Impossible differentials in Twofish
Niels Ferguson · 1999
We show how an impossible-differential attack, first applied to DEAL by Knudsen, can be applied to Twofish. This attack breaks six rounds of the 256-bit key version using 2^256 steps; it cannot be extended to seven or more Twofish rounds.