{[ promptMessage ]}

Bookmark it

{[ promptMessage ]}

crypto-slides-22-dc-tutor.1x1

# crypto-slides-22-dc-tutor.1x1 - Tutorial on Dierential...

This preview shows pages 1–6. Sign up to view the full content.

Tutorial on Differential Cryptanalysis c circlecopyrt Eli Biham - August 18, 2010 670 Tutorial on Differential Cryptanalysis (22)

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document
An Example of a 0R-Attack on 5-Round DES We use a 5-round characteristic with probability p = 1 10485 . 76 : Ω P = 40 5 C 00 00 04 00 00 00 x A = 40 08 00 00 x a = 04 00 00 00 x p = 1 4 = P (0 A 00 00 00 x ) B = 04 00 00 00 x b = 00 54 00 00 x p = 10 · 16 64 · 64 = P (00 10 00 00 x ) C = 0 c = 0 p = 1 D = 04 00 00 00 x d = 00 54 00 00 x p = 10 · 16 64 · 64 E = 40 08 00 00 x e = 04 00 00 00 x p = 1 4 Ω T = Ω P = 40 5 C 00 00 04 00 00 00 x F F F F F c circlecopyrt Eli Biham - August 18, 2010 671 Tutorial on Differential Cryptanalysis (22)
An Example of a 0R-Attack on 5-Round DES (cont.) The algorithm : 1. We choose m = 2 p 20000 random pairs P,P such that P = Ω P , and request the corresponding ciphertexts T and T under the unknown key K . 2. We keep only the pairs satisfying T = Ω T , and discard the others. About m ( p + 2 64 ) pairs remain (from the m pairs): mp 2 right pairs and 2 64 m wrong pairs. 3. The differences of the inputs and the outputs of the S boxes of the last round are known from T = T T (and from the characteristic): The two inputs of F in the 5th round differ only in the 6th bit. Thus, the two inputs of S2 in the 5th round differ by 08 x in the input. From T we know that the outputs of S2 differ by A x . c circlecopyrt Eli Biham - August 18, 2010 672 Tutorial on Differential Cryptanalysis (22)

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document
An Example of a 0R-Attack on 5-Round DES (cont.) 4. When looking at the difference distribution table of S2, we find 16 possible pairs for this combination, thus we reduce the number of possible keys by a factor of 16 2 6 = 1 4 . 5. Other pairs further reduce the number of possible keys. The Difference Distribution Table of S2 : Input Output XOR XOR 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 8 x 9 x A x B x C x D x E x F x 0 x 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 . . . 8 x 0 0 0 4 0 4 0 8 0 10 16 6 6 0 6 4 . . . 3 F x 4 0 0 2 0 8 2 4 0 2 4 4 4 14 10 6 c circlecopyrt Eli Biham - August 18, 2010 673 Tutorial on Differential Cryptanalysis (22)
An Example of a 1R-Attack on 6-Round DES We use the previous 5-round characteristic: Ω P = 40 5 C 00 00 04 00 00 00 x A = 40 08 00 00 x a = 04 00 00 00 x p = 1 4 = P

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document
This is the end of the preview. Sign up to access the rest of the document.

{[ snackBarMessage ]}

### Page1 / 17

crypto-slides-22-dc-tutor.1x1 - Tutorial on Dierential...

This preview shows document pages 1 - 6. Sign up to view the full document.

View Full Document
Ask a homework question - tutors are online