Im new to cryptoanalysis and started reading A Tutorial on
Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody help me please? He uses this example of simple spn.
- How does removing k1 mixing or k5 mixing affect our attack? As far as I have understood if we dont use k1 we just skip all S1 sboxes and first permutation and start attack at second key mixing, but I just dont understand why. There is still difference with some probability for if we use generated pairs of texts. Or do we generate pair at start of k2 key mixing?
- Author says we need to find difference with good probability at start of last round and then just brute force parts of last round subkey on every generated text-pairs. But if we check key on every generated pair and not only right ones, why do we even divide them into right and wrong pairs?
- If we attack r-round cipher, we find differential for r-1 round and then undo round by round. But when we go to only 1 round we still got k1 and k2 keys that we dont know. What do we do then?(because for r=1 round we need to find differential for 0 round)
- How do we attack test cipher with only 1 round and keys k1 and k2 mixing with S-block between them?
I know I have a lot of question but would be happy if anyone answered atleast one of them!
