🚀 go-pugleaf

In article <Bv6JrL.B1L@newcastle.ac.uk>, Graham.Shaw@newcastle.ac.uk
(G.D.Shaw) writes:
| Some questions:
| 
| Is differential cryptanalysis exclusively applicable to situations
| where a chosen plaintext attack is possible?
| 

It is PRIMARILY applicable in such situations - but EXCLUSIVELY applicable?
That's hard to say.  In the long run, known plaintext generally (though not
always) gives you the same results as chosen plaintext; it just may take
longer.

| If so, does the use of a random header followed by encryption in a
| chaining mode defeat such an attack?
| 

Unknown.  However, there tend to be plenty of possible inputs that can be
used as a basis for differential cryptanalysis.  As you would expect, the
published work so far focuses on using inputs that are particularly convenient
for this purpose - hence, chosen plaintext.  If you work harder, can you get
the same results using other kinds of input?  No one knows - or at least no
one has published such results.

| Finally, is vulnerability to differential cryptanalysis (or indeed
| chosen plaintext attacks in general) believed to imply vulnerability
| to other types of attack?
| 

Beyond the fact that vulnerability to chosen plaintext probably implies vul-
nerability to known plaintext:  Unknown.  Without a sound theory, talking
about "other TYPES of attack" is philosophy, not mathematics or science.
Differential cryptanalysis is the first published mode of attack against
DES-style algorithms that actually distinguished in a non-trivial way among
different members of the class of such algorithms.  Until it appeared, the
only publically known criteria for distinguishing among such algorithms were
some fairly obvious requirements like not making the boxes implement linear or
affine transformations.  Once you avoided those, all other algorithms seemed
equally hard - and there was no plausible attack on any of them, once you used
"enough" rounds.  But where "enough" came from, and why it mattered, was a
mystery.

Are there entirely different attacks, different in the sense that the induce
a distinct subdivision of "good" and "bad" members of this class of algorithms
(or even, perhaps, break ALL such algorithms)?  No one knows - or at least no
one has said publically.
							-- Jerry

In article <1992Sep27.090739.1@zodiac.rutgers.edu>, leichter@zodiac.rutgers.edu writes:
> It is PRIMARILY applicable in such situations - but EXCLUSIVELY applicable?
> That's hard to say.  In the long run, known plaintext generally (though not
> always) gives you the same results as chosen plaintext; it just may take
> longer.

I'm not sure I agree in this case.  Differential cryptanalysis is based
on the reaction of the system to *pairs* of inputs.  While knowing the
plaintext, even in a block-chaining situation, is generally useful, in
differential cryptanalysis you'd be more or less dependent on luck to produce
the right input pairs.  And if you need 2^47 pairs of chosen plaintext,
you'd probably need a lot more known plaintext.

There's another reason to have some confidence about DES in this respect:
the original designers knew about differential cryptanalysis, and designed
DES to resist it.  Certainly, there may be other, more powerful, attacks
that can be launched against it, but I'm not convinced that they'll use
differential cryptanalysis as a major element.

Graham.Shaw@newcastle.ac.uk (G.D.Shaw) writes:

>Some questions:

>Is differential cryptanalysis exclusively applicable to situations
>where a chosen plaintext attack is possible?

Yes.

>If so, does the use of a random header followed by encryption in a
>chaining mode defeat such an attack?

I'm not sure, I expect it does if the header is long enough.

>Finally, is vulnerability to differential cryptanalysis (or indeed
>chosen plaintext attacks in general) believed to imply vulnerability
>to other types of attack?

Nobody knows, what is known is the reverse:

invulnerability to chosen-plaintext attack implies invulnerability to
known-plaintext or ciphertext-only attack (unless there are some weak keys
or plain text being used etc).