Loïc Rouquette
email: loic.rouquette@insa-lyon.fr

David Gerault
email: dagerault@gmail.com

Marine Minier
email: marine.minier@loria.fr

Christine Solnon
email: christine.solnon@insa-lyon.fr

David Gérault

And Rijndael?

Keywords: Automatic Related-key Differential Analysis of Rijndael Related-key differential characteristics, Constraint Programming (CP), Automatic Tools, Rijndael

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cryptanalysis aims at finding non-random properties and distinguishers against classical cryptographic primitives. In particular, differential cryptanalysis [START_REF] Biham | Differential cryptoanalysis of feal and n-hash[END_REF] is a powerful tool against block and stream ciphers. It studies the propagation of the difference δX = X⊕X between two plaintexts X and X through the cipher E or a part of the cipher, where ⊕ is the exclusive OR (xor). If the distribution of the output difference δC = E K (X)⊕E K (X ) is non uniform over all the keys K, then an adversary has a distinguisher and can exploit this non-uniformity to guess part of the key K faster than exhaustive search. Most of the times, the distinguisher is constructed on a reduced number of rounds. Today, differential cryptanalysis is a public knowledge, and block ciphers have proven security bounds against differential attacks. Hence, [START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF] proposed to consider differences not only between the plaintexts X and X but also between the keys K and K to mount related-key attacks. In this case, the cryptanalyst is interested in finding optimal related-key differentials, i.e., input and output differences that maximize the probability of obtaining the output difference given the input difference. In other words, we search for δX, δK, and δC that maximize the probability that δC is equal to E K (X) ⊕ E K⊕δK (X ⊕ δX) for a plaintext X and a key K.

Finding an optimal related-key differential characteristic is a highly combinatorial problem that hardly scales. To simplify this problem, Knudsen [START_REF] Knudsen | Truncated and higher order differentials[END_REF] introduced truncated differential characteristics where byte or nibble differences are abstracted by single bits that indicate if there is a difference at a given position or not. Thus, the search for related-key differential characteristics is divided into two steps as done in [START_REF] Biryukov | Automatic search for related-key differential characteristics in byte-oriented block ciphers: Application to aes, camellia, khazad and others[END_REF][START_REF] Fouque | Structural evaluation of AES and chosen-key distinguisher of 9-round AES-128[END_REF]. In Step 1, each byte or nibble difference is abstracted by a Boolean value and the aim of this step is to find the trail which minimizes the number of active S-boxes. The goal here is to find the positions of the differences. Then, for each solution found at Step 1, Step 2 aims at instantiating each Boolean value into a valid byte or nibble difference while maximizing the overall probability of the differential characteristic crossing the S-boxes. However, some truncated differential characteristics found at

Step 1 may not be valid (i.e., there do not exist byte or nibble values corresponding to these difference positions). Scaling from the AES to Rijndael can only be made with a tight model for Step 1. Models described in [START_REF] Biryukov | Automatic search for related-key differential characteristics in byte-oriented block ciphers: Application to aes, camellia, khazad and others[END_REF][START_REF] Fouque | Structural evaluation of AES and chosen-key distinguisher of 9-round AES-128[END_REF] do not scale when increasing the block size and the key size. Only the model described in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] has a sufficiently small number of solutions found at Step 1 to hope that the computational time will be reasonable.

In this paper, we show how to adapt the two-step solving process of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] dedicated to the AES to compute optimal related-key differential characteristics for Rijndael [START_REF] Daemen | Aes proposal: Rijndael[END_REF]. Both steps are solved with Constraint Programming (CP) solvers5 : Picat-SAT for Step 1 and Choco for Step 2. We improve the approach of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] by better interleaving Steps 1 and 2 and exploiting bounds to stop the search sooner. We also improve the Step 2 process of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] by decomposing the constraints associated with MixColumns. These improvements allow us to compute the optimal differential characteristics for all Rijndael instances but one within a reasonable amount of time.

Rijndael is a family of block ciphers (more precisely it is composed of 25 instances of the same cipher where the block size and the key size vary) originally proposed at the AES competition. But the NIST only retained as a standard its 128-bit-block version under the key sizes 128, 192 and 256 bits. Studying the security of Rijndael is interesting to enlighten the AES standardization process. Among the most interesting results, we obtain a 12-round (over 13 rounds) related-key differential distinguisher and a 12-round (over 13 rounds) attack for Rijndael with a block size equal to 128 bits and a key size equal to 224 bits. We also obtain an 11-round related-key differential distinguisher for Rijndael with a block size equal to 160 bits and a key size equal to 256 bits leading to an attack on 12 rounds out of 14.

When looking at the state of the art concerning the cryptanalysis of Rijndael, some of the results are in the single key scenario [START_REF] Nakahara | Impossible-differential attacks on largeblock rijndael[END_REF][START_REF] Zhang | Improved impossible differential attacks on large-block rijndael[END_REF][START_REF] Galice | Improving integral attacks against rijndael-256 up to 9 rounds[END_REF], [START_REF] Wang | Improved impossible differential attacks on large-block rijndael[END_REF][START_REF] Minier | Improving impossible-differential attacks against rijndael-160 and rijndael-224[END_REF][START_REF] Liu | Improved impossible differential cryptanalysis of large-block rijndael[END_REF] or in the related-key scenario [START_REF] Wang | Related-key rectangle cryptanalysis of rijndael-160 and rijndael-192[END_REF] and none of those attacks exceeds 10 rounds.

The rest of this paper is organized as follows: in Section 2, we recall the full description of Rijndael; in Section 3, we detail the methods and our CP models. in Section 4, we sum up all the related-key differential characteristics distinguishers we obtained, give all resolution times and compare them with those of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF]; in Section 5, we present two attacks based on the most efficient distinguishers and finally, in Section 6, we conclude this paper.

Rijndael

Rijndael-C len -K len (where C len is the block size and K len is the key size) is a set of 25 different SPN block ciphers designed by Joan Daemen and Vincent Rijmen [START_REF] Daemen | The design of Rijndael: AES -the advanced encryption standard[END_REF]. Each instance varies according to the block size (128,160,192,224 or 256 bits) and to the key size (128,160,192,224 or 256 bits) but the ciphering process is the same for all variants, except for the ShiftRows operation (given in Table 1) and the number of rounds (given in Table 2). It has been chosen as the new advanced encryption standard by the NIST [1] with a 128-bit block size and a key length that can be set to 128, 192 or 256 bits. The number of rounds N r depends on the text size C len and on the key size K len and varies between 10 and 14. For all the versions, the current block at the input of the round i is represented by a 4 × N b matrix of bytes X i where N b = (C len /32) is the number of columns and where each byte at row j and column k is denoted by

X i [j, k].
The round function, repeated N r -1 times, involves four elementary mappings, all linear except the first one. Round i consists of the following transformations: SubBytes. A bytewise transformation is applied on each byte of the current block using an 8-bit to 8-bit non linear S-box, denoted by SBOX:

SX i [j, k] = SBOX(X i [j, k]), ∀j ∈ [0, 3], ∀k ∈ [0, N b -1]. ShiftRows.
A linear mapping rotates to the left all the rows of the current matrix SX i . The values of the shifts denoted

P N b (given in Table 1) depend on N b : Y i [j, k] = SX i [j, (P N b [j] + k) mod N b ], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1].
MixColumns is a linear multiplication of each column of the current state by a constant matrix M in the Galois field GF (2 8 ), that provides the corresponding column of the new state. For a given column k ∈ [0, N b -1], if we denote by ⊗ the multiplication in GF(2 8 ), we have:

Z i [l, k] = j∈[0,3] M [l, j] ⊗ Y i [j, k]
with M the 4 × 4 circulant matrix defined by its first row = [2, 3, 1, 1] AddRoundKey performs a bitwise xor between the subkey RK i of round i and the current state

Z i : X i+1 [j, k] = Z i [j, k] ⊕ RK i [j, k], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1].
The subkeys RK i are generated from the master key K using a KeySchedule algorithm composed of byte shifting, SBOX substitutions and xors which is fully Algorithm 1: Rijndael KeySchedule function described in Algorithm 1.We denote by N k =K len /32 the number of columns of the master key K. Note that each subkey RK i is extracted from a main register W K in the following way:

input : A key matrix K of [4; N k ] bytes output: The expanded key WK of [4; N b × (Nr + 1) -1] bytes for k ∈ [0, N b ] and j ∈ [0, 3] do WK[j, k ] ← K[j, k ] ; for k ∈ [N b , N b × (Nr + 1) -1] do if k mod N k = 0 then WK[0, k ] = WK[0, k -N k ] ⊕ SBOX(WK[1, k -1 ]) ⊕ RCi ; for j ∈ [1, 3] do WK[j, k ] = WK[j, k -N k ] ⊕ SBOX(WK[(j + 1) mod 4, k -1 ]) ; else if k > 6 ∧ k mod N k = 4 then for j ∈ [0, 3] do WK[j, k ] = WK[j, k -N k ] ⊕ SBOX(WK[j, k -1 ]); else for j ∈ [0, 3] do WK[j, k ] = WK[j, k -N k ] ⊕ WK[(j + 1) mod 4, k -1 ] ; return WK Row 0 1 2 3 P128 0 1 2 3 P160 0 1 2 3 P192 0 1 2 3 P224 0 1 2 4 P256 0 1 3 4
RK i [j, k] = W K[j, (i + 1) × N b + k], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1].
Those N r -1 rounds are surrounded at the top by an initial key addition with the subkey RK 0 and at the bottom by a final transformation composed by a call to the round function where the MixColumns operation is omitted.

Our notations are summarized below.

-X i : the state at the beginning of round i. Note that X i is also the state after applying the AddRoundKey function on the previous round X i-1 ; -SX i : the state of round i, after applying SubBytes; -Y i : the state of round i, after applying ShiftRows; -Z i : the state of round i, after applying MixColumns.

-RK i : the subkey of round i.

The Solving Process

In this section, we describe how to compute the optimal related-key differential characteristics for Rijndael by adapting and improving the approach introduced in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] for the AES. We first recall some basic principles of CP; then we describe the two-step solving process; finally, we describe the CP models associated with each of these two steps.

Constraint Programming

CP is a generic framework for solving Constraint Satisfaction Problems (CSPs), i.e., finding an assignment of values to variables such that (i) each variable is assigned to a value that belongs to its domain, and (ii) a given set of constraints is satisfied. Each constraint is a relation between some variables which restricts the set of values that may be assigned simultaneously to these variables. This relation may be defined in intention, by using mathematical operators, or in extension, by listing all allowed tuples. For example, let us consider the constraint that ensures that the sum of three variables x 1 , x 2 , and x 3 is different from 1. This constraint may be defined in intention by using operators + and =: x 1 + x 2 + x 3 = 1 or it may be defined in extension by using a table constraint:

x 1 , x 2 , x 3 ∈ T sum =1
where T sum =1 is a table which enumerates every triple of values the sum of which is different from 1. For example, if the domain of x 1 , x 2 , and x 3 is {0, 1}, then T sum =1 contains the following triples: 0, 0, 0 , 0, 1, 1 , 1, 0, 1 , 0, 1, 1 , and 1, 1, 1 .

CP may also be used to solve Constrained Optimisation Problems (COPs), i.e., CSPs with an additional objective function that must be optimised. CSPs and COPs are defined by using a modelling language such as MiniZinc [START_REF] Nethercote | Minizinc: Towards a standard CP modelling language[END_REF]. Then, they can be solved by CP solvers such as, Choco [START_REF] Prud'homme | Choco Documentation[END_REF], Gecode [START_REF] Vaudenay | Gecode: Generic constraint development environment[END_REF], Chuffed [START_REF] Chu | Chuffed solver description[END_REF], or Picat-SAT [START_REF] Zhou | The picat-sat compiler[END_REF]. We refer the reader to [START_REF] Rossi | Handbook of Constraint Programming (Foundations of Artificial Intelligence)[END_REF] for more details on CP.

