I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link. I need a guess on the lower bound of the number of characteristics which could be found on a complete search for all characteristics, when attacking the last round key. Lets assume we use the cipher from the heys tutorial. There are 5 subkeys and 4 encryption rounds. The block size is 16 bits. There could be $2^{16} -1$ different differences in the last round. If we look to the round before (round 3), the number of possibilities depend on the number of active sboxes. And this is the point where I got stuck. Can somebody help me?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.