Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher.

The big gotcha with this process is that you cannot just reuse the above differential path to crack rounds 2 and 3. You must build new differential characteristics that only cover the uncracked rounds.

As I understood you cannot use the same differential for cracking all keys. For each round key, you need to use new differential. Could you explain why?

share|improve this question
What are the differentials at the start of round 2 compared to the differentials you started off with? Note the remark about the first subkey being (temporarily) out of reach due to the key whitening step. – Thomas Mar 10 '14 at 10:28
@Thomas Thanks for answer, but I did not get, what do you mean. Do you mean that differential 0x8080000080800000, which used for cracking subkey of last round, leads to the differential 0x02000000 with 100% probability? And so we cannot reveal subkey of round 2? But why we cannot use this differential to reveal subkey of round 3? – neverwalkaloner Mar 10 '14 at 12:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.