This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I implemented the attack for different cipher and to give you some more details, in this question we talk about a cipher which is could CipherFour from the book "The Block Cipher Companion" (picture with scheme following:).
So far so good. My implementation works. I get some characteristics and differentials and can recovery the subkeys successfully. While currently doing some more evaluation that checking if the implementation works in general, I got some problems with the filter procedure.
I implemented the filtering process like in the book "The Block Cipher Companion". There are two things they do:
- Check the cipher text difference and evaluate the difference on the last sboxes: for all inactive sboxes, there must the the difference 0 (if not, discard the pair).
- Process the expected difference through the last sbox and note the possible output difference in the ciphertext. If the Pair does not match one of the possible output diffs, discard the pair.
The filtering works in general, there stay some pairs after the filter. But there seems to be some problem and I don't know what it is or if it could be some case of random.
It should be self explaining what is there going on. I generated 5000 pairs with the wanted input difference. Then I do filtering and there stay 73 pairs. Then I do key recovery and get the right sub-bits from the subway.
Then I do the key recovery with the 5000 pairs (right and wrong pairs). It produces the same output.
In the literature it is written, that the filtering will make it easier to recover the right key and wrong pairs will give some more false hit to wrong subkeys.
Is there anybody who could help me? Could there be a problem with the implementation or I don't know what...