SAT is a special case of CSP, where all variables have boolean domains and all constraints are logical formulae (clauses). Also, MILPs (Mixed Integer Linear Programs) are special cases of COPs where all variables have numerical domains, constraints are linear inequalities, and the objective function is linear. To compute differential characteristics with SAT or MILP solvers, it is necessary to model the problem by means of logical formulae (for SAT) or linear inequalities (for MILP). In particular, the non linear DDT associated with an S-box must be represented by a large number of clauses (for SAT) or inequalities (for MILP), and the resulting models hardly scale [START_REF] Abdelkhalek | MILP modeling for (large) s-boxes to optimize probability of differential characteristics[END_REF][START_REF] Liu | Security analysis of SKINNY under related-tweakey settings (long paper)[END_REF][START_REF] Sun | More accurate differential properties of LED64 and midori64[END_REF].

When using CP, constraints do not need to be linear and DDTs are modelled in a straightforward way by using table constraints. In particular, [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] recently showed that CP solvers can compute optimal differential characteristics very efficiently and outperform the dedicated approaches of [START_REF] Biryukov | Automatic search for related-key differential characteristics in byte-oriented block ciphers: Application to aes, camellia, khazad and others[END_REF] and [START_REF] Fouque | Structural evaluation of AES and chosen-key distinguisher of 9-round AES-128[END_REF] for the AES.

Algorithm 2: Computation of optimal related-key differential characteristics for Rijndael.

Input: The size K len of the key, the size C len of the block and the number r of rounds Output: An optimal related-key differential characteristic S * begin NB SBOX ← Step1-opt(N k , N b , r) where N k =K len /32 and N b =C len /32

UB ← 2 -6•NBSBOX LB ← 0 while LB < UB do S1 ← Step1-next(N k , N b , r, NB SBOX) if S1 = null then S2 ← Step2(N k , N b , r, LB, S1) if S2 = null then S * ← S2 LB ← probability of S2 else NB SBOX ← NB SBOX + 1 UB ← 2 -6•NBSBOX return S *

Two-step solving process

Finding the best related-key differential characteristic is a highly combinatorial problem. To improve the scalability of the attack, Knudsen has introduced truncated differentials [START_REF] Knudsen | Truncated and higher order differentials[END_REF]. The core idea is to solve the problem in two steps: In Step 1, we compute a truncated differential characteristic S 1 where each differential byte δA of the ciphering process is replaced with a boolean variable ∆A that indicates whether δA contains a difference or not (i.e., ∆A = 0 ⇐⇒ δA = 0 and ∆A = 1 ⇐⇒ δA ∈ 1, 2 8 -1 ); In Step 2, we instantiate S 1 into a differential characteristic S 2 : for each boolean variable ∆A, if ∆A is equal to 0 in S 1 , then δA is equal to 0 in S 2 ; otherwise δA must belong to 1, 2 8 -1 . Note that some truncated characteristics cannot be instantiated to a characteristic because some abstractions are done at Step 1.

As SBOX is the only non-linear operation, the probability of a differential characteristic only depends on the values of the differential bytes that pass through S-boxes, under the Markov assumption that rounds are independent. We denote δ SB this set of bytes (including those in the key schedule), and ∆ SB the corresponding set of boolean variables.

A theoretical upper bound on the probability of the best differential characteristic may be computed by searching for the truncated differential characteristic which minimises the number of active S-boxes

NB SBOX = #{∆A | ∆A ∈ ∆ SB ∧ ∆A = 1}. As 2 -6
is the maximal differential probability of the Rijndael SBOX, the best probability is upper bounded by UB = 2 -6•NBSBOX .

UB may be larger than the actual best probability because it may be possible that the best truncated differential characteristic cannot be instantiated into a differential characteristic, or because some non null differential bytes that go through S-boxes have a probability equal to 2 -7 instead of 2 -6 . Hence, the best differential characteristic is searched by alternating Step 1 and Step 2 in an iterative process which is described in Algorithm 2. First, we call Step1-opt to compute NB SBOX , a lower bound of the number of active S-boxes in a truncated differential, and this number is used to compute a first upper bound UB on the probability. The lower bound LB on the probability is initialised to 0. Then, at each iteration of the while loop, we call Step1-next to compute the next truncated differential characteristic with NB SBOX active S-boxes: each time this function is called, it returns a new Step 1 solution with NB SBOX active S-boxes until they all have been computed (in this latter case, Step1-next returns null). If a new Step 1 solution S 1 has been computed, then Step2 is called to search for the differential characteristic S 2 corresponding to S 1 whose probability is larger than LB and maximal: if such a characteristic exists, then the best characteristic S * is updated to S 2 and LB is updated to the probability of S 2 . When Step1-next returns null, all truncated characteristics with NB SBOX active S-boxes have been enumerated. In this case, we increment NB SBOX and update consequently the upper bound UB. We stop iterating when UB becomes smaller than or equal to LB: in this case S * is equal to the optimal differential characteristic.

Algorithm 2 is different from the one used in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF]: it avoids computing useless Step 1 solutions by updating LB and UB and stopping the process when LB ≥ UB . Step1-opt, Step1-next and Step2 are implemented with CP solvers and the corresponding CP models are described in the next two sections.

Step 1

Both Step1-opt and Step1-next compute truncated differential characteristics: Step1-opt searches for the truncated characteristic that minimises NB SBOX , whereas Step1-next searches for the next truncated characteristic given NB SBOX . Both problems share the same constraints which are described in this section. Step1opt is a COP which is obtained by adding the objective function: minimise NB SBOX . Step1-next is a CSP which is obtained by assigning the variable NB SBOX to the optimal solution of Step1-opt.

A key point for Algorithm 2 to be efficient is to avoid as much as possible computing truncated characteristics which cannot be instantiated at Step 2. To this aim, we consider the model introduced in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] which is tighter than the model of [START_REF] Gérault | Constraint programming models for chosen key differential cryptanalysis[END_REF], i.e., it computes fewer truncated characteristics that cannot be instantiated at Step 2. This model has been defined for the AES, and we show in this section how to extend it to Rijndael. However, this simple model generates many truncated characteristics which cannot be instantiated at Step 2. This mainly comes from the fact that xors performed by AddRoundKey and KeySchedule are modelled by constraints which simply prevent the sum of differences to be equal to 1. Thus, we show how to refine this in the next two paragraphs.

Constraints Associated with Rijndael

Inference of new XOR equations from the KeySchedule. In Model 1, every xor equation δA ⊕ δB ⊕ δC = 0 is represented by a sum constraint ∆A + ∆B + ∆C = 1. This simple model is not sharp enough and generates a lot of truncated solutions that cannot be instantiated at Step 2. For example, the two xor equations δA ⊕ δB ⊕ δC = 0 and δB ⊕ δC ⊕ δD = 0 are represented by the two sum constraints ∆A + ∆B + ∆C = 1 and ∆B + ∆C + ∆D = 1 . When reasoning at the byte level, we easily infer that we cannot have δA = 0 and δD = 0, whatever the values of δB and δC are. However, when reasoning at the boolean level, the two sum constraints may be satisfied when ∆A = 0 and ∆D = 1 (e.g., when ∆B = ∆C = 1).

To sharpen the Step 1 model and reduce the number of Step 1 solutions that cannot be instantiated at Step 2, we generate new xor equations from the initial set of equations, by xoring them. These new equations do not change the set of solutions at the byte level. However, at the boolean level, they remove some of the truncated solutions that cannot be instantiated at Step 2. For example, when xoring the two xor equations of our previous example, we obtain the equation δA ⊕ δD = 0. When adding the constraint ∆A + ∆D = 1 to the two sum constraints, we prevent the search from generating solutions with ∆A = 0 and ∆D = 1.

This trick has been introduced in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] for the AES, and we extend it to Rijndael in a straightforward way. More precisely, we consider the set of all xor equations coming from the KeySchedule (this set corresponds to Constraint (A7) of Model 1). From this set, we generate all possible equations that involve no more than 4 variables by recursively xoring these equations 6 . This set of new equations is denoted ExtXOR.

Introduction of diff variables. As done in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF], we also introduce diff variables to reason on differences at the byte level: every variable diff A,B is a boolean variable which is true if δA = δB, and false otherwise. diff variables are associated with variables involved in the KeySchedule, in AddRoundKey and in MixColumns. This new Model is presented in Model 2.

Each variable diff A,B is related with ∆A and ∆B by ensuring: diff A,B + ∆A + ∆B = 1. In other words, diff A,B = 0 whenever ∆ A = ∆ B = 0 and diff A,B = 1 whenever ∆ A = ∆ B . This corresponds to Constraints (E1) (for KeySchedule) and (E2) (for the MixColumns). These constraints also ensure symmetry, i.e., diff A,B = diff B,A . Constraints (E3) and (E4) ensure transitivity (i.e., if δA = δB and δB = δC, then δA = δC) by constraining the sum of the corresponding diff variables to be different from 1.

Constraint (E5) relates diff variables associated with the subkey RK i with diff variables associated with the expanded key WK.

Constraints (E6) and (E7) are associated with the new xor equations in Ex-tXOR. Two cases are considered: equations with three variables in Constraint (E6), and equations with four variables in Constraint (E7). In both cases, if at least one variable involved in the equation belongs to ∆ SB , then the constraint simply prevents the sum of the variables to be equal to 1. Otherwise, we exploit diff variables to tighten the constraint.

Finally, Constraints (E8) and (E9) ensure the MDS property of MixColumns on differences between pairs of columns (this constraint is partly equivalent with the linear incompatibility of [START_REF] Fouque | Structural evaluation of AES and chosen-key distinguisher of 9-round AES-128[END_REF]). Indeed, the MDS property holds between each input and output column before and after applying MixColumns but it also holds when xoring different columns. More precisely, if i 1 , i 2 ∈ [0, r -2] are two round numbers, and k 1 , k 2 ∈ [0, 3] are two column numbers, for every row j ∈ [0, 3], we have

δZ i1 [j][k 1 ] ⊕ δZ i2 [j][k 2 ] = 3 l=0 M [j][l] • δY i1 [l][k 1 ] ⊕ 3 l=0 M [j][l] • δY i2 [l][k 2 ] = 3 l=0 M [j][l] • (δY i1 [l][k 1 ] ⊕ δY i2 [l][k 2 ])
Therefore, the MDS property also holds for the result of the xor of two different columns. This is modelled by Constraint (E8). This constraint removes many Step 1 solutions that cannot be instantiated at Step 2. In a rather similar way, Constraint (E9) is derived by xoring equations coming from AddRoundKey.

