# Biclique Cryptanalysis on the Full Crypton-256 and mCrypton-128

Authors: Junghwan Song; Kwanhyung Lee; Hwanjin Lee
Journal: Journal of Applied Mathematics
 (2014)

---

## Abstract

Biclique cryptanalysis is an attack which reduces the computational complexity by finding a biclique which is a kind of bipartite graph. We show a single-key full-round attack of the Crypton-256 and mCrypton-128 by using biclique cryptanalysis. In this paper, 4-round bicliques are constructed for Crypton-256 and mCrypton-128. And these bicliques are used to recover master key for the full rounds of Crypton-256 and mCrypton-128 with the computational complexities of 2253.78 and 2126.5, respectively. This is the first known single-key full-round attack on the Crypton-256. And our result on the mCrypton-128 has superiority over known result of biclique cryptanalysis on the mCrypton-128 which constructs 3-round bicliques in terms of computational time complexity.


---

## Body

## 1. Introduction

The block cipher Crypton is one of candidates for the Advanced Encryption Standard (AES) in 1998 [1]. The cipher has been revised to Crypton V1.0 in FSE’99 [2]. Crypton is a 12-round and 128-bit block cipher that supports key sizes up to 256 bits. A miniversion of Crypton, mCrypton, is a 64-bit block cipher with three key size versions (64 bits, 96 bits, and 128 bits) [3]. mCrypton is a 64-bit lightweight block cipher designed to be used in low-cost and resource-constrained applications. Both of them have been designed based on the block cipher square [4]. The cipher has been designed to be resistant to differential and linear cryptanalysis. Therefore it has been assumed that the above two ciphers also have the property of resisting those attacks.However, a related-key impossible differential attack on 9 rounds of Crypton-256 has been shown by Wei et al. in 2011 [5]. For mCrypton, a related-key rectangle attack on 8 rounds of mCrypton-128 has been shown by Park in 2009 [6]. In 2011, Mala et al. showed a related-key impossible differential attack on 9 rounds of mCrypton-96 and mCrypton-128 [7]. The summary of attacks on Crypton-256 and mCrypton-128 is described in Tables 1 and 2, respectively.Table 1
Summary of the attacks of Crypton-256.
Rounds
Attack
Complexities
References
Data
Time
6
Square
232
256
[9]
6
Imp. Diff.
291
2124
[10]
8
Stochastic
2112
2112
[11]
8
Trunc. Diff.
2126
2126.2
[12]
9
Rel. Imp. Diff.
2105
2243
[5]
12
Biclique
2100
2253.78
This paper
Rel.: related key, Imp.: impossible, Diff.: differential, Trunc.: truncated.Table 2
Summary of the attacks of mCrypton-128.
Rounds
Attack
Complexities
References
Data
Time
8
Rel. Rec.
246
246
[6]
9
Rel. Imp. Diff.
259.7
266.7
[7]
12
Biclique
248
2126.56
[13]
12
Biclique
252
2126.5
This paper
Rel.: related key, Imp.: impossible, Diff.: differential, Rec.: rectangle.In ASIACRYPT 2011, Bogdanov et al. introduce a biclique cryptanalysis, which is a meet-in-the-middle attack with a biclique and the attack is efficient compared to brute force key search. They show two techniques of constructing bicliques for AES in [8]. One is from independent related-key differentials, which is called independent biclique and the other is from interleaving related-key differentials.The biclique attack by using independent related-key differentials consists of two parts. The first part constructs an independent-biclique and the second is called matching with precomputations. In Section2, we describe an overview of the steps of biclique cryptanalysis. The detailed technique to recover the 256-bit master key with computational complexity in 2253.78 is presented in Section 4. And in Section 5, the 128-bit key is recovered with computational complexity in 2126.5.


## 2. Biclique Cryptanalysis

In the biclique cryptanalysis, the biclique, which is a kind of a bipartite graph improve the computational efficiency of computation. First we will briefly describe biclique. The block cipher is considered as the composition of two subciphers:e
=
f
∘
g. Consider the subcipher f maps an internal state S to the ciphertext C
:
f
K
(
S
)
=
C, where K is a secret key of e. The subcipher f maps 2
d internal states {
S
0
,
…
,
S
2
-
1
d
} to 2
d ciphertexts {
C
0
,
…
,
C
2
-
1
d
} with 2
2
d keys {
K
〈
i
,
j
〉
}, which are components of the following 2
d
×
2
d matrix:
(1)
[
K
〈
i
,
j
〉
]
=
[
K
〈
0,0
〉
K
〈
0,1
〉
⋯
K
〈
0
,
2
d
-
1
〉
⋮
K
〈
2
d
-
1,0
〉
K
〈
2
d
-
1,1
〉
⋯
K
〈
2
d
-
1
,
2
d
-
1
〉
]
.
This 3-tuple {
(
C
i
,
S
j
,
K
〈
i
,
j
〉
)
} is called ad-dimensional biclique, if
(2)
C
i
=
f
K
〈
i
,
j
〉
(
S
j
)
∀
i
,
j
∈
{
0
,
…
,
2
d
-
1
}
.
In other words, as illustrated in Figure 1, a biclique is a complete bipartite graph with {
S
j
} and {
C
i
} as the two parts of vertices connected to 2
2
d edges, where each edge has degree 2
d.Figure 1
d-dimensional biclique.Now we introduce the biclique cryptanalysis.


### 2.1. Attack Procedure

The biclique attack procedure consists of the following phases.Key Partitioning. The key space is partitioned into 2
k
-
2
d groups of 2
2
d keys each, where k is the bit length of the secret key. Each key in the set is indexed as an element of a 2
d
×
2
d matrix: [
K
〈
i
,
j
〉
].Biclique Constructing. For each group of keys, build a structure of 2
d ciphertexts {
C
0
,
…
,
C
2
d
-
1
}, 2
d intermediate states {
S
0
,
…
,
S
2
d
-
1
}, and [
K
〈
i
,
j
〉
] such that for all i
,
j
∈
{
0,1
,
…
,
2
d
-
1
} the relation (2) is satisfied.Data Collecting. An adversary obtains the plaintexts {
P
i
} from the ciphertexts {
C
i
} through the decryption oracle.Key Testing. The secret key, which is an adversary try to recover, maps the plaintext P
i to the intermediate state S
j. From this fact, an adversary checks the following equation:
(3)
∃
i
,
j
:
P
i
⟶
g
K
〈
i
,
j
〉
S
j
,
which proposes a key candidate. Note that P
i
⟶
g
K
〈
i
,
j
〉
S
j implies that each P
i is encrypted to S
j with key [
K
〈
i
,
j
〉
] (i.e., S
j
=
g
K
〈
i
,
j
〉
(
P
i
)). If there is no right key satisfying (3) in the selected key group, then another key group is chosen and repeats the above process.


