1
$\begingroup$

I have been studying on algebraic methods on cryptanalysis of block ciphers. This is where I am reading from currently

I need some help to understand Attack C.

Excluding equations from the first r rounds till which the differential characteristic holds, we are just left with the SBox equations and one constraint from the input difference to the $(r+1)^{th}$ round S Boxes as a consequence of the r round differential, for each of the plaintext pairs.

I cannot understand how they are considering an equivalent structure with 2R -1 rounds from C' to C''.

A brief explanation would be really helpful.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.