Differential Cryptanalysis - Modern Cryptanalysis: Techniques for Advanced Code Breaking - page 161

( 000110 ⇒ 000110) ( 000110 ⇒ 100001)

( 000110 ⇒ 110000) ( 000111 ⇒ 101001)

( 001001 ⇒ 011000) ( 001001 ⇒ 100010)

( 001001 ⇒ 110010) ( 001010 ⇒ 110111)

( 001100 ⇒ 101110) ( 001101 ⇒ 010100)

( 001110 ⇒ 110001) ( 010001 ⇒ 010100)

( 010010 ⇒ 000001) ( 010011 ⇒ 001000)

( 011011 ⇒ 100101) ( 011100 ⇒ 001100)

( 011100 ⇒ 111111) ( 011101 ⇒ 111001)

( 011110 ⇒ 010101) ( 011111 ⇒ 100110)

( 100000 ⇒ 100111) ( 100010 ⇒ 001101)

( 100011 ⇒ 000110) ( 100101 ⇒ 000001)

( 101000 ⇒ 001100) ( 101011 ⇒ 001100)

( 101011 ⇒ 111100) ( 101100 ⇒ 101011)

( 101101 ⇒ 000011) ( 110010 ⇒ 101101)

( 110011 ⇒ 011111) ( 110011 ⇒ 101111)

( 111000 ⇒ 100000) ( 111001 ⇒ 001001)

( 111001 ⇒ 001101) ( 111011 ⇒ 010100)

( 111011 ⇒ 111110) ( 111100 ⇒ 011100)

( 111100 ⇒ 100000) ( 111101 ⇒ 000100)

Table 7-3 S-Box Characteristics of EASY1 with a Probability of 8/64
(001011 ⇒ 001010)
(010000 ⇒ 011001)
(011001 ⇒ 010110)
(110101 ⇒ 101001)

In general, entries with fewer bits set in the Ω X and Ω Y that have higher occurrence counts are desirable.
However, there is the issue of round keys. Specifically, in EASY1, as well as many other ciphers, there is a
layer of key mixing after the input bits are used in the S-box. In linear cryptanalysis, these were kept track of
and taken care of at the end of the linear expression. However, in differential cryptanalysis, we are not accumu-
lating a massive linear expression; therefore, we need to address the key influence.
In our EASY1 cipher, denote W to be the corresponding input into the S-box after the key has been mixed
in, or W = X ⊕ K , and let Y be the output of the S-box. We will naturally now rework our above analysis to be
on Ω W instead of Ω X . Then, we have inputs to the S-box, W 1 and W 2 , with Ω W = W 1 ⊕ W 2 . We substitute in the
appropriate values in this equation, to obtain

Therefore, having the key bits mixed in does not affect our analysis at all and can be safely ignored in this
cipher.Normally,this is the case with most ciphers. (However,there are some ciphers that provide more trouble,
such as Blowfish, where the S-boxes themselves are determined by the key.)