Impossible Di!erential Cryptanalysis of CLEFIA

This paper reports impossible di!erential cryptanalysis on the 128-bit block cipher CLEFIA that was proposed in 2007, including new 9-round impossible di!erentials for CLEFIA, and the result of an impossible di!erential attack using them. For the case of a 128-bit key, it is possible to apply the impossible di!erential attack to CLEFIA re- duced to 12 rounds. The number of chosen plaintexts required is 2 118.9 and the time complexity is 2 119 . For key lengths of 192 bits and 256 bits, it is possible to apply impossible di!erential attacks to 13-round and 14- round CLEFIA. The respective numbers of chosen plaintexts required are 2 119.8 and 2 120.3 and the respective time complexities are 2 147 and 2 211 . These impossible di!erential attacks are the strongest method for attacking reduced-round CLEFIA.