🚀 go-pugleaf

In article <1992Sep27.090739.1@zodiac.rutgers.edu>, leichter@zodiac.rutgers.edu writes:
> It is PRIMARILY applicable in such situations - but EXCLUSIVELY applicable?
> That's hard to say.  In the long run, known plaintext generally (though not
> always) gives you the same results as chosen plaintext; it just may take
> longer.

I'm not sure I agree in this case.  Differential cryptanalysis is based
on the reaction of the system to *pairs* of inputs.  While knowing the
plaintext, even in a block-chaining situation, is generally useful, in
differential cryptanalysis you'd be more or less dependent on luck to produce
the right input pairs.  And if you need 2^47 pairs of chosen plaintext,
you'd probably need a lot more known plaintext.

There's another reason to have some confidence about DES in this respect:
the original designers knew about differential cryptanalysis, and designed
DES to resist it.  Certainly, there may be other, more powerful, attacks
that can be launched against it, but I'm not convinced that they'll use
differential cryptanalysis as a major element.