4
$\begingroup$

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.

But I don't understand the initial pairs preperation step: ![first step of impossible differential cryptanalysis on Mini-AES

In the paper the author say to obtain $2^{13}$ plaintext $P$ and another $2^{13}$ plaintext $P^{'}$ which are equal in the second and third nibble and from those plaintexts we can obtain $2^{13}$ pairs.

But where did the $2^{13}$ come from if the input difference of the differential trail has two active nibbles and each nibble is $4\;bits$ so we have $2^8$ possible input differences for the pairs ?

Improve this question
$\endgroup$
5
  • $\begingroup$ In fact in the public (non paywall) version of the paper available on the author's page geocities.ws/dearphael/ImpMiniAES.pdf the same argument starts with obtain $2^{11}$ plaintexts P and P’ which are equal in the second and third nibble and differ in the other nibbles. Since each P and P’ forms a pair with passive second and third nibbles while the first and third nibbles are active, we then have $2^{11}$ such pairs. $\endgroup$ Commented Mar 14, 2023 at 15:22
  • $\begingroup$ so the author himself presents two inconsistent versions. $\endgroup$ Commented Mar 14, 2023 at 15:23
  • $\begingroup$ where does $2^{11}$ comes from? do we take variations of passive nibble or we just use a constant value and only change active varitaions ? @kodlu $\endgroup$ Commented Mar 18, 2023 at 15:47
  • $\begingroup$ That's exactly what's unclear to me, and it seems the author has two versions of the same claim. $\endgroup$ Commented Mar 18, 2023 at 16:06
  • $\begingroup$ well, regardless of the paper what do you think the number of the initial pairs should be? @kodlu $\endgroup$ Commented Mar 18, 2023 at 17:26

1 Answer 1

Reset to default
1
$\begingroup$

The number of the initial plaintext $2^{13}$ was chosen to satisfy the final equation: enter image description here enter image description here enter image description here

so using all the probabilites mentioned in the paper and if we put $2^{x-7}$ instead of $2^{6}$ in the final equation we'll get: $$ 2^{8}(1-2^{-3})^{2^{x-7}} \approx 2^{8}e^{-2^{x-7-3}} \approx 0$$

By plotting this equation we'll get: enter image description here

So the minimum value of $x=13$ and thus the number of initial plaintext should be $2^{13}$.

Improve this answer
$\endgroup$

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.