# Tag Info

### Why is the permutation in AES (and other ciphers) not random or key-dependent?

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns ...
• 4,375
Accepted

### Understanding the wide trail design strategy

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief ...
• 1,816

### Why is the permutation in AES (and other ciphers) not random or key-dependent?

I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, ...
• 27.2k
Accepted

### Selection of rotation constants in ARX design

Leaving besides that the designers (NSA) of Simon and Speck did not provide an initial design rational for their ciphers/parameter choices, they added some notes later after pressure from the ...
• 116
Accepted

### In differential cryptanalysis for DES, why is F(0...0) assumed to be always 0...0?

The question arises from a misunderstanding: The attack described in the paper does not work with actual inputs and outputs, but with differences between them. Hence Differential Cryptanalysis. ...
• 181

• 18.1k

### Best differential characteristic for this PRF

The function $f$ is biased towards the complement of the input $c_{i,j}$, assuming the other two inputs are approximately randomly distributed. As all the values $c_{i,j}$ are public, this means ...
• 139k
Accepted

### What is the complexity for attacking 3DES in linear or differential cryptanalysis?

"Not vulnerable" is not how I would describe it, but my understanding is that the existing attacks on DES cannot directly not work with 3DES. At the moment, the best attack against single DES is a ...
• 3,447
Accepted

### What makes this mixer function resistant to differential cryptanalysis?

From your picture I deduce that $A$ and $B$ are both 8 bits. So this construction can be seen as a $16 \times 8$ bit S-box (not bijective). The fact that it's not square is probably what is causing ...
• 1,816
Accepted

### Differential Fault Analysis of AES

Your fault attack scenario correspond to this paper : A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003) This paper ...

### Performing differential cryptanalysis for randomly generated S-boxes

With DES, the issue is the size of the s-box. The DES s-boxes are highly tuned for their security properties, but if you compare their nonlinearity to the larger AES s-box, the are quite inferior. ...
• 12.9k
Accepted

### What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed ...
• 4,375

### differential cryptanalysis cipher for the final round

Remark: The round function of your toy cipher is the following. ...
• 9,889
Accepted

### What is the difference between strong/weak alignment?

Truncated differential cryptanalysis was introduced by Lars R. Knudsen at FSE 1994. The Keccak team provides an summary of this technique as follows: In truncated differential cryptanalysis one ...
• 9,889
Accepted

### What is the meaning of Maximum Expected Differential/Linear Probability (MEDP/MELP)?

The paper you link to gives precise definitions for the MEDP and MELP. I will attempt to explain the definitions more expansively & clearly. First, the differential probability (DP) function ...
• 4,375
Accepted

### How is the SHA-1 collision detector so fast?

One trick used by the collision detector you mention is to check for "unavoidable conditions", described in the paper here: http://oai.cwi.nl/oai/asset/23932/23932A.pdf Essentially, the unavoidable ...

### What is an advantage of MDS matrices in block ciphers?

They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. That would probably depend on the cipher, but in generally, pretty accurate. is ...
• 139k
Accepted

### Why is variable rotation uncommon in cryptographic primitives?

One issue is that data-dependent rotations (such as you describe) is patented by RSA data security (or, at least, was, the patent may have expired). RC5 and RC6 was created by the holder of this ...
• 139k

### Security of the AES with a Secret S-box

A random 8 bit permutation has $log_2(256!)=1684$ bits of information in it. Add thar to the regular AES key and you get the required number. You would not need/want to change the s box. You ...
• 11.5k
Accepted

• 139k

### Why is the permutation in AES (and other ciphers) not random or key-dependent?

I made a toy cipher that functioned in this manner. It had a bytewise transposition step that was performed by an invertible randomized permutation, similar to the Fisher-Yates shuffle, but easily ...
• 19.4k