@article {24076,
	title = {Distinguishing attack on five-round Feistel networks},
	journal = {Electronic Letters},
	volume = {39},
	year = {2003},
	month = {08/2003},
	pages = {1175-1177},
	publisher = {IEE},
	abstract = {Recently it was shown (by J. Patarin) how to distinguish a general five-round Feistel network from a random permutation using O(23n/2) chosen plaintexts or O(27n/4) known plaintexts. The present authors report improvement of these results and a distinguisher is presented which uses roughly 2n\&nbsp;chosen plaintexts or roughly 23n/2\&nbsp;known plaintexts.},
	doi = {10.1049/el:20030768},
	author = {Knudsen, Lars and Raddum, H{\r a}vard}
}
@inproceedings {24063,
	title = {A Differential Attack on Reduced-Round SC2000},
	journal = {Selected Areas in Cryptography 2001},
	volume = {2259},
	year = {2001},
	month = {12/2001},
	pages = {190 - 198},
	publisher = {Lecture Notes in Computer Science, Springer Verlag},
	abstract = {SC2000 is a 128-bit block cipher with key length of 128, 192 or 256 bits, developed by Fujitsu Laboratories LTD. For 128-bit keys, SC2000 consists of 6.5 rounds, and for 192- and 256-bit keys it consists of 7.5 rounds. In this paper we demonstrate two different 3.5-round differential characteristics that hold with probabilities 2-106\&nbsp;and 2-107. These characteristics can be used to extract up to 32 bits of the first and last round keys in a 4.5-round variant of SC2000.},
	isbn = {978-3-540-43066-7},
	issn = {0302-9743},
	doi = {10.1007/3-540-45537-X_15},
	author = {Raddum, H{\r a}vard and Knudsen, Lars}
}
@inproceedings {24064,
	title = {On Noekeon},
	journal = {Second Open NESSIE workshop},
	year = {2001},
	month = {09/2001},
	publisher = {Royal Holloway Univerity of London},
	address = {London},
	abstract = {In this note we analyse Noekeon, a 128-bit block cipher submitted to the NESSIE project. It is shown that for six of seven S-boxes which satisfy the design criteria of the Noekeon designers the resulting block ciphers are vulnerable to either a differential attack, a linear attack or both. One conclusion is that Noekeon is not designed according to the wide trail strategy. Also, it is shown that there exist many related keys for which plaintexts of certain differences result in ciphertexts of certain differences with high probabilities. Noekeon has two key-schedules, one for applications where related-key attacks are not considered dangerous and one for applications where related-key attacks can be mounted. In this paper it is shown that for any given user-selected keys there are many related keys independently of which key-schedule is used.},
	author = {Raddum, H{\r a}vard and Knudsen, Lars}
}
