Noname manuscript No.

(will be inserted by the editor)

Variants of Differential and Linear Cryptanalysis

Mehak Khurana · Meena Kumari

Received: date / Accepted: date

Abstract Block cipher is in vogue due to its require- of cryptographic algorithms from uniform distribution.
ment for integrity, confidentiality and authentication. Based on this property one finds the distinguisher which
Differential and Linear cryptanalysis are the basic tech- distinguishes it from randomness and exploits this to
niques on block cipher and till today many cryptana- find the key. Attack is said to be theoretically success-
lytic attacks are developed based on these. Each variant ful if cryptanalyst breaks the cipher with less key com-
of these have different methods to find distinguisher and plexity than exhaustive search. It may not be practi-
based on the distinguisher, the method to recover key. cally feasible to break with lesser key complexity than
This paper illustrates the steps to find distinguisher and exhaustive search. But lesser key complexity than brute
steps to recover key of all variants of differential and lin- force attack shows that the cipher design has some flaws
ear attacks developed till today. This is advantageous or weakness which can be exploited in future with ad-
to cryptanalyst and cryptographer to apply various at- vent of new attacks.
tacks simultaneously on any crypto algorithm. There are various types of cryptanalytic attacks; based
on the attackers access such as ciphertext only attack,
Keywords Boomerang · Differential Cryptanalysis ·
known plaintext attack or attacker access to encryption
Higher Order · Impossible · Integral · Linear crypt-
system to generate chosen plaintext and its ciphertext
analysis · Rectangle · Related Key · Truncated · Zero
or decryption process to generate plaintexts of chosen
Correlation
ciphertexts. The success of attack can be measured us-
ing number of plaintext-ciphertext pairs or operations
1 Introduction required to recover secret key or partial key. When for
the attack the number of operations required is less
Block cipher is one of the cryptographic techniques which than 2n where n is size of secret key, the cipher is said
are used for integrity, confidentiality and authentica- to be broken.
tion mechanism. Designing a cipher which is secure Biham and Shamir [1][2] proposed the basic differential
and immune to all present day attacks is a challenging cryptanalytic technique based on DES, which is proba-
task. Cryptanalyst has to find statistical and algebraic bilistic chosen plaintext attack. Many modifications and
technique based on mathematical weakness in design extensions have been proposed and analyzed to improve
with the aim to recover the secret key. Cryptanalytic the attacks on various crypto algorithms. In 1993 Bi-
method consists of analyzing mathematical properties ham [3] proposed new types of cryptanalytic attacks
of encryption algorithms with the aim to find the dis- using related key. In 1994, Lars Knudsen[4] proposed
tinguishers which distinguishes the output distribution truncated differential which predicts only part of the
difference in a pair of texts after each round of encryp-
ITM University
Gurgaon, India tion. In same year he proposed higher order differential
E-mail: [email protected] based on the concept of higher order derivatives. Knud-
ITM University sen and Wagner [5] in 1997 proposed integral cryptanal-
Gurgaon, India ysis where some part of plaintext is kept constant and
E-mail: [email protected] rest part is varied with all possibilities. In 1998 Eli Bi-
2 Mehak Khurana, Meena Kumari

ham, Alex Biryukov, and Adi Shamir used impossible

differential to break IDEA and Skipjack block ciphers
[6] by exploiting differentials that never occurs. In 1999
Boomerang attack was developed by Wagner [7] which
states, attack is possible even if no differentials with
high or low probability is present for whole cipher. This
attack was modified and named as Rectangle attack [8]
in 2001. Related Key attack can be combined with other
variants of differential cryptanalysis where knowledge of
difference in keys may allow to attack more number of
rounds [9].
Linear cryptanalysis was developed by Matsui [10] in
1993 to exploit linear approximation with high proba-
bility i.e. greater than 21 . Zero correlation is a variant Fig. 2 Variants of Cryptanalysis
of linear cryptanalysis developed by Bogdanov and Rij-
men [11] which tries to construct atleast one non trivial The basic differential cryptanalytic technique is explained
linear hull with no linear trail i.e. with correlation C ex- in section II and the steps to find distinguisher and
actly zero. This attack is countermeasure of impossible steps to recover key for each variant of differential crypt-
differential attack. analysis is explained in section 3. In section 4 linear
To attack a cipher using integral, impossible or zero cryptanalysis is illustrated and the steps to find dis-
correlation attack details of S-Box is not required as it tinguisher and steps to recover key for the latest vari-
is independent of the choice of S-Box. Choosing another ant of linear cryptanalysis is explained in section 5. We
S-Box for a cipher will result in almost same cryptan- conclude in section 6 by describing unification of these
alytic results. Fig. 1 illustrates the different types of attacks and how this work is advantageous to the crypt-
attacks developed till today. analyst.

