Tag Info

Hot answers tagged

15

Basically it's analysis of a cryptographic cypher by the means of finding a relationship between the difference in the input data and the output data. Ideally, the slightest difference in input data (cleartext), even a single bit, should produce a completely different cypthertext. However, if the cypher is not well-designed, a correlation between the two ...


12

This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are not really confident in the subject.


7

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...


6

There are 256! possible 8x8 S-boxes (i.e., bijective functions from $\{0,1\}^8$ to $\{0,1\}^8$. This is an absolutely enormous number. You couldn't possibly enumerate all of them within the lifetime of the universe. So, yes, this is one reason why it is not straightforward to determine whether there exists such a S-box with differential uniformity 2.


6

No, it's not flawed. You're just running into a fact of life; differential cryptanalysis generally doesn't just give you the entire key (or even subkey) in one shot. It generally gives you partial information about the key, and if you want the entire key, well, you need to work at it more. In this phase of the attack, you know that the last round subkey ...


4

They are generally relevant only to symmetric-key cryptography (e.g., block ciphers, hash functions, message authentication codes). There's no deep reason why -- it's just that differential and linear cryptanalysis tend to be effective against the sort of structure that are commonly used in block ciphers, but not very effective against the sort of designs ...


4

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a ...


4

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits. In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally: Very sophisticated in theory and ...


4

I understand the question as you have a single 4-bit S-box, which you first apply rowwise, and then columnwise. As already mentioned, this is equivalent to a large S-box $\mathcal{S}$ $$ c = \mathcal{S}(m\oplus k_1)\oplus k_2. $$ This is a well-known Even-Mansour cipher, and it can be broken with complexity $2^{n/2}$, which is $2^8$ for your $n=16$. The ...


3

As with Dmitry, I assume you are applying a 4-bit s-box to a 4-by-4 array of 16 bits, first to the rows (after xoring 16 bits of key material to the plaintext), then to the columns (and lastly xoring 16 more bits of key material to produce the ciphertext). Strictly speaking, you need to specify the 4-bit s-box in order to fully evaluate it against ...


3

This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$ A \boxminus B \equiv (A-B)\pmod{2^{32}}. $$ You compute ...


3

The design documents for Rijndael explain exactly how the designers proved its resistance to differential cryptanalysis. Read their submission to the AES competition process, particularly Section 8.2 and the Annex. To understand their approach, it will probably help to understand differential cryptanalysis and read some of the related literature. You can ...


1

A good tutorial on differential cryptanalysis can be found in Stinson's book where he conducts differential attacks on reduced-round DES. He gives details on attacking 4 rounds of DES (which is relatively easy) and 6 rounds of DES (which is significantly harder) and this is enough to get the intuition on why extending the attack to full DES (which is 16 ...



Only top voted, non community-wiki answers of a minimum length are eligible