Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences on output.

Filter by
Sorted by
Tagged with
0
votes
0answers
42 views

AES - Non-linearity hinders differential cryptoanalysis

Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
2
votes
0answers
63 views

Enhancing Differential-Linear Cryptanalysis

I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
0
votes
1answer
65 views

structure in modular arithmetic

I was playing around with modular arithmetic when I noticed something. \begin{align} g^k &= a \bmod n\\ g^{k+0.5(n-1)} &= b \bmod n \end{align} Then $a + b = n$, so you can also write $$g^{...
1
vote
1answer
45 views

How is it possible to define differential privacy on two databases that differ more than a single entry?

The original definition of $\epsilon-$differential privacy is for two databases $D_1$, $D_2$ that differ at most one entry and an randomized algorithm $A$. We have a bound on the probability ratio $\...
0
votes
0answers
62 views

Differential cryptanalysis filtering process

This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I ...
0
votes
0answers
43 views

Constructing Differential Characteristics for Feistel Cipher

I have to construct for every i-round of Feistel cipher, for $i \in \{3,4,5,6,7,8\}$, a differential characteristic with there properties: $Pr[\Delta x = a \overset{f_i}{\rightarrow} \Delta y = b] = ...
1
vote
0answers
36 views

Guess the number of characteristics in differential cryptanalysis

I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
1
vote
1answer
71 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
2
votes
1answer
86 views

Symmetric property of DDT of inverse function

Given a bijective function $F: \mathbb{F}_2^n \rightarrow \mathbb{F}_2^n$. The entry of the Difference Distribution Table (DDT) at row $\alpha$ and column $\beta$ is defined as $$DDT_{F}(\alpha,\...
1
vote
0answers
55 views

Implementation of differential cryptanalysis

This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay. I am working with the book "The Block Cipher Companion" on the topic differential ...
2
votes
1answer
81 views

Differential cryptanalysis in “The Block Cipher Companion”

I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher: In Fig. 6.10 (page 126) there are ...
2
votes
0answers
59 views

Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
1
vote
1answer
53 views

Calculate number of required pairs for differential cryptanalysis

I am currently doing some study on differential cryptanalysis. However, I have two open questions in the field. The first question is: How can I calculate the number of messages necessary for a ...
0
votes
0answers
48 views

good OmegaP for characteristic to use in differential cryptanalysis on DES

how to choose a good OmegaP(input difference) for the characteristic used in differential crypt-analysis on DES?
1
vote
2answers
142 views

Searching for a differential characteristic (differential cryptanalysis)

Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done. I am currently talking about ciphers with multiple rounds. It ...
3
votes
1answer
81 views

What does it mean : “Canonical representative of Sbox is 0123468A5BCF79DE”? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
3
votes
1answer
151 views

Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
2
votes
0answers
50 views

differential cryptanalysis on the second round of 4-variant DES

I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference . they say that we should choose two input Xor P3 and P4 that ...
0
votes
1answer
60 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
2
votes
1answer
89 views

Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
1
vote
1answer
88 views

Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
6
votes
1answer
117 views

Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
1
vote
0answers
37 views

Additive differential probability

I am studying about additive differential probability. And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX. I have a question in chapter 5.2. V.Velichkov et ...
0
votes
1answer
46 views

Additive Differential of XOR

I'm studying about Additive differential of XOR I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
0
votes
0answers
94 views

Differential probability of modular subtraction $xdp^-$

The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
15
votes
1answer
332 views

Selection of rotation constants in ARX design

My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
3
votes
1answer
168 views

Minimum number of active s box to be resistance to differential cryptanalysis

I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? ...
2
votes
2answers
189 views

How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?

I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis ...
4
votes
1answer
130 views

Cryptanalysis of MD4 (Wang et al) — how did the authors come up with the collision differential?

Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
2
votes
1answer
72 views

The Collision Differential for MD4 - a question on notation (Wang, et al)

In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1): $\Delta$$H_0$ = 0 $\xrightarrow{(M_,M')}$ $\Delta$$H$ = 0 What exactly ...
7
votes
0answers
177 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
-1
votes
1answer
148 views

Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
1
vote
1answer
145 views

Calculating the number of rounds required for block cipher with known differential [closed]

Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential ...
4
votes
1answer
184 views

it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks

I am trying to use Grover's algorithm to find Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high ...
9
votes
1answer
546 views

Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
5
votes
2answers
321 views

Security of the AES with a Secret S-box

In this paper they change the $AES$ S-box to a uniformly random one and answer the questions: How does the security of AES change when the S-box is changed by a secret S-box? Would it be safe to ...
1
vote
1answer
125 views

Does CPA-secure means security against differential cryptanalysis?

I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits. However, I wonder is the differential cryptanalysis ...
2
votes
1answer
162 views

Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

SHA-2 has two functions: $\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$ $\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$ Are these two functions non-linear? ...
0
votes
0answers
70 views

Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
2
votes
1answer
68 views

Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
1
vote
1answer
110 views

Minimum difference collision metric

Take a hash function $H$. There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$. Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
2
votes
0answers
188 views

If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
2
votes
1answer
644 views

How can one construct the weakest S-box ever?

Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability? I am studying the properties of S-boxes and I don't quite understand ...
6
votes
1answer
402 views

What is a differential trail?

From what I could find it relates input differences to output differences usually across multiple rounds. But is it the entire probability distribution over all output differences for one input ...
2
votes
1answer
237 views

Differential or Truncated Differential Attack On Small Cipher

The cipher given below is a 16-bit toy cipher which uses 8-bit sbox and 2x2 byte Matrix. The Key $k_0$ and $k_1$ are $\oplus$ with the data. The multiplication with matrix is performed in $GF(2^8)$ ...
2
votes
1answer
389 views

What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
0
votes
1answer
183 views

Signal-to-noise ratio in differential cryptanalysis

What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
0
votes
0answers
103 views

Determining number of required plaintext pairs for differential cryptanalysis

When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
3
votes
0answers
63 views

Does this approach on MEDP take into account the multiple differential trails?

I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES: I cannot fully understand what he is doing but it seems like it iterating over all ...
5
votes
2answers
630 views

What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?

I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct. For the MEDP, I would ...