2 Differential Cryptanalysis

In differential cryptanalysis, one attacks by exploiting

the fact that for some fixed plaintext difference ∆P =
P ⊕ P 0 , certain differences in the ciphertext ∆C =
C ⊕ C 0 appear more often than one would expect for
secured design and this high probability of occurrence
is used to find secret key, where P and P 0 are two plain-
texts and C and C 0 are corresponding ciphertexts. To
apply differential cryptanalysis, one needs to find the
high probability of differentials in each S-Box used in
block cipher based on Substitution Permutation Net-
Fig. 1 Types of Cryptanalytic Attacks
work (SPN) and then find products of high probabilities
of differential of S-boxes which lead the given plaintext
Differential and Linear cryptanalysis or its variants have difference ∆P = P ⊕ P 0 to the ciphertext difference
been applied on almost all the block ciphers developed ∆C = C ⊕ C 0 . So in order to determine the differ-
till today. The fig. 2 shows various differential and lin- ential characteristic, Difference distribution tables are
ear based attacks which are developed and their com- constructed for each S-Box for input difference ∆X and
binations. Block cipher which is resistant to one attack output difference ∆Y . Due to the weakness in S-Box
can be attacked by its variants or some combinations of (nxm), we may get high probabilities of difference pair
variants. To ease the process of applying these attacks (∆X, ∆Y ) instead of 21n as in the case of ideal S-Box,
to check resistance to present day cryptanalytic attacks, which is not achievable. All difference pairs of input X
the simplified steps of each attack are described in next and output Y of an S-Box can be examined and the high
sections. probabilities of input output pairs (∆X, ∆Y ) of each
S-Boxes are traversed and combined from first round
to second last round treating S-Boxes as independent.
Variants of Differential and Linear Cryptanalysis 3

Once the differential characteristic for second last round as expected from the differ-
with a suitably large enough probability pD is discov- ential characteristic
ered, it is easy to attack cipher to recover some bits of (d) If same, increment count
last round subkey by ex-oring all the possible combina- The partial subkey value with largest count is con-
tions of all influenced nonzero difference bits TPS (Tar- sidered for each TPS*
get Partial Subkeys) entering last round with the ci- 3. Obtain a table of partial subkey values and corre-
phertext and running one round backwards through S- sponding prob = count/N .
boxes. The number of chosen plaintext-ciphertext pairs 4. If probability (prob) as calculated in step 3 is equal
required for attack will be 1/pD . to pD (as expected)⇒ Correct TPS is determined
Differential cryptanalysis is divided into two steps: i) For fast implementation, discard those wrong cipher-
Finding the Distinguisher and ii) Steps for Key Recov- text pairs of which zeros do not appear in appropriate
ery. subblock of the ciphertext difference.
i) Finding the Distinguisher
1. Difference distribution table is constructed for each
S-Box (nxm) which contains the number of occur- 3 Variants Of Differential Cryptanalysis
rences of corresponding output difference ∆Y for
each given input difference ∆X. In this section variants of differential cryptanalysis are
2. Find the probability of the each value of input out- described by illustrating the steps to formulate the dis-
put difference by dividing it by 2n (number of input tinguisher and steps to recover key.
bits)
3. Mark S-box difference pairs from round to round
so that the nonzero output difference bits from one
round correspond to the nonzero input difference 3.1 Truncated Differential Cryptanalysis
bits of the next round with highest probability. There-
fore traversing the active S-Box (i.e. non-zero dif- In case of differential cryptanalysis, one exploits the
ferential with high probability) difference pair from probability of fixed plaintext difference of two plain-
first round till second last round of the cipher. The texts that produces the predicted Ciphertext difference
highest probabilities of input output pairs of active of the respective ciphertexts, but in case of truncated
S-boxes are multiplied, to get the differential proba- differential, instead of getting the exact differential in
bility pD till second last round of the cipher [10]. plaintext and Ciphertext, one exploits the probability
4. So the differential probability pD is the distinguisher of subset of plaintext differences and subset of predicted
Ciphertext differences [12]. Wherever the value in the
During the cryptanalysis process, many pairs of plain- difference is not as predicted in Differential cryptanaly-
texts for which ∆P will be encrypted. With high prob- sis we denote by 0 ?0 (don’t care), So the predicted prob-
ability, the differential characteristic ∆C will occur. We ability of truncated differential increases the number of
term such pairs for (∆P, ∆C) as right pairs. Plaintext plaintext and Ciphertext pairs to be counted in the dis-
difference pairs for which the characteristic does not oc- tinguisher, which in turn increases the probability of
cur are referred to as wrong pairs. recovering the key [13]. The attack is as follows:
ii) Steps for Key Recovery i)Finding the Distinguisher
1. Generate N plaintext/ciphertext pairs with given 1. Let ∆Pα be the subset of non trivial difference ∆P
∆P . of two inputs to encryption function f : GF (2n ) →
2. If kr (TPS) is l − bit. There are 2l possibilities. For GF (2n ) upto r rounds, for which only fraction of
each TPS value (say TPS*) do the following output difference ∆C i.e. ∆Cδ occurs after r rounds.
i Set count=0 The truncated differentials ∆Pα → ∆Cδ
ii For each Ciphertext(i) for i = 1toN do 2. Let T be a table of size 2n which is initialized to zero
the partial decryption for all entries.
(a) Ciphertext(i) ⊕ T P S∗ 3. For all possible value of input x, x ∈ GF (2n ), com-
(b) Run backward through S-boxes pute the table T by putting 1 at position f (x) ⊕
to obtain bits into the last f (x ⊕ ∆Pα ), which gives truncated output ∆Cδ cor-
round responding truncated input ∆Pα , i.e. T [f (x)+f (x+
(c) Check the input difference to ∆Pα )] = 1. Therefore all possible output differen-
the final round determined by tials corresponding to the truncated differential are
partial decryption is the same marked and known.
4 Mehak Khurana, Meena Kumari

