Questions tagged [differential-analysis]
Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.
31
questions with no upvoted or accepted answers
19
votes
0
answers
446
views
Adding bit constants to the key schedule to reduce rounds?
Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
- 4,625
4
votes
0
answers
54
views
Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?
I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't ...
- 191
3
votes
0
answers
49
views
Markov ciphers - generalized group operation
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
- 315
3
votes
0
answers
70
views
Does this approach on MEDP take into account the multiple differential trails?
I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES:
I cannot fully understand what he is doing but it seems like it iterating over all ...
- 391
2
votes
0
answers
27
views
how to build the plaintext structure for impossible differential cryptanaysis on IDEA?
I'm trying to implement impossible differential cryptanalysis on 3.5 round IDEA using Miss in the Middle Attack on IDEA and Khufu paper as a reference and I'm stuck on the first two steps of the ...
- 191
2
votes
1
answer
48
views
Sensitivy Maximization RAPPOR (Local Differential Privacy)
Hi I have a doubt at the end of the proof of the RAPPOR Algorithm, when they say the sensitivity is maximized when $b'_{h+1}=b'_{h+2}=...=b'_{2h}=1$ and $b'_{1}=b'_{2}=...=b'_{h}=0$. I don't ...
- 152
2
votes
0
answers
51
views
(Enhancing Linear-Differential Cryptanalysis - Biham et al.) Diff-Lin Extension Characteristic and Characteristic Probability
I studied Langford and Hellman's Differential-Linear Cryptanalysis and moved on to Biham, Dunkelman and Keller's Enhancing Linear-Differential Cryptanalysis.
In the paper, although I've read many ...
- 96
2
votes
0
answers
82
views
Whats the probability a random cipher has a high probability differential?
This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated.
Fix some general structure for a cipher, for example Sbox then ...
- 315
2
votes
0
answers
47
views
Linear approximattion of $(x+y) \bmod 2^n$ in FSM of SNOW 2.0 where $x,y$ in $F_{2}^n$
I would like to understand the linear approximation of $(x+y) \bmod 2^n$ by linear masking method in the paper refereed ""Improved Linear Distinguis'hers for SNOW 2.0" by Kaisa Nyberg and Johan Wall´...
2
votes
0
answers
36
views
Unknown bit in the output of encryption of data using SIMECK32 cipher?
How is the unknown bits (annotated by red arrow in figure below) come in the OUTPUT after round 1 and round 2 ?
Following is the pictorial representation of SIMECK round function operation.
Ref: ...
- 121
2
votes
0
answers
53
views
what if the S-boxes in DES were "optimal"
if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
- 21
2
votes
0
answers
111
views
Enhancing Differential-Linear Cryptanalysis
I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
- 315
2
votes
0
answers
239
views
Implementation of differential cryptanalysis
This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay.
I am working with the book "The Block Cipher Companion" on the topic differential ...
- 509
2
votes
0
answers
256
views
If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?
AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
- 1,025
1
vote
0
answers
47
views
What's the average time to generate IDEA pairs?
I'm trying to implement impossible differential cryptanalysis on IDEA cipher based on the Miss in the Middle Attacks on IDEA and Khufu, I've started by implementing the cryptanalysis on 3.5-Round IDEA ...
- 191
1
vote
1
answer
165
views
Why does differential cryptanalysis always start from the last round?
Suppose we are working with a cipher with the same general structure as AES.
I want to attack the cipher in the following way: suppose that the differential holds only for the first round (much higher ...
- 47
1
vote
0
answers
51
views
Are the weaknesses of my functions attackable?
I got specific problem with my functions in $128$-bit block cipher. One round of encryption is like that:
$input$ $\rightarrow$ $F(k_{i},input)$ $\rightarrow$ reverse block $\rightarrow$ $F(k_{i+1},...
- 1,211
1
vote
0
answers
58
views
Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?
The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
- 11
1
vote
0
answers
64
views
Guess the number of characteristics in differential cryptanalysis
I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
- 509
1
vote
0
answers
83
views
differential cryptanalysis on the second round of 4-variant DES
I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference .
they say that we should choose two input Xor P3 and P4 that ...
- 191
1
vote
0
answers
55
views
Additive differential probability
I am studying about additive differential probability.
And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX.
I have a question in chapter 5.2.
V.Velichkov et ...
- 129
1
vote
0
answers
128
views
Determining number of required plaintext pairs for differential cryptanalysis
When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
- 441
0
votes
0
answers
29
views
Writing a specific position of AES state in a specific round in terms of Key bytes
Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
0
votes
0
answers
48
views
Cryptanalyzing a hash compression function
I'm designing a hash function which uses a double-tree construction and a compression function $c(s,A,B,C,a)$ ($s$ and $a$ may be omitted when there's only one of them) where
$s$ is a set of three ...
- 221
0
votes
0
answers
106
views
How Differential Cryptanalysis of DES work?
I have been studying the DC of DES. As a beginner, I completed the general structure of DES and began DC. I understand the idea of attack, how to find different characteristics for differential ...
- 1
0
votes
0
answers
35
views
I cannot get the meaning of "check s-box"
In second lecture of cryptography, we had a lecture "Block cyphers" and teacher gave me permuted array of numbers 1...10 and letters "a"..."f" and asked me to find XOR ...
0
votes
0
answers
46
views
Differential attack on repeating pairs of zeros in blocks
Let's consider $5$ types of vulnerabilities in one round of encryption in 128-bit cipher.
We got 00 at the beginning of the block (the first two bits are two zeros).
We got 00 in the middle of the ...
- 1,211
0
votes
0
answers
44
views
Trying to attack specific encryption scheme
Let's consider 128-bit cipher. Now let's consider example keys $k_1$ to $k_{128}$:
$k_1$: 10
$k_2$: 1100
$k_3$: 11110000
...
In general every key $k_n$ can be some binary number which is consist of $n$...
- 1,211
0
votes
0
answers
64
views
AES - Non-linearity hinders differential cryptoanalysis
Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
- 461
0
votes
0
answers
233
views
Differential cryptanalysis filtering process
This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I ...
- 509
0
votes
0
answers
160
views
Differential probability of modular subtraction $xdp^-$
The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
- 2,074