Im new to cryptoanalysis and started reading A Tutorial on Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody help me please? He uses this example of simple spn. enter image description here

  1. How does removing k1 mixing or k5 mixing affect our attack? As far as I have understood if we dont use k1 we just skip all S1 sboxes and first permutation and start attack at second key mixing, but I just dont understand why. There is still difference with some probability for if we use generated pairs of texts. Or do we generate pair at start of k2 key mixing?
  2. Author says we need to find difference with good probability at start of last round and then just brute force parts of last round subkey on every generated text-pairs. But if we check key on every generated pair and not only right ones, why do we even divide them into right and wrong pairs?
  3. If we attack r-round cipher, we find differential for r-1 round and then undo round by round. But when we go to only 1 round we still got k1 and k2 keys that we dont know. What do we do then?(because for r=1 round we need to find differential for 0 round)
  4. How do we attack test cipher with only 1 round and keys k1 and k2 mixing with S-block between them?

I know I have a lot of question but would be happy if anyone answered atleast one of them!



Browse other questions tagged or ask your own question.