# Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.

97 questions
Filter by
Sorted by
Tagged with
73 views

### Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
111 views

### Minimum difference collision metric

Take a hash function $H$. There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$. Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
211 views

### If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
754 views

### How can one construct the weakest S-box ever?

Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability? I am studying the properties of S-boxes and I don't quite understand ...
529 views

### What is a differential trail?

From what I could find it relates input differences to output differences usually across multiple rounds. But is it the entire probability distribution over all output differences for one input ...
248 views

### Differential or Truncated Differential Attack On Small Cipher

The cipher given below is a 16-bit toy cipher which uses 8-bit sbox and 2x2 byte Matrix. The Key $k_0$ and $k_1$ are $\oplus$ with the data. The multiplication with matrix is performed in $GF(2^8)$ ...
492 views

### What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
211 views

### Signal-to-noise ratio in differential cryptanalysis

What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
107 views

### Determining number of required plaintext pairs for differential cryptanalysis

When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
64 views

### Does this approach on MEDP take into account the multiple differential trails?

I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES: I cannot fully understand what he is doing but it seems like it iterating over all ...
700 views

### What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?

I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct. For the MEDP, I would ...
369 views

### How is the SHA-1 collision detector so fast?

The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection. It claims a false positive rate of $2^{-90}$ and to take less then ...
126 views

### Differential trails in FEAL-8

In this paper the authors describe a differential attack against FEAL-8. They find several short differential trails, then extend the attack to the full 8-Rounds of the cipher by algebraic means. In ...
204 views

### In differential cryptanalysis for DES, why is F(0…0) assumed to be always 0…0?

In this paper about differential cryptanalysis, an attack on 2n-Round DES is described. The attack is all about finding certain inputs for DES rounds, for which ...
303 views

### What is the difference between strong/weak alignment?

In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis". What exactly is the difference between ...
2k views

### Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
282 views

### Can I use a differential that can be traced through the whole cipher with 100% probability?

I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
897 views