Abstract: This paper first presents an impossible differential property of the 4-round AES-if only one S-box of the input plaintext pair is different, and it is impossible that there be three different S-boxes in the same column for the corresponding cipher-text pair after 4-round encryption. Based on this property, a new method is proposed for cryptanalyzing the 6-round AES, which is to add one round to each end of the impossible differential cryptanalysis for the 4-round AES. This attack on the reduced 6-round AES requires about 2^99.5 chosen plaintexts, demands 2⁵⁷ words of memory, and performs 2⁸⁶ 6-round AES encryptions. Furthermore, there is only 2^-66.5 of the probability to fail to recover the secret key.

Key words: impossible differential cryptanalysis, advanced encryption standard, cryptanalysis