In differential cryptanalysis for DES, why is F(0...0) assumed to be always 0...0?

Question

In this paper about differential cryptanalysis, an attack on 2n-Round DES is described.

The attack is all about finding certain inputs for DES rounds, for which the output of the round function Fis equal to the input with high probability.

For the inputs given in the paper, one half is always assumed to consist of only zeros. Also, it is assumed that the round function for that all-zero input always yields zero with probability one:

F(0...0) = 0...0

To my understanding the round function F works as follows: Expand the input, then xor the key, then perform substitutions. That conflicts with the assumption described in the paper.

How can the round function always yield zeroes for an all-zero input, independently of the key?

Answer 1

The question arises from a misunderstanding: The attack described in the paper does not work with actual inputs and outputs, but with differences between them. Hence Differential Cryptanalysis.

Given two messages m1 = (l1, r1) and m2 = (l2, r2) with equal right halves r1 = r2, it obviously follows that r1 - r2 = 0...0 and F(r1) - F(r2) = 0...0.