### Table 1. Complexity of 6-Round Impossible Differential Attack

"... In PAGE 10: ...ryptions, or 293.5 plaintexts, 2110.5 encryptions and 2104.5 bytes of memory. We summarize the complexities of our attacks together with those of previous works in Table1 . We expect that this method can be applied to other block ciphers... ..."

### Table 1: Parallelism between square and impossible differential characteris- tics

### Table 1. Summary of attacks on MISTY variants.

2001

"... In PAGE 1: ... Furthermore reduced- round KASUMI, a MISTY variant to be used in next generation cellular phones, is attacked with impossible differentials. Table1 shows a summary of the attacks. This paper is organised as follows.... ..."

Cited by 5

### Table 3. Linear approximations for fMAJ(a, b, c), fIF(e, f, g) and the corresponding (x1, x2, x3, y1, y2, y3). Case A has been considered by Gilbert-Handschuh. It has one impossible condition each for both fMAJ and fIF . Cases B to E have one impossible condition for fMAJ and none for fIF .

"... In PAGE 6: ... There are four linear approximations of fIF which do not have any impossible conditions. In Table3 we consider the situation where fMAJ is approximated by zero and fIF is approximated by zero and the four other linear functions which do not have impossible conditions. From Table 2, we find that there are 16 possible combinations of linear approximations of fMAJ and fIF which do not have any impossible conditions.... In PAGE 7: ... On the other hand, the equations do have a pattern, which we have exploited to obtain solutions. We explain our method for k = 9 for Case B of Table3 . Similar methods have been applied to the other two cases.... In PAGE 11: ... For example in [7] a 19 Step 1 bit near collision for SHA-256 is reported which is obtained by using 23 GH local collisions. 8 Results The detailed differential paths for the cases of Table3 are shown in Table 6. The differential paths for the cases in Table 4 are shown in Tables 8 to 11 in Section C.... In PAGE 12: ... provides the probability of the differential path; and NIC provides the number of impossible conditions. The cases are from Table3 and 4. Case A is the GH local collision, rest are new local collisions.... In PAGE 13: ...Table3 . Probability calculations are done taking x to be 231 for SHA-256 and 263 for SHA-512.... ..."

### Table 3. Linear approximations for fMAJ(a, b, c), fIF(e, f, g) and the corresponding (x1, x2, x3, y1, y2, y3). Case A has been considered by Gilbert-Handschuh. It has one impossible condition each for both fMAJ and fIF . Cases B to E have one impossible condition for fMAJ and none for fIF .

"... In PAGE 6: ... There are four linear approximations of fIF which do not have any impossible conditions. In Table3 we consider the situation where fMAJ is approximated by zero and fIF is approximated by zero and the four other linear functions which do not have impossible conditions. From Table 2, we find that there are 16 possible combinations of linear approximations of fMAJ and fIF which do not have any impossible conditions.... In PAGE 7: ... On the other hand, the equations do have a pattern, which we have exploited to obtain solutions. We explain our method for k = 9 for Case B of Table3 . Similar methods have been applied to the other two cases.... In PAGE 11: ... For example in [7] a 19 Step 1 bit near collision for SHA-256 is reported which is obtained by using 23 GH local collisions. 8 Results The detailed differential paths for the cases of Table3 are shown in Table 6. The differential paths for the cases in Table 4 are shown in Tables 8 to 11 in Section C.... In PAGE 12: ... provides the probability of the differential path; and NIC provides the number of impossible conditions. The cases are from Table3 and 4. Case A is the GH local collision, rest are new local collisions.... In PAGE 13: ...Table3 . Probability calculations are done taking x to be 231 for SHA-256 and 263 for SHA-512.... ..."

### Table 1. Summary of the Previous Attacks and of Our New Attacks

2006

"... In PAGE 12: ... 5 Summary and Conclusions In this paper we have presented several new related-key impossible differential attacks on 7-round and 8-round AES-192. The data and time complexities are summarized in Table1 . Our attacks significantly improve the attacks presented in [12], but use different properties of the key schedule of AES-192.... ..."

Cited by 2

### Table 1: Complexities of some attacks on reduced-round SAFER ciphers.

"... In PAGE 17: ...This paper reports on an Impossible Differential analysis of reduced-round variants of some SAFER ciphers. A summary of the attack complexities is shown in Table1 , compared to Square attacks by Knudsen [5], and to Square attacks to SAFER+ and SAFER++ adapted by the authors. The ID attacks on SAFER ciphers demand too much memory and time.... ..."

### Table 2: Case of Impossible Partition

"... In PAGE 6: ... There are some cases that a data set can not be further partitioned. For example in the training set of Table2 , it is impossible for a classifier to split the first two records into two separate data sets since there all have identical attributes except the classifying attribute Lived. There is no classification rule that can explain why the two records have different class labels.... ..."

### Table 2: 16-round square-like characteristic of Skipjack

"... In PAGE 10: ... Using the observations we made in section 3, we build a square-like dis- tinguisher for the rounds 5-20, corresponding to the impossible differential found by Biham amp; al. Table2 shows the state of the different words after each round. We note the four words obtained after round i by the quadruplet (ai 0, ai 1, ai 2, ai 3); an active (respectively passive, balanced, garbled) word is de- noted by A (respectively p, b, .... ..."