### 2.2. Biclique Construction by Independent Related-Key Differentials

In biclique cryptanalysis, there are two methods to construct a biclique. One is using independent related-key differentials and the other is using interleaving related-key differential trails. In this paper, we focus on the first of two methods, to construct biclique as described in [8].Suppose that a secret keyK
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0. Then we consider the following two types of 2
d related-key differentials with respect to S
0
⟶
f
K
〈
0,0
〉
C
0.Δ
i-Differentials. This is a related-key differential trail where the input difference is 0 and the output difference is Δ
i under a key difference Δ
i
K: (4)
0
⟶
f
Δ
i
K
Δ
i
with
Δ
0
K
=
0
,
Δ
0
=
0
.∇
j-Differentials. This is a related-key differential trail where the input difference is ∇
j and the output difference is 0 under a key difference ∇
j
K:
(5)
∇
j
⟶
f
∇
j
K
0
with
∇
0
K
=
0
,
∇
0
=
0
.
The 3-tuple (
S
0
,
C
0
,
K
〈
0,0
〉
) conforms to both sets of differentials at the same time. If the two key differential trails, Δ
i-differentials and ∇
j-differentials, do not share active nonlinear components, then the tuple also conforms to 2
2
d combined (
Δ
i
,
∇
j
)-differentials:
(6)
∇
j
⟶
f
Δ
i
K
⊕
∇
j
K
Δ
i
for
i
,
j
∈
{
0
,
…
,
2
d
-
1
}
.
This combined (
Δ
i
,
∇
j
)-differentials is derived from property of S-box switch [14] and sandwich attack [15]. By using the combined differentials, an adversary reduces the computational complexity. The construction of a biclique requires less than 2
·
2
d computations of f.


### 2.3. Matching with Precomputations

The technique of matching with precomputations is an efficient method to check (3) in biclique cryptanalysis procedure. Let v be some selected bytes of an internal state between {
P
i
} and {
S
j
}. The flow of matching with precomputation procedure is as the following. First, an adversary computes and stores in memory the following for all i, j:
(7)
∀
i
=
0,1
,
…
,
2
d
-
1
,
P
i
→
K
〈
i
,
0
〉
v
→
i
,
∀
j
=
0,1
,
…
,
2
d
-
1
,
v
←
j
→
K
〈
0
,
j
〉
S
j
.
Then for particular i and j, which is not in stored memory, the adversary checks the matching at v by recomputing only those parts of the cipher which differ from the stored one.


## 2.1. Attack Procedure

The biclique attack procedure consists of the following phases.Key Partitioning. The key space is partitioned into 2
k
-
2
d groups of 2
2
d keys each, where k is the bit length of the secret key. Each key in the set is indexed as an element of a 2
d
×
2
d matrix: [
K
〈
i
,
j
〉
].Biclique Constructing. For each group of keys, build a structure of 2
d ciphertexts {
C
0
,
…
,
C
2
d
-
1
}, 2
d intermediate states {
S
0
,
…
,
S
2
d
-
1
}, and [
K
〈
i
,
j
〉
] such that for all i
,
j
∈
{
0,1
,
…
,
2
d
-
1
} the relation (2) is satisfied.Data Collecting. An adversary obtains the plaintexts {
P
i
} from the ciphertexts {
C
i
} through the decryption oracle.Key Testing. The secret key, which is an adversary try to recover, maps the plaintext P
i to the intermediate state S
j. From this fact, an adversary checks the following equation:
(3)
∃
i
,
j
:
P
i
⟶
g
K
〈
i
,
j
〉
S
j
,
which proposes a key candidate. Note that P
i
⟶
g
K
〈
i
,
j
〉
S
j implies that each P
i is encrypted to S
j with key [
K
〈
i
,
j
〉
] (i.e., S
j
=
g
K
〈
i
,
j
〉
(
P
i
)). If there is no right key satisfying (3) in the selected key group, then another key group is chosen and repeats the above process.


## 2.2. Biclique Construction by Independent Related-Key Differentials

In biclique cryptanalysis, there are two methods to construct a biclique. One is using independent related-key differentials and the other is using interleaving related-key differential trails. In this paper, we focus on the first of two methods, to construct biclique as described in [8].Suppose that a secret keyK
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0. Then we consider the following two types of 2
d related-key differentials with respect to S
0
⟶
f
K
〈
0,0
〉
C
0.Δ
i-Differentials. This is a related-key differential trail where the input difference is 0 and the output difference is Δ
i under a key difference Δ
i
K: (4)
0
⟶
f
Δ
i
K
Δ
i
with
Δ
0
K
=
0
,
Δ
0
=
0
.∇
j-Differentials. This is a related-key differential trail where the input difference is ∇
j and the output difference is 0 under a key difference ∇
j
K:
(5)
∇
j
⟶
f
∇
j
K
0
with
∇
0
K
=
0
,
∇
0
=
0
.
The 3-tuple (
S
0
,
C
0
,
K
〈
0,0
〉
) conforms to both sets of differentials at the same time. If the two key differential trails, Δ
i-differentials and ∇
j-differentials, do not share active nonlinear components, then the tuple also conforms to 2
2
d combined (
Δ
i
,
∇
j
)-differentials:
(6)
∇
j
⟶
f
Δ
i
K
⊕
∇
j
K
Δ
i
for
i
,
j
∈
{
0
,
…
,
2
d
-
1
}
.
This combined (
Δ
i
,
∇
j
)-differentials is derived from property of S-box switch [14] and sandwich attack [15]. By using the combined differentials, an adversary reduces the computational complexity. The construction of a biclique requires less than 2
·
2
d computations of f.


