I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult points.

This is the distinguisher based on differential-linear cryptanalysis:

enter image description here

And this is the article I'm reading:

enter image description here

Q1) [Note that the differential probability p' is the probability for the expected difference in the required subset of bits, which is usually different (higher) than the probability of the differential characteristic with the full block output difference, so the best characteristic for our purposes may be different than the best ordinary characteristic.]

What is the difference between the expected difference in the required subset of bits and the full block output difference? Because I didn't get it, I didn't understand the best ordinary characteristic. as well. At first, I thought the expected difference in the required subset of bits means that $\lambda_P$'s concerned bit. But at that time, what is the the full block output difference? This is so confusing.

Q2) [This assumption is not necessarily accurate, for example, there might be other high probability differential characteristics with the same plaintext difference, but with different (or same) parity of the subset of bits of the difference. Thus, this approximated probability should be verified by the designer of an attack, and if possible, he should perform a more accurate computation of the probability, or check it experimentally.]

I didn't get the detail in this sentence. Does this sentence mean that this attack is not practical? Can you give me the meaning of this sentence?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.