# Tag Info

21

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns were carefully selected to work in tandem, such that every byte affects every other byte in the state within just two rounds. MixColumns ensures that every ...

15

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief summary and some context. Hopefully this will help you understand the paper by Daemen and Rijmen (paywal-free preprint) better. Since the (public) discovery of ...

14

This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are not really competent in the subject.

10

I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, one of the things that they showed was that if you replace the S-boxes in DES with randomly chosen ones, then the differential attack becomes much more ...

9

Leaving besides that the designers (NSA) of Simon and Speck did not provide an initial design rational for their ciphers/parameter choices, they added some notes later after pressure from the cryptographic community/ISO. There they mention that they selected the round constants to be ... optimal with respect to resistance against 8-round differential and ...

7

This is called an Even-Mansour cipher. Actually, for the differential cryptanalysis it does not matter what sort of difference you use, you only need that it propagates deterministically through linear transformations (whatever linearity means). In this case you use a difference modulo $2^{32}$: $$A \boxminus B \equiv (A-B)\pmod{2^{32}}.$$ You compute ...

7

The question arises from a misunderstanding: The attack described in the paper does not work with actual inputs and outputs, but with differences between them. Hence Differential Cryptanalysis. Given two messages m1 = (l1, r1) and m2 = (l2, r2) with equal right halves r1 = r2, it obviously follows that r1 - r2 = 0...0 and F(r1) - F(r2) = 0...0.

7

Are the S-boxes they are considering just random permutations of bytes that fit into an 8×8 table? How might they have chosen all the entries to get the S-box? Yes, they chose a random s-box. Are they choosing a random S-box and then leaving it unchanged thereafter Yes, it was unchanged. In Section 3.1 they state differential cryptanalysis will not ...

6

This is known as the complementation property of $DES$; I had thought that it actually predated Biham and Shamir's work. In any case, your questions: Does this hold for only that particular combination of $S$-Box or it will be same for any $S$-Box combination? It'd remain even if you change the $S$-Boxes arbitrarily. The reason for this is that it is ...

6

I understand the question as you have a single 4-bit S-box, which you first apply rowwise, and then columnwise. As already mentioned, this is equivalent to a large S-box $\mathcal{S}$ $$c = \mathcal{S}(m\oplus k_1)\oplus k_2.$$ This is a well-known Even-Mansour cipher, and it can be broken with complexity $2^{n/2}$, which is $2^8$ for your $n=16$. The ...

6

Imagine you have a function like this: $$f(x) = p_3(p_2(p_1(x))).$$ Now imagine that you find a pair $\Delta_0, \Delta_1$ such that $p_1(x \oplus \Delta_0) = p_1(x) \oplus \Delta_1$ with probability $2^{-n_1}$, $\Delta_2$ such that $p_2(x \oplus \Delta_1) = p_2(x) \oplus \Delta_2$ with probability $2^{-n_2}$, and $\Delta_3$ such that $p_3(x \oplus \Delta_2) =... 6 Any affine function will do. Let your Sbox be $$S(x)=Mx\oplus c$$ where$M$is an$n\times n$binary matrix and$c$is an$n-$bit constant vector. The output difference for this Sbox is, for any nonzero$a$$$S(x \oplus a)\oplus S(x)=(M(x\oplus a)\oplus c )\oplus Mx\oplus c= M a\oplus c$$ which is a constant for fixed$a$so all the output differences for ... 6 Differential cryptanalysis is a tool which is used to analyze symmetric primitives such as block ciphers and cryptographic hash functions. So it is applicable to CPA secure symmetric encryption schemes. ElGamal, however, is an asymmetric encryption scheme. Its CPA security essentially relies on the decisional Diffie-Hellman assumption in some group$\...

5

In the case of block ciphers, differential cryptanalysis aim to measure the changes between inputs and outputs with a probability. The goal is to predict what the result will be before the last round and try to extract the key. For hash functions, your aim is to find a second-pre-image. I will take Keccak as an example. It is a sponge construction ...

5

Those tables are fairly easy to build conceptually but require quite some work to actually carry out. Note that: The columns show the XOR for the in-going pairs and the rows show the number of pairs that had the specified XOR afterwards. This pseudo-code generates the table: InLength; // input length of the S-Box in bits OutLengh; // output length of the ...

4

From your picture I deduce that $A$ and $B$ are both 8 bits. So this construction can be seen as a $16 \times 8$ bit S-box (not bijective). The fact that it's not square is probably what is causing confusion. Usually, for SPNs, invertible S-boxes are used. Non-invertible S-boxes are less common, but they certainly have applications. One of the things we can ...

4

Your fault attack scenario correspond to this paper : A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003) This paper describe how to retrieve four bytes of the last round key with at least two pairs of ciphertext/faultytext. Each pair of ciphertext $C$ and faultytext $C^*$ could be ...

4

With DES, the issue is the size of the s-box. The DES s-boxes are highly tuned for their security properties, but if you compare their nonlinearity to the larger AES s-box, the are quite inferior. Note than random s-boxes and key dependent s-boxes are not the same thing. Random = fixed random, key dependent = permuted s-boxes based on the key. A random set ...

4

As with Dmitry, I assume you are applying a 4-bit s-box to a 4-by-4 array of 16 bits, first to the rows (after xoring 16 bits of key material to the plaintext), then to the columns (and lastly xoring 16 more bits of key material to produce the ciphertext). Strictly speaking, you need to specify the 4-bit s-box in order to fully evaluate it against ...

4

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a blockcipher,...

4

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits. In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally: Very sophisticated in theory and ...

4

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means that the output of the function $R_i$, and hence the function $F$ is strongly distinguishable from random (being biased towards a known bit pattern). This isn't an ...

4

Remark: The round function of your toy cipher is the following. | K ---> + | ------- | S | ------- | >> 2 | Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred. I did a ...

4

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...

4

The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of the table here so that you can see. The code used to produce this table can be found here. Disclaimer: This is my personal github. If by "uniform", you mean ...

4

Truncated differential cryptanalysis was introduced by Lars R. Knudsen at FSE 1994. The Keccak team provides an summary of this technique as follows: In truncated differential cryptanalysis one divides the function input, output and intermediate computation values in sub-blocks, typically of equal size (e.g. bytes). Whereas in classical differential ...

4

One trick used by the collision detector you mention is to check for "unavoidable conditions", described in the paper here: http://oai.cwi.nl/oai/asset/23932/23932A.pdf Essentially, the unavoidable conditions are a faster check, but may have false positives. If a given block meets these conditions, the detector then runs the full check. Per the paper above, ...

4

The paper you link to gives precise definitions for the MEDP and MELP. I will attempt to explain the definitions more expansively & clearly. First, the differential probability (DP) function with respect to a given block cipher takes an input difference $\Delta x$, an output difference $\Delta y$, and a key $k$ as inputs and generates a probability as ...

4

They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. That would probably depend on the cipher, but in generally, pretty accurate. is constructing the bias table of MDS matrices behavior impossible? Actually, it's trivial; MDS matrices are completely linear, and so they have probability 1 ...

4

One issue is that data-dependent rotations (such as you describe) is patented by RSA data security (or, at least, was, the patent may have expired). RC5 and RC6 was created by the holder of this patent, however such a patent could be enforced against someone else, and so people have shied away from it. More minor issues would include: It is likely to take ...

Only top voted, non community-wiki answers of a minimum length are eligible