Differential Cryptanalysis - Modern Cryptanalysis: Techniques for Advanced Code Breaking - page 175

itself. Therefore, any potential solution of a ciphertext must not have a character of plaintext be the same as the
corresponding character in the ciphertext.
The particular attack Biham et al. [4] explain is a miss-in-the-middle attack on Skipjack. If we feed an input
differential into round 5 of (0, a, 0, 0) [into ( w 5 , w 6 , w 7 , w 8 )], then we can check for an impossible output differ-
ential in (the output of) round 28: ( b , 0, 0, 0). We will write this impossible differential as
This differential is impossible if a and b are both not 0. (The rounds are numbered from 1 to 32.)
This is a miss-in-the-middle attack because, if we analyze the differentials from round 5 and round 28, we
can trace them all the way to the output of round 16 (or, equivalently, the input of round 17); two effects of
each differential meet: The input differential says that the round value should be ( c , d, e, 0 ), while the output
differential says that the round value should be ( f, g, 0, h ). Specifically, e and h cannot be 0, and therefore there
is a contradiction. Figure 7-2 graphically depicts the impossible differential attack.