Key-Recovery Attack on 5-Round AES with Multiple-of-8 Property

SUMMARY At EUROCRYPT 2017, Grassi et al. proposed the multiple-of-8 property for 5-round AES, which states that the number of pairs in a certain input-output subspace, referred to as right pairs, is always a multiple of 8. However, no key-recovery attack has been proposed that utilizes this property until now. In this paper, we identify a new aspect of the multiple-of-8 property: when the number of right pairs is exactly eight, these eight pairs all have the same difference from after the 1st round SubBytes to before the 4th round SubBytes. Based on this observation, we propose a new key-recovery attack on 5-round AES. Our attack requires data and time complexities of 2^32.6 chosen plaintexts and 5-round AES encryptions, and a memory complexity of 2³¹ 128-bit blocks to recover a 32-bit subkey with a success probability of 50.5%. Although it is not the best attack on 5-round AES, it is notable as the first key-recovery attack that utilizes the multiple-of-8 property. We validate our observation through experiments and demonstrate its applicability to other ciphers with SPN structures, beyond AES.