Questions tagged [differential-analysis]
Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.
136
questions
31
votes
2
answers
5k
views
How do I apply differential cryptanalysis to a block cipher?
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
user46
19
votes
0
answers
446
views
Adding bit constants to the key schedule to reduce rounds?
Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
- 4,625
18
votes
1
answer
2k
views
Understanding the wide trail design strategy
I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
- 15.1k
16
votes
1
answer
689
views
Selection of rotation constants in ARX design
My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
- 2,074
14
votes
4
answers
6k
views
Why is the permutation in AES (and other ciphers) not random or key-dependent?
If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks?
If this is so, then might we need fewer rounds for ...
- 1,025
9
votes
2
answers
7k
views
How to build a difference distribution table?
i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
- 281
7
votes
2
answers
919
views
S-box with differential uniformity = 2
I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2.
I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
- 304
7
votes
1
answer
1k
views
What is a differential trail?
From what I could find it relates input differences to output differences usually across multiple rounds.
But is it the entire probability distribution over all output differences for one input ...
- 91
6
votes
2
answers
1k
views
Security of the AES with a Secret S-box
In this paper they change the $AES$ S-box to a uniformly random one and answer the questions:
How does the security of AES change when the S-box is changed by a secret S-box?
Would it be safe to ...
- 1,025
6
votes
2
answers
1k
views
Cryptanalysis and weaknesses of SEED cipher
I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
- 3,527
6
votes
1
answer
1k
views
Differential cryptanalysis - breaking the last round of FEAL4?
I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful:
http://theamazingking.com/crypto-feal.php
So far I've been almost successful in breaking FEAL4 ...
- 7,438
6
votes
2
answers
6k
views
DES with the bitwise complement of a key
I was reading upon Biham and Shamir's paper and a fact has been presented over there:
if $ P_1 = \bar P_2$ and I choose a key $K_1 = \bar K_2$ then in that case
$$T_1 = DES(P_1, K_1)$$
$$T_2 = DES(...
- 163
6
votes
1
answer
179
views
Differential and Linear trail propagation in Noekeon
In the Noekeon Cipher Specification they write the following :
The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a
step. Because of the linearity of Lambda it is fully ...
- 153
6
votes
2
answers
332
views
Can I use a differential that can be traced through the whole cipher with 100% probability?
I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
- 305
6
votes
1
answer
174
views
Finding differentials and space complexity
In Differential Cryptanalysis of DES-like Cryptosystems by Biham and Shamir, they provide examples using differentials inputs such as $\Omega_p = 00\ 80\ 82\ 00\ 60\ 00\ 00\ 00_x$. Most of article is ...
- 9,969
5
votes
1
answer
986
views
Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
- 597
5
votes
1
answer
30k
views
Difference between linear cryptanalysis and differential cryptanalysis
What is the main difference between linear cryptanalysis and differential cryptanalysis? For example in relation to DES?
5
votes
2
answers
3k
views
Is the difference distribution table of AES S-box uniform?
I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
- 284
5
votes
1
answer
1k
views
Differential Cryptanalysis for Hash functions
How is differential cryptanalysis used to attack hash functions? I've been struggling through a couple academic papers and thesis's on the subject but they all sound like greek to me. Does anyone know ...
- 55
5
votes
2
answers
1k
views
What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?
I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct.
For the MEDP, I would ...
- 391
5
votes
1
answer
405
views
How is the SHA-1 collision detector so fast?
The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection.
It claims a false positive rate of $2^{-90}$ and to take less then ...
- 11.7k
5
votes
1
answer
536
views
What is the difference between strong/weak alignment?
In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis".
What exactly is the difference between ...
- 19.5k
5
votes
1
answer
376
views
differential cryptanalysis cipher for the final round
I have a problem to find the sub-key.
The system is…
For each round, we make the following stage:
We add the round key $K_i$.
Substitution : we have 8 blocks of 4 bits, and an S-box takes each ...
- 51
4
votes
2
answers
252
views
Best complexity of guessing difference of AES-256 outputs
Suppose we have two plaintexts $m_1$ and $m_2$ such a way that $|m_1| = |m_2| = 128 $ and these two plaintexts are different just in one bit. Now suppose we know the value of $c_1 = AES_{k}(m_1)$($|k|...
