Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am studying differential analysis and have a question.

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an S-BOX, the output of which is xor'd with $K_2$). This case is very simple. Using the main property of XOR we can get differential that independent from KEY.

How do we can get such differential if instead of XOR we use addition modulo $2^{32}$? When using XOR, we have $(m_1 \oplus k_1) \oplus ( m_2 \oplus k_1 ) = m_1 \oplus m_2$. What operation need apply to get rid of the key when using addition modulo $2^{32}$?

share|improve this question
@user8911, thank you for the fix. – Vladislav Koroteev Nov 21 '13 at 9:35
up vote 5 down vote accepted

This is called an Even-Mansour cipher.

Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$ A \boxminus B \equiv (A-B)\pmod{2^{32}}. $$

You compute the differential distribution table for $S$ in the same way, but replace $\oplus$ with $\boxminus$.

share|improve this answer
thank you very much for your answer. ((m1 - k1) mod c) - (m2 - k1) mod c) mod c ==> ((m1 mod c) - (k1 mod c) - (m2 mod c) + (k1 mod c)) mod c ==> ((m1 mod c) - (m2 mod c)) mod c. So we get rid of the key. – Vladislav Koroteev Nov 21 '13 at 10:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.