Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences on output.

1
vote
0answers
21 views

differential cryptanalysis on the second round of 4-variant DES

I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference . they say that we should choose two input Xor P3 and P4 that ...
0
votes
0answers
30 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
2
votes
1answer
57 views

Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
1
vote
1answer
40 views

Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
6
votes
1answer
83 views

Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
1
vote
0answers
28 views

Additive differential probability

I am studying about additive differential probability. And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX. I have a question in chapter 5.2. V.Velichkov et ...
0
votes
1answer
38 views

Additive Differential of XOR

I'm studying about Additive differential of XOR I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
0
votes
0answers
76 views

Differential probability of modular subtraction $xdp^-$

The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
15
votes
1answer
265 views

Selection of rotation constants in ARX design

My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
3
votes
1answer
98 views

Minimum number of active s box to be resistance to differential cryptanalysis

I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? ...
2
votes
2answers
96 views

How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?

I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis ...
4
votes
1answer
121 views

Cryptanalysis of MD4 (Wang et al) — how did the authors come up with the collision differential?

Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
2
votes
1answer
56 views

The Collision Differential for MD4 - a question on notation (Wang, et al)

In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1): $\Delta$$H_0$ = 0 $\xrightarrow{(M_,M')}$ $\Delta$$H$ = 0 What exactly ...
7
votes
0answers
146 views

Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
-1
votes
1answer
132 views

Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
1
vote
1answer
117 views

Calculating the number of rounds required for block cipher with known differential [closed]

Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential ...
4
votes
1answer
167 views

it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks

I am trying to use Grover's algorithm to find Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high ...
6
votes
1answer
283 views

Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper which describes it from the point of view of AES. From what I understand, it is a technique to increase diffusion in a ...
5
votes
2answers
214 views

Security of the AES with a Secret S-box

In this paper they change the $AES$ S-box to a uniformly random one and answer the questions: How does the security of AES change when the S-box is changed by a secret S-box? Would it be safe to ...
1
vote
1answer
122 views

Does CPA-secure means security against differential cryptanalysis?

I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits. However, I wonder is the differential cryptanalysis ...
2
votes
1answer
111 views

Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

SHA-2 has two functions: $\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$ $\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$ Are these two functions non-linear? ...
0
votes
0answers
55 views

Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
2
votes
1answer
64 views

Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
1
vote
1answer
100 views

Minimum difference collision metric

Take a hash function $H$. There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$. Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
2
votes
0answers
153 views

If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
3
votes
1answer
501 views

How can one construct the weakest S-box ever?

Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability? I am studying the properties of S-boxes and I don't quite understand ...
6
votes
1answer
281 views

What is a differential trail?

From what I could find it relates input differences to output differences usually across multiple rounds. But is it the entire probability distribution over all output differences for one input ...
2
votes
1answer
200 views

Differential or Truncated Differential Attack On Small Cipher

The Cipher given below is a Sample 16bit Cipher which uses 8bit Sbox and 2x2 byte Matrix. The Key k0 and k1 are Xored with the data. The Multiplication with Matrix is performed in GF(2^8) with ...
3
votes
1answer
282 views

What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
0
votes
1answer
142 views

Signal vs Noise ratio in differential cryptanalysis

What does signal vs noise ratio mean in the context of differential cryptanalysis and how can one use it to derive the number of required plaintext pairs to carry a successful attack ?
0
votes
0answers
67 views

Determining number of required plaintext pairs for differential cryptanalysis

When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
3
votes
0answers
58 views

Does this approach on MEDP take into account the multiple differential trails?

I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES: I cannot fully understand what he is doing but it seems like it iterating over all ...
5
votes
2answers
512 views

What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?

I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct. For the MEDP, I would ...
5
votes
1answer
344 views

How is the SHA-1 collision detector so fast?

The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection. It claims a false positive rate of $2^{-90}$ and to take less then ...
2
votes
1answer
97 views

Differential trails in FEAL-8

In this paper the authors describe a differential attack against FEAL-8. They find several short differential trails, then extend the attack to the full 8-Rounds of the cipher by algebraic means. In ...
1
vote
1answer
190 views

In differential cryptanalysis for DES, why is F(0…0) assumed to be always 0…0?

In this paper about differential cryptanalysis, an attack on 2n-Round DES is described. The attack is all about finding certain inputs for DES rounds, for which ...
4
votes
1answer
254 views

What is the difference between strong/weak alignment?

In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis". What exactly is the difference between ...
5
votes
2answers
1k views

Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
6
votes
2answers
263 views

Can I use a differential that can be traced through the whole cipher with 100% probability?

I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
2
votes
3answers
730 views

What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?

As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^...
2
votes
1answer
156 views

Countering Cryptographic Attacks

By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view. Differential and Linear Crypt-analysis. Number of Active S-...
4
votes
1answer
212 views

Differential & linear characteristics for integer multiplication

What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a $n \times n \rightarrow 2n$ bit multiplication? I remember reading ...
6
votes
1answer
262 views

differential cryptanalysis cipher for the final round

I have a problem to find the sub-key. The system is… For each round, we make the following stage: We add the round key $K_i$. Substitution : we have 8 blocks of 4 bits, and an S-box ...
13
votes
4answers
3k views

Why is the permutation in AES (and other ciphers) not random or key-dependent?

If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for ...
5
votes
1answer
127 views

Best differential characteristic for this PRF

Consider the following construction of a PRF $F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$ on 64-bit messages and 128-bit keys. Define $f:\{0,1\}^3 \to \{0,1\}$ by $$f(c,x,y) = \begin{...
1
vote
0answers
109 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
4
votes
1answer
437 views

Differential Cryptanalysis for Hash functions

How is differential cryptanalysis used to attack hash functions? I've been struggling through a couple academic papers and thesis's on the subject but they all sound like greek to me. Does anyone know ...
6
votes
1answer
109 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
1
vote
0answers
125 views

Differential Cryptanalysis [closed]

How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ...
7
votes
2answers
3k views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...