Questions tagged [differential-analysis]
Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.
122
questions
0
votes
0answers
5 views
Sensitivy Maximization RAPPOR (Local Differential Privacy)
Hi I have a doubt at the end of the proof of the RAPPOR Algorithm, when they say the sensitivity is maximized when $b'_{h+1}=b'_{h+2}=...=b'_{2h}=1$ and $b'_{1}=b'_{2}=...=b'_{h}=0$. I don't ...
0
votes
2answers
42 views
Targeting integer number of right pair in differential attacks
As we know, purpose of attackers is finding some high probable differential characteristics in differential cryptanalysis. Then they construct some plaintext structures, plaintext pool and expect some ...
2
votes
1answer
66 views
Complexity of Boomerang Attack on COCONUT98
I am trying to understand the paper The Boomerang Attack from David Wagner. On page 162 about complexity of boomerang attack the paper says that:
The attack requires $8 \cdot 2 \cdot 32 \cdot 2^{32} ...
0
votes
0answers
19 views
Non-linear phase that's Side channel attack proof
I'm designing a cipher and I'm looking for a Non-linear phase in my cipher that is side channel attack proof, I know that Sboxes are vulnerable to to that because of accessing the cache. I'm thinking ...
3
votes
1answer
61 views
What are “unspecified” differentials in a differential characteristic?
I've been studying many papers on differential cryptanalysis and I see that in the published differential characteristics, such as in the appendices of [1], [2] and [3], some differences are left &...
3
votes
1answer
76 views
How exactly to concatenate two differential trails to form a boomerang disguisher in practice?
I've been reading many papers on boomerang/rectangle attacks. The general strategy is to find two trails for a small number of rounds and then concatenate them to form a longer distinguisher. ...
1
vote
1answer
60 views
How do we know a single differential/linear trail dominates the others?
I have read the proof of AES's resistance against differential cryptanalysis. In the proof the authors show that there is no single differential trail with prop ratio higher than $2^{-300}$ over 8 ...
2
votes
1answer
48 views
Why the differential cryptanalysis complexity is linear with inverse of the probability while linear cryptanalysis is quadratic with the bias inverse?
I am trying to understand the analysis of the complexity of Differential Cryptanalysis versus the complexity of linear cryptanalysis.
In differential cryptanalysis the number of required texts is $\...
3
votes
1answer
70 views
Backdoor Designer Key Recovery in LowMC-M
The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
0
votes
0answers
31 views
I cannot get the meaning of “check s-box”
In second lecture of cryptography, we had a lecture "Block cyphers" and teacher gave me permuted array of numbers 1...10 and letters "a"..."f" and asked me to find XOR ...
2
votes
1answer
57 views
Building a 4-bit S-box with a 4-uniform DDT
I am looking for a 4-bit S-box which has only 4s in its difference distribution table (except the top left corner) but I was not able to find one in the literature.
Has such an S-box been already ...
0
votes
0answers
34 views
Differential attack on repeating pairs of zeros in blocks
Let's consider $5$ types of vulnerabilities in one round of encryption in 128-bit cipher.
We got 00 at the beginning of the block (the first two bits are two zeros).
We got 00 in the middle of the ...
0
votes
0answers
27 views
DFA on aes Giraud's attack on 10 th round
I am trying to implement an attack on aes using Giraud's attack on the last round of aes using a fault injection of one bytes
here is the situation
normal byte in the 10th position (1,2) of the 4x4 ...
0
votes
0answers
36 views
Trying to attack specific encryption scheme
Let's consider 128-bit cipher. Now let's consider example keys $k_1$ to $k_{128}$:
$k_1$: 10
$k_2$: 1100
$k_3$: 11110000
...
In general every key $k_n$ can be some binary number which is consist of $n$...
0
votes
0answers
20 views
calculating the branch number/ active bundles of a cipher
I have read the papers Wide Trail Strategy and Wide Trail Design Strategy for Binary MixColumns. These papers describe the need for a good linear transformation in a cipher, a provable mechanism to ...
0
votes
0answers
39 views
Differenital and linear attack on specific vulnerabilities
Consider 128-bit cipher. It has one weakness. In every round you can find such even number $E$ which is encrypted into block that has $0$ as one of $1-128$ bits (lets say it has $0$ as $k$-th bit). ...
0
votes
2answers
123 views
Differential and Linear Cryptanalysis on Random Sbox
Assume that we use the key to perform a uniform permutation to generate a sbox. The literature is rich supporting the statement that a random Sbox can make any cryptographic scheme weaker. I have ...
0
votes
0answers
24 views
Best differential attack on round functions with specific vulnerabilities
I got problem with my encryption functions. They have a repeating series of ones and zeros. It is 128-bit symmetric cipher.
Let's consider numbers divisible by $2.$ Let's count how many times are they ...
0
votes
1answer
40 views
Differential-linear attack on DES
Is there any known differential-linear attack on full round DES? I couldn't found any and couldn't work on this due to time restriction.
2
votes
0answers
38 views
(Enhancing Linear-Differential Cryptanalysis - Biham et al.) Diff-Lin Extension Characteristic and Characteristic Probability
I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis.
In the paper, although I've read many ...
1
vote
0answers
49 views
Are the weaknesses of my functions attackable?
I got specific problem with my functions in $128$-bit block cipher. One round of encryption is like that:
$input$ $\rightarrow$ $F(k_{i},input)$ $\rightarrow$ reverse block $\rightarrow$ $F(k_{i+1},...
0
votes
1answer
65 views
Are the weaknesses of my s-boxes attackable?
