# Differential cryptanalysis in "The Block Cipher Companion"

I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher:

In Fig. 6.10 (page 126) there are some evaluations to the probabilities of success to correctly restore the bits 4-8 of k5 depending on a given count of choose messages. I try to compare my implementation with the given results. My problem currently is, that my implementation does not really compare good to the given results. For example: In the book they say, with 32 choosen messages, they restore the bits of k5 with a probability of 64% in 100 cases. I get roughly 28% with my implementation. So may be there is some problem with my implementation or the setup of the tests are a bit different. Is here anybody who implemented the differential cryptanalysis for the cipher in the book "The Block Cipher Companion"? Or does somebody has some test vectors?

• people may have not implemented it, but if you share your implementation, we may be able to point out some issue in it. May 13, 2019 at 18:47

## 1 Answer

I haven't studied this in detail, but the authors seem to give quite a comprehensive presentation of the differential attack.

Please note that this cipher is essentially the same as the one in Heys' Tutorial on Linear and Differential Cryptanalysis (easily found online by a google search) but the Sbox is different.

I have had students implement that attack successfully. So you can use that text as an extra reference while you are trying to sort things out.

In fact the authors themselves of the Block Cipher Companion state, on page 121, that

The probability of the characteristic we have identified could be too small to effectively distinguish the correct key information.

• I've also noticed that the cipher is the same as in the Hays tutorial. My attack works successful in general. But it seems that I need some more choosen messages than the authors of 'The Block Cipher Companion'. And this is exactly the point which makes me a bit doubtful. I can imagine that if there would be a mistake in my implementation, it would not work I think. if I deliberately make a mistake, cryptanalysis won't work. For my test I use exactly the same differential as the authors. There is just one point which is not clear: Is the message count for them before oder after the filter? May 14, 2019 at 6:38
• Are there any links to implementations? May 18, 2019 at 7:38
• I‘m afraid the authors gave no links to their implementation. May 18, 2019 at 7:54