Multidimensional Zero-Correlation Linear Cryptanalysis of E2

Abstract

E2 is a block cipher designed by NTT and was a first-round AES candidate. E2’s design principles influenced several more recent block ciphers including Camellia, an ISO/IEC standard cipher. So far the cryptanalytic results for round-reduced E2 have been concentrating around truncated and impossible differentials. At the same time, rather recently at SAC’13, it has been shown how to improve upon the impossible differential cryptanalysis of Camellia with the zero-correlation linear cryptanalysis. Due to some similarities between E2 and Camellia, E2 might also render itself more susceptible to this type of cryptanalysis.

In this paper, we investigate the security of E2 against zero-correlation linear cryptanalysis. We identify zero-correlation linear approximations over 6 rounds of E2. With these linear approximations, we can attack 8-round E2-128 and 9-round E2-256 without IT and FT. The attack on 8-round E2-128 requires 2^124.1 known plaintexts (KPs), 2^119.3 encryptions and 2⁹⁹ bytes memory. The attack on 9-round E2-256 requires 2^124.6 KPs, 2^225.5 encryptions and 2⁹⁹ bytes memory. In contrast, the previous attacks on 8-round E2-128 had an uncertain time complexity and one could only attack 8-round E2-256. Besides, for the first time, we propose a key recovery attack on reduced-round E2 with both IT and FT taken into consideration. More concretely, we can attack 6-round E2-128 with 2^123.7 KPs, 2^119.1 encryptions and 2²⁹ bytes and 7-round E2-256 requires 2^124.7 KPs, 2^252.8 encryptions and 2⁹¹ bytes when both IT and FT are considered.