I got specific problem with my s-boxes in $128$-bit block cipher. One round of encryption is like that:
input - sbox - reverse block - $sbox^{-1}$ - output
Every s-box got specific $128$-bit key. $...
0
votes
1answer
72 views
Improving differential cryptanalysis of a vulnerable cipher
How to avoid differential cryptanalysis attacks when you are inventing new cipher?
Let's say you have a $16$-round $128$-bit cipher vulnerable on differential cryptanalysis attacks. Now let's say you ...
3
votes
1answer
90 views
Are these two methods of differential cryptanalysis different?
I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
1
vote
0answers
47 views
Differential analysis for dummies, how key position impact on tactic? [closed]
Im new to cryptoanalysis and started reading A Tutorial on
Linear and Differential Cryptanalysis. The author is trying to explain it as simple as he can. But I still got some questions, can anybody ...
2
votes
2answers
253 views
Is this permutation secure?
Let vector ${\bf d} \in \{ \pm 1 \}^n$ be the message we want to send. In my system, ${\bf d}$ is multiplied by an $n \times n$ Fourier matrix ${\bf F}$, as follows
$$ {\bf x} = {\bf F} {\bf d} $$
...
0
votes
0answers
20 views
Check linear and differential cryptanalysis of a new block cipher [duplicate]
I am developing a new block cipher primitive. I would like to test its robustness against attacks of linear and differential cryptanalysis. Is there a tool to evaluate this using only plaintext and ...
0
votes
2answers
107 views
Is the linear and differential cryptanalysis only dependent on Sbox?
While performing the linear and differential cryptanalysis a Linear Approximation Table(LAT) and a Different Distribution Table(DDT) is required which is created exploiting the S-box of the cipher ...
0
votes
0answers
51 views
Do you know of other graphical implementations of the differential cryptanalysis I should know or I may have missed?
I wrote my master thesis in computer science last year and would like to share it with the community.
When I got to know differential cryptanalysis (DCA), I probably used the same literature and web ...
2
votes
0answers
45 views
Whats the probability a random cipher has a high probability differential?
This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated.
Fix some general structure for a cipher, for example Sbox then ...
1
vote
0answers
34 views
Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?
The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
3
votes
0answers
41 views
Markov ciphers - generalized group operation
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
2
votes
0answers
43 views
Linear approximattion of $(x+y) \bmod 2^n$ in FSM of SNOW 2.0 where $x,y$ in $F_{2}^n$
I would like to understand the linear approximation of $(x+y) \bmod 2^n$ by linear masking method in the paper refereed ""Improved Linear Distinguis'hers for SNOW 2.0" by Kaisa Nyberg and Johan Wall´...
0
votes
1answer
54 views
AES difference propagation
when does active S box count reduce in AES difference propagation?
what is the relationship between active S-boxes and MixColumns?
can you please explain it with an example?
2
votes
1answer
64 views
Definition Problem for toy SPN
I am reading Differential Attack from Stinson-Cryptography: Theory and Practice on a toy example of S-box(block Cipher) with Nr=n=m=4.
I am mainly confused in the following definition
Definition ...
2
votes
0answers
31 views
Unknown bit in the output of encryption of data using SIMECK32 cipher?
How is the unknown bits (annotated by red arrow in figure below) come in the OUTPUT after round 1 and round 2 ?
Following is the pictorial representation of SIMECK round function operation.
Ref: ...
2
votes
0answers
44 views
what if the S-boxes in DES were “optimal”
if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
2
votes
1answer
91 views
Why isn't there a final permutation on SPN-based ciphers?
I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, ...
0
votes
0answers
53 views
AES - Non-linearity hinders differential cryptoanalysis
Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
2
votes
0answers
87 views
Enhancing Differential-Linear Cryptanalysis
I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
0
votes
1answer
75 views
structure in modular arithmetic
I was playing around with modular arithmetic when I noticed something.
\begin{align}
g^k &= a \bmod n\\
g^{k+0.5(n-1)} &= b \bmod n
\end{align}
Then $a + b = n$, so you can also write
$$g^{...
1
vote
1answer
80 views
How is it possible to define differential privacy on two databases that differ more than a single entry?
The original definition of $\epsilon-$differential privacy is for two databases $D_1$, $D_2$ that differ at most one entry and an randomized algorithm $A$.
We have a bound on the probability ratio
$\...
0
votes
0answers
110 views
Differential cryptanalysis filtering process
This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I ...
1
vote
0answers
45 views
Guess the number of characteristics in differential cryptanalysis
I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
1
vote
1answer
89 views
Why is DES secure against differential cryptanalysis
I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse.
...
2
votes
1answer
148 views
Symmetric property of DDT of inverse function
Given a bijective function $F: \mathbb{F}_2^n \rightarrow \mathbb{F}_2^n$.
The entry of the Difference Distribution Table (DDT) at row $\alpha$ and column $\beta$ is defined as
$$DDT_{F}(\alpha,\...
1
vote
0answers
129 views
Implementation of differential cryptanalysis
This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay.
I am working with the book "The Block Cipher Companion" on the topic differential ...
2
votes
1answer
139 views
Differential cryptanalysis in “The Block Cipher Companion”
I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher:
In Fig. 6.10 (page 126) there are ...
2
votes
0answers
118 views
Recover all keys on differential cryptanalysis
I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" .
I am successful to get the last key $k_5$. Just to say some words about the ...
1
vote
1answer
111 views
Calculate number of required pairs for differential cryptanalysis
I am currently doing some study on differential cryptanalysis.
However, I have two open questions in the field.
The first question is: How can I calculate the number of messages necessary for a ...