∀ω1, ω2 ∈ [0, N b × (Nr + 1) -1], ∀j ∈ [0, 3] where ω2 > ω1 (E1) diff WK [j,ω 1 ],WK [j,ω 2 ] + ∆WK [j, ω1] + ∆WK [j, ω2] = 1 diff WK [j,ω 1 ],WK [j,ω 2 ] = diff WK [j,ω 2 ],WK [j,ω 1 ] ∀i1, i2 ∈ [0, Nr -2], ∀j ∈ [0, 3], ∀k1, k2 ∈ [0, N b -1] where (i2, k2) > (i1, k1) (E2) diff Y i 1 [j,k 1 ],Y i 2 [j,k 2 ] + ∆Yi 1 [j, k1] + ∆Yi 2 [j, k2] = 1 diff Y i 1 [j,k 1 ],Y i 2 [j,k 2 ] = diff Y i 2 [j,k 2 ],Y i 1 [j,k 1 ] diff Z i 1 [j,k 1 ],Z i 2 [j,k 2 ] + ∆Zi 1 [j, k1] + ∆Zi 2 [j, k2] = 1 diff Z i 1 [j,k 1 ],Z i 2 [j,k 2 ] = diff Z i 2 [j,k 2 ],Z i 1 [j,k 1 ] ∀ω1, ω2, ω3 ∈ [0, N b × (Nr + 1) -1], ∀j ∈ [0, 3] where ω3 > ω2 > ω1 (E3) diff WK [j,ω 1 ],WK [j,ω 2 ] + diff WK [j,ω 1 ],WK [j,ω 3 ] + diff WK [j,ω 2 ],WK [j,ω 3 ] = 1 ∀i1, i2, i3 ∈ [0, Nr -2], ∀j ∈ [0, 3], ∀k1, k2, k3 ∈ [0, N b -1] where (i3, k3) > (i2, k2) > (i1, k1) (E4) diff Y i 1 [j,k 1 ],Y i 2 [j,k 2 ] + diff Y i 2 [j,k 2 ],Y i 3 [j,k 3 ] + diff Y i 3 [j,k 3 ],Y i 1 [j,k 1 ] = 1 diff Z i 1 [j,k 1 ],Z i 2 [j,k 2 ] + diff Z i 2 [j,k 2 ],Z i 3 [j,k 3 ] + diff Z i 3 [j,k 3 ],Z i 1 [j,k 1 ] = 1 ∀i1, i2 ∈ [0, Nr -1], ∀j ∈ [0, 3], ∀k1, k2 ∈ [0, N b -1] (E5) diff RK i 1 [j,k 1 ],RK i 2 [j,k 2 ] = diff WK [j,(i 1 +1)×N b +k],WK [j,(i 2 +1)×N b +k]
For each equation

δ B1 ⊕ δ B2 ⊕ δ B3 = 0 in ExtXOR, (E6) if {∆ B1 , ∆ B2 , ∆ B3 } ∩ ∆ SB = ∅ then ∆ B1 + ∆ B2 + ∆ B3 = 1 if {∆ B1 , ∆ B2 } ∩ ∆ SB = ∅ then diff B1,B2 = ∆ B3 if {∆ B2 , ∆ B3 } ∩ ∆ SB = ∅ then diff B2,B3 = ∆ B1 if {∆ B1 , ∆ B3 } ∩ ∆ SB = ∅ then diff B1,B3 = ∆ B2 For each equation δ B1 ⊕ δ B2 ⊕ δ B3 ⊕ δ B4 = 0 in ExtXOR, (E7) if {∆ B1 , ∆ B2 , ∆ B3 , ∆ B4 } ∩ ∆ SB = ∅ then ∆ B1 + ∆ B2 + ∆ B3 + ∆ B4 = 1 else diff B1,B2 = diff B3,B4 diff B1,B3 = diff B2,B4 diff B1,B4 = diff B2,B3 ∀i1, i2 ∈ [0, Nr -2], ∀k1, k2 ∈ [0, N b -1] where (i2, k2) > (i1, k1) (E8) j∈[0,3] diff Y i 1 [j,k 1 ],Y i 2 [j,k 2 ] + j∈[0,3] diff Z i 1 [j,k 1 ],Z i 2 [j,k 2 ] ∈ {0, 5, 6, 7, 8} ∀i1, i2 ∈ [0, Nr -2], ∀j ∈ [0, 3], ∀k1, k2 ∈ [0, N b -1] where (i2, k2) > (i1, k1) (E9) diff RK i 1 [j,k 1 ],RK i 2 [j,k 2 ] + diff Z i 1 [j,k 1 ],Z i 2 [j,k 2 ] + ∆Xi 1 +1[j, k1] + ∆Xi 2 +1[j, k2] = 1
Model 2: Additional constraints for the refined Step 1 model for Rijndael.

Incomplete

Step 1 solutions. As pointed out in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF], some AES instances have a huge number of Step 1 solutions. Many of these solutions have exactly the same values for the boolean variables in ∆ SB (corresponding to S-boxes), and they only differ on values of other boolean variables (that do not correspond to S-boxes). For example, when the key has 192 bits and the number of rounds is equal to 10, there are 27,548 different Step 1 solutions. However, there are only 7 different assignments of values to the variables in ∆ SB . As Rijndael is a generalisation of the AES, this is also true for Rijndael. Hence, as proposed in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF], we enumerate incomplete solutions such that only the variables in ∆ SB are assigned.

Step 2

Given a Step 1 solution (corresponding to a truncated characteristic), Step 2 aims at searching for the corresponding characteristic which has the largest probability, and such that this largest probability is larger than the best probability found so far (LB).

The CP model used to solve Step 2 is described in Model 3. For each boolean variable ∆A of Step 1, this model uses an integer variable δA to represent the corresponding differential byte. If this byte passes through an S-box (i.e., δA ∈ δ SB ), then the initial domain of δA depends on the value of ∆A in the Step 1 solution: If ∆A = 0, then δA is assigned to 0; Otherwise the domain of δA is 1, 255 . For each variable δA ∈ δ SB , the domain of δA is 0, 255 as the associated boolean variable ∆A is not assigned in the Step 1 solution.

SBOX. We introduce new variables in order to represent probabilities associated with S-boxes. More precisely, for each byte δA ∈ δ SB that passes through an S-box, we introduce an integer variable p A . This variable represents the binary logarithm of the probability to observe the output difference δSA given the input difference δA. We consider the binary logarithm of the probability (instead of the probability), in order to avoid rounding errors. As the probability for Rijndael S-boxes is 0, 2 -7 , 2 -6 , or 1, and as we only consider values with non null probabilities, the values that may be assigned to p A are -7, -6, and 0. Constraint (C2) of Model 3 relates input differences, output differences and probabilities for the S-boxes applied on the plaintext, whereas Constraint (C9) relates them for the S-boxes in the KeySchedule. In both cases, we use a table constraint which ensures that the triple of variables belongs to a table denoted T SBOX : This table contains a triple δ in , δ out , p for each couple of differential bytes (δ in , δ out ) such that the DDT content for (δ in , δ out ) is different from 0, and such that p is equal to: log 2 ( #{(X,X )∈ 0,255 2 |(X⊕X =δin)∧(SBOX(X)⊕SBOX(X )=δout)}

256

).

Objective function. We introduce an integer variable obj to represent the binary logarithm of the probability of the differential characteristic. The objective function is: maximise obj. The actual probability is computed as 2 obj .

obj = δA∈δ SB p A (C1) obj > LB ∀i ∈ [0, Nr -1], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1], (C2) δXi[j, k], δSX i[j, k], p X i [j, k] ∈ TSBOX ∀i ∈ [0, Nr -1], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1], (C3) δYi[j, k] = δSX i[j, P N b [j] + k mod N b ] ∀i ∈ [0, Nr -1], ∀k ∈ [0, N b -1], ∀j ∈ [0, 3], ∀v ∈ {2, 3} (C4) δYi[j, k], vδYi[j, k] ∈ TMULv ∀i ∈ [0, Nr -1], ∀k ∈ [0, N b -1], (C5) 2δYi[0, k], 3δYi[1, k], ai[k] ∈ T⊕ δYi[2, k], δYi[3, k], bi[k] ∈ T⊕ ai[k], bi[k], δZi[0, k] ∈ T⊕ δYi[0, k], 2δYi[1, k], ci[k] ∈ T⊕ 3δYi[2, k], δYi[3, k], di[k] ∈ T⊕ ci[k], di[k], δZi[1, k] ∈ T⊕ δYi[0, k], δYi[1, k], ei[k] ∈ T⊕ 2δYi[2, k], 3δYi[3, k], fi[k] ∈ T⊕ ei[k], fi[k], δZi[2, k] ∈ T⊕ 3δYi[0, k], δYi[1, k], gi[k] ∈ T⊕ δYi[2, k], 2δYi[3, k], hi[k] ∈ T⊕ gi[k], hi[k], δZi[3, k] ∈ T⊕ ∀i ∈ [0, Nr -1], ∀k ∈ [0, N b -1], ∀j ∈ [0, 3], ∀v ∈ {9, 11, 13, 14} (C6) δZi[j, k], vδZi[j, k] ∈ TMULv ∀i ∈ [0, Nr -1], ∀k ∈ [0, N b -1], (C7) 14δZi[0, k], 11δZi[1, k], mi[k] ∈ T⊕ 13δZi[2, k], 9δZi[3, k], ni[k] ∈ T⊕ mi[k], ni[k], δYi[0, k] ∈ T⊕ 9δZi[0, k], 14δZi[1, k], oi[k] ∈ T⊕ 11δZi[2, k], 13δZi[3, k], pi[k] ∈ T⊕ oi[k], pi[k], δYi[1, k] ∈ T⊕ 13δZi[0, k], 9δZi[1, k], qi[k] ∈ T⊕ 14δZi[2, k], 11δZi[3, k], ri[k] ∈ T⊕ qi[k], ri[k], δYi[2, k] ∈ T⊕ 11δZi[0, k], 13δZi[1, k], si[k] ∈ T⊕ 9δZi[2, k], 14δZi[3, k], ti[k] ∈ T⊕ si[k], ti[k], δYi[3, k] ∈ T⊕ ∀i ∈ [0, Nr -1], ∀j ∈ [0, 3], ∀k ∈ [0, N b -1], (C8) δXi+1[j, k], δZi[j, k], δWK [j, (i + 1) × N b + k] ∈ T⊕ ∀ω ∈ [N b , N b × (Nr + 1) -1] such that isSbCol(ω), ∀j ∈ [0, 3], (C9) δWK [j, ω], δSWK [j, ω], pWK [j, ω] ∈ TSBOX where predicate isSbCol(ω) is ω ≥ N k -1 ∧ ω < Nr × (N k + 1) -1 ∧ (ω mod N k = N k -1 ∨ (N k > 6 ∧ ω mod N k = 3)) ∀j ∈ [0, 3], ∀ω ∈ [N b , N b × (Nr + 1) -1], (C10) if ω mod N k = 0 then δWK [j, ω], δWK [j, ω -N k ], δSWK [(j + 1) mod 4, ω -1] ∈ T⊕ elsif N k > 6 ∧ k mod N k = 4 then δWK [j, ω], δWK [j, ω -N k ], δSWK [j, ω -1] ∈ T⊕ else δWK [j, ω], δWK [j, ω -N k ], δWK [j, ω -1] ∈ T⊕ Model 3:
Step 2 model for Rijndael.

Constraint (C1) of Model 3 ensures that obj is equal to the sum of every p A such that δA is a byte that passes through an S-box. It also ensures that obj is strictly greater than the current lower bound LB.

ShiftRows. Constraint (C3) of Model 3 is the straightforward translation of

ShiftRows.

MixColumns. Constraints (C4) to (C7) represent the MixColumns operation. We introduce new integer variables to represent the result of applying the Galois Field multiplication to a byte: for each value v ∈ {2, 3}, and each byte δY i [j, k], the variable vδY i [j, k] is constrained to be equal to v ⊗ δY i [j, k] by the table constraint (C4), where T MULv contains every couple (δA, δB) ∈ 0, 255 2 such that δB = v ⊗ δA. Then, Constraint (C5) ensures that δZ i [j, k] is equal to the result of xoring four bytes (corresponding to the bytes at column k of δY i multiplied by the coefficients at row j of M ). Again, this is done by using table constraints. The main novelty with respect to the model introduced in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] for the AES is that we do not use a single table containing every tuple of five bytes such that the xor of these bytes is equal to 0, as this table is very large (2 40 tuples of five bytes). Instead, we introduce new variables (denoted a i [k], b i [k], etc), and we decompose the relation into three constraints such that each constraint ensures that the xor of three variables is equal to zero. For example, the relation

δZ i [0, k] ⊕ 2δY i [0, k] ⊕ 3δY i [1, k] ⊕ δY i [2, k] ⊕ δY i [3, k] = 0
is decomposed into the three following constraints:

2δY i [0, k], 3δY i [1, k], a i [k] ∈ T ⊕ δY i [2, k], δY i [3, k], b i [k] ∈ T ⊕ a i [k], b i [k], δZ i [0, k] ∈ T ⊕
where T ⊕ is the table which contains every triple (δA, δB, δC) ∈ 0, 255 3 such that δA ⊕ δB ⊕ δC = 0. This decomposition allows us to remove some variables and simplify constraints when we know that some variables are equal to 0. For example, if ∆Y i [0, k] = 0 in the truncated characteristic, then we infer that 2δY

i [0, k] = 0 (because 2 ⊗ 0 = 0) and a i [k] = 3δY i [1, k] (because 0 ⊕ δY i [1, k] ⊕ a i [k] = 0).
Hence, in this case the three previous constraints are replaced with:

δY i [2, k], δY i [3, k], b i [k] ∈ T ⊕ and 3δY i [1, k], b i [k], δZ i [0, k] ∈ T ⊕ .
Constraints (C6) and (C7) are redundant constraints that model the MixColumns -1 operation: They do not change the solutions, but they speed up the solution process by allowing the solver to propagate in both forward (from the plaintext to the ciphertext) and backward (from the ciphertext to the plaintext) directions.

