Questions tagged [differential-analysis]
Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.
136
questions
2
votes
0
answers
53
views
what if the S-boxes in DES were "optimal"
if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
- 21
2
votes
1
answer
174
views
Why isn't there a final permutation on SPN-based ciphers?
I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, ...
- 509
0
votes
0
answers
64
views
AES - Non-linearity hinders differential cryptoanalysis
Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
- 461
2
votes
0
answers
111
views
Enhancing Differential-Linear Cryptanalysis
I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
- 315
0
votes
1
answer
87
views
structure in modular arithmetic
I was playing around with modular arithmetic when I noticed something.
\begin{align}
g^k &= a \bmod n\\
g^{k+0.5(n-1)} &= b \bmod n
\end{align}
Then $a + b = n$, so you can also write
$$g^{...
- 11
1
vote
1
answer
116
views
How is it possible to define differential privacy on two databases that differ more than a single entry?
The original definition of $\epsilon-$differential privacy is for two databases $D_1$, $D_2$ that differ at most one entry and an randomized algorithm $A$.
We have a bound on the probability ratio
$\...
- 1,595
0
votes
0
answers
233
views
Differential cryptanalysis filtering process
This question is a little more implementation based. I am writing my masters thesis on differential cryptanalysis and I wrote a program to evaluate some things about differential cryptanalysis. I ...
- 509
1
vote
0
answers
64
views
Guess the number of characteristics in differential cryptanalysis
I am doing some research on differential cryptanalysis for my master thesis. I analyzed some toy ciphers like the one in the popular tutorial about differential and linear cryptanalysis from heys Link....
- 509
1
vote
1
answer
204
views
Why is DES secure against differential cryptanalysis
I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse.
...
- 13
2
votes
1
answer
183
views
Symmetric property of DDT of inverse function
Given a bijective function $F: \mathbb{F}_2^n \rightarrow \mathbb{F}_2^n$.
The entry of the Difference Distribution Table (DDT) at row $\alpha$ and column $\beta$ is defined as
$$DDT_{F}(\alpha,\...
- 23
2
votes
0
answers
239
views
Implementation of differential cryptanalysis
This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay.
I am working with the book "The Block Cipher Companion" on the topic differential ...
- 509
2
votes
1
answer
196
views
Differential cryptanalysis in "The Block Cipher Companion"
I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher:
In Fig. 6.10 (page 126) there are ...
- 509
2
votes
1
answer
279
views
Recover all keys on differential cryptanalysis
I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" .
I am successful to get the last key $k_5$. Just to say some words about the ...
- 509
1
vote
1
answer
183
views
Calculate number of required pairs for differential cryptanalysis
I am currently doing some study on differential cryptanalysis.
However, I have two open questions in the field.
The first question is: How can I calculate the number of messages necessary for a ...
- 509
1
vote
2
answers
968
views
Searching for a differential characteristic (differential cryptanalysis)
Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done.
I am currently talking about ciphers with multiple rounds. It ...
- 509
3
votes
1
answer
208
views
What does it mean : "Canonical representative of Sbox is 0123468A5BCF79DE"? and How can we calculate this representative for Sbox?
In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes.
What does "Canonical ...
- 336
3
votes
1
answer
1k
views
Differential cryptanalysis tutorial of Howard M. Heys
I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
- 509
1
vote
0
answers
83
views
differential cryptanalysis on the second round of 4-variant DES
I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference .
they say that we should choose two input Xor P3 and P4 that ...
- 191
0
votes
1
answer
116
views
Can multiple Pearson permutation tables be reduced or merged?
There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
- 15.2k
2
votes
1
answer
131
views
Attacking AES using Round 1 output
I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES.
What I understand is ...
- 31
1
vote
1
answer
268
views
Getting the s-box input from its output in differential cryptanalysis on DES
If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output?
This seems hard to do since the substitution operation is ...
- 191
6
votes
1
answer
179
views
Differential and Linear trail propagation in Noekeon
In the Noekeon Cipher Specification they write the following :
The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a
step. Because of the linearity of Lambda it is fully ...
