Boomerang Attack
The boomerang attack, introduced by Wagner, chains two short differential characteristics through a "boomerang" switch into a long differential path, breaking past the round limit of a single characteristic.
Purpose
It builds longer distinguishers for ciphers whose differential characteristics cover only part of the rounds by splicing two differential segments.
Mechanism
Split the cipher into upper and lower halves, each covered by one differential characteristic; a four-step encrypt-decrypt-encrypt-decrypt "boomerang" constructs pairs whose middle differences match, with probability equal to the square of the two characteristics’ probabilities times a correction factor.
Use cases
- Reduced-round AES attacks
- Differential evaluation of block ciphers
- Cipher competition analysis