## 2.3. Matching with Precomputations

The technique of matching with precomputations is an efficient method to check (3) in biclique cryptanalysis procedure. Let v be some selected bytes of an internal state between {
P
i
} and {
S
j
}. The flow of matching with precomputation procedure is as the following. First, an adversary computes and stores in memory the following for all i, j:
(7)
∀
i
=
0,1
,
…
,
2
d
-
1
,
P
i
→
K
〈
i
,
0
〉
v
→
i
,
∀
j
=
0,1
,
…
,
2
d
-
1
,
v
←
j
→
K
〈
0
,
j
〉
S
j
.
Then for particular i and j, which is not in stored memory, the adversary checks the matching at v by recomputing only those parts of the cipher which differ from the stored one.


## 3. Description the Crypton and mCrypton

In this section, we describe Crypton and mCrypton, briefly.


### 3.1. Description of Crypton

Crypton is a 128-bit block cipher supports key sizes up to 256 bits. The standard number of rounds is 12. Let us represent the 128-bit blockA as a 4 × 4 matrix of bytes:
(8)
A
=
(
a
0,3
a
0,2
a
0,1
a
0,0
a
1,3
a
1,2
a
1,1
a
1,0
a
2,3
a
2,2
a
2,1
a
2,0
a
3,3
a
3,2
a
3,1
a
3,0
)
.
Crypton uses component functions, γ, π, τ, and σ.Nonlinear Substitution
γ
.
γ
o and γ
e are bytewise nonlinear substitutions which are applied to odd rounds and even rounds, respectively.Bit Permutation
π
.
π
o and π
e are linear transformations for odd rounds and even rounds, respectively. The two bit permutations mix each byte column of 4 × 4 byte array using four masking bytes m
i.We denote “·” and “⊕” bitwise logical operations for AND and XOR, respectively. π
o is given as follows:
(9)
B
i
,
j
=
⊕
k
=
0
3
(
A
k
,
j
·
m
(
i
+
j
+
k
)
mod
⁡
4
)
,
and π
e is given as shown below:
(10)
B
i
,
j
=
⊕
k
=
0
3
(
A
k
,
j
·
m
(
i
+
j
+
k
+
2
)
mod
⁡
4
)
.Byte Transposition
τ
.
τ is a byte transposition; it simply moves the byte at (
i
,
j
) position to (
j
,
i
) position; that is, B
=
τ
(
A
)
⇔
b
i
,
j
=
a
j
,
i.Key Addition
σ
.
σ
K is a bitwise key XOR with key K. Let K
i be the ith encryption round key derived from a user key K using the key schedule.The block cipher Crypton can be described asϕ
e
∘
ρ
e
K
12
∘
ρ
o
K
11
∘
⋯
∘
ρ
e
K
2
∘
ρ
o
K
1
∘
σ
K
0, where odd round function ρ
o
K and even round function ρ
e
K are defined by ρ
o
K
=
σ
K
∘
τ
∘
π
o
∘
γ
o and ρ
e
K
=
σ
K
∘
τ
∘
π
e
∘
γ
e. Linear transformation ϕ
e
=
τ
∘
π
e
∘
τ is used after the last round.


### 3.2. Description of mCrypton

mCrypton is a 12-round and 64-bit block cipher with three key size options (64 bits, 96 bits, and 128 bits). Since mCrypton is based on Crypton, the main concepts of description are very similar to ones of Crypton. The round function of mCrypton also consists of four steps as follows.Nonlinear Substitution
γ
. It consists of nibblewise substitutions on a 4 × 4 array using four 4-bit S-boxes, S
i, (
0
≤
i
≤
3
).Bit Permutation
π
. It mixes each column 4 × 4 array A using column permutation π
i for each column i
(
0
≤
i
≤
3
):
(11)
π
(
A
)
=
(
π
0
(
A
c
[
0
]
)
π
1
(
A
c
[
1
]
)
π
2
(
A
c
[
2
]
)
π
3
(
A
c
[
3
]
)
)
,
where A
c
[
i
] are the ith column of A.Eachπ
i is defined by
(12)
b
=
π
i
(
a
)
⟺
b
j
-
⊕
k
=
0
3
(
m
i
+
j
+
k
mod
⁡
4
·
a
k
)
,
where a column a
=
(
a
0
,
a
1
,
a
2
,
a
3
)
t and a column b
=
(
b
0
,
b
1
,
b
2
,
b
3
)
t.Byte Transposition
τ
. It moves the nibble at the (
i
,
j
)th position to the (
j
,
i
)th position; that is, B
=
τ
(
A
)
⇔
b
j
i
=
a
i
j. So τ
-
1
=
τ.Key Addition
σ
.
B
=
σ
K
(
A
) is defined by B
r
[
i
]
=
A
r
[
i
]
⊕
K
[
i
]
(
0
≤
i
≤
3
), where K
=
(
K
[
0
]
,
K
[
1
]
,
K
[
2
]
,
K
[
3
]
) is a round key.Like Crypton, mCrypton also can be described as(13)
E
K
=
ϕ
∘
ρ
K
12
∘
ρ
K
11
∘
⋯
∘
ρ
K
2
∘
ρ
K
1
∘
σ
K
0
,
where ϕ
=
τ
∘
π
∘
τ.In this paper, we focus on the 128-bit key version of the mCrypton that is composed of 12 rounds.


