I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.

But I don't understand the initial pairs preperation step: ![first step of impossible differential cryptanalysis on Mini-AES

In the paper the author say to obtain $2^{13}$ plaintext $P$ and another $2^{13}$ plaintext $P^{'}$ which are equal in the second and third nibble and from those plaintexts we can obtain $2^{13}$ pairs.

But where did the $2^{13}$ come from if the input difference of the differential trail has two active nibbles and each nibble is $4\;bits$ so we have $2^8$ possible input differences for the pairs ?

  • $\begingroup$ In fact in the public (non paywall) version of the paper available on the author's page geocities.ws/dearphael/ImpMiniAES.pdf the same argument starts with obtain $2^{11}$ plaintexts P and P’ which are equal in the second and third nibble and differ in the other nibbles. Since each P and P’ forms a pair with passive second and third nibbles while the first and third nibbles are active, we then have $2^{11}$ such pairs. $\endgroup$
    – kodlu
    Mar 14, 2023 at 15:22
  • $\begingroup$ so the author himself presents two inconsistent versions. $\endgroup$
    – kodlu
    Mar 14, 2023 at 15:23
  • $\begingroup$ where does $2^{11}$ comes from? do we take variations of passive nibble or we just use a constant value and only change active varitaions ? @kodlu $\endgroup$
    – siba36
    Mar 18, 2023 at 15:47
  • $\begingroup$ That's exactly what's unclear to me, and it seems the author has two versions of the same claim. $\endgroup$
    – kodlu
    Mar 18, 2023 at 16:06
  • $\begingroup$ well, regardless of the paper what do you think the number of the initial pairs should be? @kodlu $\endgroup$
    – siba36
    Mar 18, 2023 at 17:26

1 Answer 1


The number of the initial plaintext $2^{13}$ was chosen to satisfy the final equation: enter image description here enter image description here enter image description here

so using all the probabilites mentioned in the paper and if we put $2^{x-7}$ instead of $2^{6}$ in the final equation we'll get: $$ 2^{8}(1-2^{-3})^{2^{x-7}} \approx 2^{8}e^{-2^{x-7-3}} \approx 0$$

By plotting this equation we'll get: enter image description here

So the minimum value of $x=13$ and thus the number of initial plaintext should be $2^{13}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.