On the distribution of characteristics in composite permutations

Abstract

Differential cryptanalysis is a method of attacking iterated mappings which has been applied with varying success to a number of product ciphers and hash functions [1, 2]. Let ρ: Z2c × Z2m → Z2m be a mapping that consists of c ‘control’ bits and m ‘data’ bits. The mapping p mapping contains 2c m-bit permutations π1: Z2m → Z2m, 0 ≤ i ≤ 2c - 1, one of which is selected (multiplexed) by the control bits, and a substitution is then performed on the data bits using the selected permutation. Such mappings will be called composite permutation8. The S-boxes of DES are composite permutations of the form Si: Z22 × Z24 → Z24 with 2 control bits and 4 data bits. In differential cryptanalysis the attacker is interested in the largest entry in a given XOR table, and the fraction of the XOR table that is zero. In this paper we determine the distribution of characteristics in the XOR tables of composite permutations, which leads to approximations for the largest entry in the XOR table and the density of zero entries.