A method to estimate the number of ciphertext pairs for differential cryptanalysis

Abstract

Differential cryptanalysis introduced by Biham and Shamir in 1990 is one of the most powerful attacks to DES-like cryptosystems. This attack presumes on some tendency of the target cryptosystem. So the efficiency of the attack depends upon the conspicuousness of this tendency. S/N ratio introduced in the paper is to evaluate this conspicuousness. In other words, the S/N ratio is a measure of the efficiency of the attack. Nevertheless, S/N ratio does NOT suggest how many pairs of ciphertexts are needed. In this paper, we show how to estimate the number of necessary pairs of ciphertexts for the differential cryptanalysis. We also show that our estimation is adequate using the 8-round-DES as an example. Biham and Shamir also showed a counting scheme to save memories at the cost of efficiency. We show an algorithm to find the secret key saving memories at the less cost of efficiency.