Improved meet-in-the-middle attacks on Crypton and mCrypton

This study presents several meet-in-the-middle attacks on reduced-round Crypton and mCrypton block ciphers. Using the generalised δ-set, the authors construct 5-round distinguishers on Crypton and mCrypton. Based on these distinguishers, the authors propose meet-in-the-middle attacks on 8-round Crypton and mCrypton-96/128. The attack on Crypton needs 2121 chosen plaintexts, 2132 encryptions and 2130 128-bit blocks; the attacks on mCrypton need 261 chosen plaintexts, 280 encryptions and 278 64-bit blocks. Furthermore, the attack can be extended to 9 rounds for mCrypton-128 with complexities of 261 chosen plaintexts, 2112 encryptions and 282 64-bit blocks.