## 3.1. Description of Crypton

Crypton is a 128-bit block cipher supports key sizes up to 256 bits. The standard number of rounds is 12. Let us represent the 128-bit blockA as a 4 × 4 matrix of bytes:
(8)
A
=
(
a
0,3
a
0,2
a
0,1
a
0,0
a
1,3
a
1,2
a
1,1
a
1,0
a
2,3
a
2,2
a
2,1
a
2,0
a
3,3
a
3,2
a
3,1
a
3,0
)
.
Crypton uses component functions, γ, π, τ, and σ.Nonlinear Substitution
γ
.
γ
o and γ
e are bytewise nonlinear substitutions which are applied to odd rounds and even rounds, respectively.Bit Permutation
π
.
π
o and π
e are linear transformations for odd rounds and even rounds, respectively. The two bit permutations mix each byte column of 4 × 4 byte array using four masking bytes m
i.We denote “·” and “⊕” bitwise logical operations for AND and XOR, respectively. π
o is given as follows:
(9)
B
i
,
j
=
⊕
k
=
0
3
(
A
k
,
j
·
m
(
i
+
j
+
k
)
mod
⁡
4
)
,
and π
e is given as shown below:
(10)
B
i
,
j
=
⊕
k
=
0
3
(
A
k
,
j
·
m
(
i
+
j
+
k
+
2
)
mod
⁡
4
)
.Byte Transposition
τ
.
τ is a byte transposition; it simply moves the byte at (
i
,
j
) position to (
j
,
i
) position; that is, B
=
τ
(
A
)
⇔
b
i
,
j
=
a
j
,
i.Key Addition
σ
.
σ
K is a bitwise key XOR with key K. Let K
i be the ith encryption round key derived from a user key K using the key schedule.The block cipher Crypton can be described asϕ
e
∘
ρ
e
K
12
∘
ρ
o
K
11
∘
⋯
∘
ρ
e
K
2
∘
ρ
o
K
1
∘
σ
K
0, where odd round function ρ
o
K and even round function ρ
e
K are defined by ρ
o
K
=
σ
K
∘
τ
∘
π
o
∘
γ
o and ρ
e
K
=
σ
K
∘
τ
∘
π
e
∘
γ
e. Linear transformation ϕ
e
=
τ
∘
π
e
∘
τ is used after the last round.


## 3.2. Description of mCrypton

mCrypton is a 12-round and 64-bit block cipher with three key size options (64 bits, 96 bits, and 128 bits). Since mCrypton is based on Crypton, the main concepts of description are very similar to ones of Crypton. The round function of mCrypton also consists of four steps as follows.Nonlinear Substitution
γ
. It consists of nibblewise substitutions on a 4 × 4 array using four 4-bit S-boxes, S
i, (
0
≤
i
≤
3
).Bit Permutation
π
. It mixes each column 4 × 4 array A using column permutation π
i for each column i
(
0
≤
i
≤
3
):
(11)
π
(
A
)
=
(
π
0
(
A
c
[
0
]
)
π
1
(
A
c
[
1
]
)
π
2
(
A
c
[
2
]
)
π
3
(
A
c
[
3
]
)
)
,
where A
c
[
i
] are the ith column of A.Eachπ
i is defined by
(12)
b
=
π
i
(
a
)
⟺
b
j
-
⊕
k
=
0
3
(
m
i
+
j
+
k
mod
⁡
4
·
a
k
)
,
where a column a
=
(
a
0
,
a
1
,
a
2
,
a
3
)
t and a column b
=
(
b
0
,
b
1
,
b
2
,
b
3
)
t.Byte Transposition
τ
. It moves the nibble at the (
i
,
j
)th position to the (
j
,
i
)th position; that is, B
=
τ
(
A
)
⇔
b
j
i
=
a
i
j. So τ
-
1
=
τ.Key Addition
σ
.
B
=
σ
K
(
A
) is defined by B
r
[
i
]
=
A
r
[
i
]
⊕
K
[
i
]
(
0
≤
i
≤
3
), where K
=
(
K
[
0
]
,
K
[
1
]
,
K
[
2
]
,
K
[
3
]
) is a round key.Like Crypton, mCrypton also can be described as(13)
E
K
=
ϕ
∘
ρ
K
12
∘
ρ
K
11
∘
⋯
∘
ρ
K
2
∘
ρ
K
1
∘
σ
K
0
,
where ϕ
=
τ
∘
π
∘
τ.In this paper, we focus on the 128-bit key version of the mCrypton that is composed of 12 rounds.


## 4. Biclique Cryptanalysis of Crypton-256

In this section, we describe a biclique attack with dimension 8(
d
=
8
) on the full 12-round Crypton-256. We recover secret key by constructing biclique using independent related-key differentials.


### 4.1. Key Partitioning and Constructing Biclique for 4 Rounds

We describe how to partition key groups of Crypton-256 in this section. Key schedule of Crypton-256 expands master key, and then all of the round keys are uniquely determined by expanded keys. Therefore, if an expanded keyE
e
[
i
] is recovered, the mater key K
[
i
]
(
0
≤
i
≤
7
) is derived. Indices of 32-bit expanded keys E
e
[
i
] used for generating round keys in each round are listed in Table 3.Table 3
Indices of expanded keysE
e
[
i
] of Crypton-256 associated with each round.
Round
i
0
0, 1, 2, 3
1
4, 5, 6, 7
2
1, 2, 3, 0
3
7, 4, 5, 6
4
2, 3, 0, 1
5
6, 7, 4, 5
6
3, 0, 1, 2
7
5, 6, 7, 4
8
0, 1, 2, 3
9
4*, 5*, 6*, 7*
10
1*, 2*, 3*, 0*
11
7, 4, 5, 6
12
2, 3, 0, 1
Note: the * represents key space.The base keysK
〈
0,0
〉 are all 2240 32-byte values with two bytes fixed to 0 (K
e
[
38
] and K
e
[
42
], which is derived from E
e
[
6
] and E
e
[
3
], resp.), but the remaining 30 bytes changes over all values:We Find second byte ofE
e
[
0
] and E
e
[
3
] and fourth byte of E
e
[
6
] and E
e
[
7
] give construction of biclique. Therefore the set of keys {
K
〈
i
,
j
〉
} which is considering combined (
Δ
i
,
∇
j
)-differentials with respect to the base key K
〈
0,0
〉, is determined by all possible i and j in the following positions:Now, we explain how to construct biclique for 4 rounds of Crypton-256 with dimension 8(
d
=
8
). Let f be the subcipher from Round 9 to final round of Crypton-256. Let the key K
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0, C
0
=
f
K
〈
0,0
〉
(
S
0
). Consider previously explained two related-key differentials.Δ
i-Differentials. The Δ
i-differentials are derived from the difference Δ
i
K where the difference of the expanded key is i in the following positions:∇
j
-Differentials. The ∇
j-differentials are derived from the difference ∇
j
K where the difference of the expanded key is j in the following positions:BothΔ
i-differentials and ∇
j-differentials are depicted in Figure 2. Since those two differentials do not share active S-boxes, one can easily obtain the following differentials with respect to the (
P
0
,
S
0
,
K
〈
0,0
〉
):
(14)
∀
i
,
j
,
S
0
⊕
∇
j
⟶
f
K
〈
0,0
〉
⊕
Δ
i
K
⊕
∇
j
K
P
0
⊕
Δ
i
.
Hence we can confirm a construction of biclique with dimension 8.Figure 2
4-round biclique of Crypton-256.


### 4.2. Key Recovery for the Crypton-256

We describe the key recovery procedure using constructed 4-round biclique for the full Crypton-256. For further explanation, letg be a composition of g
1 and g
2, g
=
g
2
∘
g
1. Then Crypton-256, E, is the composition of the subciphers as follows:
(15)
E
:
P
⟶
g
1
V
⟶
g
2
S
⟶
f
C
,
where g
1 is the subcipher from Round 0 to 4, and g
2 is the subcipher from Round 5 to 8 of Crypton-256. Assume that the plaintext P
i corresponding to each ciphertext C
i in a constructed 4-round biclique is obtained by a decryption oracle.The adversary finds a candidate key in the followingkey testing step by computing the only 1 byte of intermediate variable v:
(16)
P
i
⟶
g
1
K
〈
i
,
j
〉
v
→
=
?
v
←
⟵
g
2
K
〈
i
,
j
〉
S
j
.
One can perform key recovery procedure by the following steps, precomputation and recomputations.Precomputation. This step is a preparation phase for an efficient meet-in-the-middle attack. As in Section 2.3, one computes and stores (7) with 2
d encryptions and 2
d decryptions. In Crypton-256, we consider an intermediate matching variable byte v in the output of Round 4 as the byte in the following position:In precomputation step, first we consider forward direction, from an initial round to Round 4. For alli
=
0
,
…
,
2
8
-
1, the adversary computes v of the output in Round 4 from P
i with K
〈
i
,
0
〉. And one stores it as v
→ with the intermediate states and subkeys in memory. On the other hand, in backward direction, let us consider subcipher of Crypton-256 from Round 5 to 8. For all j
=
0
,
…
,
2
8
-
1, one computes v from S
j with K
〈
0
,
j
〉 and stores it as v
← with the intermediate states and subkeys in memory. And then we check (16) for every i, j by recomputing those variables which differ from the bytes stored in memory, considering forward and backward directions.Backward Recomputation. In this step, we explain how to recompute difference between v
←
←
K
〈
i
,
j
〉
S
j and stored one, v
←
j
←
K
〈
0
,
j
〉
S
j. This difference is influenced by the key difference between K
〈
i
,
j
〉 and K
〈
0
,
j
〉. By key schedule of Crypton-256, the difference in the subkey of Round 8 is two bytes of 16 bytes. The bytes to be recomputed, which include 29 S-boxes, are illustrated in Figure 3.Figure 3
Recomputation in the backward direction of Crypton-256.Forward Recomputation. Recomputing difference, between P
i
→
K
〈
i
,
j
〉
v
→ and stored one, P
i
→
K
〈
i
,
0
〉
v
→
i, is influenced by the key difference between K
〈
i
,
j
〉 and K
〈
i
,
0
〉. By the key schedule, the difference in the subkey of Round 8 is two bytes of 16 bytes. The bytes to be recomputed, which include 10 S-boxes, are depicted in Figure 4.Figure 4
Recomputation in the forward direction of Crypton-256.By these recomputations of two directions, the adversary would make sure whether corresponding keyK
〈
i
,
j
〉 satisfies (16). If it satisfies (16), the adversary should check matching the whole bytes at output of Round 4 (input of Round 5) for K
〈
i
,
j
〉, P
i, and S
j. If the adversary cannot find the right key, then one should choose another key group and repeat the above procedures.


### 4.3. Complexities

LetC
biclique be the complexity of constructing a biclique. In our cryptanalysis, it is at most 2
d
+
1
(
=
2
9
) 8-round computations, where n
=
256 and d
=
8. Let C
precomp be the complexity of the precomputation for the matching in (16). And C
recomp is the complexity of the recomputation of the byte v. Approximately 2.438 byte substitution operations (39 S-boxes) are required in recomputation. C
falsepos is the complexity caused by false positives, which have to be matched on other byte positions. Since the matching in (16) is performed on a single byte, C
falsepos is less than 2
2
d
-
8
(
=
2
8
) computations. Therefore, the total complexity of the biclique cryptanalysis on the full Cryption-256 is as follows:
(17)
C
Total
=
2
(
n
-
2
d
)
[
C
biclique
+
C
precomp
+
C
recomp
+
C
falsepos
]
,
where C
biclique: 2
(
8
+
1
)
×
(
4
/
12
)
≤
2
8, C
precomp: 2
8
×
(
8
/
12
)
≤
2
8, C
recomp: 2
(
2
·
8
)
×
(
2.438
/
12
)
≤
2
13.701, and C
falsepos: 2
(
2
·
8
-
8
)
=
2
8.Consequentially, the total complexity is(18)
C
Total
:
2
240
×
(
2
8
+
2
8
+
2
13.7
+
2
8
)
=
2
253.78
.
Although the Δ
i-differential affects all bytes of the ciphertext, only two bytes have 8-bit difference and the remaining bytes have only 6-bit difference. So, 28-bit ciphertext has no difference. As a result, the data complexity does not exceed 2100.


