I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? For example AES algorithm or LED


1 Answer 1


The maximum differential probability of SBoxes should be first calculated. Then, after finding the number of active SBoxes for some defined rounds, you should calculate the number of overall chosen plaintexts-ciphertexts by raising the probability to the power of the number of reached active SBoxes for this defined rounds. If the number that we computed, exceeds of some bounds of today's computational power, then this defined round is enough for resistance against differential cryptanalysis. Example: in Present cipher, any five round differential characteristics have a minimum of ten active boxes. If the maximum differential probability of a Present SBox is $2^{-2}$, so for five rounds, that has 10 active SBoxes, is $2^{-10}$. It means that for 5 rounds, this cipher is not immune against differential attack and by gathering $2^{10}$ numbers of chosen plaintext-chosen ciphertexts, we can set up this attack. But in own Present cipher, it has 25 rounds, it has 50 active SBoxes, so $(2^{-2})^{50}$ results in $2^{100}$, it means for setting up this attack, we need $2^{100}$ numbers of chosen plaintexts-chosen ciphertexts that it exceeds the amount available of today's computational power. So, we proved Present is immune in 25 rounds and 50 active SBoxes against differential attack.

  • $\begingroup$ Thanks a lot, I need more explanation about this points $\endgroup$ Aug 30, 2018 at 16:57
  • $\begingroup$ Thanks a lot, I want to be sure about this points,1- the maximum differential probability of any 4 bit sbox is 2^2 and for 8 bit sbox is 2^3?, 2- how can I know the bounds of the today's computational power to make decision about the number of rounds?, 3- if there is a reference that can help me for deep understanding. Thanks again $\endgroup$ Aug 30, 2018 at 17:07
  • $\begingroup$ The maximum differential probability of any 4-bit SBox is not 2^2. probability is a quantity between 0 and 1. For calculating the probability of an SBox, you should use the XOR table. For more explanation about this points, you should read papers in this subject. $\endgroup$ Aug 31, 2018 at 7:49
  • $\begingroup$ For the 25 round calculation you used differential probability to the power of number of active s-boxes. But for the 5 round calculation you used the differential probability to the power of the number of rounds. Surely the 5 round calculation should yield $2^{-20}$ rather than $2^{-10}$? $\endgroup$
    – Ella Rose
    Mar 26, 2019 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.