Note: This attack requires a large amount of RAM. They may have saved a few operations, but they increased the total cost by many orders of magnitude over a brute-force search because they need a larger machine.
Also note: An attack taking 2^126.1 operations to break AES-128 is not 2^1.9 times faster than brute force; it's 2^0.9 times faster than brute force. A brute force search on a 128-bit key takes on average 2^127 operations.
In short, this is definitely in the "interesting new method to explore" column rather than the "interesting attack" column.
Also note: An attack taking 2^126.1 operations to break AES-128 is not 2^1.9 times faster than brute force; it's 2^0.9 times faster than brute force. A brute force search on a 128-bit key takes on average 2^127 operations.
I'm confused (though admittedly I haven't read the paper fully and don't have any background in cryptanalysis, so I guess it's not surprising that I'm confused). It looks like 2^126.1 is a worst-case complexity for this attack, so it makes sense to compare that complexity to the worst-case complexity of a brute force attack, doesn't it?
My understanding was that was an average complexity for the attack. It's possible that I misunderstood it, though -- I didn't read the paper in detail.
"Note: This attack requires a large amount of RAM. They may have saved a few operations, but they increased the total cost by many orders of magnitude over a brute-force search because they need a larger machine."
Is this terribly relevant though? Deep Crack was a quarter of a million dollars (90s dollars) as I recall.
Yes. The entire concept of cryptanalysis revolves around cost factors. It is very relevant when a new avenue of attack costs more than brute force in its best known mode of implementation.
That doesn't make the research a dead end, but it further reduces the relevance of this work to engineers.
It depends on whether "a large amount of RAM" means "a quarter of a million dollars' worth of RAM" or "an amount of RAM substantially larger than the Milky Way galaxy".
I don't know the details of the attack, but the article says, "AES-128 is more like AES-126", so you should therefore need 2^125 operations in average, which is 4 times faster.
On the other hand, I may be wrong... do you mind linking to the original source?
Also note: An attack taking 2^126.1 operations to break AES-128 is not 2^1.9 times faster than brute force; it's 2^0.9 times faster than brute force. A brute force search on a 128-bit key takes on average 2^127 operations.
In short, this is definitely in the "interesting new method to explore" column rather than the "interesting attack" column.