If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output?

This seems hard to do since the substitution operation is non-invertable for DES.


1 Answer 1


In DES cryptanalysis this is in general achieved by trying all 4 possible preimages for the given S-box output.

In particular, for S-box $S_i$ a 6-bit input (say $b_1b_2 ... b_6$) produces a 4-bit output $a_1a_2a_3a_4$. The s-boxes can then be written as a 2-dimensional array of size 4x16. The input bits $b_1b_6$ determine the row of the s-box table and the input bits $b_2b_3b_4b_5$ determine the column. The value of the output corresponding to the 6-bit input is the value at cell $S_i[b_1b_6][b_2b_3b_4b_5]$.

Therefore, given an output $a_1a_2a_3a_4$ there are exactly 4 possible inputs corresponding to this output, one in each row of the array corresponding to S-box $S_i.$

If additional information is available - such as Hamming weights within some side channel attacks - this can be done more efficiently.

  • $\begingroup$ sorry but i didn't understand the answer can you explain it in more detail $\endgroup$
    – siba36
    Commented Mar 19, 2019 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.