1
$\begingroup$

I have read the proof of AES's resistance against differential cryptanalysis. In the proof the authors show that there is no single differential trail with prop ratio higher than $2^{-300}$ over 8 rounds. I understand that part but it does not prove that there is no differential with prop ratio higher than $2^{1-n} = 2^{-127}$ because we could end up with the same differential using many different trails. I have read in Jon Daemen's dissertation that in a well constructed cipher a single trail should dominate all the other trails. Is it proven for AES that, in fact, no different differential trails combine to give a significantly higher prop ratio of a differential? If yes, how do they prove that? If no, why is AES assumed to be proven resistant against linear and differential cryptanalysis?

Links:

The proof - https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf.

The dissertation- https://cs.ru.nl/~joan/papers/JDA_Thesis_1995.pdf

$\endgroup$
1
$\begingroup$

The short answer is that we don't. There are several block ciphers (most famously PRESENT) where multiple linear trails combine to form a stronger distinguisher. The collection of trails is called a linear hull. The concept has been extended to differential-linear cryptanalysis, but I don't have any reference for a "difference hull". These multiple trail effects seem to be more pronounced in lightweight designs.

The analytic approach seems to be to assume that hulls don't contribute significantly unless they can be demonstrated to do so. If the term "resistant" is used rather than "immune", then this assumption does not feel too unreasonable.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.