On the optimal diffusion layers with practical security against differential and linear cryptanalysis

Abstract

In this works we examine the diffusion layers of some block ciphers referred to as substitution-permutation networks. We investigate the practical security of these diffusion layers against differential and linear cryptanalysis by using the notion of active S-boxes. We show that the minimum number of differentially active S-boxes and that of linearly active S-boxes are generally not identical and propose some special conditions in which those are identical. Moreover, we apply our results to analyze three diffusion layers used in the block ciphers E2, CRYPTON and Rijndael, respectively. It is also shown that these all diffusion layers have achieved optimal security according to their each constraints of using operations.