I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" Cipher to attack.

I am successful to get the last key $k_5$. Just to say some words about the implementation:

  1. I search for a good differential, calculate the probability and generate a list of input pairs which satisfy my input difference.

  2. I let the pairs flow through the cipher (with the unknown keys) and then I guess the key bits of the sbox in the last round who are involved in my expected differential.

  3. Now I decrypt with my guessed key, undo the sbox and generate the difference of the pair. If it satisfys my expected value, I count it as a hit. The key with the highest counter is probably the right one. So far so good. I can recover $k_5$.

However I can not get it work with the $k_4$.

I do the following: Search for a good differential, calculate the probability and generate the list with pairs which satisfy my input difference. I let them flow through the cipher and decrypt the last round with my recovered $k_5$. Then I undo the sbox and apply my guessed $k_4$ undo the permutation and undo the next sbox. Then I generate the difference and compare to the expected...

But this does not work. Is there a general mistake in my doing here?


1 Answer 1


Generally, if you want to recover k4, you will need to use a 4-round differential trail rather than the same 5-round trail you used for k5. This is because when you generated the pairs for the latter attack, the actual intermediate differences that a "right pair" follows will not necessarily correspond to a "right pair" for the former due to the differential effect.

P/S: I know that this question is 3 years old but since there has not been any answer, hopefully mine would help others in the future.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.