu, and Dengguo Feng. New results on impossi-
ble di®erential cryptanalysis of reduced AES. In K.-H. Nam and G. Rhee,
editors, Proceedings of ICISC '07 | The 10th International Conference on
Information Security and Cryptology, volume 4817 of Lecture Notes in Com-
puter Science, pages 239{250. Springer-Verlag, 2007.

[112] Wentao Zhang, Lei Zhang, WenlingWu, and Dengguo Feng. Improved related-
key impossible di®erential attacks on reduced-round AES-192. In E. Biham
and A.M. Youssef, editors, Proceedings of SAC '06 | The 13th Annual Work-
shop on Selected Areas in Cryptography, volume 4356 of Lecture Notes in Com-
puter Science, pages 15{27. Springer-Verlag, 2007.

[113] Wentao Zhang, Lei Zhang, Wenling Wu, and Dengguo Feng. Related-key
di®erential-linear attacks on reduced AES-192. In K. Srinathan, C. Pandu
Rangan, and M. Yung, editors, Proceedings of INDOCRYPT '07 | The 8th
International Conference on Cryptology in India, volume 4859 of Lecture Notes
in Computer Science, pages 73{85. Springer-Verlag, 2007.