# Tag Info

21

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns were carefully selected to work in tandem, such that every byte affects every other byte in the state within just two rounds. MixColumns ensures that every ...

14

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...

14

This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are not really competent in the subject.

11

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief summary and some context. Hopefully this will help you understand the paper by Daemen and Rijmen (paywal-free preprint) better. Since the (public) discovery of ...

10

I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, one of the things that they showed was that if you replace the S-boxes in DES with randomly chosen ones, then the differential attack becomes much more ...

9

Leaving besides that the designers (NSA) of Simon and Speck did not provide an initial design rational for their ciphers/parameter choices, they added some notes later after pressure from the cryptographic community/ISO. There they mention that they selected the round constants to be ... optimal with respect to resistance against 8-round differential and ...

8

There are 256! possible 8x8 S-boxes (i.e., bijective functions from $\{0,1\}^8$ to $\{0,1\}^8$). This is an absolutely enormous number. You couldn't possibly enumerate all of them within the lifetime of the universe. So, yes, this is one reason why it is not straightforward to determine whether there exists such a S-box with differential uniformity 2.

7

This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$A \boxminus B \equiv (A-B)\pmod{2^{32}}.$$ You compute ...

7

The question arises from a misunderstanding: The attack described in the paper does not work with actual inputs and outputs, but with differences between them. Hence Differential Cryptanalysis. Given two messages m1 = (l1, r1) and m2 = (l2, r2) with equal right halves r1 = r2, it obviously follows that r1 - r2 = 0...0 and F(r1) - F(r2) = 0...0.

7

Are the S-boxes they are considering just random permutations of bytes that fit into an 8×8 table? How might they have chosen all the entries to get the S-box? Yes, they chose a random s-box. Are they choosing a random S-box and then leaving it unchanged thereafter Yes, it was unchanged. In Section 3.1 they state differential cryptanalysis will not ...

6

I understand the question as you have a single 4-bit S-box, which you first apply rowwise, and then columnwise. As already mentioned, this is equivalent to a large S-box $\mathcal{S}$ $$c = \mathcal{S}(m\oplus k_1)\oplus k_2.$$ This is a well-known Even-Mansour cipher, and it can be broken with complexity $2^{n/2}$, which is $2^8$ for your $n=16$. The ...

6

This is known as the complementation property of $DES$; I had thought that it actually predated Biham and Shamir's work. In any case, your questions: Does this hold for only that particular combination of $S$-Box or it will be same for any $S$-Box combination? It'd remain even if you change the $S$-Boxes arbitrarily. The reason for this is that it is ...

6

Imagine you have a function like this: $$f(x) = p_3(p_2(p_1(x))).$$ Now imagine that you find a pair $\Delta_0, \Delta_1$ such that $p_1(x \oplus \Delta_0) = p_1(x) \oplus \Delta_1$ with probability $2^{-n_1}$, $\Delta_2$ such that $p_2(x \oplus \Delta_1) = p_2(x) \oplus \Delta_2$ with probability $2^{-n_2}$, and $\Delta_3$ such that $p_3(x \oplus \Delta_2) =... 6 Any affine function will do. Let your Sbox be $$S(x)=Mx\oplus c$$ where$M$is an$n\times n$binary matrix and$c$is an$n-$bit constant vector. The output difference for this Sbox is, for any nonzero$a$$$S(x \oplus a)\oplus S(x)=(M(x\oplus a)\oplus c )\oplus Mx\oplus c= M a\oplus c$$ which is a constant for fixed$a$so all the output differences for ... 6 Differential cryptanalysis is a tool which is used to analyze symmetric primitives such as block ciphers and cryptographic hash functions. So it is applicable to CPA secure symmetric encryption schemes. ElGamal, however, is an asymmetric encryption scheme. Its CPA security essentially relies on the decisional Diffie-Hellman assumption in some group$\...

5

In the case of block ciphers, differential cryptanalysis aim to measure the changes between inputs and outputs with a probability. The goal is to predict what the result will be before the last round and try to extract the key. For hash functions, your aim is to find a second-pre-image. I will take Keccak as an example. It is a sponge construction ...

5

Those tables are fairly easy to build conceptually but require quite some work to actually carry out. Note that: The columns show the XOR for the in-going pairs and the rows show the number of pairs that had the specified XOR afterwards. This pseudo-code generates the table: InLength; // input length of the S-Box in bits OutLengh; // output length of the ...

5

The design documents for Rijndael explain exactly how the designers proved its resistance to differential cryptanalysis. Read their submission to the AES competition process, particularly Section 8.2 and the Annex. To understand their approach, it will probably help to understand differential cryptanalysis and read some of the related literature. You can ...

4

As with Dmitry, I assume you are applying a 4-bit s-box to a 4-by-4 array of 16 bits, first to the rows (after xoring 16 bits of key material to the plaintext), then to the columns (and lastly xoring 16 more bits of key material to produce the ciphertext). Strictly speaking, you need to specify the 4-bit s-box in order to fully evaluate it against ...

4

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a blockcipher,...

4

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits. In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally: Very sophisticated in theory and ...

4

They are generally relevant only to symmetric-key cryptography (e.g., block ciphers, hash functions, message authentication codes). There's no deep reason why -- it's just that differential and linear cryptanalysis tend to be effective against the sort of structure that are commonly used in block ciphers, but not very effective against the sort of designs ...

4

From your picture I deduce that $A$ and $B$ are both 8 bits. So this construction can be seen as a $16 \times 8$ bit S-box (not bijective). The fact that it's not square is probably what is causing confusion. Usually, for SPNs, invertible S-boxes are used. Non-invertible S-boxes are less common, but they certainly have applications. One of the things we can ...

4

Your fault attack scenario correspond to this paper : A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003) This paper describe how to retrieve four bytes of the last round key with at least two pairs of ciphertext/faultytext. Each pair of ciphertext $C$ and faultytext $C^*$ could be ...

4

With DES, the issue is the size of the s-box. The DES s-boxes are highly tuned for their security properties, but if you compare their nonlinearity to the larger AES s-box, the are quite inferior. Note than random s-boxes and key dependent s-boxes are not the same thing. Random = fixed random, key dependent = permuted s-boxes based on the key. A random set ...

4

Remark: The round function of your toy cipher is the following. | K ---> + | ------- | S | ------- | >> 2 | Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred. I did a ...

4

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means that the output of the function $R_i$, and hence the function $F$ is strongly distinguishable from random (being biased towards a known bit pattern). This isn't an ...

4

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...

4

The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of the table here so that you can see. The code used to produce this table can be found here. Disclaimer: This is my personal github. If by "uniform", you mean ...

4

Truncated differential cryptanalysis was introduced by Lars R. Knudsen at FSE 1994. The Keccak team provides an summary of this technique as follows: In truncated differential cryptanalysis one divides the function input, output and intermediate computation values in sub-blocks, typically of equal size (e.g. bytes). Whereas in classical differential ...

Only top voted, non community-wiki answers of a minimum length are eligible