28
A. Mileva et al.
Table 2.2 Lightweight block ciphers (best known attacks)
Best known attack: data complexity/memory/time
Name
Ref
complexity
3-Way
[164]
Practical related-key attack [320], 1 related key pair, 2 22
CPs
AES-128
[166]
Biclique key-recovery attack [545]: 2 56 / − /2 126.13
CLEFIA
[527]
Impossible differential attack [106]: 2 114.58 / 2 83.16 B
/2 116.16
DESL/
[361]
Linear cryptanalysis on DES [311]: 2 39 − 2 41 DES
evaluations
DESLX
Related-key attack on DESX[474]:2 3.5 KPs/− / 2 56 DES
evaluations
Fantomas
[247]
−
FLY
[317]
−
GOST
revisited
[487]
Single-key KP differential attack [159]: 2 64 / 2 70 B /2 179
GRANULE
[54]
−
HIGHT
[283]
Biclique cryptanalysis [15]: 2 8 / _ /2 126.07
ICEBERG
[541]
Differential cryptanalysis [543]: 2 63 CPs /2 96 enc. on 8
rounds
ITUbee
[315]
−
KASUMI
[1]
Practical related-key attack [192]: 4 related keys, 2 26 / 2 30
B / 2 32
KATANn/
[126]
Meet-In-The-Middle attack on KTANTANn [104]
KTANTANn
(3, 2, 2) pairs/ −/(2 75.17 , 2 75.044 , 2 75.584 )
KLEIN
[239]
Truncated differential attack [497]: 2 48.6 / 2 32 /2 54.9 on
KLEIN-64
LBlock
[583]
CP related-key impossible differential attack[584]: 2 63 / −
/2 75.42 on 24 rounds
LEA
[282]
−
LED
[252]
Random-difference distinguishers [443]: − / 2 60 B/2 60.3 on
40 rounds LED-128
Lilliput
[78]
Key-recovery attack with the division property [512]: 2 63 /
− /2 77 on 17 rounds
MANTIS r
[68]
Practical key-recovery attack [185]: 2 28 / − /2 38 enc. on
MANTIS 5
mCrypton
[372]
Related-key impossible differential cryptanalysis [388]:
(2 59.9 , 2 59.7 ) / (2 63.9 , 2 55.7 )B /(2 74.9 , 2 66.7 ) on 9 rounds
MIBS
[299]
Biclique cryptanalysis [519] (MIBS-80): 2 52 /− /2 78.98
Midori
[51]
Key-recovery attack for the class of 2 32 weak keys in
Midori64 [250]: 2/− /2 16
MISTY1
[398]
Single-key integral attack [56]: 2 64 /− /2 69.5
Mysterion
[306]
−
(continued)
A. Mileva et al.
Table 2.2 Lightweight block ciphers (best known attacks)
Best known attack: data complexity/memory/time
Name
Ref
complexity
3-Way
[164]
Practical related-key attack [320], 1 related key pair, 2 22
CPs
AES-128
[166]
Biclique key-recovery attack [545]: 2 56 / − /2 126.13
CLEFIA
[527]
Impossible differential attack [106]: 2 114.58 / 2 83.16 B
/2 116.16
DESL/
[361]
Linear cryptanalysis on DES [311]: 2 39 − 2 41 DES
evaluations
DESLX
Related-key attack on DESX[474]:2 3.5 KPs/− / 2 56 DES
evaluations
Fantomas
[247]
−
FLY
[317]
−
GOST
revisited
[487]
Single-key KP differential attack [159]: 2 64 / 2 70 B /2 179
GRANULE
[54]
−
HIGHT
[283]
Biclique cryptanalysis [15]: 2 8 / _ /2 126.07
ICEBERG
[541]
Differential cryptanalysis [543]: 2 63 CPs /2 96 enc. on 8
rounds
ITUbee
[315]
−
KASUMI
[1]
Practical related-key attack [192]: 4 related keys, 2 26 / 2 30
B / 2 32
KATANn/
[126]
Meet-In-The-Middle attack on KTANTANn [104]
KTANTANn
(3, 2, 2) pairs/ −/(2 75.17 , 2 75.044 , 2 75.584 )
KLEIN
[239]
Truncated differential attack [497]: 2 48.6 / 2 32 /2 54.9 on
KLEIN-64
LBlock
[583]
CP related-key impossible differential attack[584]: 2 63 / −
/2 75.42 on 24 rounds
LEA
[282]
−
LED
[252]
Random-difference distinguishers [443]: − / 2 60 B/2 60.3 on
40 rounds LED-128
Lilliput
[78]
Key-recovery attack with the division property [512]: 2 63 /
− /2 77 on 17 rounds
MANTIS r
[68]
Practical key-recovery attack [185]: 2 28 / − /2 38 enc. on
MANTIS 5
mCrypton
[372]
Related-key impossible differential cryptanalysis [388]:
(2 59.9 , 2 59.7 ) / (2 63.9 , 2 55.7 )B /(2 74.9 , 2 66.7 ) on 9 rounds
MIBS
[299]
Biclique cryptanalysis [519] (MIBS-80): 2 52 /− /2 78.98
Midori
[51]
Key-recovery attack for the class of 2 32 weak keys in
Midori64 [250]: 2/− /2 16
MISTY1
[398]
Single-key integral attack [56]: 2 64 /− /2 69.5
Mysterion
[306]
−
(continued)