# How do we find differentials in differential cryptanalysis when we don't the details about the S-boxes

I m new to cryptanalysis and trying to understand differential cryptanalysis. I have read the paper by Howard M. Heys. I understood the concept of differentials but I m not able to understand how to calculate the probability of a differential to occur when we don't know any information regarding the S-boxes.

It is given that, we give 2 inputs with a difference of say, x to an S-box and get outputs of difference y and in this way, we calculate the probabilities of all the differentials possible.

• But in general, the details of the S-boxes of a cipher are not disclosed (as far as I know, pls correct me if I m wrong), so how do we calculate these probabilities for each S-box?

• Can we somehow use differential cryptanalysis even if we don't know the details of S-boxes used in the cipher?

• @kelalaka thanks for responding. I have a follow-up question. Can we somehow use differential cryptanalysis even if we don't know the details of S-boxes used in the cipher? Commented Oct 28, 2021 at 12:42
• @kelalaka thanks. I will definitely read them. Commented Oct 28, 2021 at 12:50

## 2 Answers

In Cryptography we play with the Kerckhoffs's principles, in short, we can say that everything is known but not the secret key.

$$\text{There is no security with obscurity!}$$

Therefore;

The details of the S-boxes of a cipher are not disclosed

This is completely false. The designers don't need to give the full details of their s-boxes, however, usually, they provide, as we see in the AES case;

It is the attacker side to analyze even more than the designer to see a weakness in their design, or one may see errors on the calculations and provide the correct one, as in OCB2, the history full of examples.

Can we somehow use differential cryptanalysis even if we don't know the details of S-boxes used in the cipher?

Yes, that is possible, however, that will be impractical and will not provide a better attack than the bruteforce ( since it is a blackbox).

For the beginners of Differential and Linear attack a tutorial and a book is a must;

The Sbox package of the SageMath is the helper to analyze the S-Boxes.

And, if you want to study this field, always read the original paper, too;

There's an interesting case study here with the AES finalist Twofish. Twofish uses key dependent S-boxes and so we do not know the S-boxes, only their means of construction. Nevertheless several papers have proposed differential attacks on the design (Murphy and Robshaw, Shiho Moriai and Yiun Lisa Yin, Ferguson).

• Technically we know all of the design ( opposing to the OP's; we don't know the details ) that still doesn't make it a block-box design, right? Commented Oct 28, 2021 at 16:19