A meet-in-the-middle attack on reduced-round ARIA

In this paper, the meet-in-the-middle attack against block cipher ARIA is presented for the first time. Some new 3-round and 4-round distinguishing properties of ARIA are found. Based on the 3-round distinguishing property, we can apply the meet-in-the-middle attack with up to 6 rounds for all versions of ARIA. Based on the 4-round distinguishing property, we can mount a successful attack on 8-round ARIA-256 for the first time. Furthermore, the 4-round distinguishing property could be improved which leads to a 7-round attack on ARIA-192. Compared with the existing cryptanalytic results on ARIA, the meet-in-the-middle attack has a huge precomputation and memory complexities. However, we can do the precomputation once and for all. These results show that 8-round ARIA-256 is not immune to the meet-in-the-middle attack.

► The first meet-in-the-middle attack against block cipher ARIA is presented.
► Some new 3-round and 4-round distinguishing properties of ARIA are found.
► We can attack 6-round ARIA-128, 7-round ARIA-192 and 8-round ARIA-256.
► This is the first attack on 8-round ARIA-256.