Paper 2026/1865 Original: eprint.iacr.org/2026/1865 ↗

Polytopic Sieving: Practical Low-Data Key-Recovery Attacks on Reduced-Round AES

Abstract

Minimizing the data complexity required to recover the secret key of reduced-round block ciphers is a fundamental problem in symmetric cryptanalysis. Here, we introduce Polytopic Sieving, a data-efficient key-recovery framework and apply it to reduced-round AES. By characterizing the algebraic dependencies of anchor bytes (the reference state values that govern differential transitions across S-boxes), we show that cross-column and cross-row geometric consistency substantially restricts the realizable subkey space. We apply this framework to 4-round AES to achieve a practical key recovery using only 3 chosen plaintexts in $2^{40}$ time complexity or 4 chosen plaintexts in less than $2^{34}$ time complexity. This sets a new benchmark for data efficiency of polytopic attacks, and outperforms other recent techniques such as Subspace Trail Cryptanalysis and Mixture-Integral attacks on very low data targets. Furthermore, we extend our framework to a 5-round attack which requires only 10 plaintexts. By pairing our sieving with a dissected meet-in-the-middle approach, we can reduce both the data and time complexity over the previously best known polytopic attacks. These results establish the lowest data requirements known to date for practical key recovery on 4-round AES.