I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ?

I have read "Linear and Differential Cryptanalysis" by Howard M. Heys, but I am not able to find it there, he only takes it for granted.

Thank you for your answers


1 Answer 1


is it because we already know the output or why ?

It's one of the strategies we use to turn a distinguisher (which a differential or linear characteristic) into a key recovery attack.

Here's how it goes; suppose we have a distinguisher that works over R-1 rounds, that is, given a number of plaintext/ciphertext pairs, it can tell us (with advantage over random guessing) whether or not those pairs there generated via the R-1 cipher (and an unknown key).

Then, we can then test guesses for the subkey on the last round on the full R round cipher. We take our guess of the subkey (or a subset of that subkey, if our distinguisher doesn't rely on the entire ciphertext block), and then decrypt it through the round function to get the intermediate state after R-1 rounds. Then, we can use our R-1 distinguisher to check whether the known plaintext and our guesses that the R-1 state are consistent with the R-1 cipher; if it is, then our guess for the subkey (or subset) is likely accurate.

If successful, this gives us some of the subkey bits; depending on how the key scheduling works, we may be able to deduce some key bits directly; alternatively, we may need to rely on other distinguishers (based on our knowledge of some of the subkey bits) to obtain others.

Obtainly, the details of how this works can vary significantly depending on the details of the cipher; this is just the general strategy.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.