I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES:

enter image description here

I cannot fully understand what he is doing but it seems like it iterating over all possible intermediate differentials that lead to (a,b). Is that really the case?

  • $\begingroup$ Have you looked at Appendix A (it contains a proof, which may be helpful)? By the way, the authors are both female (use she, not he). $\endgroup$ – Aleph Mar 10 '17 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.