Cryptanalysis of C2

Julia Borghoff, Lars Ramkilde Knudsen, Gregor Leander, Krystian Matusiewicz

    Research output: Chapter in Book/Report/Conference proceedingArticle in proceedingsResearchpeer-review


    We present several attacks on the block cipher C2, which is used for encrypting DVD Audio discs and Secure Digital cards. C2 has a 56 bit key and a secret 8 to 8 bit S-box. We show that if the attacker is allowed to choose the key, the S-box can be recovered in 2^24 C2 encryptions. Attacking the 56 bit key for a known S-box can be done in complexity 2^48. Finally, a C2 implementation with a 8 to 8 bit secret S-box (equivalent to 2048 secret bits) and a 56 bit secret key can be attacked in 2^53.5 C2 encryptions on average.
    Original languageEnglish
    Title of host publicationAdvances in Cryptology - CRYPTO 2009 : 29th Annual International Cryptology Conference
    EditorsShai Halevi
    Number of pages692
    Place of PublicationBelin Heldelberg New York
    Publication date2009
    ISBN (Print)978-3-642-03355-1
    Publication statusPublished - 2009
    EventCRYPTO - Santa Barbara, California, USA
    Duration: 1 Jan 2009 → …


    CitySanta Barbara, California, USA
    Period01/01/2009 → …


    • block cipher
    • boomerang attack
    • key recovery
    • Cryptomeria
    • C2
    • S-box recovery


    Dive into the research topics of 'Cryptanalysis of C2'. Together they form a unique fingerprint.

    Cite this