I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who reads this paper, please explain it to me.

  • 1
    $\begingroup$ @e-sushi I don't think this is a reference request. It's asking for for clarification of certain concepts used in a notable paper. It's limited in scope and doesn't lead to link-only answers. So I consider it on topic. $\endgroup$ Commented Jul 20, 2013 at 19:09
  • 3
    $\begingroup$ Can you please provide a link to the paper and quote the relevant section here? $\endgroup$
    – rath
    Commented Jul 24, 2013 at 19:46

1 Answer 1


We talk about cryptanalytic tools here. A differential trail describes how a certain difference evolutes throughout the cipher, which helps to find out a key in a standard differential cryptanalysis. Each trail activates certain non-linear operations (S-boxes), which contribute to its probability (a difference goes through a nonlinear operation probabilistically).

The biclique key search method works with a pair of such trails in a small part of the cipher. For the method to work, these trails must activate non-interleaving groups of S-boxes, otherwise more sophisticated conditions come into play.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.