ii)Steps for Key Recovery called impossible differential pair. We eliminate or dis-
In order to recover last round key kr , if we get truncated card keys for which impossible differential characteristic
differentials and table T values of function f of r round β 6= γ holds for the subkey of that key.
1. Generate N pair of plaintext P, P 0 and their corre-
sponding ciphertext C, C 0 respectively.
2. For all possible value of the last round key kr , do the
following:
i Decrypt one round backwards C, C 0 us-
ing kr , and obtain the intermediate ci-
phertexts M, M 0
3. For all possible value of the second last round key,
kr − 1 do the following:
i Calculate t1 = f (M +kr −1), t2 = f (M 0 +
kr − 1)
ii If T [t1 + t2 + M + M 0 ] > 0, then pair of Fig. 3 Miss in Middle
keys kr − 1 and kr are right keys. Here,
we are measuring if the truncated differ-
ential was seen.
4. By repeating the attack N number of times only one
unique pair of keys kr − 1 and kr , the right key will i)Finding the Distinguisher
be suggested. Then output the values of kr − 1 and To obtain impossible differentials (α 9 δ)
kr . 1. Obtain the input differential α = N ⊕ N 0 , encrypt
5. Output the subkeys for last and second last round N, N 0 by r1 rounds to obtain differential β of the
kr and kr − 1 respectively. outputs i.e. P r(α → β) = 1
2. For the differential δ = M ⊕ M 0 , decrypt M, M 0
by r2 rounds to obtain values with differential γ i.e.
P r(δ → γ) = 1.
3.2 Impossible Differential Cryptanalysis
3. If β 6= γ then α 9 δ is impossible
4. Repeat above 4 steps for different values (α, δ) to ob-
Biham et.al. in 1998 developed variant of a truncated
tain a set ID i.e. ID = (α1 , δ1 ), (α2 , δ2 ), . . . , (αn , δn ).
differential cryptanalysis called impossible differential
ii)Filtering and Key Elimination
cryptanalysis [14][15][16] by formulating distinguisher
For each key, obtain subkey after x rounds and y rounds.
based on the fact that certain differentials never occur
Do the following to rule out the invalid subkeys
(i.e. the differentials with zero probability). It can be
1. For input-output pairs (N, M ) and (N 0 , M 0 ). Check
applied to the cipher, whose non-linear round function
N ⊕ N 0 = α and M ⊕ M 0 = δ i.e. (α, δ) ∈ ID
is bijective. To apply impossible differential attack, we
2. Find the differential β of the values after encrypting
need to find impossible differential pair (α 9 δ) which
N and N 0 by r1 round
can be used as distinguisher the differential α can be
3. Find differential γ of the value after decrypting M, M 0
∆P the difference of two plaintext P and P 0 or it can
by r2 rounds
be the difference of two inputs N and N 0 after encryp-
4. Check β 6= γ then subkey is invalid.
tion of x rounds of P and P 0 and the differential δ can
5. Rejecting the invalid keys, the total key space is re-
be ∆C the difference of two ciphertext C and C 0 or
duced.
it can be the difference of two outputs M and M 0 af-
ter decryption of y rounds of C and C 0 . The difference
α after r1 + r2 rounds produces the output difference 3.3 Integral Cryptanalysis
δ. An impossible differential with miss in middle tech-
nique works as a distinguisher to rule out the incorrect In 1997, Daemen, Knudsen and Rijmen published new
keys, where miss in middle technique uses combination block cipher called SQUARE, and later discovered an
of two differentials both of which hold with probabil- attack on it and named as Square Attack which could
ity one and do not meet in middle i.e. for r1 rounds not be able to attack large number of rounds. This
of partial encryption α becomes β and for partial de- attack was later on named as Saturation Attack. Fi-
cryption of r2 rounds δ becomes γ (see Fig 3). If β 6= γ nally in 2002, Knudsen and Wagner came up with many
the difference α 9 δ after r1 + r2 rounds of encryption improvements and modifications by combining differ-
is impossible because α → β 6= γ ← δ and (α, δ) is ent techniques and named it as Integral Cryptanaly-
 Variants of Differential and Linear Cryptanalysis 5

