Featured Research

from universities, journals, and other organizations

First flaws in the Advanced Encryption Standard used for internet banking identified

Date:
September 1, 2011
Source:
Katholieke Universiteit Leuven
Summary:
Researchers have found a weakness in the AES algorithm used worldwide to protect internet banking, wireless communications, and data on hard disks. They managed to come up with a clever new attack that can recover the secret key four times easier than anticipated by experts. However the attack has no practical implications on the security of user data due to various complexities.

Researchers have found a weakness in the AES algorithm. They managed to come up with a clever new attack that can recover the secret key four times easier than anticipated by experts.

The attack is a result of a long-term cryptanalysis project carried out by Andrey Bogdanov (K.U.Leuven, visiting Microsoft Research at the time of obtaining the results), Dmitry Khovratovich (Microsoft Research), and Christian Rechberger (ENS Paris, visiting Microsoft Research).

The AES algorithm is used by hundreds of millions of users worldwide to protect internet banking, wireless communications, and the data on their hard disks. In 2000, the Rijndael algorithm, designed by the Belgian cryptographers Dr. Joan Daemen (STMicroelectronics) and Prof. Vincent Rijmen (K.U.Leuven), was selected as the winner of an open competition organized by the US NIST (National Institute for Standards and Technology). Today AES is used in more than 1700 NIST-validated products and thousands of others; it has been standardized by NIST, ISO, and IEEE and it has been approved by the U.S. National Security Agency (NSA) for protecting secret and even top secret information.

In the last decade, many researchers have tested the security of the AES algorithm, but no flaws were found so far. In 2009, some weaknesses were identified when AES was used to encrypt data under four keys that are related in a way controlled by an attacker; while this attack was interesting from a mathematical point of view, the attack is not relevant in any application scenario. The new attack applies to all versions of AES even if it used with a single key. The attack shows that finding the key of AES is four times easier than previously believed; in other words, AES-128 is more like AES-126. Even with the new attack, the effort to recover a key is still huge: the number of steps to find the key for AES-128 is an 8 followed by 37 zeroes. To put this into perspective: on a trillion machines, that each could test a billion keys per second, it would take more than two billion years to recover an AES-128 key. Note that large corporations are believed to have millions of machines, and current machines can only test 10 million keys per second.

Because of these huge complexities, the attack has no practical implications on the security of user data; however, it is the first significant flaw that has been found in the widely used AES algorithm and was confirmed by the designers.


Story Source:

The above story is based on materials provided by Katholieke Universiteit Leuven. Note: Materials may be edited for content and length.


Cite This Page:

Katholieke Universiteit Leuven. "First flaws in the Advanced Encryption Standard used for internet banking identified." ScienceDaily. ScienceDaily, 1 September 2011. <www.sciencedaily.com/releases/2011/08/110817075424.htm>.
Katholieke Universiteit Leuven. (2011, September 1). First flaws in the Advanced Encryption Standard used for internet banking identified. ScienceDaily. Retrieved August 30, 2014 from www.sciencedaily.com/releases/2011/08/110817075424.htm
Katholieke Universiteit Leuven. "First flaws in the Advanced Encryption Standard used for internet banking identified." ScienceDaily. www.sciencedaily.com/releases/2011/08/110817075424.htm (accessed August 30, 2014).

Share This




More Computers & Math News

Saturday, August 30, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

JPMorgan Chase Confirms Possible Cyber Attack

JPMorgan Chase Confirms Possible Cyber Attack

Reuters - US Online Video (Aug. 28, 2014) Attackers stole checking and savings account information and lots of other data from JPMorgan Chase, according to the New York Times. Other banks are believed to be victims as well. Fred Katayama reports. Video provided by Reuters
Powered by NewsLook.com
Spend 2 Minutes Watching This Smartwatch Roundup

Spend 2 Minutes Watching This Smartwatch Roundup

Newsy (Aug. 28, 2014) LG announces a round-faced smartwatch, Samsung adds 3G connectivity to its latest wearable, and Apple will reportedly announce the iWatch on Sept. 9. Video provided by Newsy
Powered by NewsLook.com
Google Reveals Drone Delivery Program, 'Project Wing'

Google Reveals Drone Delivery Program, 'Project Wing'

Newsy (Aug. 28, 2014) Google has been developing a drone delivery system of its own, and it hopes to revolutionize how people view possessions with it. Video provided by Newsy
Powered by NewsLook.com
Why Apple Might Add Mobile Payment Options To iPhone 6

Why Apple Might Add Mobile Payment Options To iPhone 6

Newsy (Aug. 28, 2014) A report by Wired suggests Apple's next iPhone will feature a mobile payment system and near-field communication. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins