Impossible differential attack on 13-round Camellia-192

• We analyze the security of Camellia in the impossible differential context.
• We improve the complexity of the impossible differential attacks on 12 rounds of Camellia-192 and 14 rounds of Camellia-256.
• We present the first attack on 13 rounds of Camellia-192.

In this paper, we study the security of the block ciphers Camellia-192 and Camellia-256 in the impossible differential context. In particular, we present the first attack on 13 rounds of Camellia-192 with FL/FL−1FL/FL−1 layers. An attack on 14 rounds of Camellia-256 requiring less complexity than the previous impossible differential attacks is also described.