1
$\begingroup$

Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential attack will be formed when using this differential.

How many rounds would the block cipher need in order to be resistant to differential cryptanalysis?

$\endgroup$

closed as unclear what you're asking by SEJPM Oct 15 '18 at 12:47

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ Is this homework? What have you tried so far? $\endgroup$ – puzzlepalace Apr 25 '18 at 15:52
  • 1
    $\begingroup$ What does probability 2^7 mean? Probability should be a value between 0 and 1. $2^7$ is 128, which is not a value between 0 and 1. Do you mean probability 128/256 or something similar? $\endgroup$ – Ella Rose Apr 25 '18 at 16:23
  • $\begingroup$ I'd guess $1 \over 2^7$ but we should not have to guess. $\endgroup$ – Maarten Bodewes Apr 25 '18 at 20:21
  • $\begingroup$ again, this looks like homework, and "resistant to DC" is a somewhat subjective term. Tell us, what is the differential probability if you iterate two rounds? three? r? $\endgroup$ – kodlu Apr 30 '18 at 1:12
  • $\begingroup$ I've put this question on hold as "unclear what you're asking" until it the questions in the above comments are resolved. $\endgroup$ – SEJPM Oct 15 '18 at 12:47
0
$\begingroup$

I think that you typed the probability of two rounds incorrect and it should be $2^{-7}$. By assuming that, you should choose the numbers of rounds in a way that the number of (chosen plaintexts, chosen ciphertext), exceeds of the number of (plaintext, ciphertext) that are available(for example with today's computational devices is bounded). As you told the probability for two rounds, if you choose 15 rounds, the number of (chosen plaintexts, chosen Ciphertexts) will be about $15 \times 7 = 105$, that we can use it as a bound for this. You should be considered that it is a theoretical bound and choosing the number of rounds based on 2 rounds estimation is somehow not precious.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.