- 165
4
votes
1
answer
772
views
How to prove a cipher resistant to differential cryptanalysis?
How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
- 157
4
votes
1
answer
172
views
Best differential characteristic for this PRF
Consider the following construction of a PRF $F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$ on 64-bit messages and 128-bit keys. Define $f:\{0,1\}^3 \to \{0,1\}$ by
$$f(c,x,y) = \begin{...
- 36.2k
4
votes
2
answers
740
views
Differential and Linear Cryptanalysis
I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show the weakness of DES.
However, many articles state that differential and ...
- 151
4
votes
1
answer
162
views
Cryptanalysis of MD4 (Wang et al) -- how did the authors come up with the collision differential?
Edit:
ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
- 407
4
votes
0
answers
54
views
Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?
I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't ...
- 191
4
votes
1
answer
251
views
it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks
I am trying to use Grover's algorithm to find Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high ...
3
votes
2
answers
1k
views
Two-dimensional S-Box
Consider the following simple cipher:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key.
If S-box is standard then this ...
3
votes
1
answer
156
views
Why is variable rotation uncommon in cryptographic primitives?
Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:
For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
- 359
3
votes
1
answer
647
views
What is an advantage of MDS matrices in block ciphers?
I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is:
For example in the ...
- 2,323
3
votes
1
answer
2k
views
What is the complexity for attacking 3DES in linear or differential cryptanalysis?
I know that 3DES is NOT vulnerable to DC , LC .
But is it because the attacks requires too many input\output pairs ?
Or because it's impossible ? (i.e requires more than 2^64 pair )
- 203
3
votes
1
answer
688
views
Performing differential cryptanalysis for randomly generated S-boxes
As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
- 203
3
votes
1
answer
107
views
What are "unspecified" differentials in a differential characteristic?
I've been studying many papers on differential cryptanalysis and I see that in the published differential characteristics, such as in the appendices of [1], [2] and [3], some differences are left &...
- 63
3
votes
1
answer
208
views
What does it mean : "Canonical representative of Sbox is 0123468A5BCF79DE"? and How can we calculate this representative for Sbox?
In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes.
What does "Canonical ...
- 336
3
votes
2
answers
656
views
How do we find the subkey out of a differential cryptanalysis?
I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we ...
- 1,535
3
votes
1
answer
100
views
How exactly to concatenate two differential trails to form a boomerang disguisher in practice?
I've been reading many papers on boomerang/rectangle attacks. The general strategy is to find two trails for a small number of rounds and then concatenate them to form a longer distinguisher. ...
- 63
3
votes
1
answer
113
views
Backdoor Designer Key Recovery in LowMC-M
The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
- 31
3
votes
1
answer
561
views
Minimum number of active s box to be resistance to differential cryptanalysis
I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round?
...
- 101
3
votes
1
answer
229
views
Countering Cryptographic Attacks
By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view.
Differential and Linear Crypt-analysis. Number of Active S-...
- 2,397
3
votes
1
answer
303
views
Differential & linear characteristics for integer multiplication
What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a $n \times n \rightarrow 2n$ bit multiplication?
I remember reading ...
- 4,763
3
votes
1
answer
115
views
Are these two methods of differential cryptanalysis different?
I'm trying to understand how differential analysis works. I'm reading this and this tutorials, but it looks like they do different things. In the first paper author tells us to bruteforce last round ...
- 55
3
votes
1
answer
1k
views
Differential cryptanalysis tutorial of Howard M. Heys
I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
- 509
3
votes
1
answer
125
views
Security of an S-box based on modular multplicative inverse
The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
- 3,645
3
votes
1
answer
221
views
Differential bound of the S-Box in GOST R34.11-2012
In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
- 63
3
votes
0
answers
49
views
Markov ciphers - generalized group operation
I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general
http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf
They do their ...
- 315
3
votes
0
answers
70
views
Does this approach on MEDP take into account the multiple differential trails?
I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES:
I cannot fully understand what he is doing but it seems like it iterating over all ...
- 391
2
votes
3
answers
1k
views
What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?
As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^...
- 141