sis[17]. Block ciphers which uses bijective components 3. Thus by changing the position of 0 A0 in chosen plain-
are proneR to integral
P cryptanalysis. The integral is de- text we can obtain different distinguisher.
fined as R = B∈R B, where B = b1 , b2 . . . , bn is a ii) Steps for Key Recovery
state vector where each bi ∈ GF (2n ). R is a multiset of 1. Obtain all the possible combination of subkey kr
state vectors. In integral 0 n0 represents the number of (TPS).
words in the plaintext and ciphertext, for example in 2. Do the partial decryptions (for r2 rounds) upto the
AES the state vector is of 16 words each of 8 bits. In this output of integral distinguisher.
attack, attacker tries to predict the values in the inte- 3. If decryption gives exclusive-or sum of the states as
gral after certain number of rounds of encryption. The zero i.e. balanced, store that subkey.
following properties can be observed in output of cipher Otherwise, repeat the steps for other possible sub-
rounds which play an important role to construct ba- keys.
sic model of integral distinguisher to distinguish several 4. Repeat step 1-3 number of times for all multiset,
rounds of block cipher from random permutation. subkey with maximum count is the correct subkey.
(a) All ith words are equal i.e. bi = c for all B ∈ R,
denoted by symbol 0 C 0 Where c ∈ GF (2n ), are some
fixed values (constants).
3.4 Higher Order Differential Cryptanalysis
(b) All ith words are different bi : B ∈ R = GF (2n ), de-
noted by symbol 0 A0 .
Knudsen introduced higher order differential cryptanal-
(c) All ith Lwords sum to certain value predicted in ad-
0 0 0 ysis based on the concept of higher order derivative pro-
vance B∈R bi = c , denoted by symbol S (bal-
0 n posed by Lai [18] that are applicable to those ciphers
anced) Where c ∈ GF (2 ), are some fixed values
that can be expressed by multivariable Boolean func-
(constants)
tions with low degree [19].
(d) The sum of words that cannot be predicted i.e. no
The derivative of function f : GF (2n ) → GF (2m ) at
information can be derived are denoted by symbol
the point a is ∆a f (x) = f (x + a) − f (x) where a ∈
‘?0
GF (2n ). For ith derivative of f at the point (a1 , a2 , .., ai ) ∈
(i) (i−1)
GF (2n ) is defined as ∆a1 ,...,ai f (x) = ∆ai (∆a1 ,...,ai −1 )f (x),
(i−1)
where ∆a1 ,. . . ,ai −1 f (x) is the (i − 1)th derivative of f at
(a1 , a2 , . . . , ai−1 ), the 0th derivative of f is defined to be
f (x) itself, also deg(∆a f (x)) 6 deg(f (x)) − 1. For any
x ∈ GF (2n ), let L[a1 , . . . , ai ] be the list of all 2i possible
(i)
combinations of a1 , . . . , ai [20]. Then ∆a1 ,. . . ,ai f (x) =
L
v∈L[a1 ,. . . ,.ai ] f (x ⊕ v) If ai is linearly independent
(i)
of (a1 , . . . , ai − 1), then ∆a1 ,. . . ,ai f (x) = 0. In iter-
ated block cipher of block size n and r rounds, Attack
is possible, when we know the total degree deg(f ) of
the output of the (r − 1)th round. To attack (r − 1)
Fig. 4 Integral Attack rounds of cipher, we find the order of (r − 1) rounds for
which derivative ∆a1 ,a2 ,. . . ,ar−1 f (x) = c(constant)∀x ∈
GF (2n ) i.e. independent of round keys k1 , k2 , . . . , kr−1 .
i) Finding the Distinguisher The steps to find the order are given in[21]. The attack
1. Choose an input multiset R which consists of 2n cho- is based on the property that the dth derivative of a
sen plaintexts which have above property such that multivariate polynomials f with degree d is a constant
plaintext with some certain words being A and rest and (d + 1)th derivative is zero.
of the words being C. e.g. P = (CCCC; CCCC), P 0 = i)Finding the Distinguisher
(ACCC; CCCC). 1. Randomly choose a plaintext P ∈ GF (2n )
2. Encrypt the multiset, after a few rounds r1 of en- 2. Encrypt plaintexts P ⊕v, ∀v ∈ L[a1 , . . . , ai ] to obtain
cryption check if all the sum (usually exclusive-or) their corresponding
L ciphertexts cv .
at some word is zero (balanced) i.e. some bytes of 3. Compute v∈L[a1 ,. . . ,ai ] f (x ⊕ v)
output will have state 0 S 0 (balanced) with proba- 4. If v∈L[a1 ,. . . ,ai ] f (x⊕v) = c(constant)∀x ∈ GF (2n ),
L

bility one which works as a distinguisher that can for (r−1) round with any round keys k1 , k2 , . . . , kr−1 .This
distinguish few rounds of cipher from random per- will work as a distinguisher to recover the key.
mutation, see fig. 4. ii)Steps for Key Recovery
6 Mehak Khurana, Meena Kumari

