2
$\begingroup$

I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis.

In the paper, although I've read many times, I couldn't understand their characteristic and how they computed the total probability. As far as I know, the attack is based on concatenating a linear part to a differential part, but Biham et al. proposed a different notation, and I am really confused with what they meant, and also how they calculated the total probability, based on picking the probability of differential part to be not equal to 1.

The exact part of the paper that creates my confusion is:

enter image description here

So, I don't get why their characteristic involves a linear part (which seems it is some kind of decrypting since it begins at 6th round and goes back up to 4th round, and I couldn't understand the reason of this too), then a concatenated differential part which is followed by another linear part, where the subscript says it is the second encryption. I guess subscripts somehow impose "differential pair" concept but have no idea how..

If I were to write the flow, I would express it basically as:

differential -- linear(round4-- rounnd 5 -- round 6).

My second question is, how they ended up with total probability

$$1/2 + 4pq^2$$

in this case?

Improve this question
$\endgroup$
1
  • $\begingroup$ I don’t have time to look at this for a while, so just a suggestion. See if there is either a set of talk slides or a recording by the authors. Usually (not always) things are made clearer there. $\endgroup$
    – kodlu
    Nov 13, 2020 at 21:19

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.