This preview shows pages 1–5. Sign up to view the full content.
This preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full Document
Unformatted text preview: Tutorial on Differential Cryptanalysis c circlecopyrt Eli Biham  August 18, 2010 670 Tutorial on Differential Cryptanalysis (22) An Example of a 0RAttack on 5Round DES We use a 5round characteristic with probability p = 1 10485 . 76 : Ω P = 40 5 C 00 00 04 00 00 00 x A ′ = 40 08 00 00 x a ′ = 04 00 00 00 x p = 1 4 = P (0 A 00 00 00 x ) B ′ = 04 00 00 00 x b ′ = 00 54 00 00 x p = 10 · 16 64 · 64 = P (00 10 00 00 x ) C ′ = 0 c ′ = 0 p = 1 D ′ = 04 00 00 00 x d ′ = 00 54 00 00 x p = 10 · 16 64 · 64 E ′ = 40 08 00 00 x e ′ = 04 00 00 00 x p = 1 4 Ω T = Ω P = 40 5 C 00 00 04 00 00 00 x F F F F F c circlecopyrt Eli Biham  August 18, 2010 671 Tutorial on Differential Cryptanalysis (22) An Example of a 0RAttack on 5Round DES (cont.) The algorithm : 1. We choose m = 2 p ≈ 20000 random pairs P,P ∗ such that P ′ = Ω P , and request the corresponding ciphertexts T and T ∗ under the unknown key K . 2. We keep only the pairs satisfying T ′ = Ω T , and discard the others. About m ( p + 2 − 64 ) pairs remain (from the m pairs): mp ≈ 2 right pairs and 2 − 64 m wrong pairs. 3. The differences of the inputs and the outputs of the S boxes of the last round are known from T ′ = T ⊕ T ∗ (and from the characteristic): The two inputs of F in the 5th round differ only in the 6th bit. Thus, the two inputs of S2 in the 5th round differ by 08 x in the input. From T ∗ we know that the outputs of S2 differ by A x . c circlecopyrt Eli Biham  August 18, 2010 672 Tutorial on Differential Cryptanalysis (22) An Example of a 0RAttack on 5Round DES (cont.) 4. When looking at the difference distribution table of S2, we find 16 possible pairs for this combination, thus we reduce the number of possible keys by a factor of 16 2 6 = 1 4 . 5. Other pairs further reduce the number of possible keys. The Difference Distribution Table of S2 : Input Output XOR XOR x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x A x B x C x D x E x F x x 64 ....
View
Full
Document
This note was uploaded on 04/14/2011 for the course CS 236506 taught by Professor Yanivcarmeli during the Spring '11 term at Technion.
 Spring '11
 YanivCarmeli

Click to edit the document details