1. Generate N plaintext randomly. For each plaintext

P , do the following
2. For all the possible combination of last round in-
fluenced bits kr (TPS), if kr is l-bits, there are 2l
possibilities for each kr value, for each value of TPS
(say TPS*) Do the following
i Decrypt all ciphertexts cv one round
backwards using TPS*
ii L
The value of TPS* for which
−1
v∈L[a1 ,. . . ,ai ] fkr (cv ) becomes
constant ∀v ∈ L[a1 , . . . , ai ], store that
TPS* value in a table T and reject
TPS* if
L −1
v∈L[a1 ,. . . ,ai ] fkr cv , ∀v ∈ L[a1 , . . . , ai ]
is not constant.
3. Repeat the step 2 for N plaintexts and the key in
the table T with highest probability is the correct
last round key. Output that key kr . Fig. 5 Structure of Boomerang Attack
Higher order cryptanalysis can be applied to maximum
5 feistel rounds of cipher i.e. cannot defeat ciphers with
large or more than 6 rounds. 4. Decrypt these Ciphertext D and D0 for E1−1 partially
to get N, N 0 and further decrypt it for E0−1 to get O
and O0 i.e. O = E0−1 (N ) and O0 = E0−1 (N 0 ).
3.5 Boomerang Differential Attack 5. Finally for each pair (O, O0 ) check whether O and
O0 differ by same differential α i.e. O ⊕ O0 = α. If
In 1999, Boomerang was developed by Wagner which this condition is satisfied, it means it has formed a
states that even if there is no differential with either right quartet (P, P 0 , O, O0 ). If so, store the quartet.
high or low probability for whole cipher, it may still be 6. Repeat these steps with other set of plaintext to find
vulnerable to Boomerang attack. It is an adaptive cho- other pairs that form right quartets and store it in
sen plaintext/Ciphertext attack in which attacker finds a table (Boomerang distinguisher).
two short differentials with high probabilities instead of
ii) Steps of Key Recovery
one whole differential with low probability.
n k n 1. From set of boomerang distinguisher, for each ob-
The block cipher encryption E : (0, 1) X(0, 1) = (0, 1)
is decomposed into two halves E = E0 ◦ E1 where E0 tained right quartets (P, P 0 , O, O0 )
represents first half and E1 represents second half. Dif- 2. Find all possible values for nonzero influenced dif-
ferential characteristic for E0 is α → β with proba- ference bits entering last round (TPS).
bility p and for E1−1 the differential characteristic is 3. For all the possible values TPS (kr ) i.e. if kr is l-
δ → γ with probability q. In boomerang attack, to find bits, there are 2l possibilities for each kr value, Do
all plaintexts sharing a desired difference that depends the following
on the choice of the differential is the distinguisher [22]. i Set count=0
i) Finding the Distinguisher ii Encrypt (P, P 0 , O, O0 ) and obtain the cor-
1. The attacker randomly chooses two plaintexts P, P 0 responding ciphertext quartet (C, C 0 , D, D0 )
and computes α = P 0 ⊕ P respectively
2. Encrypt P and P 0 by E0 to obtain middle cipher- iii Then do the one round partial decryp-
text M = E0 (P ) and M 0 = E0 (P 0 ) and further en- tion dk under key kr
0
crypt for E1 to obtain ciphertext C = E1 (M ), C 0 = (a) C = dkr (C), C = dkr (C 0 )
0
E1 (M 0 ). and D = dkr (D), D = dkr (D0 )
3. Obtain new ciphertexts D, D0 from ciphertexts C, C 0 (b) Check the difference by par-
0
with difference δ i.e. D = C ⊕δ and D0 = C 0 ⊕δ such tial decryption C ⊕ C and
0
that when we decrypt C, C 0 by E1−1 and D, D0 by D ⊕ D is the same as ex-
E1−1 we get the difference γ i.e. E1−1 (C) ⊕ E1−1 (D) = pected from the differential
E1−1 (C 0 ) ⊕ E1−1 (D0 ) = γ characteristic.
Variants of Differential and Linear Cryptanalysis 7

(c) If difference is same in both 3.7 Related Key Attack

the pairs then increment the
count In key schedule algorithm of block cipher, if the re-
4. Value of TPS which has maximum count for right lations between pairs of keys in different rounds exist
quartet is correct TPS and output that value. then all the subkeys can be shifted one round backward
and a new set of subkeys can be obtained, these key re-
lations can be used to attack the block ciphers. The
3.6 Rectangle Attack
attack where keys are unknown, but relation is known
to the attacker is called chosen key attacks. The attacks
Boomerang uses adaptive chosen plaintext/ciphertext
are not dependent on number of rounds of a cipher [25].
due to which many of the ciphers that were developed
The Chosen Key Attacks
through the years cannot be attacked by boomerang
Several plaintexts are encrypted by these related keys.
distinguishers and key recovery attack cannot be ap-
After encryption the corresponding ciphertexts are ob-
plied, which led to the development of its chosen plain-
tained under these related keys which have some rela-
text variant called amplified attack [23]. This was later
tion between them, this relation is used by attacker to
modified and named as rectangle attack. The Rectangle
find both the keys. Chosen Key attack can be further
attack is divided into two steps: 1) Finding the distin-
divided into
guisher 2) Key Recovery (same as Boomerang) [24]
• Chosen Key Known Plaintext Attack
i) Finding the Distinguisher
• Chosen Key Chosen Plaintext Attack
1. The attacker randomly chooses two plaintext pairs
In chosen key known plaintext attack, attacker exploits
(P, P 0 ), (O, O0 ) with same difference α such that α =
only relation between the keys and in chosen key chosen
P 0 ⊕ P and α = O0 ⊕ O.
plaintext attack, the relation between keys and plain-
2. Encrypt (P, P 0 ) and (O, O0 ) to obtain middle cipher-
text are exploited by the attacker. The process of re-
texts i.e. M = E0 (P ) and M 0 = E0 (P 0 ) and N =
covering the keys is almost same in both cases.
E0 (O) and N 0 = E0 (O0 ), we are interested in the
i) Steps for Key Recovery
cases where M ⊕ M 0 = β, N ⊕ N 0 = β and M ⊕ N =
1. The attacker chooses such a plaintext pair P and
γ, which leads to M 0 ⊕ N 0 = (M ⊕ β) ⊕ (N ⊕ β) = γ.
P ∗ such that right half of P equals the left of P ∗ i.e.
3. We receive two pairs (M ⊕ N andM 0 ⊕ N 0 ) each with
PR = PL∗ .
the difference γ. When encrypting (M, M 0 ), (N, N 0 )
2. P is encrypted with key K and result of encryption
by E1 , i.e. C = E1 (M ), C 0 = E1 (M 0 ) and D =
of P is obtained before next round which may be the
E1 (N ), D0 = E1 (N 0 ) then in some of the cases γ
same as P ∗ encrypted with key K ∗ after first round.
becomes δ. And we look for those cases where both
3. For plaintexts P and P ∗ corresponding ciphertext C
difference become C ⊕ D = δ and C 0 ⊕ D0 = δ after
and C ∗ is obtained after encryption after all rounds
E1 . The quartet satisfying these differential require-
and if these ciphertexts satisfies the relation CL =
ments forms a right quartet. ∗
CR , then it has high probability to find expected pair
4. Repeat these steps to find the pairs that form right
(by birthday paradox).
quartets (P, P 0 , O, O0 ) and save it in a table (distin-
4. If attacker find such pairs then P, P ∗ , C, C ∗ and K, K ∗
guisher).
can be used to recover secret key bits with less trails
ii) Steps of Key Recovery
than brute force attack.
1. From set of distinguisher, for each obtained right n

