Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who reads this paper, please explain it to me.

share|improve this question
@e-sushi I don't think this is a reference request. It's asking for for clarification of certain concepts used in a notable paper. It's limited in scope and doesn't lead to link-only answers. So I consider it on topic. – CodesInChaos Jul 20 '13 at 19:09
Can you please provide a link to the paper and quote the relevant section here? – rath Jul 24 '13 at 19:46

We talk about cryptanalytic tools here. A differential trail describes how a certain difference evolutes throughout the cipher, which helps to find out a key in a standard differential cryptanalysis. Each trail activates certain non-linear operations (S-boxes), which contribute to its probability (a difference goes through a nonlinear operation probabilistically).

The biclique key search method works with a pair of such trails in a small part of the cipher. For the method to work, these trails must activate non-interleaving groups of S-boxes, otherwise more sophisticated conditions come into play.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.