Differential Cryptanalysis 1

We study the differential cryptanalysis of S-DES. Consider a three

round S-DES, with the inputs L1 R1 and L1 R1 , and the corresponding
outputs L4 R4 and L4 R4 . From the definition of the S-DES system, we
have
L2 = R1

(1)

R 2 = L 1 f ( R 1 , K2 )

(2)

L3 = R2

(3)

R 3 = L 2 f ( R 2 , K3 )

(4)

L4 = R3

(5)

R 4 = L 3 f ( R 3 , K4 ) .

(6)

Note that we have with us only L1 R1 and L4 R4 , and hence, we want

to get rid of the intermediate variables.
Using Eqn. (5) in Eqn. (6), R4 = L3 f ( L4 , K4 )

(7)

Using Eqn. (3) in Eqn. (7), R4 = R2 f ( L4 , K4 )

(8)

Using Eqn. (2) in Eqn. (8), R4 = L1 f ( R1 , K2 ) f ( L4 , K4 ).

(9)

Thus, with the input L1 R1 , we have

R4 = L1 f ( R1 , K2 ) f ( L4 , K4 ).

(10)

Adding Eqns. (9) and (10), we get

R4 R4 = L1 L1 f ( R1 , K2 ) f ( R1 , K2 ) f ( L4 , K4 ) f ( L4 , K4 ).
(11)
We choose R1 = R1 , and hence, we get
R4 R4 = L1 L1 f ( L4 , K4 ) f ( L4 , K4 ).

(12)

We wish to solve the above equation for the key K4 (and eventually
get the key K).
Note that the cipher system is a black box with a secret key, and
our intention is to crack the key using the differential cryptanalysis
method. We consider the input L1 R1 = 000111011011 for which
the output is L4 R4 = 000011100101. For the same system (same
system imply that the key is the same!), we choose the second input
L1 R1 = 101110011011 for which the output is L4 R4 = 100100011000.
Note that R1 = R1 .
On evaluating the quantities in Eqn. (12), we get the following:
R4 R4 = 111101
L1

L1

= 101001

(13)
(14)

Email: PremkumarK@ssn.edu.in

differential cryptanalysis

Thus, substituting the appropriate values in Eqn. (12), we get

111101 = 101001 f ( L4 , K4 ) f ( L4 , K4 )
111101 101001 = f ( L4 , K4 )
010100 = f ( L4 , K4 )

f ( L4 , K4 )
f ( L4 , K4 ).

(15)
(16)
(17)

In other words, we have the following information:

010 = S1(first four bits of E( L4 ) K4 ) S1(first four bits of E( L4 ) K4 )
(18)
100 = S2(last four bits of E( L4 ) K4 ) S2(last four bits of

E( L4 ) K4 )

(19)

Note that E( L4 ) = 0000 0011 and E( L4 ) = 1010 1000.

Finding the first 4 bits of K4

Let `1 represent the first four bits of E( L4 ) K4 , and `2 represent the
first four bits of E( L4 ) K4 . Note that `1 `2 = the first four bits of
E( L4 ) E( L4 ). Since E( L4 ) E( L4 ) = 10101011, `1 + `2 = 1010. Thus
the inputs to Sbox S1 differ by 1010, and the corresponding outputs
differ by 010 (see Eqn. (18)).
`1
`2
S1(`1 ) S1(`2 ) S1(`1 ) S1(`2 )
0000 1010 101
110
011
0001 1011 010
010
000
0010 1000 001
001
000
0011 1001 110
100
010
0100 1110 011
101
110
0101 1111 100
011
111
0110 1100 111
000
111
0111 1101 000
111
111
1000 0010 001
001
000
1001 0011 100
110
010
1010 0000 110
101
011
1011 0001 010
010
000
1100 0110 000
111
111
1101 0111 111
000
111
1110 0100 101
011
110
1111 0101 011
100
111
Note: the first 4 bits of E( L4 ) is 0000. Hence, the first 4 bits of K4 is
given by the following:
0000 + K4 (1)K4 (2)K4 (3)K4 (4) = 0011,

(20)

or, 0000 + K4 (1)K4 (2)K4 (3)K4 (4) = 1001.

(21)

differential cryptanalysis

Hence, K4 (1)K4 (2)K4 (3)K4 (4) is

K4 (1)K4 (2)K4 (3)K4 (4) = 0011,

(22)

or, K4 (1)K4 (2)K4 (3)K4 (4) = 1001.

(23)

Alternatively, one could start with E( L4 ) to obtain the first 4 bits of

the key K4 .
1010 + K4 (1)K4 (2)K4 (3)K4 (4) = 0011,

(24)

or, 1010 + K4 (1)K4 (2)K4 (3)K4 (4) = 1001.

(25)

Hence,
K4 (1)K4 (2)K4 (3)K4 (4) = 1001,

(26)

or, K4 (1)K4 (2)K4 (3)K4 (4) = 0011.

(27)

Thus, K4 (1)K4 (2)K4 (3)K4 (4) {1001, 0011}.

Finding the last 4 bits of K4

Let r1 represent the last four bits of E( L4 ) K4 , and r2 represent the
last four bits of E( L4 ) K4 . Note that r1 r2 = the last four bits of
E( L4 ) E( L4 ). Since E( L4 ) E( L4 ) = 10101011, r1 + r2 = 1011. Thus
the inputs to Sbox S2 differ by 1011, and the corresponding outputs
differ by 100 (see Eqn. (19)).
r1
r2
S2(r1 ) S2(r2 ) S2(r1 ) S2(r2 )
0000 1011 100
111
011
0001 1010 000
000
000
0010 1001 110
011
101
0011 1000 101
101
000
0100 1111 111
100
001
0101 1110 001
001
000
0110 1101 011
010
001
0111 1100 010
110
100
1000 0011 101
101
000
1001 0010 011
110
101
1010 0001 000
000
000
1011 0000 111
100
011
1100 0111 110
010
100
1101 0110 010
011
001
1110 0101 001
001
000
1111 0100 100
111
011
Note: the last 4 bits of E( L4 ) is 0011. Hence, the last 4 bits of K4 is

differential cryptanalysis

given by the following:

0011 + K4 (5)K4 (6)K4 (7)K4 (8) = 0111,

(28)

or, 0011 + K4 (5)K4 (6)K4 (7)K4 (8) = 1100.

(29)

Hence, K4 (5)K4 (6)K4 (7)K4 (8) is

0011 + K4 (5)K4 (6)K4 (7)K4 (8) = 0100,

(30)

or, 0011 + K4 (5)K4 (6)K4 (7)K4 (8) = 1111.

(31)

Alternatively, one could start with E( L4 ) to obtain the last 4 bits of

the key K4 .
1000 + K4 (5)K4 (6)K4 (7)K4 (8) = 0111,

(32)

or, 1000 + K4 (5)K4 (6)K4 (7)K4 (8) = 1100.

(33)

Hence,
K4 (5)K4 (6)K4 (7)K4 (8) = 1111,

(34)

or, K4 (5)K4 (6)K4 (7)K4 (8) = 0100.

(35)

Thus, K4 (5)K4 (6)K4 (7)K4 (8) {1111, 0100}. Thus, K4 {10011111, 10010100, 00111111, 00110100}.
Note that K = K4 (7)K4 (8)K (3)K4 (1)K4 (2)K4 (3)K4 (4)K4 (5)K4 (6)
where K (3) {0, 1}. Thus,
K {110100111, 000100101, 110001111, 000001101, 111100111, 001100101, 111001111, 001001101}.