Linear and differential cryptanalysis of~reduced-round~AES

Abstract

The subject of this paper is linear and differential cryptanalysis of two rounds of the Advanced Encryption Standard (AES) with estimation of complexity for three-round AES attack. Presented linear attack is based on finding highly probable linear expressions and presented differential attack is based on finding specific bitwise differences. Data complexity of described linear and differential attack is $2^{28}$ and $2^{27}$, respectively, where $8$ bits of subkey are recovered. Minimal complexity of linear attack on three-round AES is bigger than $d\times2^{60}$, where $d$ is a small constant.