quartet (P, P 0 , O, O0 ) For chosen plaintext attack 2 4 Chosen plaintexts are

n

2. Find all possible values for nonzero influenced dif- required and for known plaintext attack 2 2 known plain-
ference bits entering last round (TPS). texts are required.
3. For all the possible values TPS (kr ) i.e. if kr is l-
bits, there are 2l possibilities for each kr value, Do
the following for each right quartet, 4 Linear Cryptanalysis
i Set count=0
ii Do the partial decryption by one round. Matsui in 1993 developed linear attack to attack DES
iii Check the input difference by partial decryption by exploiting linear approximation with high probabil-
is the same as expected from the differential ity of input and second last round output of DES cipher
characteristic. by known plaintext approach. In this attack linear ex-
iv If same, increment count for that TPS. pression of u bits of input and v bits of output which
4. TPS which has maximum count value for right quar- holds high or low probability is exploited to find the key.
tet that is correct and output that value. The bias probability (ε = |pL − 12 |) is amount it deviates
8 Mehak Khurana, Meena Kumari

from probability 21 where pL is the probability of hold- 2. If TPS is l-bit. There are 2l possibilities
ing the linear expression. The higher the magnitude of 3. For each TPS value (say TPS*) do the following
the bias |pL − 21 |, poorer the randomization ability of the i Set count=0
0 cipher and weak is the system, so with fewer known ii For each ciphertext(i) for i = 1 to N do
plaintext this attack can be applied. If PL > 12 expres- the partial decryption
sion Xi1 ⊕Xi2 ⊕Xi3 . . . ⊕Xiu ⊕Yi1 ⊕Yi2 ⊕Yi3 . . . ⊕Yv = 0 (a) ciphertext(i)⊕ TPS*
between u input bits and v output bits of second last (b) Run backward through S-boxes
round is called linear approximation and if pL < 12 it to obtain bits into the last
is called affine approximation. Distinguisher for the at- round
tack is the bias probability of holding the linear attack (c) XOR the Bits of plaintext (i)
of plaintext bits and the second last round of cipher; with XOR of the bits obtained
following are the steps to find distinguisher of SPN ci- in step (b)
pher with r rounds. (d) If expression in (c) is zero
i) Finding the Distinguisher (e) Increment count
1. Generate the linear approximation table of order iii |Bias| = |count– N2 |
2n x2m for each S-Box of size nxm by 4. Obtain a Table of partial subkey values and corre-
i Form a table for each nxm S-Box where sponding |Bias|
the elements of the table represent the 5. If |Bias| = 0 ⇒ IncorrectT P S
number coincides between linear relation If |Bias| ≈ Expectedvalue ⇒ CorrectT P S
a.x = a1 x1 ⊕ a2 x2 ⊕ . . . ⊕ an xn of input
and the linear relation b.y = b1 y1 ⊕b2 y2 ⊕
. . . ⊕ bm ym of the output where a, b rep- 5 Variants Of Linear Cryptanalysis
resents n and m bit numbers respectively
for 0 ≤ a ≤ 2n−1 and 0 ≤ b ≤ 2m−1 . In 5.1 Zero Correlation Linear Cryptanalysis
a table the binary value of a1 a2 a3 . . . an
(a1 the MSB) represents row no, the bi- Zero correlation linear cryptanalysis was proposed by
nary value of b1 b2 b3 . . . bm (b1 the MSB) Bogdanov and Rijmen for an iterative block cipher is
represents column no. a counterpart of impossible differential cryptanalysis.
ii Calculate the coincidence probability pL This attack exploits the linear approximation a → b of
by dividing the elements of linear ap- the cryptographic function f of the cipher of r rounds
proximation table by 2n (number of in- where a and b are input sum and
output sum selection
put bits). pattern. The probability p = Pxr (ax = bf (x)) for lin-
iii Calculate the bias probability e for each ear approximation a → b over all input x is exactly 12
high coincidence probability pL of each which amounts to correlation C zero because C = 2p−1
S-Box for each round by using formula with a 6= 0, b 6= 0. The linear approximation a → b for
ε = |pL − 12 |. an iterative block cipher from fixed input a to fixed
2. Mark the linear trail for the whole cipher by con- output b is called a Linear Hull which contains all pos-
sidering those elements of S-Boxes with highest bias sible sequences of linear approximation. These set of
probability e in each round till second last round. sequences are called Linear Trails [26]. See fig 5, where
3. Calculate the expected bias probability pD of hold- fi is the function of ith round and ui ’s are intermediate
ing the linear expression between input and the last values.
round cipher by using pilling up lemma, considering
all S-Boxes as independent. For each round function
the linear expression which hold with high coinci-
dence probability and calculate bias probability by
subtracting from 12 and combine this linear expres-
sion with next round linear expression with high-
Fig. 6 Linear Trail
est coincidence probability and go on calculating εi
for each round and at last probability of pD (x1 ⊕
= 0) = 12 + 2k−1 i=1tok εi where
Q
x2 ⊕ . . . ⊕ xn Q According to pilling up lemma, the total correlation
ε1,2. . . k = 2k−1 i=1tok ε. contribution CU over a cipher of a linear trail U is a
ii) Steps to Recover Key computed by identifying strong linear approximation
1. Generate N plaintext/ciphertext pairs trail by concatenating approximations from round to
Variants of Differential and Linear Cryptanalysis 9