AddRoundKey. Constraint (C8) is a straightforward implementation of AddRoundKey, using table T ⊕ .

KeySchedule. Constraints (C9) and (C10) model the KeySchedule. Constraint (C9) models the S-boxes of the KeySchedule (as described in Section 3.4). Constraint (C10) models the xors of the KeySchedule, using table T ⊕ . Note that we do not represent xors with constants as they are cancelled by differential cryptanalysis.

Results

The Step 1 model is implemented with the MiniZinc 2.4.3 modelling language 7 . This language is accepted by many CP solvers and preliminary experiments have

AES-128 AES-192 AES-256

Approach of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] New approach without MC decomposition New approach without bounds New approach Fig. 1. Comparison of the approach of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] (in green) with our new approach (in red), our new approach without MixColumns decomposition (in orange), and our new approach without exploiting bounds (in purple). Each point (x, y) corresponds to an AES instance (with K len = 128 on the left, K len = 192 on the middle, and K len = 256 on the right): y gives the CPU time in seconds needed to solve it (logscale) when there are Nr = x rounds.

shown us that the best performing solver is Picat-SAT8 2.8.6: This solver first translates the MiniZinc model into a SAT instance and then uses the Lingeling SAT solver to solve the SAT instance. The Step 2 model is implemented and solved with the CP library Choco9 v4.10.2. In Fig. 1, we compare solving times of the approach of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] with those of our new approach on the AES instances in order to evaluate the interest of our two modifications, i.e., (i) the interleaving of Steps 1 and 2 and the active use of LB and UB to stop the search whenever LB≥UB (see Section 3.2), and (ii) the decomposition of the MixColumns constraint into 3 smaller table constraints (see Section 3.4). For this experiment, all runs have been performed on a single core of an Intel Xeon CPU E3 at 3.50 GHz with 4 cores under a Linux Ubuntu 20.04.1 (Focal Fossa) using at most 16 GB of RAM. There are two instances for which our new approach needs slightly more time than the approach of [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF]: AES-128 when N r = 3 (48s instead of 23s) and AES-256 when N r = 13 (567s instead of 479s). For the 21 remaining instances our new approach is faster and, in some cases the difference is very large, e.g., 4, 217s instead of 95, 389s for AES-128 when N r = 5, or 5, 163s instead of 30, 059s for AES-192 when N r = 10. To evaluate the interest of each of our two modifications separately, we also display our new approach without (ii), and our new approach without (i). In many cases, each modification improves the solution process, and the combination of these two modifications is even better. However, modification (i) deteriorates the solution process when N r ≥ 10 for AES-256. This comes from the fact that, for these instances, the optimal solution is strictly smaller than 2 -6•N B sbox so that the lower bound LB cannot be used to stop the search.

We give in Tables 3 and4 the results of Algorithm 2 for every key length K len ∈ {128, 160, 192, 224, 256}, every block size C len ∈ {128, 160, 192, 224, 256}, and every number of rounds N r ∈ 3, x where x is the maximum number of rounds authorized (i.e., the maximal number of rounds for which NB SBOX is smaller than the key length divided by 6 and the number of active S-boxes in the plaintext part is smaller than the block length divided by 6). For this experiment, all runs have been performed on a single core of an Intel Xeon E5-2630 v4 at 3.10 Ghz with 10 cores under a Linux Debian 10 (Buster) using at most 16 GB of RAM (default JVM configuration). This architecture was provided by the Grid5000 cluster [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF].

Please note that there is a slight difference between the model used for Fig. 1 and the model used for Tables 3 and4. Indeed, the model in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] ignores the sboxes of the last round subkey. When the key has 128 or 256 bits, this does not change anything. However, when the key has 192 bits this may change results. To allow a fair comparison with [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF], we also ignore the sboxes of the last round key in all models compared in Fig. 1. However, in Tables 3 and4, we do consider the sboxes of the last round subkey. Therefore, when the key has 192 bits and the text 128 bits, some probabilities may be greater than those reported in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF], e.g., for the instance Rijndael-128-192 with 7 rounds the maximal probability is 2 -84 instead of 2 -78 .

One instance (when C len = 128, K len = 160, and N r = 8) is still not completely solved at the time we submit the paper, after 38 days of computation. For this instance, the output value of Step1-opt is 23. Step1-enum has enumerated 7 truncated characteristics with 23 active S-boxes and none of them can be instantiated into a Step 2 characteristic. So far, we have enumerated 213 truncated characteristic with 24 active S-boxes and none of them can be instantiated into a Step 2 characteristic. Hence, for this instance the current upper bound is U B = 2 -150 . We have computed 189 instances with 25 active S-boxes and 1048 instances with 26 active S-boxes and the smaller probability is LB = 2 -160 .

All other instances have been solved within a reasonable amount of time: 82 are solved within 1, 000s; 24 need more than 1, 000s and less than 10, 000s (i.e., less than three hours); 10 need more than 10, 000s and less than 100, 000s (i.e., less than 28 hours); and finally 2 need more than 28 hours and less than 3 days.

In Tables 3 and4, o 1 is the output value of Step1-opt (called at line 1 of Algorithm 2), i.e., the initial value of NB SBOX ; p is the output value of Algorithm 2, i.e., the probability of the optimal related-key differential characteristic; and time is the total CPU time spent by Algorithm 2 in seconds (this time both includes the running times of Picat-SAT and of Choco). We also report the number o 2 of active S-boxes in the optimal differential characteristic. In most cases (91 out of 122 cases), o 1 = o 2 and p > 2 -6•(o1+1) . In these cases, Algorithm 1 has enumerated Step 1 solutions for only one value of NB SBOX , and LB became larger than or equal to UB the first time NB SBOX has been incremented.

In 17 cases (marked with c just after o 2 ), o 1 = o 2 but it has been necessary to increment NB SBOX at least once in order to check that no better characteristic can be found with more active S-boxes. For example, when C len = 128, K len = 224, and r = 9, the best differential characteristic has 22 active S-boxes and its probability is 2 -139 . As 2 -139 < 2 -6•23 , Algorithm 1 has incremented NB SBOX in order to check that it is not possible to have a larger probability (equal to 2 -139 ) with 23 active S-boxes.

In 2 cases (marked with ! just after o 2 ), o 2 ≥ o 1 + 1 because none of the step 1 truncated characteristic with o 1 active S-boxes can be instantiated into a Step 2 characteristic. In these two cases, Algorithm 1 has incremented NB SBOX in order to enumerate Step 1 solutions with o 1 + 1 active S-boxes and find the best differential characteristic. Results when C len = 160 and K len ∈ {128, 160, 192} In the same way, from the related-key differential characteristic distinguisher on 11-round of Rijndael-160-256 presented in Table 6, we can easily mount a 12-round attack against Rijndael-160-256 that has 14 rounds. Note that the 12th round does not contain the MixColumns operation as it is the last round of our attack. The 11-round related-key differential characteristic distinguisher presented in Table 6 has a probability equal to 2 -204 : 2 -128 coming from the difference in the state and 2 -76 coming from the key.

K len = 128 K len = 160 K len = 192 o 1 o 2 p time o 1 o 2 p time o 1 o 2 p time N r = 3 9 9 2 -54 6
Thus, the attack process is the following one. We submit M = 2 128+ pairs of plaintexts X and X with the difference specified in the first line of Table 6 under the keys K and K = K ⊕ δK with the difference specified in the first line (second column) of Table 6. Then a possible propagation of the difference is the one shown in Table 6. Then, we obtain the corresponding ciphertexts C and C .

Then, we know from Table 6 that the output of the 11th round (and the beginning of the 12th round) is of the form So the attack works as follows:

1. For all the 2 128+ encrypted pairs of plaintexts/ciphertexts, we filter on the values 82 and 0 at positions (0, 2) and (0, 3) in δC. This filters 2 -16 values. Then, it remains 2 112+ encrypted pairs of plaintexts/ciphertexts. 2. We guess the three bytes at positions (1, 4), [START_REF] Abdelkhalek | MILP modeling for (large) s-boxes to optimize probability of differential characteristics[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF], and [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF] in K 11 for a cost of 2 24 . This gives us the values of differences A, B and C. With those known values, we filter on δSX 12 on the 8 positions that are equal to 0 after removing A, B, and C (positions (1, 1), (1, 2), (1, 3), (2, 0), (2, 1), (2, 2), (2, 3) and [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF][START_REF] Abdelkhalek | MILP modeling for (large) s-boxes to optimize probability of differential characteristics[END_REF]). This filters 2 -64 values. 3. We guess 6 bytes of K 12 (those at positions (0, 0), (0, 1), (1, 0), (3, 0), [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF]1) and [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF][START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF]). We filter the corresponding 2 -48 values on δX 12 (before the SBOXes) at the same positions. 4. We guess the byte at position (2, 3) in K 12 to get one new byte in δK 12 at position (1, 4) equal to D and check if the difference is equal to 0 at position (1, 4) in δX 12 . It filters 2 -8 values.

5. We guess the byte at position [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF] in K 12 to filter one byte of value in δX 12 at position [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF]. We guess another byte at position [START_REF] Abdelkhalek | MILP modeling for (large) s-boxes to optimize probability of differential characteristics[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF] in K 12 to filter the byte value at position [START_REF] Abdelkhalek | MILP modeling for (large) s-boxes to optimize probability of differential characteristics[END_REF][START_REF] Biham | New types of cryptoanalytic attacks using related keys (extended abstract)[END_REF] in δX 12 . And finally, we guess the two bytes at positions (1, 3) and (0, 4) in K 12 to filter the byte value at position (0, 4) in δX 12 .

We have guessed a total of 112 key bits and we have filtered, in the initial step 16 bits and the equivalent of 32 bits in the second step and the last step leading to stay with 2 80+ pairs of plaintexts/ciphertexts.

The related-key differential characteristic given in Table 6 has a probability to happen for the state part equals to 2 -128 . Thus, if we use 2 129 plaintexts/ciphertexts in the related-key differential attack on 12 rounds of Rijndael-160-256, then the right difference of the 112 bits of the last subkey will be counted at least twice on average whereas the probability that a bad key appears twice is really low (around 2 81-112 = 2 -31 ). The success probability computed using the results of [START_REF] Aydin | On probability of success in linear and differential cryptanalysis[END_REF] is around 97% also. The time complexity of the attack is about 2 130 encryptions and the attack succeeds if the key follows the characteristic described in Table 6. In other words, we have a set of weak keys of size 2 256-76 = 2 180 .

The 144 remaining bits of the master key can be guessed through guessing more bytes in K 11 and in K 12 and filtering according the remaining values in δX 11 and the SBoxes of the key schedule.

Conclusion

In this paper, we have extended and improved the models initially proposed in [START_REF] Gerault | Computing AES related-key differential characteristics with constraint programming[END_REF] for the AES to the 25 instances of Rijndael. This allowed us to compute optimal related-key differential characteristics for all Rijndael instances but one (and provide upper and lower bounds for the remaining one). We sum up in Those results are obtained using a two-step strategy that is feasible in terms of memory usage and time consumption. This strategy is modelled in MiniZinc, and it is solved by combining two solvers: Picat-SAT for Step 1 and Choco for Step 2. It essentially means that we could today automate a big part of cryptanalysis through the use of generic solvers: we have gone from the artisan age of cryptanalysis to its industrial age.

7

  https://github.com/MiniZinc/MiniZincIDE/releases/tag/2.

