In this paper about differential cryptanalysis, an attack on
2n-Round DES is described.
The attack is all about finding certain inputs for DES rounds, for which the output of the round function
Fis equal to the input with high probability.
For the inputs given in the paper, one half is always assumed to consist of only zeros. Also, it is assumed that the round function for that all-zero input always yields zero with probability one:
F(0...0) = 0...0
To my understanding the round function
F works as follows: Expand the input, then xor the key, then perform substitutions. That conflicts with the assumption described in the paper.
How can the round function always yield zeroes for an all-zero input, independently of the key?