## 4.1. Key Partitioning and Constructing Biclique for 4 Rounds

We describe how to partition key groups of Crypton-256 in this section. Key schedule of Crypton-256 expands master key, and then all of the round keys are uniquely determined by expanded keys. Therefore, if an expanded keyE
e
[
i
] is recovered, the mater key K
[
i
]
(
0
≤
i
≤
7
) is derived. Indices of 32-bit expanded keys E
e
[
i
] used for generating round keys in each round are listed in Table 3.Table 3
Indices of expanded keysE
e
[
i
] of Crypton-256 associated with each round.
Round
i
0
0, 1, 2, 3
1
4, 5, 6, 7
2
1, 2, 3, 0
3
7, 4, 5, 6
4
2, 3, 0, 1
5
6, 7, 4, 5
6
3, 0, 1, 2
7
5, 6, 7, 4
8
0, 1, 2, 3
9
4*, 5*, 6*, 7*
10
1*, 2*, 3*, 0*
11
7, 4, 5, 6
12
2, 3, 0, 1
Note: the * represents key space.The base keysK
〈
0,0
〉 are all 2240 32-byte values with two bytes fixed to 0 (K
e
[
38
] and K
e
[
42
], which is derived from E
e
[
6
] and E
e
[
3
], resp.), but the remaining 30 bytes changes over all values:We Find second byte ofE
e
[
0
] and E
e
[
3
] and fourth byte of E
e
[
6
] and E
e
[
7
] give construction of biclique. Therefore the set of keys {
K
〈
i
,
j
〉
} which is considering combined (
Δ
i
,
∇
j
)-differentials with respect to the base key K
〈
0,0
〉, is determined by all possible i and j in the following positions:Now, we explain how to construct biclique for 4 rounds of Crypton-256 with dimension 8(
d
=
8
). Let f be the subcipher from Round 9 to final round of Crypton-256. Let the key K
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0, C
0
=
f
K
〈
0,0
〉
(
S
0
). Consider previously explained two related-key differentials.Δ
i-Differentials. The Δ
i-differentials are derived from the difference Δ
i
K where the difference of the expanded key is i in the following positions:∇
j
-Differentials. The ∇
j-differentials are derived from the difference ∇
j
K where the difference of the expanded key is j in the following positions:BothΔ
i-differentials and ∇
j-differentials are depicted in Figure 2. Since those two differentials do not share active S-boxes, one can easily obtain the following differentials with respect to the (
P
0
,
S
0
,
K
〈
0,0
〉
):
(14)
∀
i
,
j
,
S
0
⊕
∇
j
⟶
f
K
〈
0,0
〉
⊕
Δ
i
K
⊕
∇
j
K
P
0
⊕
Δ
i
.
Hence we can confirm a construction of biclique with dimension 8.Figure 2
4-round biclique of Crypton-256.


## 4.2. Key Recovery for the Crypton-256

We describe the key recovery procedure using constructed 4-round biclique for the full Crypton-256. For further explanation, letg be a composition of g
1 and g
2, g
=
g
2
∘
g
1. Then Crypton-256, E, is the composition of the subciphers as follows:
(15)
E
:
P
⟶
g
1
V
⟶
g
2
S
⟶
f
C
,
where g
1 is the subcipher from Round 0 to 4, and g
2 is the subcipher from Round 5 to 8 of Crypton-256. Assume that the plaintext P
i corresponding to each ciphertext C
i in a constructed 4-round biclique is obtained by a decryption oracle.The adversary finds a candidate key in the followingkey testing step by computing the only 1 byte of intermediate variable v:
(16)
P
i
⟶
g
1
K
〈
i
,
j
〉
v
→
=
?
v
←
⟵
g
2
K
〈
i
,
j
〉
S
j
.
One can perform key recovery procedure by the following steps, precomputation and recomputations.Precomputation. This step is a preparation phase for an efficient meet-in-the-middle attack. As in Section 2.3, one computes and stores (7) with 2
d encryptions and 2
d decryptions. In Crypton-256, we consider an intermediate matching variable byte v in the output of Round 4 as the byte in the following position:In precomputation step, first we consider forward direction, from an initial round to Round 4. For alli
=
0
,
…
,
2
8
-
1, the adversary computes v of the output in Round 4 from P
i with K
〈
i
,
0
〉. And one stores it as v
→ with the intermediate states and subkeys in memory. On the other hand, in backward direction, let us consider subcipher of Crypton-256 from Round 5 to 8. For all j
=
0
,
…
,
2
8
-
1, one computes v from S
j with K
〈
0
,
j
〉 and stores it as v
← with the intermediate states and subkeys in memory. And then we check (16) for every i, j by recomputing those variables which differ from the bytes stored in memory, considering forward and backward directions.Backward Recomputation. In this step, we explain how to recompute difference between v
←
←
K
〈
i
,
j
〉
S
j and stored one, v
←
j
←
K
〈
0
,
j
〉
S
j. This difference is influenced by the key difference between K
〈
i
,
j
〉 and K
〈
0
,
j
〉. By key schedule of Crypton-256, the difference in the subkey of Round 8 is two bytes of 16 bytes. The bytes to be recomputed, which include 29 S-boxes, are illustrated in Figure 3.Figure 3
Recomputation in the backward direction of Crypton-256.Forward Recomputation. Recomputing difference, between P
i
→
K
〈
i
,
j
〉
v
→ and stored one, P
i
→
K
〈
i
,
0
〉
v
→
i, is influenced by the key difference between K
〈
i
,
j
〉 and K
〈
i
,
0
〉. By the key schedule, the difference in the subkey of Round 8 is two bytes of 16 bytes. The bytes to be recomputed, which include 10 S-boxes, are depicted in Figure 4.Figure 4
Recomputation in the forward direction of Crypton-256.By these recomputations of two directions, the adversary would make sure whether corresponding keyK
〈
i
,
j
〉 satisfies (16). If it satisfies (16), the adversary should check matching the whole bytes at output of Round 4 (input of Round 5) for K
〈
i
,
j
〉, P
i, and S
j. If the adversary cannot find the right key, then one should choose another key group and repeat the above procedures.


