I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round using every possible keybits for active sboxes and traces differential up to r-1 round. In second work differential goes to the end and bruteforce goes only for a number of keys and author finds k0 and k1 at the same time. Which method is a basic to find round keys?

  • $\begingroup$ What do you mean with "a basic"? A textbook approach for differential cryptanalysis ? $\endgroup$
    – Maarten Bodewes
    Sep 17, 2020 at 18:12

1 Answer 1


The approach in the Heys’ tutorial where the author uses the approach

bruteforce last round using every possible keybit [at the output of] active sboxes and trace differentials up to [the output of] $r-1$ rounds

is more fundamental because it is more general. One needs to meet in the middle at the output of some round and check which value for the guessed keybits results in the highest probability differential for the set of plaintext/ciphertext pairs with a fixed input difference.

It is most convenient and natural to use meet in the middle at the input to the last round, and let the guessed key bits be the bits from the last round.

In fact the other (amazing king) reference is essentially using the same approach (whether the author of the webpage realizes it) since that is a one round cipher with $r=1,$ so $r-1=0,$ and the $r-1$ differential is the input (plaintext) difference.

  • $\begingroup$ Thanks for a clear answer! But can you explain, what for do we need to divide pairs into right and wrong, even though we use every generated pair for round key brute forcing?We dont care if those pairs are right or wrong. $\endgroup$
    – Kirill
    Sep 18, 2020 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.