Questions tagged [differential-analysis]
Differential cryptanalysis is a form of cryptanalysis which studies cryptographic algorithms by observing how differences in input affect differences in output.
136
questions
5
votes
1
answer
405
views
How is the SHA-1 collision detector so fast?
The google collision website shattered.it refers to a collision detector: https://github.com/cr-marcstevens/sha1collisiondetection.
It claims a false positive rate of $2^{-90}$ and to take less then ...
- 11.7k
2
votes
1
answer
233
views
Differential trails in FEAL-8
In this paper the authors describe a differential attack against FEAL-8. They find several short differential trails, then extend the attack to the full 8-Rounds of the cipher by algebraic means.
In ...
- 23
1
vote
1
answer
223
views
In differential cryptanalysis for DES, why is F(0...0) assumed to be always 0...0?
In this paper about differential cryptanalysis, an attack on 2n-Round DES is described.
The attack is all about finding certain inputs for DES rounds, for which ...
- 181
5
votes
1
answer
536
views
What is the difference between strong/weak alignment?
In this answer there is the mention of "weak alignment", followed by an indication that it is related to "resistance to truncated differential cryptanalysis".
What exactly is the difference between ...
- 19.5k
5
votes
2
answers
3k
views
Is the difference distribution table of AES S-box uniform?
I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
- 284
6
votes
2
answers
332
views
Can I use a differential that can be traced through the whole cipher with 100% probability?
I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
- 305
2
votes
3
answers
1k
views
What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?
As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^...
- 141
3
votes
1
answer
229
views
Countering Cryptographic Attacks
By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view.
Differential and Linear Crypt-analysis. Number of Active S-...
- 2,397
3
votes
1
answer
303
views
Differential & linear characteristics for integer multiplication
What are the probabilities of differential & linear characteristics for the function that XORs the high and low bits from a $n \times n \rightarrow 2n$ bit multiplication?
I remember reading ...
- 4,763
5
votes
1
answer
376
views
differential cryptanalysis cipher for the final round
I have a problem to find the sub-key.
The system is…
For each round, we make the following stage:
We add the round key $K_i$.
Substitution : we have 8 blocks of 4 bits, and an S-box takes each ...
- 51
14
votes
4
answers
6k
views
Why is the permutation in AES (and other ciphers) not random or key-dependent?
If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks?
If this is so, then might we need fewer rounds for ...
- 1,025
4
votes
1
answer
172
views
Best differential characteristic for this PRF
Consider the following construction of a PRF $F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$ on 64-bit messages and 128-bit keys. Define $f:\{0,1\}^3 \to \{0,1\}$ by
$$f(c,x,y) = \begin{...
- 36.2k
3
votes
1
answer
221
views
Differential bound of the S-Box in GOST R34.11-2012
In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
- 63
5
votes
1
answer
1k
views
Differential Cryptanalysis for Hash functions
How is differential cryptanalysis used to attack hash functions? I've been struggling through a couple academic papers and thesis's on the subject but they all sound like greek to me. Does anyone know ...
- 55
6
votes
1
answer
174
views
Finding differentials and space complexity
In Differential Cryptanalysis of DES-like Cryptosystems by Biham and Shamir, they provide examples using differentials inputs such as $\Omega_p = 00\ 80\ 82\ 00\ 60\ 00\ 00\ 00_x$. Most of article is ...
- 9,969
1
vote
0
answers
162
views
Differential Cryptanalysis [closed]
How do I find the differential characteristics using techniques Shrinking ?
How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm?
Shrinking ...
9
votes
2
answers
7k
views
How to build a difference distribution table?
i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
- 281
3
votes
1
answer
2k
views
What is the complexity for attacking 3DES in linear or differential cryptanalysis?
I know that 3DES is NOT vulnerable to DC , LC .
But is it because the attacks requires too many input\output pairs ?
Or because it's impossible ? (i.e requires more than 2^64 pair )
- 203
0
votes
1
answer
296
views
What makes this mixer function resistant to differential cryptanalysis?
I recently learned how differential cryptanalysis works, and decided to have a play around with testing various designs for resistance against attack.
My testing algorithm is essentially to loop ...
- 3,527
2
votes
1
answer
838
views
Differential Fault Analysis of AES
Let's say: an error is induced into an implementation of the AES-128 to produce a faulty ciphertext. The error is a one-byte eror and is always induced on the last state byte, during round9, before ...
- 153
3
votes
1
answer
688
views
Performing differential cryptanalysis for randomly generated S-boxes
As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
- 203
3
votes
2
answers
656
views
How do we find the subkey out of a differential cryptanalysis?
I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we ...
- 1,535
2
votes
1
answer
316
views
SHA-1 collision resistance
I'm researching on the SHA-1 algorithm and looking for reasons why it has fallen prey to differential cryptanalysis. I have read the research papers by Merc Stevens and Wang both of which describe how ...
- 43
6
votes
2
answers
6k
views
DES with the bitwise complement of a key
I was reading upon Biham and Shamir's paper and a fact has been presented over there:
if $ P_1 = \bar P_2$ and I choose a key $K_1 = \bar K_2$ then in that case
$$T_1 = DES(P_1, K_1)$$
$$T_2 = DES(...
- 163
1
vote
1
answer
881
views
Comparing Difference Distribution Tables
I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is
I have calculated the tables programmatically and found that the second table has a max value of 6 ...
- 53
5
votes
1
answer
986
views
Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
- 597
3
votes
2
answers
1k
views
Two-dimensional S-Box
Consider the following simple cipher:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key.
If S-box is standard then this ...
2
votes
1
answer
357
views
Applying differential cryptanalysis to ciphers with addition mod $2^{32}$
I am studying differential analysis and have a question.
Consider the following simple cipher:
$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$
(Plaintext $m_1$ xor with key $K_1$, then result goes into an S-...
6
votes
2
answers
1k
views
Cryptanalysis and weaknesses of SEED cipher
I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
- 3,527
5
votes
1
answer
30k
views
Difference between linear cryptanalysis and differential cryptanalysis
What is the main difference between linear cryptanalysis and differential cryptanalysis? For example in relation to DES?
4
votes
1
answer
772
views
How to prove a cipher resistant to differential cryptanalysis?
How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
- 157
4
votes
2
answers
738
views
Differential and Linear Cryptanalysis
I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show the weakness of DES.
However, many articles state that differential and ...
- 151
7
votes
2
answers
919
views
S-box with differential uniformity = 2
I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2.
I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
- 304
1
vote
0
answers
314
views
Differential Cryptanalysis of FEAL-4 [duplicate]
I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall.
Basically I attacked the final round first ($K3$) using the differential characteristic ...
- 19
6
votes
1
answer
1k
views
Differential cryptanalysis - breaking the last round of FEAL4?
I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful:
http://theamazingking.com/crypto-feal.php
So far I've been almost successful in breaking FEAL4 ...
- 7,438
31
votes
2
answers
5k
views
How do I apply differential cryptanalysis to a block cipher?
I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
user46