I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis.

In the paper, although I've read many times, I couldn't understand their characteristic and how they computed the total probability. As far as I know, the attack is based on concatenating a linear part to a differential part, but Biham et al. proposed a different notation, and I am really confused with what they meant, and also how they calculated the total probability, based on picking the probability of differential part to be not equal to 1.

The exact part of the paper that creates my confusion is:

enter image description here

So, I don't get why their characteristic involves a linear part (which seems it is some kind of decrypting since it begins at 6th round and goes back up to 4th round, and I couldn't understand the reason of this too), then a concatenated differential part which is followed by another linear part, where the subscript says it is the second encryption. I guess subscripts somehow impose "differential pair" concept but have no idea how..

If I were to write the flow, I would express it basically as:

differential -- linear(round4-- rounnd 5 -- round 6).

My second question is, how they ended up with total probability

$$1/2 + 4pq^2$$

in this case?

  • $\begingroup$ I don’t have time to look at this for a while, so just a suggestion. See if there is either a set of talk slides or a recording by the authors. Usually (not always) things are made clearer there. $\endgroup$
    – kodlu
    Commented Nov 13, 2020 at 21:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.