Difference chain through multiple rounds L 0 R

Difference chain through multiple rounds: (L 0, R 0) = P P P = 0 x 0002 L 1 = R 0 R 1 = L 0 F(R 0, K 1) With probability 3/4 (L 1, R 1) = 0 x 0202 L 2 = R 1 R 2 = L 1 F(R 1, K 2) L 3 = R 2 R 3 = L 2 F(R 2, K 3) L 4 = R 3 R 4 = L 3 F(R 3, K 4) C = (L 4, R 4) With probability (3/4)2 (L 2, R 2) = 0 x 0200 With probability (3/4)2 (L 3, R 3) = 0 x 0002 With probability (3/4)3 (L 4, R 4) = 0 x 0202 C C = 0 x 0202 Note: K is the sub-key, and K 1 means the sub-key of round one Source: Dr. Mark Stamp’s cs 265 course note

Algorithm To Find The Rightmost 6 Bits Of K 4 we know that if P 1 P 2 = 0 x 0002, C 1 C 2 = 0 x 0202 R 4 = L 3 F(R 3, K 4). we need to know L 3 and R 3 but we only know L 4 and R 4. old right half is new left half in Feistel cipher, – replace R 3 with L 4 => R 4 = L 3 F(L 4, K 4). – rearrange the equation to L 3 = R 4 F(L 4, K 4). • (L 3, R 3) = 0 x 0002, both L 3 are identical. • any key K that make R 4 F(L 4, K) = R 4 F(L 4, K) always hold true, we are likely to find the correct sub-key K 4. • there are 64 possible keys to try. – count the number of times each such key satisfies the condition • • R 4 F(L 4, K) == R 4 F(L 4, K) – all keys with maximum count are possible partial sub-keys. • the rightmost 6 bits of K 4 is k 13 k 14 k 15 k 9 k 10 k 11 of the original key, we know this 6 bits group is in the set of all possible partial sub-keys.