Cryptography Reference
In-Depth Information
Fig. 3.7
Error propagation
paths from
L
r
to
L
15
for
r
=
12 and
r
=
11
3.4.2 Wrong Key Distinguishers
As in the previous attacks, every subkey
K
16
,
i
is retrieved independently. For every
i
∈{
1
,...,
8
}
,(
3.6
) is equivalent to
Δ
R
16
=
S
i
E
i
(
K
16
,
i
⊕
S
i
E
i
(
K
16
,
i
⊕
Δ
L
15
.
L
16
)
⊕
P
−
1
i
P
−
1
i
L
16
)
⊕
(3.7)
Let us define
g
i
as the function that predicts
P
−
1
C
)
(Δ
L
15
)
according to a pair
(
C
,
i
and a guess
k
on the value of
K
16
,
i
:
S
i
E
i
(
k
⊕
S
i
E
i
(
k
⊕
Δ
R
16
.
L
16
)
⊕
C
),
P
−
1
i
g
i
((
C
,
k
)
=
L
16
)
⊕
P
−
1
i
C
,
From (
3.7
), we have
g
i
(
,
)
=
(Δ
L
15
)
=
C
k
for the correct key guess
k
K
16
,
i
.
C
,
On the other hand,
g
i
(
C
,
k
)
can be assumed to have a uniform distribution for a
