The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-plaintext attack setting.
As the framework is scalable, suppose a cipher with 16 bit block size of 3 rounds is constructed. The framework generates the necessary constant parameters (RC, key matrices, linear layer matrices etc.) for designing a cipher along with deterministic differential characteristics for key recovery. For the above setting with 2 differential characteristics embedded, it generates as
How the designer knowing the tweak pairs and the Plaintext differences can be able to recover the key in a short span of time in contrast to an attacker not knowing any of these parameters.
How the key can be recovered using plain differential cryptanalysis in this setting, I am confused or not getting the elaboration presented on page 17 and page 19? Will the designer be able to recover the round keys or the main key being input to cipher?
According to the article, only one differential characteristics (tweak pair) is able to recover the key, but for enhanced security more should be embedded? How one differential characteristics (tweak pair) embedded over r-1 round will be able to recover the key?