# Questions tagged [differential-analysis]

Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.

136 questions
Filter by
Sorted by
Tagged with
53 views

### what if the S-boxes in DES were "optimal"

if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
• 21
174 views

### Why isn't there a final permutation on SPN-based ciphers?

I am doing some research on differential cryptanalysis. Most people who are familiar with that cryptanalysis technique do know the tutorial from Heys (Heys Tutorial). I came currently to the question, ...
• 509
64 views

### AES - Non-linearity hinders differential cryptoanalysis

Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
• 461
111 views

### Enhancing Differential-Linear Cryptanalysis

I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
• 315
87 views

• 23
239 views

### Implementation of differential cryptanalysis

This question is a little bit more implementation based of differential cryptanalysis. I hope it is okay. I am working with the book "The Block Cipher Companion" on the topic differential ...
• 509
196 views

### Differential cryptanalysis in "The Block Cipher Companion"

I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher: In Fig. 6.10 (page 126) there are ...
• 509
279 views

### Recover all keys on differential cryptanalysis

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" . I am successful to get the last key $k_5$. Just to say some words about the ...
• 509
1 vote
183 views

### Calculate number of required pairs for differential cryptanalysis

I am currently doing some study on differential cryptanalysis. However, I have two open questions in the field. The first question is: How can I calculate the number of messages necessary for a ...
• 509
1 vote
968 views

### Searching for a differential characteristic (differential cryptanalysis)

Currently I am doing some research on differential cryptanalysis. In general I got a good idea about the attack and how it is done. I am currently talking about ciphers with multiple rounds. It ...
• 509
208 views

### What does it mean : "Canonical representative of Sbox is 0123468A5BCF79DE"? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
• 336
1k views

### Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
• 509
1 vote
83 views

### differential cryptanalysis on the second round of 4-variant DES

I am using differential cryptanalysis to attack the second key of a 4-variant DES and I am using Shamir and biham book as a reference . they say that we should choose two input Xor P3 and P4 that ...
• 191
116 views

### Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
• 15.2k
131 views

### Attacking AES using Round 1 output

I was reading the paper Differential Scan Attack on AES with X-tolerant and X-masked Test Response Compactor and I have a question in the section Differential Scan Attack on AES. What I understand is ...
1 vote
268 views

### Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
• 191
179 views

### Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
• 153
1 vote
55 views

I am studying about additive differential probability. And I show a paper that is V.Velichkov et al., The Additive Differential Probability of ARX. I have a question in chapter 5.2. V.Velichkov et ...
• 129
99 views

I'm studying about Additive differential of XOR I saw two papers that are "H.Lipmaa et al., On the Additive Differential Probability of Exclusive-or" and "V.Velichkov et al., The Additive ...
• 129
160 views

### Differential probability of modular subtraction $xdp^-$

The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
• 2,074
689 views

### Selection of rotation constants in ARX design

My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
• 2,074
561 views

### Minimum number of active s box to be resistance to differential cryptanalysis

I am calculating the minimum number of active s_boxes for block cipher using mixed integer programming, when can we say that block cipher is resistance to differential cryptanalysis after which round? ...
• 101
1k views

### How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?

I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis ...
162 views

### Cryptanalysis of MD4 (Wang et al) -- how did the authors come up with the collision differential?

Edit: ok, after I re-read the paper a couple of times it is clear that Table 6 is easily derived from Table 5, which describes the collision differential. So the real question is: how did the ...
• 407
132 views

### The Collision Differential for MD4 - a question on notation (Wang, et al)

In the paper "Cryptanalysis of the Hash Functions MD4 and RIPEMD" the authors introduce the following notation (paragraph 4.1): $\Delta$$H_0 = 0 \xrightarrow{(M_,M')} \Delta$$H$ = 0 What exactly ...
• 407
446 views

### Adding bit constants to the key schedule to reduce rounds?

Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have ...
• 4,625
239 views

### Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
1 vote
272 views

### Calculating the number of rounds required for block cipher with known differential [closed]

Suppose we have a 128-bit block cipher for which the best two-round differential holds with probability $p = 2^7$. Suppose as well that this differential is iterative and that the best differential ...
• 43
251 views

### it is possible to use quantum algorithm search (Grover's algorithm) for new searching strategies for differential and linear attacks

I am trying to use Grover's algorithm to find Differential characteristic of Feistel and SPN structures block ciphers. basically, which is Finding a good differential characteristic with high ...
2k views

### Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
• 15.1k
1k views

### Security of the AES with a Secret S-box

In this paper they change the $AES$ S-box to a uniformly random one and answer the questions: How does the security of AES change when the S-box is changed by a secret S-box? Would it be safe to ...
• 1,025
1 vote
159 views

### Does CPA-secure means security against differential cryptanalysis?

I've read on differential cryptanalysis where it traces the differences on the changes of ciphertexts of the same plaintext, except for some bits. However, I wonder is the differential cryptanalysis ...
• 113
284 views

### Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

SHA-2 has two functions: $\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$ $\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$ Are these two functions non-linear? ...
• 3,645
125 views

### Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
• 3,645
156 views

### Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
• 359
1 vote
120 views

### Minimum difference collision metric

Take a hash function $H$. There will be pairs of messages of the same length $M,M'$ for which $M\ne M',H(M)=H(M')$. Let $P(x)$ be a function counts the number of $1$s in $x$. $d=P(M\oplus M')$, or ...
• 359
256 views

### If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
• 1,025
1k views

### How can one construct the weakest S-box ever?

Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability? I am studying the properties of S-boxes and I don't quite understand ...
• 81
1k views

### What is a differential trail?

From what I could find it relates input differences to output differences usually across multiple rounds. But is it the entire probability distribution over all output differences for one input ...
• 91
304 views

### Differential or Truncated Differential Attack On Small Cipher

The cipher given below is a 16-bit toy cipher which uses 8-bit sbox and 2x2 byte Matrix. The Key $k_0$ and $k_1$ are $\oplus$ with the data. The multiplication with matrix is performed in $GF(2^8)$ ...
• 2,397
647 views

### What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
• 2,323
1 vote
335 views

### Signal-to-noise ratio in differential cryptanalysis

What does signal-to-noise ratio mean in the context of differential cryptanalysis, and how can one use it to derive the number of required plaintext pairs to carry out a successful attack?
• 441
1 vote
128 views

### Determining number of required plaintext pairs for differential cryptanalysis

When carrying differential analysis of a SPN network, how can one determine the number of required plaintext for the attack to be successful with high probability?
• 441