Differential Cryptanalysis of Lucifer

Abstract

Differential cryptanalysis was introduced as an approach to analyze the security of DES-like cryptosystems. The first example of a DES-Like cryptosystem was Lucifer, the direct predecessor of DES, which is still believed by many people to be much more secure than DES, since it has 128 key bits, and since no attacks against (the full variant of) Lucifer were ever reported in the cryptographic literature. In this paper we introduce a new extension of differential cryptanalysis, devised to extend the class of vulnerable cryptosystems. This new extension suggests key-dependent characteristics, called conditional chamcteristics, selected to enlarge the characteristics' probabilities for keys in subsets of the key space. The application of conditional characteristics to Lucifer shows that more than half of the keys of Lucifer are insecure, and the attack requires about 2" complexity and chosen plaintexts to find these keys. The same extension can also be used to attack a new variant of DES, called RDES, which was designed to be immune against differential cryptanalysis. These new attacks flash new light on the design of DES, and show that the transition of Lucifer to DES strengthened the later cryptosystem.

Cryptanalysis of Skipjack Reduced to 31 Rounds Using Impossible Differentials

“…There are many modifications and extensions of the ideas presented in this paper. For example, cryptanalysis with impossible differentials can be used with low-probability (rather than zero-probability) differentials, can be used with conditional characteristics [2] (or differentials), and can be combined with linear [11] (rather than differential) cryptanalysis.…”

Advanced Encryption Standard - Cryptanalysis research

“…The attacks are made more successful and accurate by more trial, Comprehensive enumeration is done to discover the rest of the key bits. Relationship difference between the input & output of the function blocks are exploited by the differential cryptanalysis [2]. For an algorithm with encryption, plaintext pattern that have fixed difference are inspected.…”

“…Bard and Courtois [22] described one more hybrid-attack on DES, which was the combination of SAT-Solver with the algebraic attack. The DES S-boxes were represented by them as a nearly-linear, sparse, and large system of equation in GF (2). ("Nearly-linear" depicts maximum of 1 nonlinear term in all equations.)…”

Differential Cryptanalysis of the ICE Encryption Algorithm

“…In general we call these conditional characteristics (cf. the attack on Lucifer [1]), which have a certain probability with respect to a subset of the key space. Their usage is advisable when they improve the probability over the best probability of a nonconditional characteristic by a factor higher than the inverse of the key fraction (the ratio between the size of the subset and the size of the key space), especially if several such characteristics can efficiently share the same structure of chosen plaintexts.…”