Preliminary Cryptanalysis of Reduced-Round Serpent

Serpent is a 32-round AES block cipher nalist. In this paper we present several attacks on reduced-round variants of Serpent that require less work than exhaustive search. We attack six-round 256-bit Serpent using the meet-in-the-middle technique, 512 known plaintexts, 2 bytes of memory, and approximately 2 trial encryptions. For all key sizes, we attack six-round Serpent using standard di erential cryptanalysis, 2 chosen plaintexts, 2 bytes of memory, and 2 trial encryptions. We present boomerang and ampli ed boomerang attacks on sevenand eight-round Serpent, and show how to break nine-round 256-bit Serpent using the ampli ed boomerang technique, 2 chosen plaintexts, 2 bytes of memory, and approximately 2 trial encryptions.