# Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.

145 questions
Filter by
Sorted by
Tagged with
76 views

### Midori block cipher design: importance of $S_b$ as the S-box

With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
1 vote
69 views

### Is there any notion of key-recovery attacks security (perhaphs using games) that is equivalent to IND-CPA?

I am talking about Symmetric Cryptography only in the following. We know that Semantic Security (in the presence of eavesdropper) implies security against message recovery (in the presence of ...
1 vote
70 views

### New Impossible Differential Attacks on AES reduce time complexity

I am interested in the following snippet from the paper New Impossible Differential Attacks on AES. Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack The most time consuming steps of ...
62 views

### improved impossible differential crpytanalysis of 6-round rijndael

I'm studying the paper: "Improved Impossible Differential Cryptanalysis of Rijndael and Crypton". I've got two questions: Please explain the calculation performed for step 5? Step 4 ...
209 views

### Why does differential cryptanalysis always start from the last round?

Suppose we are working with a cipher with the same general structure as AES. I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
28 views

### Can a differential attack on FEAL4 yield multiple valid keys?

For my version of this attack I used the FEAL4 version depicted here http://theamazingking.com/crypto-feal.php and in the book "Applied Cryptanalysis Breaking Ciphers in the Real World -- Mark ...
1 vote
53 views

### Differential uniformity of vectorial Boolean function

What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
1 vote
110 views

### Differential analysis for dummies, how key position impact on tactic?

Im new to cryptoanalysis and started reading A Tutorial on Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
61 views

### Sensitivy Maximization RAPPOR (Local Differential Privacy)

Hi I have a doubt at the end of the proof of the RAPPOR Algorithm, when they say the sensitivity is maximized when $b'_{h+1}=b'_{h+2}=...=b'_{2h}=1$ and $b'_{1}=b'_{2}=...=b'_{h}=0$. I don't ...
51 views

### Heys Differential Cryptanalysis Question

I'm wondering if anyone is aware of the best input difference to input into the system Heys outlines in his paper (http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf) to achieve a high probability ...
61 views

### How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$，for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
78 views

### Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
68 views

### Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
101 views

### How to evaluate the minimum complexity of the key recovery when the success probability p is given？

Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques. My problem is that could we ...
211 views

### Breaking the Even-Mansour Cipher with Quantum Period Finding: Probability of unwanted collision

The paper Breaking Symmetric Cryptosystems using Quantum Period Finding shows how to break the Even-Mansour Cipher using Simon's algorithm. The Even-Mansour uses two keys $k_1, k_2$ and a random ...
32 views

### Writing a specific position of AES state in a specific round in terms of Key bytes

Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
51 views

### Cryptanalyzing a hash compression function

I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where $s$ is a set of three ...
59 views

### What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper. I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
54 views

316 views

### Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
1 vote
49 views

### What's the average time to generate IDEA pairs?

I'm trying to implement impossible differential cryptanalysis on IDEA cipher based on the Miss in the Middle Attacks on IDEA and Khufu, I've started by implementing the cryptanalysis on 3.5-Round IDEA ...
170 views

### Differential cryptanalysis - how to extend the attack to rounds before the last?

Suppose that we have a block cipher such that the last round of the cipher depends on half of the key and the penultimate round uses the other half. Suppose also that I attacked the last round using ...
1k views

### Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
1 vote
53 views

### differential diffusion property of addition in SPECK cipher

I'm studying Impossible Differential Cryptanalysis of SPECK paper and I'm having trouble understanding the differential diffusion property of addition in page 19 which is as follows: can someone ...
1 vote
66 views

### Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?

The context is iterated ciphers. Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
1 vote
250 views

### What is a differential attack on a hash function? How would one attack a SHA algorithm and what would achieve?

Currently, I have been assigned to attack a reduced version of SHA-1. What are we trying to achieve? How do we attack it?
468 views

### Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
271 views

### How do we find differentials in differential cryptanalysis when we don't the details about the S-boxes

I m new to cryptanalysis and trying to understand differential cryptanalysis. I have read the paper by Howard M. Heys. I understood the concept of differentials but I m not able to understand how to ...
1 vote
191 views

### Differential analysis of SPN

Reference : Tutorial by HM Heys If we find a differential trail that holds with some non negligible probability for n-1 rounds for a n rounds SPN structure, then we can recover some of the bits of the ...
759 views

### Differential and Linear Cryptanalysis

I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show the weakness of DES. However, many articles state that differential and ...
122 views

### How Differential Cryptanalysis of DES work?

I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
126 views

### Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
71 views

### Targeting integer number of right pair in differential attacks

As we know, purpose of attackers is finding some high probable differential characteristics in differential cryptanalysis. Then they construct some plaintext structures, plaintext pool and expect some ...
163 views

121 views

### Backdoor Designer Key Recovery in LowMC-M

The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
177 views

### Finding differentials and space complexity

In Differential Cryptanalysis of DES-like Cryptosystems by Biham and Shamir, they provide examples using differentials inputs such as $\Omega_p = 00\ 80\ 82\ 00\ 60\ 00\ 00\ 00_x$. Most of article is ...
35 views

### I cannot get the meaning of "check s-box"

In second lecture of cryptography, we had a lecture "Block cyphers" and teacher gave me permuted array of numbers 1...10 and letters "a"..."f" and asked me to find XOR ...
164 views

### Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
Let's consider $5$ types of vulnerabilities in one round of encryption in 128-bit cipher. We got 00 at the beginning of the block (the first two bits are two zeros). We got 00 in the middle of the ...