I'm wondering if anyone is aware of the best input difference to input into the system Heys outlines in his paper (http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf) to achieve a high probability differential characteristic w/ S-Box 4_1 and S_Box 4_3 active at the point of attack (4_2 and 4_4 inactive). I've built a function that tracks the input/output differences at all S-Box layers given an input difference to the system, but I'm unable to identify a 4 bit input difference that results in a very highly probable input difference at the point of attack. I've found that 0500 and D000 work some of the time, but they don't produce an anticipated input difference at the top of S-boxes 1 and 3 at a high enough frequency in order to crack key bits 1-4 and 9-12 with certainty. 0B00 works great for k5-8, k13-16. What is best for k1-4, k9-12?



1 Answer 1


So to attack those keys you need to create high probability input differences confined to $S_{41}$ and $S_{43}$.

Taking the same input differences as in Heys for $S_{42}$ and $S_{43}$ and working backwards suggests that an input difference of A or E confined to $S_{12}$ might work well. So I'd try



$∆P=0000 ~1110 ~0000 ~0000.$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.