round and calculated by doing product ofQ these correla- This can be done by encrypting fixed input a to ob-
r
tion for all rounds and is defined as CU = i=1 Cufii−1 ,ui , tain output β for r1 rounds of cipher, decrypting
where Cufii−1 ,ui is correlation for each intermediate value fixed output b to obtain γ for r2 rounds of cipher.
ui−1 → ui . For a linear hull a → b, total correlation 3. Obtain the partial trails with non zero correlation
over a cipher is computed by summing the correlation contribution. If both the partial trails do not match
contribution CU of all its possible linear trails U . in middle β 6= γ, this contradiction ensures the cor-
relation zero therefore r1 +r2 rounds must be a zero-
correlation linear hull i.e. C = 0. Thus correlation of
X
C= CU
U =u0 =a,u1 ,u2 ,. . . ,ur =b linear hull is exactly zero and linear distinguisher
(a, b) is obtained.
To construct zero correlation (C = 0) linear hull, input ii) Steps to Recover Key
a and output b is selected in such a way that no linear 1. Obtain all the possible combination of subkey kr
trail exists with non-zero correlation contribution CU (TPS) to compute encryption and decryption.
i.e. if correlation contribution CU = 0 for each linear 2. For each possible subkey, partially encrypt each plain-
trail, then correlation over the entire iterative cipher text (for r1 rounds) and partial decrypt each ci-
is exactly zero, C = 0 and it is denoted by a 9 b. phertext (for r2 rounds) upto the input and output
For correlation contribution to be zero CU = 0 for boundaries of the distinguisher (zero correlation lin-
each trail, construct each trail with at least one inter- ear approximation boundaries)
mediate Cufii−1 ,ui linear approximation ui−1 → ui over 3. Evaluate the correlation for partial encryption de-
the rounds to be zero since the product of all corre- cryption of all linear approximations for each possi-
lation values with intermediate zero correlation value ble subkey by counting number of times ax⊕bf (x) =
will result in zero correlation C=0 for this linear hull. 0
If Cufii−1 ,ui = 0 for a linear trail U , the pair of selection 4. If the correlation C is 0, the subkey guess is correct
pattern ui−1 and ui for a trail is called incompatible. We evaluate the correlation for distinct linear hulls to
If even one zero correlation linear hull (distinguisher) reduce the error probability.
exists, the cipher can be attacked.
6 Conclusion

Cryptographers as well as cryptanalysts all over the

world have been applying the latest attacks to already
published or newly designed crypto algorithm. To de-
sign a highly secure block ciphers which are immune
to the present day attacks, one needs to analyze the
possibility of any weakness in the design which can be
exploited by all the variants of differential and linear
attacks. The steps described in this paper, to find the
distinguisher and to recover the key of each cryptana-
lytic attack will be of great help to cryptanalyst. With
the advent of High Performance Computing(HPC) and
Distributed computing, these attacks will make crypt-
analysis efficient. All the attacks described in this paper
can be applied on SPN, feistel and generalized feistel
structure with the additional condition that the round
Fig. 7 Zero correlation Linear Cryptanalysis Structure
function should be bijective for impossible, integral and
zero correlation. The following Table 1 consolidates the
ciphers which have been attacked by variants of linear
The basic steps for constructing an attack on ciphers and differential cryptanalysis till today.
are The proposed work, helps to apply simultaneously all
i)Finding the Distinguisher the variants of differential attacks to a block ciphers.
1. Choose plaintext and ciphertext pairs with fixed un- These steps of finding distinguisher and steps to re-
known key K. cover key eases the task of cryptanalysts to apply the
2. Construct linear distinguisher with correlation zero attack on cipher simultaneously. The steps of key re-
C(a 9 b) = 0 by using miss in middle technique. covery described in this paper on the latest zero corre-
10 Mehak Khurana, Meena Kumari

