Multi-Diagonal Truncated Differentials and Ciphertext-Only Attacks on Reduced-Round AES eprint.iacr.org
Can ciphertext-only English-text AES really fall to 5-round distinguishers and 6-round key recovery?
3 comments
feels like a redux of biham and shamir's truncated differentials, just dressed as ciphertext-only.
> feels like a redux of biham and shamir's truncated differentials
Not really, ciphertext-only changes the game a lot.
Saving this, 6-round ciphertext-only AES is a bit of a groan.