What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The point of differential cryptanalysis is to find a differential characteristic with sufficiently high probability. You go through plaintexts until you find pairs that give you "enough" of a difference. You know only plaintext and ciphertext difference and you do not know difference between individual rounds, because cipher is a black box. (this is called filtration btw)
You use these pairs as a start for "key-recovery" by exploring the probabilities into possible subkeys in order to try to correlate the pairs. Every pair suggests several subkeys. Good pair suggests exactly one good subkey and few wrong subkeys. How many times the correct subkey is more frequent than other subkeys is signal to noise (S/N) ratio.
There's a paper that I read (which currently eludes me) that had a nice description of this where they used about 2GiB of data an javascript to extract the keys from TLS. You basically will want to look at the cipher of interest, and do a literature review to see how much data you'll need, unless you want to go into the mathematics yourself.