Table 1 List of Attacks and ciphers 13. Lars R. Knudsen, Matthew J.B. Robshaw, The Block Ci-
pher Companion, Springer-Verlag (2011).
14. Y. Liu, D. Gu, Z. Liu, Wei Li, “Impossible Differential At-
tacks on Reduced Round LBlock,” in ISPEC 2012, LNCS
7232, pp. 97–108, 2012, Springer-Verlag Berlin Heidel-
berg (2012).
15. C. Boura, M. Naya-Plasencia, V. Suder, “Scrutinizing
and Improving Impossible Differential Attacks: Appli-
cations to CLEFIA, Camellia, LBlock and Simon” Asi-
acrypt 2014, LNCS Volume 8873, 2014, pp 179-199,
Springer-Verlg (2014).
16. R. Li1, B. Sun1 and C. Li, ”Impossible Dif-
ferential Cryptanalysis of SPN Ciphers,”
https://eprint.iacr.org/2010/307.pdf (2010).
17. Y. Yeom, “Integral Cryptanalysis and Higher Order Dif-
ferential Attack,” in Trends in Mathematics, Information
Center for Mathematical Sciences, Volume 8, Number 1,
June, Pages 101-118 (2005).
lation attack which is a variant of linear cryptanalysis 18. M. Duan, X. Lai, ”Higher Order Differential Cryptanal-
will also help to check the weakness in the design. Our ysis Framework and its Applications,” in International
Conference on Information Science and Technology, Nan-
futurist work is to apply these attacks on various algo-
jing, Jiangsu, China, March 26-28, (2011).
rithms and to do comparison on basis of time and data 19. M. Duan, X. Lai, Mohan Yang, X. Sun, B. Zhu, “Dis-
complexity. tinguishing Properties of Higher Order Derivatives of
Boolean Functions,” in IEEE Transactions on Informa-
tion Theory, Jul (2010).
20. A. Canteaut, M.Videau, “Degree of Composition of
References
Highly Nonlinear Functions and Applications to Higher
Order Differential Cryptanalysis,” in L.R. Knudsen
1. E. Biham, A. Shamir, “Differential Cryptanalysis of DES-
(Ed.): EUROCRYPT 2002, LNCS 2332, pp. 518–533,
like Cryptosystems,” Journal of Cryptology, Vols.4, no.1,
2002, Springer-Verlag (2002).
pp. 3-72 (1991).
21. Francois-Xavier Standaert, Gilles Piret, Jean-
2. E. Biham, A. Shamir, Differential Cryptanalysis of the
Jacques Quisquater, “Cryptananlysis of Block
Data Encryption Standard, Springer Verlag (1993).
Ciphers: A Survey,” UCL, Groupe Crypto,
3. E. Biham, ”New Types of Cryptanalytic Attacks Using
http://www.dice.ucl.ac.be/crypto/, Belgium (2003).
Related Keys,” Journal of Cryptology, vol. 7, no. No. 4,
22. E. Biham, O. Dunkelman, N. Keller, ”New Results and
p. 229–246, Springer-Verlag (1994).
boomerang and rectangle attack,” in Proceeding of Fast
4. L. Knudsen, ”Truncated and higher order differentials,”
Software Encryption, LNCS 2365, pp 1-16 Springer verlag
in In B.Preneel,editor, FSE, LNCS 1008, pp.196-211,
(2002).
Springer-verlag (1995).
23. J. Kelsey, T. Kohno, B. Schneier, Amplified Boomerang
5. L. Knudsen, D. Wagner, “Integral Cryptanalysis (Ex-
Attacks Against Reduced-Round MARS and Serpent,
tended Abstract),” in FSE 2002, LNCS 2365, pp.
New York : FSE 2000, pp. 75–93, Springer-Verlag (2000).
112–127, Springer-Verlag (2002).
24. E. Fleischmann, M. Gorski, S. Lucks, ”Attack-
6. E. Biham, A. Biryukov, A. Shamir, “Cryptanalysis of
ing Reduced Rounds of the ARIA Block Cipher,”
Skipjack Reduced to 31 Rounds using Impossible Differ-
https://eprint.iacr.org/2009/334.pdf, Germany (2009).
entials,” in Advances in Cryptology: EUROCRYPT’99
25. E. Biham, “New Types of Cryptanalytic Attacks Using
LNCS 1592, pp. 12-23, Springer Verlag (1999).
Related Keys,” Journal of Cryptology, , vol. 7, no. No. 4,
7. D. Wagner, ”The Boomerang Attack,” in Fast Soft-
p. 229–246, Springer-Verlag (1994).
ware Encryption, FSE’99 (L. R.Knudsen, ed.) Springer-
26. A. Bogdanov and V. Rijmen, “Linear hulls with corre-
Verlag, vol. 1636 of Lecture Notes in Computer Science,
lation zero and linear cryptanalysis of block ciphers,”
p. 156–170 (1999).
Designs, Codes and Cryptography, vol. 70 , no. 3, pp.
8. E. Biham, O. Dunkelman, N. Keller, ”The Rectan- 369-383, March (2014) .
gle Attack - Rectangling the Serpent,” EUROCRYPT
2001 LNCS,, vol. 2045, pp. 340-357, Springer, Heidelberg
(2001).
9. E. Biham, O. Dunkelman, N. Keller, ”Related-Key
Boomerang and Rectangle Attacks.,” EUROCRYPT
2005, LNCS, vol. 3494, pp. 507-525, Springer, Heidelberg,
(2005).
10. Howard M. Heys, A Tutorial on Linear and Differential
Cryptanalysis.
11. A. Bogdanov, V. Rijmen, “Zero Correlation Linear
Cryptanalysis of Block Ciphers,” IACR Eprint Archive
Report 2011/123, March (2011).
12. C. Swenson, Modern Cryptanalysis: Techniques and Ad-
vanced Code Breaking, Indianapolis: Wiley Publishing
(2008).