## 4.3. Complexities

LetC
biclique be the complexity of constructing a biclique. In our cryptanalysis, it is at most 2
d
+
1
(
=
2
9
) 8-round computations, where n
=
256 and d
=
8. Let C
precomp be the complexity of the precomputation for the matching in (16). And C
recomp is the complexity of the recomputation of the byte v. Approximately 2.438 byte substitution operations (39 S-boxes) are required in recomputation. C
falsepos is the complexity caused by false positives, which have to be matched on other byte positions. Since the matching in (16) is performed on a single byte, C
falsepos is less than 2
2
d
-
8
(
=
2
8
) computations. Therefore, the total complexity of the biclique cryptanalysis on the full Cryption-256 is as follows:
(17)
C
Total
=
2
(
n
-
2
d
)
[
C
biclique
+
C
precomp
+
C
recomp
+
C
falsepos
]
,
where C
biclique: 2
(
8
+
1
)
×
(
4
/
12
)
≤
2
8, C
precomp: 2
8
×
(
8
/
12
)
≤
2
8, C
recomp: 2
(
2
·
8
)
×
(
2.438
/
12
)
≤
2
13.701, and C
falsepos: 2
(
2
·
8
-
8
)
=
2
8.Consequentially, the total complexity is(18)
C
Total
:
2
240
×
(
2
8
+
2
8
+
2
13.7
+
2
8
)
=
2
253.78
.
Although the Δ
i-differential affects all bytes of the ciphertext, only two bytes have 8-bit difference and the remaining bytes have only 6-bit difference. So, 28-bit ciphertext has no difference. As a result, the data complexity does not exceed 2100.


## 5. Biclique Cryptanalysis of mCrypton-128

In this section, we describe a biclique cryptanalysis with dimension 8(
d
=
8
) on the full mCrypton-128. We recover secret key by constructing a 4-round biclique using independent related-key differentials.


### 5.1. Key Partitioning and Constructing Biclique for 4 Rounds

By the key schedule of mCrypton-128 in Table4, all of the round keys are uniquely determined by the master key U
[
i
]. We find that some bits of U
[
3
], U
[
4
], U
[
1
], and U
[
2
] give construction of a biclique. The base keys K
〈
0,0
〉 are all 2112 32 nibbles at Round 11 and 12 with 16 bits fixed to 0, in the following positions:Table 4
Each round keys of mCrypton-128 from Round 9 to 12.
Round
Round keys
9
(
U
[
6
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
7
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
0
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
1
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
10
(
U
[
3
]
<
<
11
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
4
]
<
<
19
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
5
]
<
<
14
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
6
]
<
<
11
)
⊕
S
(
U
[
2
]
<
<
11
)
11
(
U
[
0
]
<
<
14
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
1
]
<
<
19
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
2
]
<
<
14
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
3
]
<
<
11
)
⊕
S
(
U
[
7
]
<
<
11
)
12
(
U
[
5
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
6
]
<
<
19
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
7
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
0
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)And the set of keys{
K
〈
i
,
j
〉
}, which is considering combined (
Δ
i
,
∇
j
)-differentials with respect to the base key K
〈
0,0
〉, is determined by all possible i
=
i
1
∥
i
2 and j
=
j
1
∥
j
2 in the following positions:Now, we explain how to construct a biclique for 4 rounds of mCrypton-128. Consider the following two related-key differentials. Letf be the subcipher from Round 9 to final round of mCrypton-128. Let the key K
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0, C
0
=
f
K
〈
0,0
〉
(
S
0
). Consider the two related-key differentials.Δ
i-Differentials. The Δ
i-differentials are derived from the following difference Δ
i
K:∇
j-Differentials. The ∇
j-differentials are derived from the following difference ∇
j
K:Δ
i-differentials and ∇
j-differentials are depicted in Figure 5. We construct a 4-round biclique with dimension 8.Figure 5
4-round biclique of mCrypton-128.


### 5.2. Key Recovery for the mCrypton-128

Let us explain the key recovery procedure using the 4-round biclique for the full round of mCrypton-128. The adversary finds the right key in the followingkey testing step by checking the only 1 nibble of intermediate variable v in (16).Precomputation. As explained in Section 4.2 for Crypton-256, in mCrypton-128, we consider an intermediate matching variable v in the output of Round 4 as the byte in the following position:In this step, we first consider forward direction, from initial round to Round 4 of mCrypton-128. For alli
=
0
,
…
,
2
8
-
1, the adversary computes v of the output of Round 4, from P
i and K
〈
i
,
0
〉. And one stores it as v
→ with the intermediate states and subkeys in memory. On the other hand, in backward direction, we consider Rounds from 5 to 8. For all j
=
0
,
…
,
2
8
-
1, one computes v from S
j and K
〈
0
,
j
〉 and stores it as v
← with the intermediate states and subkeys in memory. Then we check (16) for every i, j by recomputing those variables which differ from the variables stored in memory considering forward and backward direction.Backward Recomputation. In backward direction, we look at how the computation v
←
←
K
〈
i
,
j
〉
S
j differs from stored one, v
←
j
←
K
〈
0
,
j
〉
S
j. The area to be recomputed, which includes 25 S-boxes, is illustrated in Figure 6.Figure 6
Recomputation in the backward direction of mCrypton-128.Forward Recomputation. Let us figure out how the computation P
i
→
K
〈
i
,
j
〉
v
→ differs from stored one, P
i
→
K
〈
i
,
0
〉
v
→
i. The area to be recomputed, which includes 30 S-boxes, is depicted in Figure 7.Figure 7
Recomputation in the forward direction of mCrypton-128.By those recomputations of two directions, the adversary would make sure whether corresponding keyK
〈
i
,
j
〉 satisfies (16). If it is satisfied (16), the candidate key is right key with high probability. Otherwise, the adversary should choose another key group and repeat the above procedures again.


### 5.3. Complexities

We construct a biclique for 4 rounds of mCrypton-128 where the dimension is 8. TheΔ
i-differentials are based on the difference in 4-bits of U
[
3
] and U
[
4
], and ∇
j-differentials are based on the difference in 4 bits of U
[
1
] and U
[
2
]. Approximately 3.4375 nonlinear substitution operations (55 S-boxes) are required in recomputation:C
biclique: 2
(
8
+
1
)
×
(
4
/
12
)
≤
2
8,
C
precomp: 2
8
×
(
8
/
12
)
≤
2
8,
C
recomp: 2
(
2
·
8
)
×
(
3.4375
/
12
)
≤
2
14.2,
C
falsepos: 2
(
2
·
8
-
4
)
=
2
12.Consequentially, the total complexity is
(19)
C
Total
:
2
112
×
(
2
8
+
2
8
+
2
14.2
+
2
12
)
=
2
126.5
.
In ciphertext, four nibbles have 4-bit difference and the remaining 12 nibbles have only 3-bit difference. Also 12 bits of ciphertext have zero difference. Hence the data complexity does not exceed 252.


