Low Data Complexity Attack on Reduced Camellia-256

Abstract

AbstractThis paper proposes a low data complexity attack on reduced-round block cipher Camellia. Utilizing a 7-round meet-in-the-middle distinguisher with an FL layer between the fifth and the sixth round, one can attack 12-round Camellia-256 with 219 chosen plaintexts and 2231.2 encryptions. This attack starts from the first round of Camellia-256, so as to keep the property of Camellia that inserting the FL layers every 6 rounds; it also takes the whitening keys into account. Compared with the recent proposed attacks on Camellia-256, the attack in this paper has much lower data complexity; at the same time, it is also the best attack on Camellia-256 in terms of the number of rounds and the time complexity, if one only consider the ’regular’ reduced Camellia with 6 rounds before (after) the first (last) FL layer and with whitening keys.KeywordsBlock CipherCamelliaMeet-in-the-Middle AttackLow Data ComplexityCryptanalysis