I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? For example AES algorithm or LED


The maximum differential probability of SBoxes should be first calculated. Then, after finding the number of active SBoxes for some defined rounds, you should calculate the number of overall chosen plaintexts-ciphertexts by raising the probability to the power of the number of reached active SBoxes for this defined rounds. If the number that we computed, exceeds of some bounds of today's computational power, then this defined round is enough for resistance against differential cryptanalysis. Example: in Present cipher, any five round differential characteristics have a minimum of ten active boxes. If the maximum differential probability of a Present SBox is $2^{-2}$, so for five rounds, that has 10 active SBoxes, is $2^{-10}$. It means that for 5 rounds, this cipher is not immune against differential attack and by gathering $2^{10}$ numbers of chosen plaintext-chosen ciphertexts, we can set up this attack. But in own Present cipher, it has 25 rounds, it has 50 active SBoxes, so $(2^{-2})^{50}$ results in $2^{100}$, it means for setting up this attack, we need $2^{100}$ numbers of chosen plaintexts-chosen ciphertexts that it exceeds the amount available of today's computational power. So, we proved Present is immune in 25 rounds and 50 active SBoxes against differential attack.

  • $\begingroup$ Thanks a lot, I need more explanation about this points $\endgroup$ – Maha Ibrahim Aug 30 '18 at 16:57
  • $\begingroup$ Thanks a lot, I want to be sure about this points,1- the maximum differential probability of any 4 bit sbox is 2^2 and for 8 bit sbox is 2^3?, 2- how can I know the bounds of the today's computational power to make decision about the number of rounds?, 3- if there is a reference that can help me for deep understanding. Thanks again $\endgroup$ – Maha Ibrahim Aug 30 '18 at 17:07
  • $\begingroup$ The maximum differential probability of any 4-bit SBox is not 2^2. probability is a quantity between 0 and 1. For calculating the probability of an SBox, you should use the XOR table. For more explanation about this points, you should read papers in this subject. $\endgroup$ – Arsalan Vahi Aug 31 '18 at 7:49
  • $\begingroup$ For the 25 round calculation you used differential probability to the power of number of active s-boxes. But for the 5 round calculation you used the differential probability to the power of the number of rounds. Surely the 5 round calculation should yield $2^{-20}$ rather than $2^{-10}$? $\endgroup$ – Ella Rose Mar 26 '19 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.