## 5.1. Key Partitioning and Constructing Biclique for 4 Rounds

By the key schedule of mCrypton-128 in Table4, all of the round keys are uniquely determined by the master key U
[
i
]. We find that some bits of U
[
3
], U
[
4
], U
[
1
], and U
[
2
] give construction of a biclique. The base keys K
〈
0,0
〉 are all 2112 32 nibbles at Round 11 and 12 with 16 bits fixed to 0, in the following positions:Table 4
Each round keys of mCrypton-128 from Round 9 to 12.
Round
Round keys
9
(
U
[
6
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
7
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
0
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
(
U
[
1
]
<
<
11
)
⊕
S
(
U
[
5
]
<
<
11
)
10
(
U
[
3
]
<
<
11
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
4
]
<
<
19
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
5
]
<
<
14
)
⊕
S
(
U
[
2
]
<
<
11
)
(
U
[
6
]
<
<
11
)
⊕
S
(
U
[
2
]
<
<
11
)
11
(
U
[
0
]
<
<
14
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
1
]
<
<
19
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
2
]
<
<
14
)
⊕
S
(
U
[
7
]
<
<
11
)
(
U
[
3
]
<
<
11
)
⊕
S
(
U
[
7
]
<
<
11
)
12
(
U
[
5
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
6
]
<
<
19
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
7
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)
(
U
[
0
]
<
<
14
)
⊕
S
(
U
[
4
]
<
<
19
)And the set of keys{
K
〈
i
,
j
〉
}, which is considering combined (
Δ
i
,
∇
j
)-differentials with respect to the base key K
〈
0,0
〉, is determined by all possible i
=
i
1
∥
i
2 and j
=
j
1
∥
j
2 in the following positions:Now, we explain how to construct a biclique for 4 rounds of mCrypton-128. Consider the following two related-key differentials. Letf be the subcipher from Round 9 to final round of mCrypton-128. Let the key K
〈
0,0
〉 maps an intermediate state S
0 to a ciphertext C
0, C
0
=
f
K
〈
0,0
〉
(
S
0
). Consider the two related-key differentials.Δ
i-Differentials. The Δ
i-differentials are derived from the following difference Δ
i
K:∇
j-Differentials. The ∇
j-differentials are derived from the following difference ∇
j
K:Δ
i-differentials and ∇
j-differentials are depicted in Figure 5. We construct a 4-round biclique with dimension 8.Figure 5
4-round biclique of mCrypton-128.


## 5.2. Key Recovery for the mCrypton-128

Let us explain the key recovery procedure using the 4-round biclique for the full round of mCrypton-128. The adversary finds the right key in the followingkey testing step by checking the only 1 nibble of intermediate variable v in (16).Precomputation. As explained in Section 4.2 for Crypton-256, in mCrypton-128, we consider an intermediate matching variable v in the output of Round 4 as the byte in the following position:In this step, we first consider forward direction, from initial round to Round 4 of mCrypton-128. For alli
=
0
,
…
,
2
8
-
1, the adversary computes v of the output of Round 4, from P
i and K
〈
i
,
0
〉. And one stores it as v
→ with the intermediate states and subkeys in memory. On the other hand, in backward direction, we consider Rounds from 5 to 8. For all j
=
0
,
…
,
2
8
-
1, one computes v from S
j and K
〈
0
,
j
〉 and stores it as v
← with the intermediate states and subkeys in memory. Then we check (16) for every i, j by recomputing those variables which differ from the variables stored in memory considering forward and backward direction.Backward Recomputation. In backward direction, we look at how the computation v
←
←
K
〈
i
,
j
〉
S
j differs from stored one, v
←
j
←
K
〈
0
,
j
〉
S
j. The area to be recomputed, which includes 25 S-boxes, is illustrated in Figure 6.Figure 6
Recomputation in the backward direction of mCrypton-128.Forward Recomputation. Let us figure out how the computation P
i
→
K
〈
i
,
j
〉
v
→ differs from stored one, P
i
→
K
〈
i
,
0
〉
v
→
i. The area to be recomputed, which includes 30 S-boxes, is depicted in Figure 7.Figure 7
Recomputation in the forward direction of mCrypton-128.By those recomputations of two directions, the adversary would make sure whether corresponding keyK
〈
i
,
j
〉 satisfies (16). If it is satisfied (16), the candidate key is right key with high probability. Otherwise, the adversary should choose another key group and repeat the above procedures again.


## 5.3. Complexities

We construct a biclique for 4 rounds of mCrypton-128 where the dimension is 8. TheΔ
i-differentials are based on the difference in 4-bits of U
[
3
] and U
[
4
], and ∇
j-differentials are based on the difference in 4 bits of U
[
1
] and U
[
2
]. Approximately 3.4375 nonlinear substitution operations (55 S-boxes) are required in recomputation:C
biclique: 2
(
8
+
1
)
×
(
4
/
12
)
≤
2
8,
C
precomp: 2
8
×
(
8
/
12
)
≤
2
8,
C
recomp: 2
(
2
·
8
)
×
(
3.4375
/
12
)
≤
2
14.2,
C
falsepos: 2
(
2
·
8
-
4
)
=
2
12.Consequentially, the total complexity is
(19)
C
Total
:
2
112
×
(
2
8
+
2
8
+
2
14.2
+
2
12
)
=
2
126.5
.
In ciphertext, four nibbles have 4-bit difference and the remaining 12 nibbles have only 3-bit difference. Also 12 bits of ciphertext have zero difference. Hence the data complexity does not exceed 252.


## 6. Conclusions

We use bicliques to recover master key for the full rounds of Crypton-256 and mCrypton-128 with the computation complexity of 2253.78 and 2126.5, respectively. This is the first single-key full-round attack for the Crypton-256. And our result on the mCrypton-128 with 4-round bicliques is better than the known biclique cryptanalysis result with 3-round bicliques in terms of computational time complexity.



---

*Source: 529736-2014-03-27.xml*