22
votes
Why is the permutation in AES (and other ciphers) not random or key-dependent?
You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not.
ShiftRows and MixColumns ...
- 4,375
16
votes
Accepted
Understanding the wide trail design strategy
Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief ...
- 1,816
10
votes
Why is the permutation in AES (and other ciphers) not random or key-dependent?
I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, ...
- 27.2k
9
votes
Accepted
Selection of rotation constants in ARX design
Leaving besides that the designers (NSA) of Simon and Speck did not provide an initial design rational for their ciphers/parameter choices, they added some notes later after pressure from the ...
- 116
7
votes
Accepted
In differential cryptanalysis for DES, why is F(0...0) assumed to be always 0...0?
The question arises from a misunderstanding: The attack described in the paper does not work with actual inputs and outputs, but with differences between them. Hence Differential Cryptanalysis.
...
- 181
7
votes
What is a differential trail?
Imagine you have a function like this: $$f(x) = p_3(p_2(p_1(x))).$$
Now imagine that you find a pair $\Delta_0, \Delta_1$ such that $p_1(x \oplus \Delta_0) = p_1(x) \oplus \Delta_1$ with probability $...
- 12.1k
7
votes
Accepted
Security of the AES with a Secret S-box
Are the S-boxes they are considering just random permutations of bytes that fit into an 8×8 table? How might they have chosen all the entries to get the S-box?
Yes, they chose a random s-box.
Are ...
- 12.9k
6
votes
Accepted
How can one construct the weakest S-box ever?
Any affine function will do. Let your Sbox be $$S(x)=Mx\oplus c$$ where $M$ is an $n\times n$ binary matrix and $c$ is an $n-$bit constant vector.
The output difference for this Sbox is, for any ...
- 19.1k
6
votes
Accepted
Does CPA-secure means security against differential cryptanalysis?
Differential cryptanalysis is a tool which is used to analyze symmetric primitives such as block ciphers and cryptographic hash functions. So it is applicable to CPA secure symmetric encryption ...
- 1,303
5
votes
Accepted
Differential Cryptanalysis for Hash functions
In the case of block ciphers, differential cryptanalysis aim to measure the changes between inputs and outputs with a probability. The goal is to predict what the result will be before the last round ...
- 9,889
5
votes
Accepted
Is the difference distribution table of AES S-box uniform?
The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of ...
- 19.4k
5
votes
Accepted
How to build a difference distribution table?
Those tables are fairly easy to build conceptually but require quite some work to actually carry out.
Note that: The columns show the XOR for the in-going pairs and the rows show the number of pairs ...
- 45.3k
5
votes
Best complexity of guessing difference of AES-256 outputs
Without further information, your question is overwhelmingly likely to be insoluble.
Given $m_1$, $m_2$ and $c_1$ we expect there to be roughly $2^{128}$ 256-bit keys $k$ such that $\mathrm{AES}_k(m_1)...
- 18.1k
4
votes
Best differential characteristic for this PRF
The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed.
As all the values $c_{i,j}$ are public, this means ...
- 139k
4
votes
Accepted
What is the complexity for attacking 3DES in linear or differential cryptanalysis?
"Not vulnerable" is not how I would describe it, but my understanding is that the existing attacks on DES cannot directly not work with 3DES.
At the moment, the best attack against single DES is a ...
- 3,447
4
votes
Accepted
What makes this mixer function resistant to differential cryptanalysis?
From your picture I deduce that $A$ and $B$ are both 8 bits.
So this construction can be seen as a $16 \times 8$ bit S-box (not bijective). The fact that it's not square is probably what is causing ...
- 1,816
4
votes
Accepted
Differential Fault Analysis of AES
Your fault attack scenario correspond to this paper :
A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003)
This paper ...
- 56
4
votes
Performing differential cryptanalysis for randomly generated S-boxes
With DES, the issue is the size of the s-box. The DES s-boxes are highly tuned for their security properties, but if you compare their nonlinearity to the larger AES s-box, the are quite inferior.
...
- 12.9k
4
votes
Accepted
What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?
Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed ...
- 4,375
4
votes
differential cryptanalysis cipher for the final round
Remark: The round function of your toy cipher is the following.
...
- 9,889
4
votes
Accepted
What is the difference between strong/weak alignment?
Truncated differential cryptanalysis was introduced by Lars R. Knudsen at FSE 1994.
The Keccak team provides an summary of this technique as follows:
In truncated differential cryptanalysis one ...
- 9,889
4
votes
Accepted
What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?
The paper you link to gives precise definitions for the MEDP and MELP. I will attempt to explain the definitions more expansively & clearly.
First, the differential probability (DP) function ...
- 4,375
4
votes
Accepted
How is the SHA-1 collision detector so fast?
One trick used by the collision detector you mention is to check for "unavoidable conditions", described in the paper here: http://oai.cwi.nl/oai/asset/23932/23932A.pdf
Essentially, the unavoidable ...
4
votes
What is an advantage of MDS matrices in block ciphers?
They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks.
That would probably depend on the cipher, but in generally, pretty accurate.
is ...
- 139k
4
votes
Accepted
Why is variable rotation uncommon in cryptographic primitives?
One issue is that data-dependent rotations (such as you describe) is patented by RSA data security (or, at least, was, the patent may have expired). RC5 and RC6 was created by the holder of this ...
- 139k
4
votes
Security of the AES with a Secret S-box
A random 8 bit permutation has $log_2(256!)=1684$ bits of information in it. Add thar to the regular AES key and you get the required number.
You would not need/want to change the s box. You ...
- 11.5k
4
votes
Accepted
Differential and Linear trail propagation in Noekeon
This is due to the duality between linear and differential trails.
Let $L$ be an invertible linear map on $\mathbb{F}_2^n$, think of it as a matrix for convenience.
In general, a nonzero differential $...
- 1,816
4
votes
Accepted
Why the differential cryptanalysis complexity is linear with inverse of the probability while linear cryptanalysis is quadratic with the bias inverse?
What I don’t get is why the complexity became quadratic in linear case?
Well, in linear cryptanalysis, for each input, we get a bit with a bias of $0.5 \pm \epsilon$, and we need to determine if that ...
- 139k
3
votes
Why is the permutation in AES (and other ciphers) not random or key-dependent?
I made a toy cipher that functioned in this manner. It had a bytewise transposition step that was performed by an invertible randomized permutation, similar to the Fisher-Yates shuffle, but easily ...
- 19.4k
3
votes
Accepted
Finding differentials and space complexity
If such a large Sbox with no structure were to be analysed you'd treat the analysis as a one-off precomputation.
Considering only classical differential cryptanalysis as an example, after the ...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible