I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round using every possible keybits for active sboxes and traces differential up to r-1 round. In second work differential goes to the end and bruteforce goes only for a number of keys and author finds k0 and k1 at the same time. Which method is a basic to find round keys?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ What do you mean with "a basic"? A textbook approach for differential cryptanalysis ? $\endgroup$– Maarten Bodewes ♦Sep 17, 2020 at 18:12
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
The approach in the Heys’ tutorial where the author uses the approach
bruteforce last round using every possible keybit [at the output of] active sboxes and trace differentials up to [the output of] $r-1$ rounds
is more fundamental because it is more general. One needs to meet in the middle at the output of some round and check which value for the guessed keybits results in the highest probability differential for the set of plaintext/ciphertext pairs with a fixed input difference.
It is most convenient and natural to use meet in the middle at the input to the last round, and let the guessed key bits be the bits from the last round.
In fact the other (amazing king) reference is essentially using the same approach (whether the author of the webpage realizes it) since that is a one round cipher with $r=1,$ so $r-1=0,$ and the $r-1$ differential is the input (plaintext) difference.
-
$\begingroup$ Thanks for a clear answer! But can you explain, what for do we need to divide pairs into right and wrong, even though we use every generated pair for round key brute forcing?We dont care if those pairs are right or wrong. $\endgroup$– KirillSep 18, 2020 at 13:42