Finally, in 13 23 ≥

 1323 cases (marked with ↑ just after o 2 ), o 2 ≥ o 1 +1 because a better characteristic has been found with o 1 + n active S-boxes (though at least one Step 1 solution can be instantiated into a Step 2 solution). Results when Clen = 128 and Klen ∈ {128, 160, 192} 24! 2 -160 ≤ p ≤ 2 -150 > 10 6 18 18 2 -108 83 N r = 9 24 24 2 -146 1,800 Results when Clen = 128 and Klen ∈ {224, 256} 18 N r = 8 18 18 2 -112 1,593 10 10 2 -60 32 N r = 9 22 22 c 2 -139 2,425 15 15 2 -92 346 N r = 10 24 24 c 2 -151 1,834 16 16 2 -98 159 N r = 11 27 27 c 2 -169 1,823 20 20 2 -122 330 N r = 12 34 34 c 2 -212 9,561 20 20 2 -122 277 N r = 13 24 24 2 -146 420 N r = 14 24 24 2 -146 557

  passing through SubBytes and ShiftRows, it becomes: δSX 12 = the keyschedule, the subkey differences δK 12 will be of the form A, B, C, D, E and F are unknown difference. Thus the difference between C and C will be of the form δC =

Table 1 .

 1 ShiftRows table PC len . This table specifies the required number of byte shifts to the left according to the row number, e.g., P224[3] = 4.

	C len	128 160 192 224 256
	K len =128 10 11 12 13 14
	K len =160 11 11 12 13 14
	K len =192 12 12 12 13 14
	K len =224 13 13 13 13 14
	K len =256 14 14 14 14 14

Table 2 .

 2 The number of rounds Nr of Rijndael-C len -K len .

  Transformations. A basic Step 1 model for Rijndael is displayed in Model 1. Constraint (A1) relates NB SBOX with the number of active S-boxes. The other constraints are derived from Rijndael round function transformations. KeySchedule: the whole KeySchedule process of Rijndael is described in Algorithm 1. The variables that pass through SBOXes are unchanged, as stated in Constraint (A6). Xors are modelled by Constraint (A7) which prevents every triple of boolean variables involved in a same xor from having exactly one difference.

	Model 1: Basic step 1 model for Rijndael.

SubBytes: As SBOX is bijective, there is an output difference if and only if there is an input difference. The SubBytes transformation at Boolean level is thus abstracted by an identity mapping ∆X i and ∆SX i (Constraint (A2)). ShiftRows: As ShiftRows is just a shift at byte level, its abstraction in Step 1 is directly expressed as the equivalent shift as defined in Constraint (A3). MixColumns: Multiplications of MixColumns cannot be mapped into the Boolean domain as the coefficients of M belong to GF(2 8 ). Thus, instead of encoding multiplications, we exploit the MDS (Maximum Distance Separable) property of the MixColumns transformation as defined in Constraint (A4). AddRoundKey: It is a simple xor between bytes of the current state Z i and bytes of the subkey RK i . It is modelled by constraint (A5) which prevents every triple of boolean variables involved in a same xor from having exactly one difference. This constraint also relates variables associated with the subkey RK i with variables associated with the expanded key WK.

Table 3 .

 3 Summary of the best related-key differential characteristics for Rijndael when C len ∈ {128, 160}. The time is given in seconds. Results when C len = 192 and K len ∈ {128, 160, 192} K len = 128 K len = 160 K len = 192 o 1 o 2 p time o 1 o 2 p time o 1 o 2

	p	time

Table 4 .

 4 Summary of the best related-key differential characteristics for Rijndael when C

len ∈ {192, 224, 256}. The time is given in seconds.

Table 7

 7 the best attacks described in this paper.

	Instance	Nb rounds N r Time Number of keys
	Rijndael-128-224	12	13 2 105	2 158
	Rijndael-160-256	12	14 2 130	2 180

Table 7 .

 7 Summary of the best related-key differential attacks we found on different Rijndael instances. The last column displays the number of keys for which the attack works.

The code is available here: https://gitlab.inria.fr/lrouquet/ cp-differential-cryptanalysis/-/tree/AfricaCrypt22.

We do not generate equations with more than 4 variables as the number of new equations grows exponentially with respect to their size.

http://picat-lang.org/download/picat28_6_linux64.tar.gz

https://github.com/chocoteam/choco-solver/releases/tag/4.10.2

Acknowledgements

This work has been partly funded by the ANR under grant Decrypt ANR-18-CE39-0007.

where predicate isSbCol(ω)

We describe in this section the best attacks we could mount based on the distinguishers found in the previous section. More precisely, two particular distinguishers have a real interest in terms of attacks. The first one is an 11-round relatedkey differential characteristic distinguisher on Rijndael-128-224 (presented in Table 5 that allows us to mount an attack on 12 rounds (out of 13) of this cipher. There also exists a 12-round distinguisher for Rijndael-128-224 but due to its very low probability (equal to 2 -127 ) for the data path, we do not manage to transform this distinguisher into an attack. And second, we also mount an attack on 12 rounds of Rijndael-160-256 (it has 14 rounds) based on the 11-round related-key differential characteristic distinguisher (presented in Table 6).

Attack on 12 rounds of Rijndael-128-224

First, remember that the 12th round of Rijndael-128-224 is the last round for our attack so it does not contain a MixColumns operation. We base our attack on the distinguisher presented in Table 5. This distinguisher has a probability equal to 2 -169 : 2 -103 coming from the state and 2 -66 coming from the key.

-i = 1 01010000 00000000 00000000 00000000 21210001 1F1F0000 1F1F0000 21210000 2 -2×6 -1F1F0000 00000000 00000000 00000000 2 1F1F0001 00000000 00000000 00000000 5D5D0021 A3A3001F A3A3001F FEFE0021 2 -3×6 -A3A3001F 00000000 00000000 00000000 3 0000001F 00000000 00000000 00000000 0000015C 000000A3 000000A3 000000FE 2 -6 -000000A3 00000000 00000000 00000000 4 00001F1F 00000000 00000000 00000000 01013E3E 00001F1F 00001F1F 00002121 2 2×(-6) 2 -6 00001F1F 00000000 00000000 00000000 5 01010000 00000000 00000000 00000000 3E5C0001 1FA30000 1FA30000 21FE0000 2 -6-7 2 -6-3×7 1FA30000 00000000 00000000 00000000 6 00010001 00000000 00000000 00000000 003E003E 001F001F 001F001F 00210021 2 2×(-6) 2 -6-3×7 001F001F 00000000 00000000 00000000 7 00000000 00000000 00000000 00000000 01010000 00000000 00000000 00000000 --00000000 00000000 00000000 00000000 8 01010000 00000000 00000000 00000000 3E3E0001 1F1F0000 1F1F0000 21210000 2 2×(-6) -1F1F0000 00000000 00000000 00000000 9 00000001 00000000 00000000 00000000 0000003E 0000001F 0000001F 00000021 2 -6 -0000001F 00000000 00000000 00000000 10 00000000 00000000 00000000 00000000 00000101 00000000 00000000 00000000 --00000000 00000000 00000000 00000000 11 00000101 00000000 00000000 00000000 01012121 00001F1F 00001F1F 00002121 2 2×(-6) 2 -6 00001F1F 00000000 00000000 00000000 output 01013E3E 00001F1F 00001F1F 00002121 Table 5. The Best related key differential characteristic we found on 11 rounds of Rijndael-128-224 with probability equal to 2 -169 . The four words represent the four rows of the state and are given in hexadecimal notation. Note that the last round does not contain the MixColumns operation.

Thus, the attack process is the following one. We submit M = 2 103+ pairs of plaintexts X and X with the difference specified in the first line of Table 5 under the keys K and K = K ⊕ δK with the difference specified in the first line (second column) of Table 5. Then a possible propagation of the difference is the one shown in Table 5, and we obtain the corresponding ciphertexts C and C .

We know from Table 5 that So the attack works as follows:

1. We filter on the values 1F , 1F , and 21 at positions (1, 0), (2, 0), and [START_REF] Balouek | Adding virtualization capabilities to the Grid'5000 testbed[END_REF]0) in δC before the last ShiftRows. It remains 2 103+ -24 = 2 79+ pairs of plaintexts/ciphertexts. Moreover, we know that the three bytes at positions (1, 1), (1, 2) and (1, 3) must be equal (this remark also holds for the second and the third rows). This leads to another filter of 48 bits. 2. We guess the byte value of K 12 at position (0, 0) with a cost of 2 8 . Then, we decipher this byte from C and C to check if it is equal to 01 at the input of the 12th round. Then, it filters 2 -8 values. Moreover, the known byte at position (0, 0) in K 12 gives us the difference D (due to the keyschedule construction). 3. We can guess the byte at position (1, 0) in K 12 and check the value at the input of the 12th round at position (1, 0), by deciphering from C and C . Then, it filters 2 -8 values. Moreover, we can compute the difference A. 4. We can guess the three bytes at positions (0, 1), (0, 2), and (0, 3) in K 12 and check the value at the input of the 12th round at the same position knowing the difference A, by deciphering from C and C . Then, it filters 2 -24 values. 5. We can guess the byte at position (3, 0) in K 12 and check the value at the input of the 12th round at position (3, 0), by deciphering from C and C . Then, it filters 2 -8 values. 6. We can guess the byte at position (2, 0) in K 12 and check the value at the input of the 12th round at position (2, 0), by deciphering from C and C . Then, it filters 2 -8 values.

Then, we have guessed 7 bytes of the subkey K 12 , 56 bits of key, and we have filtered an equivalent of 72 bits, leading to keep 2 103+ -72 = 2 31+ pairs of plaintexts/ciphertexts. After guessing the 7-byte difference in the subkey K 12 , δ K12 is fully determined. Thus, guessing the bytes of one key state could determine the bytes of the related-key state.

The related-key differential characteristic given in Table 5 has a probability to happen for the state part equals to 2 -103 . Thus, if we use 2 104 plaintexts/ciphertexts in the related-key differential attack on 12 rounds of Rijndael-128-224, then the right difference of the 56 bits of the last subkey will be counted at least twice on average whereas the probability that a bad key appears twice is really low (around 2 32-72 = 2 -40 ). The success probability computed using the results of [START_REF] Aydin | On probability of success in linear and differential cryptanalysis[END_REF] is around 97%. The time complexity of the attack is about 2 105 encryptions and the attack succeeds if the key follows the characteristic described in Table 5. In other words, we have a set of weak keys of size 2 224-66 = 2 158 .

The 168 remaining bits of the master key can be guessed through guessing more bytes in K 11 and in K 12 and filtering according to the remaining values in δX 11 and the SBoxes of the key schedule.

Attack on 12 rounds of Rijndael-160-256

Round δXi = Xi ⊕ X i (before SBOX) δRKi Pr(States) Pr(Key) δSBXi (after SBOX) i = 0 E094E0E082 7000700041 1400700041 701F9000C3 E000E0E000 7000700041 7000700041 70909000C3 -i = 1 0094000082 0000000000 6400000000 008F000000 008282E0E0 0041007070 0041007070 00C3000090 2 4×(-6)

2 -6 0041000070 0000000000 2000000000 0010000000 2 000082D000 0000000000 0000000000 0000000000 00E0828200 0000414100 0000414100 0000C3C300 2 2×(-7) 2 -6 0000414100 0000000000 0000000000 0000000000 3 00E0000000 0000000000 0000000000 0000000000 82E00000E0 0070000000 0070000000 0090000000 2 -7 2 -6-7 0070000000 0000000000 0000000000 0000000000 4 82000000E0 0000000000 0000000000 0000000000 00828200E0 4100000070 4100000070 C300000090 2 2×(-7) -4100000070 0000000000 0000000000 0000000000 5 8282820000 0000000000 0000000000 0000000000 E0E0000082 7070700000 7070700000 9090900000 2 3×(-6) 2 3×(-7) 7070700000 0000000000 0000000000 0000000000 6 0000E00082 0000000000 0000000000 0000000000 0000E000E0 0000700070 0000700070 0000900090 2 -6-7 -0000700070 0000000000 0000000000 0000000000 7 0000000000 0000000000 0000000000 0000000000 E082000000 0000000000 0000000000 0000000000 -2 -6 0000000000 0000000000 0000000000 0000000000 8 E082000000 0000000000 0000000000 0000000000 E0E000E000 7070000000 7070000000 9090000000 2 -6-7 2 -6 7070000000 0000000000 0000000000 0000000000 9 000000E000 0000000000 0000000000 0000000000 000000E000 0000007000 0000007000 0000009000 2 -7 -0000007000 0000000000 0000000000 0000000000 10 0000000000 0000000000 0000000000 0000000000 00E0828282 0000000000 0000000000 0000000000 -2 -6 0000000000 0000000000 0000000000 0000000000 11 00E0828282 0000000000 0000000000 0000000000 82E0E0E000 0070707070 0070707070 00E0E0E0E0 2 4×(-6) 2 -6 0082707070 0000000000 0000000000 0000000000 Output ?????????? 00F20000?? 00F20000?? 000D0000?? Table 6. The Best related key differential characteristic we found on 11 rounds of Rijndael-160-256 with probability equal to 2 -204 . The four words represent the four rows of the state and are given in hexadecimal notation. Note that the last round does not contain the MixColumns operation.


