Strength of sboxes is generally measured by different properties eg non linearity, fixed points etc. If confusion is provided by Mixed Mode Modular Arithmetic (eg as in IDEA), how to measure the strength of this type of confusion layer? Also, my sample mixed mode modular arithmetic based confusion layer takes 64 bits input and generates 64 bit output.


1 Answer 1


The same principles (linear and differential cryptanalysis being most prominent) apply to Mixed mode confusion layers, though in general you may be limited to experimental analysis since the theory of such mappings is not so developed, being a mix of different algebraic structures.

If you have to do experimental cryptanalysis a $64\times 64$ confusion layer will clearly be too large to experimentally compute exhaustive linear approximation tables, or whatever other tool you are using.

One specific innovation by Havard Raddum (see springerlink or his site at researchgate he will probably gladly send you a pdf) in his 4 round cryptanalysis of reduced IDEA-X/2 (a weakened variant) was to include "multiplicative differentials", after all you can apply differential cryptanalysis to any group.

If you focus on the $16\times 16$ substructures operating on "words" you can isolate the groups used in IDEA. However, this is quite difficult as well since a distributive law between the three group operations namely

  • $16$ bit XOR
  • Addition modulo $2^{16}$
  • Multiplication modulo $2^{16}+1$ where the all zero element is treated as the modulus $2^{16}+1.$

does not hold. Nor do the designers ever use the same group operation in a contiguous manner.

You may find reading Raddum's paper interesting since he makes a stab at treating multiple groups in a differential attack. Then you can see the papers which cited his.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.