2
$\begingroup$

I am reading Differential Attack from Stinson-Cryptography: Theory and Practice on a toy example of S-box(block Cipher) with Nr=n=m=4.

I am mainly confused in the following definition

Definition 3.1 : Let $\pi_S:\{0,1\}^m\rightarrow \{0,1\}^n$ be a S-box. Consider an (ordered) pair of bitstrings of length $m$, say $(x,x^*)$. We say that input XOR of the S-box is $x\oplus x^*$ and the output XOR is $\pi_S(x)\oplus\pi_S(x^*)$.

Now, the point of confusion is how can the output of the S-box be separated as $\pi_S(x)\oplus\pi_S(x^*)$ when the input is $x\oplus x^*$?

For eg:
We choose the two plaintexts $x_1$ and $x_2$. Then we have $x_{12}=x_1\oplus x_2$
Now, we have round $1$ key $K^1$, we get $^1u^1=x_1\oplus K^1$ and $^2u^1=x_2\oplus K^1$
Then, we apply $\pi_S$ on the above, we get $^1v^1=\pi_S(^1u^1)=\pi_S(x_1\oplus K^1)$ and $^2v^1=\pi_S(^2v^1)=\pi_S(x_2\oplus K^1)$
Therefore, $^1v^1\oplus\enspace ^2v^1=\pi_S(^1u^1)\oplus \pi_S(^2v^1)=\pi_S(x_1\oplus K^1)\oplus \pi_S(x_2\oplus K^1)$

Now, I don't understand that How, $^1v^1\oplus\text{ }^2v^1=\pi_S(x_1)\oplus\pi_S(x_2)$?

Also, I don't know whether I got the definition or not?

EDIT: Notation Explanation:
$^iu^j$ denotes $i$th plaintext( either plaintext if j=1 or cypertext after $j-1$th round) XOR-ed with $j$th Round Key $K^j$
Also, note that $^iu^j=\pi_P(^iv^{j-1})$ if $j>1$, where $\pi_P$ is the permutation i.e diffusion layer.

$\endgroup$
2
  • $\begingroup$ what is this crazy notation $^i u^j$? we round 1 key 1? use verbs $\endgroup$
    – kodlu
    Commented Apr 16, 2020 at 11:49
  • $\begingroup$ @kodlu I hope that the edit makes the notation clear. Also, I have corrected the mistake. Thanks for pointing out. Now, Can You answer it? $\endgroup$
    – Kumar
    Commented Apr 16, 2020 at 13:44

1 Answer 1

2
$\begingroup$

Definition 3.1 : Let $\pi_S:\{0,1\}^m\rightarrow \{0,1\}^n$ be a S-box. Consider an (ordered) pair of bitstrings of length $m$, say $(x,x^*)$. We say that input XOR of the S-box is $x\oplus x^*$ and the output XOR is $\pi_S(x)\oplus\pi_S(x^*)$.

Now, the point of confusion is how can the output of the S-box be separated as $\pi_S(x)\oplus\pi_S(x^*)$ when the input is $x\oplus x^*$?

The crux of your question is above. Differential cryptanalysis is a chosen plaintext attack.

The attacker presents the Sbox (more generally the full cipher) with two sets of chosen plaintexts with a chosen difference $d$

$\{u_i: 1\leq i \leq N\},\quad \{u_i\oplus d: 1\leq i \leq N\}$

and computes the set of output distributions corresponding to this input difference

$\{\pi_S(u_i)\oplus \pi_S(u_i\oplus d):1\leq i \leq N\}.$

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.