Cryptography Reference
In-Depth Information
where
P
is the permutation in the DES round function and
||
denotes the concatenation.
is correct then Pr[
W
κ
=
This means that we
c
onsider the output bits of
S
1
only. If
κ
1)
β
√
λ
1
1
1]
is an unknown constant that depends on some key bits.
Collecting
N
independent samples (
X
i
,
=
2
+
2
(
−
, where
β
N
, we compute
N
independent samples
W
i
of
W
κ
. Let
c
κ
be
th
e number of
i
's such that
W
i
=
Y
i
)of(
X
,
Y
) for
i
=
1
,...,
1. Clearly,
1)
β
√
λ
c
N
−
1
2
1
1
1
the expected value of
is
2
(
−
and the variance is
4
N
−
4
N
λ
. We make
approximations to the first order of
√
λ
, i.e. we neglect
λ
so that the standard deviation
1
is approximately
2
√
N
.As
N
increases, the central limit theorem states that
Pr
c
κ
t
(
x
−
(
−
1)
β
√
λ
N
)
2
2
1
2
<
t
2
√
N
1
√
2
e
−
N
−
≈
dx
.
π
−∞
We deduce that
Pr
<
t
(
x
−
(
−
1)
β
√
λ
N
)
2
2
c
κ
N
−
1
2
t
2
√
N
1
√
2
e
−
≈
dx
π
−
t
t
t
(
x
−
(
−
1)
β
√
λ
N
)
2
2
(
x
+
(
−
1)
β
√
λ
N
)
2
2
1
√
2
1
√
2
e
−
e
−
=
dx
+
dx
π
π
0
0
e
−
λ
2
t
0
2
cosh
x
√
λ
N
dx
2
√
2
x
2
e
−
=
.
π
is not the right guess, we can compute
W
i
and
c
κ
by the same formula and
we can approximate the expected value and standard deviation of
If
κ
c
N
−
1
2
1
2
√
N
by 0 and
respectively. A similar analysis leads to
Pr
<
t
c
κ
N
−
1
2
t
2
√
N
2
√
2
y
2
2
dy
e
−
≈
.
π
0
c
κ
−
2
be the grade for a guess
N
Let
g
κ
=
κ
{
,
∈
. Let
T
be the triangle
(
x
y
)
R
2
;
x
≥
≥
}
. We obtain that the probability that the grade of the right candidate is
smaller than the grade of a given bad candidate is approximately
y
0
e
−
λ
2
T
cosh
x
√
N
dx dy
2
π
x
2
y
2
+
e
−
p
=
1
−
λ
.
2
1
2
This is a decreasing function in terms of
r
=
λ
N
, which runs from
p
=
(for
λ
=
0)
to
p
=
0 (for
λ
=+∞
). We have
2
T
cosh(
x
√
r
)
dxdy
2
π
x
2
+
y
2
2
r
e
−
e
−
p
=
1
−
1
π
1
π
−
√
r
)
2
+
√
r
)
2
y
2
y
2
(
x
+
(
x
+
e
−
e
−
=
1
−
dx dy
−
dx dy
.
2
2
T
T
Search WWH ::
Custom Search