[Next] [Up] [Previous] [Index] As previously noted, the basic
principle of differential cryptanalysis is that the cipher being
attacked has a characteristic if there exists a constant X such
that given many pairs of plaintexts A, B, such that B = A xor X,
if a certain statement is true about the key, E(B,k) = E(A,k)
xor Y for some constant Y will be true with a probability
somewhat above that given by random chance. A 1991 paper by
Xuejia Lai and James Massey presents a somewhat modified
definition of differential cryptanalysis which specifies a case
in which it may be more easily analyzed, and in which it can be
used to obtain more information about the key. In their
formulation, a cipher has an N-round differential if there exist
constants X, Y such that given many pairs of plaintexts A, B,
such that B = A xor X, for N-rounds of the cipher, EN(B,k) =
EN(A,k) xor Y will be true with a probability somewhat above
that given by random chance if the key k is randomly chosen.
Remember, in the case of a characteri