Cryptology ePrint Archive: Report 2007/248  1. AES seems weak.
2. Linear time secure cryptography  Warren D. Smith  Abstract:
We describe a new simple but more powerful form of linear
cryptanalysis. It appears to break AES (and undoubtably other
cryptosystems too, e.g. SKIPJACK). The break is
``nonconstructive,'' i.e. we make it plausible (e.g. prove it in
certain approximate probabilistic models) that a small algorithm
for quickly determining AES-256 keys from plaintext-ciphertext
pairs exists -- but without constructing the algorithm. The
attack's runtime is comparable to performing $64^w$ encryptions
where $w$ is the (unknown) minimum Hamming weight in certain
binary linear error-correcting codes (BLECCs) associated with
AES-256. If $w < 43$ then our attack is faster than exhaustive
key search; probably $w < 10$. (Also there should be ciphertext-
only attacks if the plaintext is natural English.)  Even if this
break breaks due to the underlying models inadequately
approximating the real world, we explain ho