I enjoyed reading all these articles who represent a tribute to Peter's outstanding scientific career but also its activity as Editor in Chief of JNT. Happy 80 th birthday Peter!

  Editorial to the special issue in Honor of Peter Riederer at the occasion of his 80 th birthday Etienne C. Hirsch ORCHID number 0000-0003-4823-276X Institut du Cerveau, ICM, Inserm U 1127, CNRS UMR 7225, Sorbonne Université, F-75013, Paris, France Email : etienne.hirsch@upmc.fr It is a great pleasure and honor for me to introduce this special issue entitled: Neurobiology of neuropsychiatric disorders: a tribute to Peter Riederer. We have generated this special issue on the occasion of his eightieth birthday to highlight his extraordinary scientific carrier and his dedication to Journal of Neural transmission (JNT) for which he is the Chief editor since 2000. He joined the editorial board of JNT in 1983 when Arvid Carlsson, who later obtained the Nobel Prize, was appointed and took over the responsibilities from Walther Birkmayer as Managing Editor. Under Peter's leadership JNT has become a key journal in the field of neurosciences, neurology and psychiatry reaching a 2020 Impact factor of 3.575. Our Journal represents a platform for translational research publications in neurosciences and associated clinical fields, thus bridging the gap between basic knowledge and clinical application. This objective is fully illustrated with the structure of this special issue composed of three parts covering neurology, psychiatry and treatment. Peter is fortunate to have very good colleagues and friends who have accepted to contribute the articles included in this special issue. These authors are not only friends of Peter but also outstanding scientists who gave historical, actual and future perspectives of the field. Personally, I accepted the invitation of Peter to join JNT in 2004 as a section editor for Parkinson's disease and allied conditions and after being Associate Editor from 2015 to 2019 I became co-Chief editor in 2020. During all these years, it appreciated the mentorship and friendship of Peter in the field of scientific journal edition. I am very grateful to him for introducing me to scientific publishing and for sharing his passion with me. I would like also to thank the Guest Editors who have accepted to organize with me the three parts of this special issue. Toshiharu Nagatsu from Fujita Health University, Toyoake, Japan and Heinz Reichmann Universitätsklinikum Carl Gustav Carus an der Technischen Universität Dresden, Germany, have kindly accepted to manage the neurology part. Jürgen Deckert from the Clinic and Policlinic for Psychiatry, Psychosomatics and Psychotherapy, University Hospital Wuerzburg, Germany, has managed the psychiatry part. And Moussa Youdim, Technion-Rappaport Family Faculty of Medicine, Haifa, Israel, has been in charge of the treatment part. Christian Riederer, Peter's son, is responsible for the editorial office of JNT and without him the journal would not be what it is.


Dai Aoki
email: dai.aoki@cea.fr

Carley Paulsen

Hisashi Kotegawa

Frédéric Hardy

Christoph Meingast

Pierre Haen

Mounir Boukahil

William Knafo

Eric Ressouche

Stephane Raymond

Jacques Flouquet
email: jacques.flouquet@cea.fr

Decoupling between Field-instabilities of Antiferromagnetism and Pseudo-metamagnetism in Rh-doped CeRu 2 Si 2 Kondo Lattice

Keywords: CeRu2Si2, Rh-doping, La-doping, antiferromagnetism, pseudo-metamagnetism, specific heat, resistivity, thermal expansion, magnetization, neutron diffraction, high pressure

Doping Kondo lattice system CeRu2Si2 with Rh-8 % (Ce(Ru0.92Rh0.08)2Si2) leads to drastic consequences due to the mismatch of the lattice parameters between CeRu2Si2 and CeRh2Si2. A large variety of experiments clarifies the unusual properties of the ground state induced by the magnetic field from longitudinal antiferromagnetic (AF) mode at H = 0 to polarized paramagnetic phase in very high magnetic field. The separation between AF phase, paramagnetic phase and polarized paramagnetic phase varying with temperature, magnetic field and pressure is discussed on the basis of the experiments down to very low temperature. Similarities and differences between Rh and La substituted alloys are discussed with emphasis on the competition between transverse and longitudinal AF modes, and ferromagnetic fluctuations.

Introduction

The effect of pressure on Ce heavy fermion systems close to the antiferromagnetic (AF) quantum phase transition is well known. Pressure drives the system from AF to paramagnetic (PM) ground state at a critical pressure P c . If the transition is of second order with continuous suppression of the sublattice magnetization at P c , P c corresponds to a quantum critical point. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF] In complex materials such as heavy fermion compounds, quite different pictures can be obtained for different materials as demonstrated in CeRu 2 Si 2 , CeCu 6 and YbRh 2 Si 2 . The first case is often referred as an example of global criticality where critical fluctuations are that of the magnetic order parameter, and two others of local criticality where quantum criticality is driven by local i. e. Q-independent magnetic fluctuations. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF][START_REF] Löhneysen | [END_REF] We focus here on the CeRu 2 Si 2 series. In this tetragonal crystal, the Ce ions show a strong Ising character with an anisotropy of susceptibility between the easyaxis (c-axis) and the hard-axis with a factor of 15 at low temperatures. The effect of the volume change via a tuning parameter δ have been achieved first by pressure or by doping on Ce 1-x La x Ru 2 Si 2 . 3,4) The pure system CeRu 2 Si 2 at P = 0 is already in a PM ground state; the effective critical pressure P c is at a slightly negative pressure of a few kbar. Expanding the volume by La substitution on the Ce side pushes to reenter in the AF domain for x > x c ∼ 0.075; the AF-PM transition at T = 0 K corresponds to a critical volume V c achieved at δ c which is equivalent to P c or x c . 5,6) Applying a magnetic field (H) will lead to cross the AF boundary H c (T ) between AF and PM. For the Ising spin system of the CeRu 2 Si 2 series the first order metamagnetic transition at H c (0) below P c terminates at the critical endpoint H * c . [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF]4,7,8) The magnetic field can lead to switch from dominant AF interactions at low field to a highly polarized paramagnetic phase (PPM) at high field via a strong interplay between AF and ferromagnetic (FM) coupling through H c studied with La-and Ge-doped system. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF]5,9) Furthermore, due to the large uniform susceptibility χ 0 associated to the huge value of the Sommerfeld coefficient γ (directly linked to the strong local 4f character of the heavy fermion quasiparticle via Kondo fluctuation), the growth of the majority spin-up component at H c is associated to a Fermi surface instability. [10][11][12][13] Roughly at T = 0 K, the magnetic polarization is given by the ratio of the induced magnetization (χ 0 H) by the saturated magnetization. It reaches a critical value, M c ∼ 0.6 µ B /Ce for H c ∼ H K Kondo field associated to the local spin fluctuations.

For P > P c , the first order metamagnetic transition is replaced by crossover phenomena at H m referred as a pseudo-metamagnetism. The effect can be quite sharp since close to P c , Kondo fluctuation and AF intersite interaction have comparable strength. Approaching P c , the crossover field H m ∼ H K is reduced and is comparable to H c at P c for T = 0 K.

The combination of pressure and magnetic field gives the opportunity to observe the interplay between H c (T, P ) and H m (T, P ) schematically shown in Figs. 1(a) and 1(b) assuming an unique AF instability at a wave vector k 1 . For P < P c in the AF domain, the H m crossover line joins the H c (T ) one at finite temperature.

For P > P c the H m line marks the entrance in the PPM region. Measuring thermal expansion or specific heat for P > P c shows that two main clear crossover regimes delimited by a T (H) line emerge: 14,15) a low field nearly AF (NAF) regime dominated by AF correlations and a high field one (PPM) above H m governed by the strong local polarization of the electron. Just in the vicinity of H c or H m strong duality between AF at k 1 and FM fluctuations at k = 0 fluctuations is observed. [16][17][18] The expected variation of γ(H) for both cases are shown in Figs. 1(c) and 1(d). Sharp maxima of γ are expected at H c and H m on both sides of P c in agreement with the theoretical framework on AF tricriticality. However, the first order nature of the metamagnetic transition can wipe out the sharp increase of γ on approaching H c . Furthermore in this complex band structure case, the magnetic field can induce changes in the ordered AF wave vector as often different magnetic hot spots exist on the Fermi surface. Thus the selection of the AF wave vector can be modified by the magnetic field in the AF domain.

γ H P AF NAF PPM 0 0 0 0 T T H H H H c (0) H m H m H m H c P < P c P < P c T = 0 P > P c P > P c H c P c H m H γ (c) (a) (b) (d)
Inelastic neutron scattering experiments on the pure CeRu 2 Si 2 system indicate that three AF hot spots exist at k 1 = (0.31, 0, 0), k 2 = (0.31, 0.31, 0) and k 3 = (0, 0, 0.35). 19) The two first k vectors, k 1 and k 2 are transverse modes as the fluctuating moments are aligned along the c-axis of the tetragonal crystal, while k 3 is a longitudinal one. Under magnetic field, a sharp pseudometamagnetic crossover occurs at H m marked by a sharp effective mass enhancement right at H m , a slowdown of the field induced FM fluctuation, and a spectacular Fermi surface change. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF]4,10,11,17,18) For the La substituted case, AF ordering at H = 0 occurs at a transverse wave vector k 1 with respect to the sublattice magnetization aligned along c-axis. 6) At low temperatures, the sharp pseudo-metamagnetic crossover at H m is replaced by a first order metamagnetic transition at H c . Increasing temperature, the field sweep below the Néel temperature T N leads to detect both H c (T ) and H m (T ). At x c for T → 0 K, H c is equal to H m . The (H, T ) phase diagram is more complex than that shown in Fig. 1 as at a critical field H a < H c , the AF ordered wave vector remains transverse but changes from incommensurate wave vector to another complex AF phase with a large hysteresis domain characterized on cooling by the appearance of the wave vector k 2 and even a commensurate component (1/3, 1/3, 0) at low temperature. 20,21) For x larger than x c , the schematic scheme of the (H, T ) phase diagram measured by the elastic neutron diffraction is shown in Fig. 2(a).

In the previous studies with La substitution, the H c (T ) and H m (T ) phase diagram interfere, leading to an AF order to PPM phase boundary at H c for δ < δ c . There is no obvious basic arguments for the coincidence between H c and H m at δ c . However, it is clear that the dominant competing wave vector are the AF transverse ones (k 1 , k 2 , . . . ) and the uniform FM mode.

A striking point is that Rh substitution on the Ru site, namely Ce(Ru 1-x Rh x ) 2 Si 2 reveals a decoupling between H c and H m . [22][23][24] This drastic change may be driven by the fact that with Rh doping the ordered wave vector in the AF domain (x > x c = 0.05) is now the longitudinal (k 3 = (0, 0, 0.35)) wave vector instead of the transverse mode in the La doped alloys (Fig. 2(b)). 25,26) Up to now there is no indication via neutron scattering experiments what will be the dominant AF spin fluctuation mode up to H m .

Previous experiments on Ce(Ru 1-x Rh x ) 2 Si 2 were limited at temperatures above 1.5 K except for x = 0.15 which is quite higher than x c ∼ 0.05. 27,28) Thus we performed new set of experiments on x = 0.08. To clarify the situation, we focus here on the thermodynamic and transport measurements at very low temperatures down to 100 mK. The first aim is to determine the field variation of the Sommerfeld coefficient γ through H c and H m and to compare the results with magnetization, specific heat and resistivity measurements. The second aim is to investigate precisely the crossover line T (H) by high accurate thermal expansion measurements in the intermediate temperature range above 2 K. The third aim is to clarify the pressure evolution of H m and the effective mass, comparing with those of CeRu 2 Si 2 .

It will be shown that the substitution of Ru by Rh is a major perturbation due to the mismatch of the lattice parameter of CeRu 2 Si 2 and CeRh 2 Si 2 . In the extended field region H m -H c = 3 T assumed to be paramagnetic, the fancy point is the quasi-invariant value of γ close to the critical value γ c observed at H * c or P c at H = 0 in the La doped system. The validity of the hypothesis of PM ground state above H c for longitudinal and transverse modes will be confirmed by new neutron scattering experiments.

Experimental

Single crystals of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 were grown using the Czochralski method in a tetra-arc furnace. Start- ing materials of Ce (purity: 99.9%-3N), Ru(4N), Rh(4N) and Si(6N) with the ratio, 1 : 1.84 : 0.16 : 2 were melted under the high purity Ar gas for a polycrystalline ingot. The ingot was tuned over and was melted again. This process was repeated several times in order to obtain the homogeneous phase. The ingot was subsequently pulled with a pulling rate of 15 mm/hr. The obtained single crystal ingot was cut using a spark cutter, and was oriented by the X-ray Laue photograph. The first specific heat measurements were realized using the relaxation method at temperatures down to 0.42 K and at magnetic fields up to 9 T. The measurements were then pushed down to 0.21 K, using a homemade dilution refrigerator up to 14 T. Precise magnetization measurements were performed down to 80 mK and up to 8 T with a homemade SQUID magnetometer, which was successfully applied in our previous experiments CeRu 2 Si 2 15) and CeCoIn 5 . 29) Thanks to the Maxwell relation, ∂γ/∂H = ∂ 2 M/∂T 2 , the field dependence of γ can be determined by integrating ∂ 2 M/∂T 2 with field. Resistivity measurements were performed using four probe AC method at temperature down to 100 mK and at field up to 16 T. The pressure study was also realized by the resistivity measurements in a NiCrAl-CuBe pressure cell up to 3.8 kbar. The pressure was determined by the superconducting transition temperature of Pb. The H c (T ) and H m (T ) boundaries were confirmed by magnetostriction experiments using a strain gauge glued on the c-plane down to 2 K and up to 9 T. The search for T (H) line was precisely investigated by high precision thermal expansion measurements using a capacitance dilatometer down to 2 K. For comparison, thermal expansion measurements were performed in Ce 0.9 La 0.1 Ru 2 Si 2 , as well. The single crystals obtained in the previous reports 30,31) were used. The precision of our measurements has been improved, compared with the previous works realized down to 1.2 K. 32,33) In order to confirm that H c marks the AF-PM boundary, a neutron diffraction experiment was performed on the two-axis D23-CRG-CEA thermal neutron diffractometer equipped with a lifting detector at ILL in Grenoble. A copper monochromator provides an unpolarized neutron beam with a wavelength of λ = 1.276 Å. The single crys-tal sample was put in the 12 T vertical field magnet with the c-axis along the field. Figure 4 shows the field dependence of C/T at different temperatures with again the field decrease of the AF anomaly at T N (H) and the smearing out of the PPM domain on warming at H m (T ).

Results

Ce(Ru

Figure 5 represents the response of the strain gauge directly linked with the change of the length ∆L/L along the c-axis. Taking the field derivative λ c = d(∆L/L)/dH, the positions of the lines H c (T ) and H m (T ) are well drawn (Fig. 6). The singular point is that the magnetostriction at H m appears quite more broadened than the one observed for CeRu 2 Si 2 at the PM-PPM boundary. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF]3,4,14,15) As discussed later, this smearing is caused by the doping which inhibits partly a full deformation of the lattice.

A new set of thermal expansion measurements α was realized to search for the crossover T (H) line for H c, as shown in Fig. 7. As observed in the La-doped case, 34) the same sign of thermal expansion is detected along c and a-axes with a ratio near 3. The AF H c (T ) line is very well defined through the strong negative jump of α. The crossover line T (H) can be drawn following the position of the extremum of thermal expansion at fixed field (Fig. 8). This indicates strongly that the region between H m and H c is paramagnetic. The (H, T ) phase diagram can be reconstructed with a mixture of phase diagram shown in Fig. 1. A clear separation exists between H c and H m . The effect is obvious in the magnetostriction data λ V = (1/V )∂V /∂H shown in Fig. 9 even for T ∼ 2 K equal only to 0.5T N .

Figure 10 shows the magnetization curve extrapolated to 0 K from the temperature dependence down to 75 mK at different fields. A weak hysteresis is detected only at H c , as it was reported on Ce(Ru 0.85 Rh 0.15 ) 2 Si 2 . 24) Taking the H derivative χ(H) = ∂M/∂H of the magnetization (inset of Fig. 10), one can observe that the transition at H c and H m are very broad by comparison to the first order metamagnetic transition detected for example on Ce 0.9 La 0.1 Ru 2 Si 2 (T N = 5 K) at H c and to the pseudo-metamagnetic transition of CeRu 2 Si 2 where χ(H m ) reaches 1.6 µ B /T at 100 mK. [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF]30) This reduction points out that the magnetostriction is strongly affected as the susceptibility at constant pressure (χ P ) is linked to the susceptibility at constant volume χ V by the relation:

χ P = χ V + λ V 2 V 0 κ , (1)
where V 0 is the molar volume and κ is the compressibility. A quite similar attenuation is observed when CeRu 2 Si 2 is doped with La and Y in χ P (H m ) and constant field value of γ is observed as derived with great accuracy from the application of the Maxwell relation to the temperature dependence of the magnetization at constant field, namely ∂γ/∂H = ∂ 2 M/∂T 2 and also by direct specific heat measurements (Fig. 11).

λ V = (1/V )∂V /∂H.
In order to establish that AF disappears at H c , we have performed new elastic scattering experiments on a single crystal extracted from the same batch. The aim was to verify the possible interplay between the longitudinal and transverse mode. Figure 12 shows the representative Q scan performed around Q = (1, 1, 0) + k 3 (Fig. 12(a)), Q = (1, 1, 0)k 1 (Fig. 12(b)) and Q = (1, 1, 0)k 2 (Fig. 12(c)) at different field at 2.3 K. These data indicate that the magnetic ordering with the wave vector k 3 disappears at H c , while no signal is induced at k 1 and k 2 for higher magnetic fields above H c and H m . Figs. 13 and14. The (H, T ) phase diagram is well reproduced with a characteristic drop of the residual resistivity at H c (0) followed by a wide maximum at H m (T ). In agreement with the validity of the Kadowaki-Woods relation, the A coefficient of the T 2 resistivity law roughly follows the field dependence of γ according to the relation A ∝ γ 2 . In the case of doping, additional deviation from the Kadowaki-Woods relation can occur due to the T dependence of the impurity scattering and also due to the additional modification in the carrier number. 35,36) Finally, preliminary pressure studies were realized to test the pressure response of H c and H m up to 3.8 kbar, as shown in Fig. 15. With increasing pressure, the plateau of the resistivity A coefficient between H m and H c decreases in value. H c disappears rapidly at P ∼ 1.5 kbar, while H m monotonously increases with pressure. In this preliminary experiments, it is not possible to conclude that H c terminates at P c as a critical endpoint, as it is in the La-doped case at x c . 1) A fine tuning through P c is necessary. Close to the critical pressure (P ∼ 1.5 kbar) where the longitudinal ordering collapses, the critical value of γ c may be quite lower than the value of γ ∼ 650 mJ K -2 mol -1 in Ce 0.9 La 0.1 Ru 2 Si 2 reported for the AF instability of the transversal mode, 30,31,37) as A Rh (P c ) ∼ 1.4A Rh (P = 0) at H = 0 leading to γ c ∼ 450 mJ K -2 mol -1 . Above P c , the field variation of A is quite identical to that reported for CeRu 2 Si 2 at P = 0.22 GPa (H m ∼ 11 T). 31) The weak maxima of A at H m reflects the duality between AF and FM correlations. Above H m , good scaling of A(H)/A(H m ) is observed under pressure. As seen in Fig. 16, assuming A ∼ (m * ) 2 at H m , the pressure dependence of electronic Grüneisen parameter Ω(H m ) = -∂ ln m * ∂ ln V is quite similar between the pure system CeRu 2 Si 2 and the Rh-doped system Ce(Ru doped crystal, as it presents similar impurity scattering, as known from the value of ρ 0 . 5,30) Its Néel temperature T N is around 2.5 K but the specific heat anomaly at T N is much broader than the one measured for the previous Rh doped case, as it is closer to AF-PM instabilities. Focus is given here on recent magnetization data published in Ref. 31. As seen in Fig. 17 for the transverse AF ordered mode, a clear metamagnetic transition occurs at H c without the separation between H c and H m at low temperatures. However, on warming, a marked difference between H c and H m was already observed since H c (T ) decreases strongly. The transition between the two transverse modes at H a ∼ 1 T is marked by a rather broad maximum of ∂M/∂H. Let us notice the large difference in shape and amplitude in ∂M/∂H detected at H c between Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 and Ce 0.9 La 0.1 Ru 2 Si 2 . The inset of Fig. 17 shows the field variation of γ(H) as derived from the Maxwell relation. For both cases, γ(H) shows a drastic decrease of γ on entering in the PPM state.

Precise thermal expansion measurements were also realized on Ce 0.9 La 0.1 Ru 2 Si 2 down to 2 K (Fig. 18). Due to the weakness of T N ∼ 2.5 K and also the rather broad specific heat anomaly associated to the onset of the ordering, the AF boundary is difficult to define. However as for Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 , clear extrema of α in temperature allow to determine the T (H) crossover (Fig. 19). The corresponding phase diagram is shown in Fig. 20. Quite similar behaviors emerge with the sign that AF correlations will be initially stronger for Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 in good agreement with the ranking of their T N .

Discussion

In Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 , the image is that H c marks the transition from AF to PM phases. Increasing the , where κ and m * are compressibility and effective mass, respectively magnetic field above H c may lead to escape from AF criticality and thus will correspond to a strong fielddecrease of γ as proposed in Fig. 1. However, as observed in Ce 0.9 La 0.1 Ru 2 Si 2 where H a marks a switch from one AF phase to another AF phase only by changing its wave vector, the γ-value is basically field-invariant between H c and H m in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . Furthermore its value is quite close to the maximum value of γ c ∼ 650 mJ K -2 mol -1 reached at P c or at H * c in the Ce 1-x La x Ru 2 Si 2 family. This suggests that above H c in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 the low energy AF spin dynamics may be dominated by the fluctuations of the transverse mode. However, when the polarization reaches a critical value at H m corresponding to a critical value of magnetization M c ∼ 0.7 µ B , a strong field decrease of γ is observed quite similar to that detected on the PPM side of CeRu 2 Si 2 for M = M c = 0.6 µ B . Figure 21 shows the comparison for the relative field variation of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 and CeRu 2 Si 2 1, 4, 7) in a γ/γ m vs H/H m representation. For CeRu 2 Si 2 a sharp maximum occurs at H m as the magnetic field close to H m wipes out the AF correlations, while the growth of uniform magnetization is associated with an increase of the FM correlations which slows down just at the vicinity of H m . [START_REF] Flouquet | Progress in Low Temperature Physics[END_REF] Increasing further the magnetic field above H m reinforces the local character and thus leads to recover the proper- Previous results on Ce(Ru 0.85 Rh 0.15 ) 2 Si 2 (T N = 5.5 K, k 3 = 0.42, H c = 3.5 T, H m = 5 T) give an extrapolation of γ(H) with only a rounded maxima near H m (γ(H m ) = 550 mJ K -2 mol -1 , while the zero field value reaches γ(0) ∼ 300 mJ K -2 mol -1 ; those two values are quite close to the ones found in the present experiment for x = 0.08. Approaching x c leads to an increase of the H c -H m window (by a factor 2) and thus to an excellent decoupling between AF and pseudo-metamagnetic instabilities. As mentioned later, low doping allows also to minimize the effect of lattice mismatch.

