An Efficient Parallel Implementation of Impossible-Differential Cryptanalysis for Five-Round AES-128

Abstract

Impossible-differential cryptanalysis finds the correct round-key of a block cipher by eliminating wrong guesses which do not satisfy some impossible path(s). In this paper, we report our parallel implementation of the impossible-differential cryptanalysis of five-round AES-128, originally proposed by Biham and Keller [4]. In this attack, the time complexity is \(2^{31}\) and the data complexity is \(2^{29.5}\). But the primary memory requirement is very high, about 4 TB, making the attack somewhat impractical to implement. The first practical implementation of this attack appears in Kakarla et al. [11], where the primary memory requirement is reduced to 128.5 GB, and the running time achieved is 48 h. Here, we propose an improvement of the attack by exploiting data and task parallelism. We use a nine-node cluster (one master node and eight worker nodes) to implement the attack. In our attack, the time complexity and the data complexity remain the same as [11], but the primary memory requirement is reduced to 96.5 GB per node. This parallelism helps us retrieve the full key in only 6.5 mins.