2
$\begingroup$

I am studying differential analysis and have a question.

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an S-BOX, the output of which is xor'd with $K_2$). This case is very simple. Using the main property of XOR we can get differential that independent from KEY.

How do we can get such differential if instead of XOR we use addition modulo $2^{32}$? When using XOR, we have $(m_1 \oplus k_1) \oplus ( m_2 \oplus k_1 ) = m_1 \oplus m_2$. What operation need apply to get rid of the key when using addition modulo $2^{32}$?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
7
$\begingroup$

This is called an Even-Mansour cipher.

Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$ A \boxminus B \equiv (A-B)\pmod{2^{32}}. $$

You compute the differential distribution table for $S$ in the same way, but replace $\oplus$ with $\boxminus$.

Improve this answer
$\endgroup$
1
  • $\begingroup$ thank you very much for your answer. ((m1 - k1) mod c) - (m2 - k1) mod c) mod c ==> ((m1 mod c) - (k1 mod c) - (m2 mod c) + (k1 mod c)) mod c ==> ((m1 mod c) - (m2 mod c)) mod c. So we get rid of the key. $\endgroup$
    – Vladislav Koroteev
    Nov 21, 2013 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.