Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am studying differential analysis and have a question.

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an S-BOX, the output of which is xor'd with $K_2$). This case is very simple. Using the main property of XOR we can get differential that independent from KEY.

How do we can get such differential if instead of XOR we use addition modulo $2^{32}$? When using XOR, we have $(m_1 \oplus k_1) \oplus ( m_2 \oplus k_1 ) = m_1 \oplus m_2$. What operation need apply to get rid of the key when using addition modulo $2^{32}$?

share|improve this question
1  
@user8911, thank you for the fix. –  vakoroteev Nov 21 '13 at 9:35
add comment

1 Answer

up vote 3 down vote accepted

This is called an Even-Mansour cipher.

Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$ A \boxminus B \equiv (A-B)\pmod{2^{32}}. $$

You compute the differential distribution table for $S$ in the same way, but replace $\oplus$ with $\boxminus$.

share|improve this answer
    
thank you very much for your answer. ((m1 - k1) mod c) - (m2 - k1) mod c) mod c ==> ((m1 mod c) - (k1 mod c) - (m2 mod c) + (k1 mod c)) mod c ==> ((m1 mod c) - (m2 mod c)) mod c. So we get rid of the key. –  vakoroteev Nov 21 '13 at 10:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.