I have been studying on algebraic methods on cryptanalysis of block ciphers. This is where I am reading from currently

I need some help to understand Attack C.

Excluding equations from the first r rounds till which the differential characteristic holds, we are just left with the SBox equations and one constraint from the input difference to the $(r+1)^{th}$ round S Boxes as a consequence of the r round differential, for each of the plaintext pairs.

I cannot understand how they are considering an equivalent structure with 2R -1 rounds from C' to C''.

A brief explanation would be really helpful.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.