- 153
1
vote
0
answers
55
views
Additive differential probability
I am studying about additive differential probability.
And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX.
I have a question in chapter 5.2.
V.Velichkov et ...
- 129
0
votes
1
answer
99
views
Additive Differential of XOR
I'm studying about Additive differential of XOR
I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
- 129
0
votes
0
answers
160
views
Differential probability of modular subtraction $xdp^-$
The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
- 2,074
16
votes
1
answer
689
views
Selection of rotation constants in ARX design
My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
- 2,074
3
votes
1
answer
561
views
Minimum number of active s box to be resistance to differential cryptanalysis
I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round?
...
- 101
2
votes
2
answers
1k
views
How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?
I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis ...
4
votes
1
answer
162
views
Cryptanalysis of MD4 (Wang et al) -- how did the authors come up with the collision differential?
Edit:
ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
- 407
2
votes
1
answer
132
views
The Collision Differential for MD4 - a question on notation (Wang, et al)
In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1):
$\Delta$$H_0$ = 0 $\xrightarrow{(M_,M')}$ $\Delta$$H$ = 0
What exactly ...
- 407
19
votes
0
answers
446
views
Adding bit constants to the key schedule to reduce rounds?
Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
- 4,625
-1
votes
1
answer
239
views
Compression function cryptanalysis
A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function.
We can assume ...
- 31
1
vote
1
answer
272
views
Calculating the number of rounds required for block cipher with known differential [closed]
Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential ...
- 43
4
votes
1
answer
251
views
it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks
I am trying to use Grover's algorithm to find Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high ...
18
votes
1
answer
2k
views
Understanding the wide trail design strategy
I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
- 15.1k
6
votes
2
answers
1k
views
Security of the AES with a Secret S-box
In this paper they change the $AES$ S-box to a uniformly random one and answer the questions:
How does the security of AES change when the S-box is changed by a secret S-box?
Would it be safe to ...
- 1,025
1
vote
1
answer
159
views
Does CPA-secure means security against differential cryptanalysis?
I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits.
However, I wonder is the differential cryptanalysis ...
- 113
2
votes
1
answer
284
views
Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?
SHA-2 has two functions:
$\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$
$\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$
Are these two functions non-linear? ...
- 3,645
3
votes
1
answer
125
views
Security of an S-box based on modular multplicative inverse
The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
- 3,645
3
votes
1
answer
156
views
Why is variable rotation uncommon in cryptographic primitives?
Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:
For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
- 359
1
vote
1
answer
120
views
Minimum difference collision metric
Take a hash function $H$.
There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$.
Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
- 359
2
votes
0
answers
256
views
If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?
AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
- 1,025
2
votes
1
answer
1k
views
How can one construct the weakest S-box ever?
Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability?
I am studying the properties of S-boxes and I don't quite understand ...
- 81
7
votes
1
answer
1k
views
What is a differential trail?
From what I could find it relates input differences to output differences usually across multiple rounds.
But is it the entire probability distribution over all output differences for one input ...
- 91
2
votes
1
answer
304
views
Differential or Truncated Differential Attack On Small Cipher
The cipher given below is a 16-bit toy cipher which uses 8-bit sbox and 2x2 byte Matrix. The Key $k_0$ and $k_1$ are $\oplus$ with the data. The multiplication with matrix is performed in $GF(2^8)$ ...
- 2,397
3
votes
1
answer
647
views
What is an advantage of MDS matrices in block ciphers?
I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is:
For example in the ...
- 2,323
1
vote
1
answer
335
views
Signal-to-noise ratio in differential cryptanalysis
What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
- 441
1
vote
0
answers
128
views
Determining number of required plaintext pairs for differential cryptanalysis
When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
- 441
3
votes
0
answers
70
views
Does this approach on MEDP take into account the multiple differential trails?
I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES:
I cannot fully understand what he is doing but it seems like it iterating over all ...
- 391
5
votes
2
answers
1k
views
What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?
I was reading this paper which has a lot of references to the terms MEDP and MELP. Even though i think i got the general meaning, I could not verify that it is indeed correct.
For the MEDP, I would ...
- 391