Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall.

Basically I attacked the final round first ($K3$) using the differential characteristic of 0x80800000 which yields a differential of 0x02000000 with a probability of $1$.

I have found four possibilities for the round 4 subkey. To advance the attack to the next round (round 3) and verify which key is the correct one, I need to choose a new differential characteristic (other than 0x80800000) to attack round 3.

I know the difference in the input to round 2 should be 0x02000000, so I can begin my attack on round 3 — but how do I go about finding my differential characteristic so I can generate my plaintext/ciphertext pairs?

share|improve this question
'requests to decrypt data are off-topic' - maybe so, but that doesn't mean all cryptanalysis questions are off-topic! This seems like a perfectly reasonable question to me – figlesquidge Dec 19 '13 at 11:28
Closely related: Differential cryptanalysis - breaking the last round of FEAL4? – Trina Dec 20 '13 at 23:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.