@misc{13577,
  author = {H{\r a}vard Raddum and Lars Knudsen},
  title = {On Noekeon},
  abstract = {In this note we analyse Noekeon, a 128-bit block cipher submitted to the NESSIE project. It is shown that for six of seven S-boxes which satisfy the design criteria of the Noekeon designers the resulting block ciphers are vulnerable to either a differential attack, a linear attack or both. One conclusion is that Noekeon is not designed according to the wide trail strategy. Also, it is shown that there exist many related keys for which plaintexts of certain differences result in ciphertexts of certain differences with high probabilities. Noekeon has two key-schedules, one for applications where related-key attacks are not considered dangerous and one for applications where related-key attacks can be mounted. In this paper it is shown that for any given user-selected keys there are many related keys independently of which key-schedule is used.},
  year = {2001},
  journal = {Second Open NESSIE workshop},
  month = {09/2001},
  publisher = {Royal Holloway Univerity of London},
  address = {London},
}