I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and differential cryptanalysis by Howard M. Heys. May be some of you know that paper, if not have a look here:
https://www.engr.mun.ca/~howard/PAPERS/ldc_tutorial.pdf
In the meanwhile I got a good idea about the attack and how it can be practically done. In the most tutorials on the net the process works a little bit different as by Heys. My focus here is the extraction of the key bits. This part is described in section 4.4 in the Heys paper. Heys starts the extraction at the end of the cipher, he wants to recover the last subkey. He is doing it by trying to decrypt the last round (How can the other keys be obtained? Heys does not tell about). As far as I currently understand the differential cryptoanalysis, it is not possible to encrypt single rounds (until now I read the paper of Heys). Because: All I have are some plaintext / ciphertext pair which I could obtain from the user of the cipher. The user encrypts with the key which I want to recover by doing the attack. So it should not be possible to obtain single outputs of a specific round or decrypt a single round by the user. (Me as an attacker should not be able to interfere the decryption and get input / outputs of a round while the user uses the algorithm) Is my guess here wrong? How could the partial decryption could be done? I am referring to page 26 "A partial decryption..." and so on. Or what is Heys here doing?
Thanks for your attention and help.