I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't understand the initial pairs preperation step:
In the paper the author say to obtain $2^{13}$ plaintext $P$ and another $2^{13}$ plaintext $P^{'}$ which are equal in the second and third nibble and from those plaintexts we can obtain $2^{13}$ pairs.
But where did the $2^{13}$ come from if the input difference of the differential trail has two active nibbles and each nibble is $4\;bits$ so we have $2^8$ possible input differences for the pairs ?