Introduced by
Martin Hellman and
Susan K. Langford in 1994, the differential-linear attack is a mix of both
linear cryptanalysis and
differential cryptanalysis
Differential cryptanalysis is a general form of cryptanalysis applicable primarily to block ciphers, but also to stream ciphers and cryptographic hash functions. In the broadest sense, it is the study of how differences in information input can aff ...
.
The attack utilises a differential characteristic over part of the cipher with a probability of 1 (for a few rounds—this probability would be much lower for the whole cipher). The rounds immediately following the differential characteristic have a linear approximation defined, and we expect that for each
chosen plaintext
A chosen-plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker can obtain the ciphertexts for arbitrary plaintexts.Ross Anderson, ''Security Engineering: A Guide to Building Dependable Distributed Systems'' ...
pair, the probability of the linear approximation holding for one chosen plaintext but not the other will be lower for the correct key. Hellman and Langford have shown that this attack can recover 10 key bits of an 8-round
DES with only 512 chosen plaintexts and an 80% chance of success.
The attack was generalised by
Eli Biham et al. to use differential characteristics with probability less than 1. Besides DES, it has been applied to
FEAL,
IDEA,
Serpent,
Camellia, and even the
stream cipher
stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream (keystream). In a stream cipher, each plaintext digit is encrypted one at a time with the corresponding digit of the keystream ...
Phelix.
References
*
*
*
*
*
*
{{cryptography navbox , block
Cryptographic attacks