# Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.

122 questions
Filter by
Sorted by
Tagged with
0answers
5 views

### Sensitivy Maximization RAPPOR (Local Differential Privacy)

Hi I have a doubt at the end of the proof of the RAPPOR Algorithm, when they say the sensitivity is maximized when $b'_{h+1}=b'_{h+2}=...=b'_{2h}=1$ and $b'_{1}=b'_{2}=...=b'_{h}=0$. I don't ...
1answer
108 views

### Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
2answers
42 views

### Targeting integer number of right pair in differential attacks

As we know, purpose of attackers is finding some high probable differential characteristics in differential cryptanalysis. Then they construct some plaintext structures, plaintext pool and expect some ...
1answer
66 views

1answer
70 views

### Backdoor Designer Key Recovery in LowMC-M

The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
1answer
147 views

### Finding differentials and space complexity

In Differential Cryptanalysis of DES-like Cryptosystems by Biham and Shamir, they provide examples using differentials inputs such as $\Omega_p = 00\ 80\ 82\ 00\ 60\ 00\ 00\ 00_x$. Most of article is ...
0answers
31 views

### I cannot get the meaning of “check s-box”

In second lecture of cryptography, we had a lecture "Block cyphers" and teacher gave me permuted array of numbers 1...10 and letters "a"..."f" and asked me to find XOR ...
1answer
97 views

### Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
1answer
57 views

### Building a 4-bit S-box with a 4-uniform DDT

I am looking for a 4-bit S-box which has only 4s in its difference distribution table (except the top left corner) but I was not able to find one in the literature. Has such an S-box been already ...
0answers
34 views

### Differential attack on repeating pairs of zeros in blocks

Let's consider $5$ types of vulnerabilities in one round of encryption in 128-bit cipher. We got 00 at the beginning of the block (the first two bits are two zeros). We got 00 in the middle of the ...
0answers
27 views

### DFA on aes Giraud's attack on 10 th round

I am trying to implement an attack on aes using Giraud's attack on the last round of aes using a fault injection of one bytes here is the situation normal byte in the 10th position (1,2) of the 4x4 ...
0answers
36 views

### Trying to attack specific encryption scheme

Let's consider 128-bit cipher. Now let's consider example keys $k_1$ to $k_{128}$: $k_1$: 10 $k_2$: 1100 $k_3$: 11110000 ... In general every key $k_n$ can be some binary number which is consist of $n$...
2answers
123 views

### Differential and Linear Cryptanalysis on Random Sbox

Assume that we use the key to perform a uniform permutation to generate a sbox. The literature is rich supporting the statement that a random Sbox can make any cryptographic scheme weaker. I have ...
0answers
20 views

### calculating the branch number/ active bundles of a cipher

I have read the papers Wide Trail Strategy and Wide Trail Design Strategy for Binary MixColumns. These papers describe the need for a good linear transformation in a cipher, a provable mechanism to ...
0answers
39 views

### Differenital and linear attack on specific vulnerabilities

Consider 128-bit cipher. It has one weakness. In every round you can find such even number $E$ which is encrypted into block that has $0$ as one of $1-128$ bits (lets say it has $0$ as $k$-th bit). ...
0answers
24 views

### Best differential attack on round functions with specific vulnerabilities

I got problem with my encryption functions. They have a repeating series of ones and zeros. It is 128-bit symmetric cipher. Let's consider numbers divisible by $2.$ Let's count how many times are they ...
1answer
40 views

### Differential-linear attack on DES

Is there any known differential-linear attack on full round DES? I couldn't found any and couldn't work on this due to time restriction.
0answers
38 views

### (Enhancing Linear-Differential Cryptanalysis - Biham et al.) Diff-Lin Extension Characteristic and Characteristic Probability

I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis. In the paper, although I've read many ...
0answers
49 views

1answer
72 views

### Improving differential cryptanalysis of a vulnerable cipher

How to avoid differential cryptanalysis attacks when you are inventing new cipher? Let's say you have a $16$-round $128$-bit cipher vulnerable on differential cryptanalysis attacks. Now let's say you ...
1answer
576 views

### What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
1answer
90 views

### Are these two methods of differential cryptanalysis different?

I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
0answers
47 views

### Differential analysis for dummies, how key position impact on tactic? [closed]

Im new to cryptoanalysis and started reading A Tutorial on Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
1answer
64 views

### Definition Problem for toy SPN

I am reading Differential Attack from Stinson-Cryptography: Theory and Practice on a toy example of S-box(block Cipher) with Nr=n=m=4. I am mainly confused in the following definition Definition ...
0answers
71 views

### differential cryptanalysis on the second round of 4-variant DES

I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference . they say that we should choose two input Xor P3 and P4 that ...
2answers
107 views

### Is the linear and differential cryptanalysis only dependent on Sbox?

While performing the linear and differential cryptanalysis a Linear Approximation Table(LAT) and a Different Distribution Table(DDT) is required which is created exploiting the S-box of the cipher ...
2answers
253 views

### Is this permutation secure?

Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows $${\bf x} = {\bf F} {\bf d}$$ ...
0answers
51 views

### Do you know of other graphical implementations of the differential cryptanalysis I should know or I may have missed?

I wrote my master thesis in computer science last year and would like to share it with the community. When I got to know differential cryptanalysis (DCA), I probably used the same literature and web ...
0answers
20 views

### Check linear and differential cryptanalysis of a new block cipher [duplicate]

I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ...
0answers
45 views

### Whats the probability a random cipher has a high probability differential?

This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated. Fix some general structure for a cipher, for example Sbox then ...
0answers
34 views

### Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
0answers
41 views

### Markov ciphers - generalized group operation

I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf They do their ...
0answers
43 views

### Linear approximattion of $(x+y) \bmod 2^n$ in FSM of SNOW 2.0 where $x,y$ in $F_{2}^n$

I would like to understand the linear approximation of $(x+y) \bmod 2^n$ by linear masking method in the paper refereed ""Improved Linear Distinguis'hers for SNOW 2.0" by Kaisa Nyberg and Johan Wall´...
1answer
54 views

### AES difference propagation

when does active S box count reduce in AES difference propagation? what is the relationship between active S-boxes and MixColumns? can you please explain it with an example?
0answers
31 views

### Unknown bit in the output of encryption of data using SIMECK32 cipher?

How is the unknown bits (annotated by red arrow in figure below) come in the OUTPUT after round 1 and round 2 ? Following is the pictorial representation of SIMECK round function operation. Ref: ...
0answers
322 views

### Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
0answers
44 views

### what if the S-boxes in DES were “optimal”

if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
1answer
91 views

### Why isn't there a final permutation on SPN-based ciphers?

I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, ...
1answer
1k views

### Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
0answers
53 views

### AES - Non-linearity hinders differential cryptoanalysis

Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
0answers
87 views

### Enhancing Differential-Linear Cryptanalysis

I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
1answer
240 views

### Signal-to-noise ratio in differential cryptanalysis

What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
1answer
75 views

### structure in modular arithmetic

I was playing around with modular arithmetic when I noticed something. \begin{align} g^k &= a \bmod n\\ g^{k+0.5(n-1)} &= b \bmod n \end{align} Then $a + b = n$, so you can also write g^{...
1answer
80 views

### How is it possible to define differential privacy on two databases that differ more than a single entry?

The original definition of $\epsilon-$differential privacy is for two databases $D_1$, $D_2$ that differ at most one entry and an randomized algorithm $A$. We have a bound on the probability ratio \$\...