computer science

Impossible differential cryptanalysis

Impossible differential cryptanalysis is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Impossible differential cryptanalysis rather than just read about it. In short: In cryptography, impossible differential cryptanalysis is a form of differential cryptanalysis for block ciphers. While ordinary differential cryptanalysis tracks differences that propagate through the cipher with greater than expected probability, impossible differential cryptanalysis exploits differences that are impossible (having probability 0) at some intermediate state of the cipher algorithm.

Key takeaways

Impossible differential cryptanalysis belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Impossible differential cryptanalysis to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Impossible differential cryptanalysis from memory before moving on to harder problems.

Reference excerpt

In cryptography, impossible differential cryptanalysis is a form of differential cryptanalysis for block ciphers. While ordinary differential cryptanalysis tracks differences that propagate through the cipher with greater than expected probability, impossible differential cryptanalysis exploits differences that are impossible (having probability 0) at some intermediate state of the cipher algorithm. Lars Knudsen appears to be the first to use a form of this attack, in the 1998 paper where he introduced his AES candidate, DEAL. The first presentation to attract the attention of the cryptographic community was later the same year at the rump session of CRYPTO '98, in which Eli Biham, Alex Biryukov, and Adi Shamir introduced the name "impossible differential" and used the technique to break 4.5 out of 8.5 rounds of IDEA and 31 out of 32 rounds of the NSA-designed cipher Skipjack. This development led cryptographer Bruce Schneier to speculate that the NSA had no previous knowledge of impossible differential cryptanalysis. The technique has since been applied to many other ciphers: Khufu and Khafre, E2, variants of Serpent, MARS, Twofish, Rijndael (AES), CRYPTON, Zodiac, Hierocrypt-3, TEA, XTEA, Mini-AES, ARIA, Camellia, and SHACAL-2. Biham, Biryukov and Shamir also presented a relatively efficient specialized method for finding impossible differentials that they called a miss-in-the-middle attack. This consists of finding "two events with probability one, whose conditions cannot be met together."

References

Further reading Orr Dunkelman (March 1999). An Analysis of Serpent-p and Serpent-p-ns (PDF/PostScript). Rump session, 2nd AES Candidate Conference. Rome: NIST. Retrieved 2007-02-27.{{cite conference}}: CS1 maint: miscellaneous url (link) E. Biham; A. Biryukov; A. Shamir (May 1999). Cryptanalysis of Skipjack Reduced to 31 Rounds using Impossible Differentials (PDF/PostScript). Advances in Cryptology – EUROCRYPT '99. Prague: Springer-Verlag. pp. 12–23. Retrieved 2007-02-13.{{cite conference}}: CS1 maint: miscellaneous url (link) Kazumaro Aoki; Masayuki Kanda (1999). "Search for Impossible Differential of E2" (PDF/PostScript). Retrieved 2007-02-27. {{cite journal}}: Cite journal requires |journal= (help)CS1 maint: miscellaneous url (link) Eli Biham, Vladimir Furman (April 2000). Impossible Differential on 8-Round MARS' Core (PDF/PostScript). 3rd AES Candidate Conference. pp. 186–194. Retrieved 2007-02-27.{{cite conference}}: CS1 maint: miscellaneous url (link) Eli Biham; Vladimir Furman (December 2000). Improved Impossible Differentials on Twofish (PDF/PostScript). INDOCRYPT 2000. Calcutta: Springer-Verlag. pp. 80–92. Retrieved 2007-02-27.{{cite conference}}: CS1 maint: miscellaneous url (link) Deukjo Hong; Jaechul Sung; Shiho Moriai; Sangjin Lee; Jongin Lim (April 2001). Impossible Differential Cryptanalysis of Zodiac. 8th International Workshop on Fast Software Encryption (FSE 2001). Yokohama: Springer-Verlag. pp. 300–311. Archived from the original (PDF) on 2007-12-13. Retrieved 2006-12-30. Raphael C.-W. Phan; Mohammad Umar Siddiqi (July 2001). "Generalised Impossible Differentials of Advanced Encryption Standard". Electronics Letters. 37 (14): 896–898. Bibcode:2001ElL....37..896P. doi:10.1049/el:20010619. Jung Hee Cheon, MunJu Kim, and Kwangjo Kim (September 2001). Impossible Differential Cryptanalysis of Hierocrypt-3 Reduced to 3 Rounds (PDF). Proceedings of 2nd NESSIE Workshop. Retrieved 2007-02-27.{{cite conference}}: CS1 maint: multiple names: authors list (link) Jung Hee Cheon; MunJu Kim; Kwangjo Kim; Jung-Yeun Lee; SungWoo Kang (December 26, 2001). Improved Impossible Differential Cryptanalysis of Rijndael and Crypton. 4th International Conference on Information Security and Cryptology (ICISC 2001). Seoul: Springer-Verlag. pp. 39–49. CiteSeerX 10.1.1.15.9966. {{cite conference}}: Cite uses deprecated parameter |citeseerx= (help) Dukjae Moon; Kyungdeok Hwang; Wonil Lee; Sangjin Lee; AND Jongin Lim (February 2002). Impossible Differential Cryptanalysis of Reduced Round XTEA and TEA (PDF). 9th International Workshop on Fast Software Encryption (FSE 2002). Leuven: Springer-Verlag. pp. 49–60. Retrieved 2007-02-27. Raphael C.-W. Phan (May 2002). "Classes of Impossible Differentials of Advanced Encryption Standard". Electronics Letters. 38 (11): 508–510. Bibcode:2002ElL....38..508P. doi:10.1049/el:20020347. Raphael C.-W. Phan (October 2003). "Impossible Differential Cryptanalysis of Mini-AES" (PDF). Cryptologia. XXVII (4): 283–292. doi:10.1080/0161-110391891964. ISSN 0161-1194. S2CID 2658902. Archived from the original (PDF) on 2007-09-26. Retrieved 2007-02-27. Raphael C.-W. Phan (July 2004). "Impossible Differential Cryptanalysis of 7-round AES". Information Processing Letters. 91 (1): 29–32. doi:10.1016/j.ipl.2004.03.006. Retrieved 2007-07-19. Wenling Wu; Wentao Zhang; Dengguo Feng (2006). "Impossible Differential Cryptanalysis of ARIA and Camellia" (PDF). Retrieved 2007-02-27. {{cite journal}}: Cite journal requires |journal= (help)

Worked examples

Example 1 — a first encounter with Impossible differential cryptanalysis

Start with the simplest possible case. Write down what Impossible differential cryptanalysis claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Impossible differential cryptanalysis before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Impossible differential cryptanalysis ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Impossible differential cryptanalysis

In research: Impossible differential cryptanalysis appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Impossible differential cryptanalysis in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Impossible differential cryptanalysis is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cryptographic attacks, so understanding it makes those chapters shorter.
In everyday life: Look for Impossible differential cryptanalysis outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Impossible differential cryptanalysis in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Impossible differential cryptanalysis means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Impossible differential cryptanalysis out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Impossible differential cryptanalysis in simple terms?

Why does Impossible differential cryptanalysis matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Impossible differential cryptanalysis?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Impossible differential cryptanalysis.