Thus it is expected that only one right pair remains, along with one wrong pair. Given the ciphertexts, it is easy to identify the right pairs, and thus also the four plaintexts and their corresponding ciphertexts. Now, we know that the data in the second word after round 28 is the same in all four encryptions. Notice that the G permutation in round 32 and the G permutation in round 29 share two common key bytes. For each such value we verify that such a difference exists in the table and that the common two key bytes are equal.
Optimized versions can reduce both the running time and the number of required plaintexts.
Details on these improved results will be given in a forthcoming announcement. It is a pleasure to acknowledge Rivka Zur, the Technion CS secretary, for preparing the figures. We also thank Charanjit Jutla for correcting a typo in the first version. You can register to get emails when new information is available.