🚀 go-pugleaf

In article <Bv6JrL.B1L@newcastle.ac.uk>, Graham.Shaw@newcastle.ac.uk
(G.D.Shaw) writes:
| Some questions:
| 
| Is differential cryptanalysis exclusively applicable to situations
| where a chosen plaintext attack is possible?
| 

It is PRIMARILY applicable in such situations - but EXCLUSIVELY applicable?
That's hard to say.  In the long run, known plaintext generally (though not
always) gives you the same results as chosen plaintext; it just may take
longer.

| If so, does the use of a random header followed by encryption in a
| chaining mode defeat such an attack?
| 

Unknown.  However, there tend to be plenty of possible inputs that can be
used as a basis for differential cryptanalysis.  As you would expect, the
published work so far focuses on using inputs that are particularly convenient
for this purpose - hence, chosen plaintext.  If you work harder, can you get
the same results using other kinds of input?  No one knows - or at least no
one has published such results.

| Finally, is vulnerability to differential cryptanalysis (or indeed
| chosen plaintext attacks in general) believed to imply vulnerability
| to other types of attack?
| 

Beyond the fact that vulnerability to chosen plaintext probably implies vul-
nerability to known plaintext:  Unknown.  Without a sound theory, talking
about "other TYPES of attack" is philosophy, not mathematics or science.
Differential cryptanalysis is the first published mode of attack against
DES-style algorithms that actually distinguished in a non-trivial way among
different members of the class of such algorithms.  Until it appeared, the
only publically known criteria for distinguishing among such algorithms were
some fairly obvious requirements like not making the boxes implement linear or
affine transformations.  Once you avoided those, all other algorithms seemed
equally hard - and there was no plausible attack on any of them, once you used
"enough" rounds.  But where "enough" came from, and why it mattered, was a
mystery.

Are there entirely different attacks, different in the sense that the induce
a distinct subdivision of "good" and "bad" members of this class of algorithms
(or even, perhaps, break ALL such algorithms)?  No one knows - or at least no
one has said publically.
							-- Jerry