crypto-slides-22-dc-tutor.1x1

crypto-slides-22-dc-tutor.1x1 - Tutorial on Differential...

Info iconThis preview shows pages 1–5. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Tutorial on Differential Cryptanalysis c circlecopyrt Eli Biham - August 18, 2010 670 Tutorial on Differential Cryptanalysis (22) An Example of a 0R-Attack on 5-Round DES We use a 5-round characteristic with probability p = 1 10485 . 76 : Ω P = 40 5 C 00 00 04 00 00 00 x A ′ = 40 08 00 00 x a ′ = 04 00 00 00 x p = 1 4 = P (0 A 00 00 00 x ) B ′ = 04 00 00 00 x b ′ = 00 54 00 00 x p = 10 · 16 64 · 64 = P (00 10 00 00 x ) C ′ = 0 c ′ = 0 p = 1 D ′ = 04 00 00 00 x d ′ = 00 54 00 00 x p = 10 · 16 64 · 64 E ′ = 40 08 00 00 x e ′ = 04 00 00 00 x p = 1 4 Ω T = Ω P = 40 5 C 00 00 04 00 00 00 x F F F F F c circlecopyrt Eli Biham - August 18, 2010 671 Tutorial on Differential Cryptanalysis (22) An Example of a 0R-Attack on 5-Round DES (cont.) The algorithm : 1. We choose m = 2 p ≈ 20000 random pairs P,P ∗ such that P ′ = Ω P , and request the corresponding ciphertexts T and T ∗ under the unknown key K . 2. We keep only the pairs satisfying T ′ = Ω T , and discard the others. About m ( p + 2 − 64 ) pairs remain (from the m pairs): mp ≈ 2 right pairs and 2 − 64 m wrong pairs. 3. The differences of the inputs and the outputs of the S boxes of the last round are known from T ′ = T ⊕ T ∗ (and from the characteristic): The two inputs of F in the 5th round differ only in the 6th bit. Thus, the two inputs of S2 in the 5th round differ by 08 x in the input. From T ∗ we know that the outputs of S2 differ by A x . c circlecopyrt Eli Biham - August 18, 2010 672 Tutorial on Differential Cryptanalysis (22) An Example of a 0R-Attack on 5-Round DES (cont.) 4. When looking at the difference distribution table of S2, we find 16 possible pairs for this combination, thus we reduce the number of possible keys by a factor of 16 2 6 = 1 4 . 5. Other pairs further reduce the number of possible keys. The Difference Distribution Table of S2 : Input Output XOR XOR x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x A x B x C x D x E x F x x 64 ....
View Full Document

This note was uploaded on 04/14/2011 for the course CS 236506 taught by Professor Yanivcarmeli during the Spring '11 term at Technion.

Page1 / 17

crypto-slides-22-dc-tutor.1x1 - Tutorial on Differential...

This preview shows document pages 1 - 5. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online