Differential cryptanalysis: Difference between revisions

Revision as of 08:35, 28 July 2021

Revision as of 08:53, 28 July 2021

Line 11:

==Attack mechanics==

{{Unreferenced section|date=July 2021}}

Differential cryptanalysis is usually a [[chosen plaintext attack]], meaning that the attacker must be able to obtain [[Encryption|ciphertexts]] for some set of [[plaintext]]s of their choosing. There are, however, extensions that would allow a [[known plaintext attack|known plaintext]] or even a [[ciphertext-only attack]]. The basic method uses pairs of plaintext related by a constant ''difference''. [[Subtraction|Difference]] can be defined in several ways, but the [[Exclusive or|eXclusive OR (XOR)]] operation is usual. The attacker then computes the differences of the corresponding ciphertexts, hoping to detect statistical patterns in their distribution. The resulting pair of differences is called a '''differential'''. Their statistical properties depend upon the nature of the [[S-box]]es used for encryption, so the attacker analyses differentials <math>(\Delta_x, \Delta_y)</math> where <blockquote>
<math display=block>\Delta_y = S(x \oplus \Delta_x) \oplus S(x)</math></blockquote>
(and ⊕ denotes exclusive or) for each such S-box ''S''. In the basic attack, one particular ciphertext difference is expected to be especially frequent. In this way, the [[cipher]] can be distinguished from [[randomness|random]]. More sophisticated variations allow the key to be recovered faster than [[Brute force attack|exhaustive search]].

In the most basic form of key recovery through differential cryptanalysis, an attacker requests the ciphertexts for a large number of plaintext pairs, then assumes that the differential holds for at least ''r'' − 1 rounds, where ''r'' is the total number of rounds. The attacker then deduces which round keys (for the final round) are possible, assuming the difference between the blocks before the final round is fixed. When round keys are short, this can be achieved by simply exhaustively decrypting the ciphertext pairs one round with each possible round key. When one round key has been deemed a potential round key considerably more often than any other key, it is assumed to be the correct round key.