I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.

But I don't understand the initial pairs preperation step: ![first step of impossible differential cryptanalysis on Mini-AES

In the paper the author say to obtain $2^{13}$ plaintext $P$ and another $2^{13}$ plaintext $P^{'}$ which are equal in the second and third nibble and from those plaintexts we can obtain $2^{13}$ pairs.

But where did the $2^{13}$ come from if the input difference of the differential trail has two active nibbles and each nibble is $4\;bits$ so we have $2^8$ possible input differences for the pairs ?

  • $\begingroup$ In fact in the public (non paywall) version of the paper available on the author's page geocities.ws/dearphael/ImpMiniAES.pdf the same argument starts with obtain $2^{11}$ plaintexts P and P’ which are equal in the second and third nibble and differ in the other nibbles. Since each P and P’ forms a pair with passive second and third nibbles while the first and third nibbles are active, we then have $2^{11}$ such pairs. $\endgroup$
    – kodlu
    Mar 14 at 15:22
  • $\begingroup$ so the author himself presents two inconsistent versions. $\endgroup$
    – kodlu
    Mar 14 at 15:23
  • $\begingroup$ where does $2^{11}$ comes from? do we take variations of passive nibble or we just use a constant value and only change active varitaions ? @kodlu $\endgroup$
    – siba36
    Mar 18 at 15:47
  • $\begingroup$ That's exactly what's unclear to me, and it seems the author has two versions of the same claim. $\endgroup$
    – kodlu
    Mar 18 at 16:06
  • $\begingroup$ well, regardless of the paper what do you think the number of the initial pairs should be? @kodlu $\endgroup$
    – siba36
    Mar 18 at 17:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.