### Table 12. Detailed complexities of our key-recovery attack against E0

2004

"... In PAGE 13: ... Last, we use the technique of guess and determine in [11] to solve R3 and R4 with knowledge of the shortest two LFSRs. The detailed complexities of each step are shown in Table12 . A comparison of our attacks with the similar attack7 [10] and the best two algebraic attacks [1, 8] is shown in Table 13.... ..."

Cited by 10

### Table 4. Summary of key recovery attack on NMAC-SHA-1

2006

"... In PAGE 8: ... For differential distinguisher and forgery attacks, a venue for future improvements could be the use of multi-block characteristics. In Table4 we summarize the results of the newly developed key recovery tech- nique when applied to step-reduced HMAC-SHA-1. Note that stronger attack models might lead to additional improvements in all presented cases.... ..."

Cited by 3

### Table 4: Key recovery attack complexities

2003

"... In PAGE 13: ... The complexities of forgery attacks against the five MAC schemes considered here are specified in Table 3. Table 3: Forgery attack complexities XCBC TMAC OMAC EMAC ARMAC [0,2n=2+1,0] [0,2n=2+1,0] [0,2n=2+1,0] [0,2n=2,1] [0,2n=2,1] The complexities of key recovery attacks are specified in Table4 . Note that this table does not take account of the fact that the complexities of the... ..."

Cited by 1

### Table 4. Key recovery attack complexities

"... In PAGE 11: ...XCBC TMAC OMAC EMAC ARMAC [0,2n=2+1,0] [0,2n=2+1,0] [0,2n=2+1,0] [0,2n=2,1] [0,2n=2,1] The complexities of key recovery attacks are specified in Table4 . Note that this table does not take account of the fact that the complexities of the second attacks for XCBC, TMAC and OMAC require no significant storage, whereas the second attack against EMAC requires around O(2k) storage.... ..."

### Table 5: Partial key recovery attack complexities

2003

Cited by 1

### Table 5. Partial key recovery attack complexities

### Table 4. Performance of our partial key-recovery attack against two-level E0

2004

"... In PAGE 10: ... To summarize, we have T = m + 24(2+ ) min(m; 28+5 ). Table4 lists the best complexities of our partial key-recovery attack corresponding to = 1; : : : ; 4. Note that the success probability of the attack in the table is estimated according to the hypothesis test result of Eq.... ..."

Cited by 4

### Table 1: Complexity of key recovery attack on envelope method (128-bit key)

"... In PAGE 25: ... Table1 summarizes the complexity to nd 64 key bits in d-bit slices, for di erent values of d. If a 128-bit key is used with the remaining bits found by exhaustive search, the overall time complexity is on the order of the number of known texts.... In PAGE 41: ... Table1 . Complexity of key recovery attack on envelope method (128-bit key) Table 2.... ..."

### Table 10: Complexities for key-recovery attacks on RC6 with 128-bit blocks

1999

"... In PAGE 14: ... This attack is faster than an exhaustive key search for the 128-bit key version of RC6 with up to 12 rounds, and for the 192-bit and 256-bit versions of RC6 with up to 14 rounds. Table10 lists the complexity for 12, and 14 rounds of RC6. For 16 rounds the number of texts needed is 2 126:3 and thus exceeds the number of available texts of 2 118 .... In PAGE 14: ... The number of plaintexts needed for this version of the attackis 2 10 #02 2 17 #02 #282 16:2 #29 r,2 2 ,1 =2 r#028:1,5:4 ; and the time complexityis 2 54+r#028:1,7:4 =2 46:6+r#028:1 ; where one unit is the time to update one entry of one array of size 2 10 of totally 2 64 arrays. Table10 lists the complexities of this attack for 14 rounds of RC6. The number of texts needed in the attack on 16 rounds is about 2 124 and thus still exceeds 2 118 .... ..."

Cited by 2

### Table 11. Summary of primary partial key-recovery attacks against R1 for E0

2004

"... In PAGE 13: ... So, choosing r = 12, we can halve the time and data complexities. The attack complexities to recover R1 for E0 are listed in Table11 . Once we recover R1, we target R2 next based on multiple of p3(x)p4(x).... ..."

Cited by 10