Minimum number of active s box to be resistance to differential cryptanalysis

Question

I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? For example AES algorithm or LED

Answer 1

The maximum differential probability of SBoxes should be first calculated. Then, after finding the number of active SBoxes for some defined rounds, you should calculate the number of overall chosen plaintexts-ciphertexts by raising the probability to the power of the number of reached active SBoxes for this defined rounds. If the number that we computed, exceeds of some bounds of today's computational power, then this defined round is enough for resistance against differential cryptanalysis. Example: in Present cipher, any five round differential characteristics have a minimum of ten active boxes. If the maximum differential probability of a Present SBox is $2^{-2}$, so for five rounds, that has 10 active SBoxes, is $2^{-10}$. It means that for 5 rounds, this cipher is not immune against differential attack and by gathering $2^{10}$ numbers of chosen plaintext-chosen ciphertexts, we can set up this attack. But in own Present cipher, it has 25 rounds, it has 50 active SBoxes, so $(2^{-2})^{50}$ results in $2^{100}$, it means for setting up this attack, we need $2^{100}$ numbers of chosen plaintexts-chosen ciphertexts that it exceeds the amount available of today's computational power. So, we proved Present is immune in 25 rounds and 50 active SBoxes against differential attack.