Pairwise Independence of Ten-Round AES

What it is

Niu and Kai Hu (ePrint 2026/2608, received 23 October 2026, approved 24 October 2026) prove that ten-round AES is close to a pairwise independent permutation. The result is a preprint, and the page lists no peer review.

The statement is about pairs of plaintexts. For any two distinct plaintexts, the joint ciphertext distribution is within 3017/2^141 (below 2^-129) statistical distance of the uniform distribution on ordered pairs of distinct ciphertexts. Both encryptions use the same sampled key tuple.

How it works

The authors work with the averaged difference-distribution matrix of the ten-round permutation E10, restricted to the set Ω of nonzero differences. They bound its induced one-norm distance from U, the projection onto the uniform distribution on Ω, by 3017/2^140. Converting that to statistical distance gives the 3017/2^141 figure.

The proof groups the ten rounds into five superbox layers. It splits the deviation from uniformity into fourteen orthogonal subspaces, indexed by the number of active words and residual factors. Local Gram moments and MDS code constraints control the dependencies between word differences.

Bounds for the first rounds keep their common source variables. Joint estimates for the last four rounds keep the constraints across two linear layers. The final bound comes from exact rational evaluation of a finite recurrence.

Preconditions / Affected

The model is AES with independent, uniform random round keys and input and output whitening. It keeps the standard round transformations, including the omission of MixColumns in the final round. The page does not say whether the result extends to the real AES key schedule.

Caveats

• The guarantee covers pairs of plaintexts only. The page makes no claim about larger tuples of queries.
• The page gives no practical consequence, attack or recommendation for deployed AES.