2
$\begingroup$

Suppose we are working with a cipher with the same general structure as AES.

I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher probability than wanting it to hold for all rounds from the first to the penultimate), recover the first subkey, then proceed from there, always crafting plaintext such that the differential is likely to hold for the next round from which I need the subkey.

I'm probably missing something basic, but why can't we attack like this instead of working our way up from the last subkey?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ You can and more Boomerang attack Dawid Wagner 1999. Your premise is flawed since we expect the differential occurs more probability in the first round. Anyway, read Boomerang attack... $\endgroup$
    – kelalaka
    Commented Apr 12, 2022 at 10:12

1 Answer 1

Reset to default
0
$\begingroup$

I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher probability than wanting it to hold for all rounds from the first to the penultimate), recover the first subkey

How would this work? If we have a differential through the first round (and the rest of the cipher acts effectively randomly), how can we determine if the differential holds by examining the ciphertext?

Or, are you thinking of a different strategy?

Improve this answer
$\endgroup$
1
  • $\begingroup$ You are right, we need to examine the ciphertext to determine if the differential holds or not, otherwise there is no way to know whether or not it held in the first round too. So there is no way to reduce the probability like I mistakenly said. Anyways, is it true that once we have a sufficient number of "good pairs" we can start key recovery from the first to the last round? That is, by considering the possible pairs of inputs (instead of outputs) to the first (instead of last) sbox layer that produce our desired difference, and deriving key candidates from there? It seems the same to me. $\endgroup$
    – xhuliano
    Commented Apr 12, 2022 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.