The novelty in the Rh doped case is the mismatch in the lattice parameters of CeRu 2 Si 2 and CeRh 2 Si 2 , which is tabulated in Table I together with the comparison with LaRu 2 Si 2 . In La-doped case, both a and c lattice parameters expand. The driving force is the volume and the local perturbation is only moderated. In Rh-doped case, the value of a decreases, while the value of c increases. This contradictory behavior boosts the local perturbation now

K ∼ 50 K for CeRh 2 Si 2 instead of T K ∼ 25 K for CeRu 2 Si 2 .
In the popular image of the Doniach collapse of AF for a Kondo lattice, the Ruderman-Kittel-Kasuya-Yosida (RKKY) in-teractions in CeRh 2 Si 2 must be quite larger than that of CeRu 2 Si 2 . Thus a source of competing interactions is created via the Rh substitution, plus additional change in the carrier number caused by the Rh doping. At least an important consequence is that at H = 0 the magnetic ordered mode became the longitudinal one. It was recently observed that slight changes of the Fermi surface occur on doping with La or Ge substitution. 36,38) It seems indirectly here that Rh doping has more drastic effect which promotes the k 3 instabilities.

Evidences of strong nesting properties with partial gap opening for the Rh-doped system were given in the resistivity measurements, when the current J is applied along the c-axis as shown in Fig. 13(a)(b). For Ce(Ru 0.85 Rh 0.15 ) 2 Si 2 , similar data can be found in ref. 39. No jump of resistivity for J c-axis was observed in the La-doped case, while with Ge-doping, the nesting is detected for J a-axis. 40) We have verified that the nesting persists also in the present system Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 , as shown in Fig. 13(b). A difficult enigma is what would be the phase diagram of a pure lattice of CeRu 2 Si 2 (without induced disorder), if the ground state at H = 0 would be an AF longitudinal mode; would the transition from AF to PM at H c be replaced by a switch between two AF structures as observed for the La substitution? As pointed out in Fig. 2, the AF regime 20,21) is rather complex at T N (H = 0). A new question is if, due to the Rh substitution, above H c , the system will switch from AF phase dominated by a longitudinal mode to a PM nearly AF phase dominated by a transverse mode between H c and H m before becoming governed by the crossover to the PPM phase. A strong indication is given by the pressure resistivity measurements suggesting quite different critical values of γ c for the longitudinal and transversal instability.

Obviously, an open question is the interplay between the different modes on the spin dynamics. It will require a new generation of inelastic experiments, in which it is expected that the transverse mode may govern the spin dynamics above H c . The main difficulty is to grow a large homogenous Rh-doped single crystal, as the physical properties are very sensitive to the development of concentration gradient. Our choice will be to remain in the AF domain with x ∼ 0.08 as we can verify the homogeneity from the size and shape of the specific heat anomaly at T N for H = 0. Another microscopic probe will be to succeed in detecting the Fermi surfaces. Here application of the magnetic field along the basal plane gives some hope to track the Fermi surface change, despite the fact that the electronic mean free path could be damped by doping.

Some of the figures with H m -H c window are reminiscent of the effects observed in the cases such as Sr 3 Ru 2 O 7 41) or recently UCoAl. 42) In Sr 3 Ru 2 O 7 it was proposed that a nematic phase appears due to the strength of spin-orbit coupling, and that weak disorder preempts this establishment at the profit of a smearing into a metamagnetic quantum critical point. In UCoAl, a plateau of γ(H) was recently detected above the quantum critical endpoint. At least, strong evidences are given here that the large H plateau of constant γ is the result of the competition between AF instability and field-driven FM instability.

Conclusion

Doping CeRu 2 Si 2 with Rh instead of La or Ge leads to a drastic change of (H, T ) phase diagram of the AF phases. The achievement of very low temperature allowed to characterize the field variation of γ inside the AF domain below H c = 2.8 T inside the "unstable" PM phase between H c and H m = 5.8 T and in the PPM phase. The pressure study suggested that two critical values of γ are associated respectively to longitudinal (k 3 ) and transversal AF instability. A key ingredient is the lattice mismatch between CeRu 2 Si 2 and CeRh 2 Si 2 . Above H c , the occurrence of a PM ground state with Rh-doping is in excellent agreement with the lattice contraction by comparison to the pure system CeRu 2 Si 2 .

Fig. 1 .

 1 Fig. 1. Interplay between AF and pseudo-metamagnetism for (a) P < Pc and (b) P > Pc. The inset of panel (a) shows the pressure variation of Hc and Hm at T = 0 K. Field variation of the Sommerfeld coefficient γ(H) for (c) P < Pc and (d) P > Pc. AF, PPM and NAF denote antiferromagnetism, polarized paramagnetism and nearly antiferromagnetism, respectively.

Fig. 2 .

 2 Fig. 2. (Color online) Schematic magnetic phase diagrams of Ce 0.8 La 0.2 Ru 2 Si 2 and Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 .

  0.92 Rh 0.08 ) 2 Si 2 Figure 3 shows the temperature dependence of C/T at different magnetic fields. AF transition occurs at T N = 4.2 K at zero field. As for classical AF, T N identified as a jump of C/T decreases with H. That allows to determine H c (0) ∼ 2.8 T. Surprisingly between 3 T and 5.8 T, C/T is almost invariant against field in a regime assumed to be paramagnetic. At H m ∼ 5.8 T, C/T abruptly drops as observed for CeRu 2 Si 2 just above the pseudo-metamagnetic field H m ∼ 7.8 T.

Fig. 3 .

 3 Fig. 3. (Color online) Temperature dependence of the specific heat in the form of C/T vs T at different fields in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . The inset shows the field dependence of the specific heat in the form of C/T vs H at 0.21 K and 0.42 K.

Fig. 4 .Fig. 5 .

 45 Fig. 4. (Color online) Field dependence of the specific heat in the form of C/T vs H at different temperatures in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . The small arrows indicate Hc(T ) and Hm(T ).

  Fig. 6. (Color online) (H, T ) phase diagram obtained by the magnetostriction measurements in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 .

Fig. 7

 7 Fig. 7. (Color online) Thermal expansion of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 with high accuracy at the intermediate temperature regime (T > 2 K) at different fields for L a-axis and L c-axis.

Fig. 8 HFig. 9 .

 89 Fig. 8. (Color online) (H, T ) phase diagram of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 determined by the precise thermal expansion measurements.

Fig. 10 .

 10 Fig. 10. Magnetization curve extrapolated to 0 K obtained by the temperature dependence at different fields in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . The inset shows the field derivative of the magnetization curve.

Fig. 11 .

 11 Fig. 11. (Color online) Field dependence of the Sommerfeld coefficient γ obtained by the Maxwell relation from the magnetization measurements assuming γ(0) = 0.36 J K -2 mol -1 . The result of direct specific heat measurements at 0.21 K is plotted as well for comparison.

Fig. 12 .

 12 Fig. 12. (Color online) (a)-(c)Neutron diffraction profiles of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 at 2.3 K at different fields for H c-axis along (1, 1, l), (h, 1, 0) and (h, h, 0) corresponding to k 3 , k 1 and k 2 , respectively. (d)Field dependence of the integrated intensity of (0, 0, k) at 2.3 K. (e)Corresponding field dependence of k.

Fig. 13 .

 13 Fig. 13. (Color online) (a)Temperature dependences of the resistivities for the current along a and c-axes and (b)the corresponding low temperature resistivities. (c)Magnetoresistance at different temperatures for H c-axis and J a-axis

Fig. 14 .Fig. 15 .

 1415 Fig. 14. (Color online) (a)Field dependence of the resistivity A coefficient and the specific heat at 0.21 K in the form of √ A vs H and C/T vs T in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . (b)Field dependence of the resistivity at 0.1 K.

H

  Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 H c : Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 H m : Ce(Ru 0.92 Rh 0.08 ) 2 Si 2

Fig. 16 .

 16 Fig. 16. (Color online) (a)Pressure dependence of the A coefficient at Hm and Hc in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 and CeRu 2 Si 2 . (b)Pressure dependence of the effective Grüneisen parameter Ω for √ A at Hm and Hc in CeRu 2 Si 2 and Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . Ω is defined as Ω ≡ -∂ ln m * ∂ ln V ∼ -1 2κA

Fig. 17 .

 17 Fig.17. Magnetization curve for H c-axis at 0.1 K in Ce 0.9 La 0.1 Ru 2 Si 2 . The inset at right-bottom is the field-derivative of the magnetization curve. The inset at left-top is the field dependence of the γ-value obtained from the temperature dependence of the magnetization using the Maxwell relation.

Fig. 18 .

 18 Fig. 18. (Color online) Thermal expansion of Ce 0.9 La 0.1 Ru 2 Si 2 with high accuracy at the intermediate temperature regime (T > 2 K) at different fields for L a-axis and L c-axis.

Fig. 19 .

 19 Fig. 19. (Color online) Field dependence of the magnetostriction λ V = (1/V )(∂V /∂H) on Ce 0.9 La 0.1 Ru 2 Si 2 .

Fig. 20 .

 20 Fig.20. (Color online) (H, T ) phase diagram of (a) Ce 0.9 La 0.1 Ru 2 Si 2 and (b) Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 obtained by the precise thermal expansion measurements. Lines are guides to the eyes. Thin lines correspond to the crossover from results of the temperature dependence of thermal expansion. Thick lines correspond to the AF boundary. The data of AF boundary for Ce 0.9 La 0.1 Ru 2 Si 2 are extrapolated from the previous low temperature measurements.30)

Fig. 21 .

 21 Fig. 21. (Color online) Field dependence of the Sommerfeld coefficient γ in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 and CeRu 2 Si 2 . The field and γ are scaled with Hm and the γ-value at Hm, respectively. The data of CeRu 2 Si 2 are cited from ref. 7

  3) It is interesting to notice that in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 the switch from PM to PPM phase occurs at a critical value M c ∼ 0.7 µ B , just slightly higher than the one measured in CeRu 2 Si 2 .The absence of hysteresis between H c and H m , the broad susceptibility anomaly at H m , and the observation of crossover T (H) line give strong supports that the H m -H c window corresponds to a paramagnetic ground state. The paradox is that in this paramagnetic domain a quasi-

		10	H // c-axis 0.92 Rh 0.08 ) 2 Si 2		T (H) Ce(Ru
	H (T)	8 6				H m
		4
		2	H c
		0 0	2	4	6	8	10
				T (K)

  0.92 Rh 0.08 ) 2 Si 2 . A more accurate value of Ω determined by thermodynamic measurements is known to be Ω(H m ) ∼ 200 at ambient pressure in CeRu 2 Si 2 . It is interesting to note that Ω(H c ) in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 strongly decreases with pressure by comparison to Ω(H m ) both in CeRu 2 Si 2 and in Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 . 3.2 Comparison with Ce 0.9 La 0.1 Ru 2 Si 2 Next we compare the results of Ce(Ru 0.92 Rh 0.08 ) 2 Si 2 with those of Ce 0.9 La 0.1 Ru 2 Si 2 , focusing on the 10 %

Table I .

 I Lattice parameters and volumes of CeRu 2 Si 2 , LaRu 2 Si 2 and CeRh 2 Si 2 .

		CeRu 2 Si 2	LaRu 2 Si 2	CeRh 2 Si 2
	a	4.192 Å	4.215 Å	4.09	Å
	c	9.78 Å	9.93 Å	10.18	Å
	c/a	2.32	2.20	2.48
	V	171	Å3	176.4	Å3	170.3	Å3

Acknowledgements

We thank Y. Matsumoto and Y. Machida for useful discussions. This work was supported by ERC starting grant (NewHeavyFermion), French ANR project (COR-MAT, SINUS, DELICE).