0
$\begingroup$

This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I implemented the attack for different cipher and to give you some more details, in this question we talk about a cipher which is could CipherFour from the book "The Block Cipher Companion" (picture with scheme following:). enter image description here

So far so good. My implementation works. I get some characteristics and differentials and can recovery the subkeys successfully. While currently doing some more evaluation that checking if the implementation works in general, I got some problems with the filter procedure.

I implemented the filtering process like in the book "The Block Cipher Companion". There are two things they do:

  1. Check the cipher text difference and evaluate the difference on the last sboxes: for all inactive sboxes, there must the the difference 0 (if not, discard the pair).
  2. Process the expected difference through the last sbox and note the possible output difference in the ciphertext. If the Pair does not match one of the possible output diffs, discard the pair.

The filtering works in general, there stay some pairs after the filter. But there seems to be some problem and I don't know what it is or if it could be some case of random.

If I apply the recovery process to the filtered pair list it gets the same result if I apply it to the unfiltered pair list. See my following screenshot: enter image description here

It should be self explaining what is there going on. I generated 5000 pairs with the wanted input difference. Then I do filtering and there stay 73 pairs. Then I do key recovery and get the right sub-bits from the subway.

Then I do the key recovery with the 5000 pairs (right and wrong pairs). It produces the same output.

In the literature it is written, that the filtering will make it easier to recover the right key and wrong pairs will give some more false hit to wrong subkeys.

Is there anybody who could help me? Could there be a problem with the implementation or I don't know what...

| improve this question | |
$\endgroup$
  • $\begingroup$ Obviously something is wrong, not sure how it can be addressed here, since it is likely implementation related and such questions are off topic. Did you try with different values? This is cipher essentially the Heys' SPN cipher from his tutorial on linear and differential cryptanalysis easily discoverable online. He does have some numerical values for his trial with differential cryptanalysis. Write items 1 and 2 more mathematically so we can tell if at least your description of the idea of filtering is absolutely correct or not. This won't help with the implementation of course. $\endgroup$ – kodlu Aug 30 '19 at 22:39
  • $\begingroup$ where should I ask that question @kodlu? I tried different keys, I tried different characteristics, I tried different sboxes to attack in the last round, I used different pairs. This cipher is like the heys cipher, but not the same. One item example (it is from the book the block cipher companion and my implementation does exactly the same, that's why I think my implementation is okay). I attack the sboxes 0010 (0 = inactive sbox, 1 = active sbox) -> this is bit 4-7. Expected difference is (0,0,2,0). On checking DDT, ciphertextdiff must have (0,0,x,0) and x is one of {1,2,9,a} (hex) $\endgroup$ – chris000r Aug 31 '19 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.