Security of E2 against truncated differential cryptanalysis

This paper evaluates the security of the block cipher E2 against truncated differential cryptanalysis. We show an algorithm to search for effective tr uncated differentials. The result of the search confirmed that there exist no truncated differentials that lead to possible attacks for E2 with more t han 8 rounds. The best attack breaks an 8-round variant of E2 with either I T-Function (the initial transformation) or FT-Function (the final transform ation) using 2(94) chosen plaintexts. We also found the attack which distin guishes a 7-round variant of E2 with IT- and FT-Functions from a random per mutation using 2(91) chosen plaintexts.