Hi guys, I'm contacting you because I'm trying to solve a differential cryptanalysis exercise, in which they give me the 16 values in hexa of the s-box. I'm required to construct the difference distribution table (which I've already achieved), and as a second question, they ask me to "find a good differential characteristic of 3 rounds".

I don't really know how to answer about a good differential characteristic. I guess that by observing the resulting difference distribution table, one must choose those combinations of input differences and output differences of HIGHEST probability.

To study this, I'm following this paper: http://www@engr@mun@ca/~howard/PAPERS/ldc_tutorial.pdf (change "@" for "."). From page 19, we have there Differential Cryptanalysis. The s-boxes selected are these:

S12: ∆X = B --> ∆Y = 2 with probability 8/16
S23: ∆X = 4 --> ∆Y = 6 with probability 6/16
S32: ∆X = 2 --> ∆Y = 5 with probability 6/16
S33: ∆X = 2 --> ∆Y = 5 with probability 6/16


01) Once you obtained the difference distribution table, how do you find a "good differential characteristic of 3 rounds"?

02) In the paper...it seems to have chosen arbitrary in page 23 the s-boxes S12, S23, S32 and S33. Why are these the s-boxes selected? What's the criterion for selection?

03) Related to the precedent question: the author arbitrary decided that, for instance, the s-box S12[/B] was going to be the one with the values ∆X = B --> ∆Y = 2. Why didn't the author decided instead, for example, that the s-box S14[/B] would be the one with the values ∆X = B --> ∆Y = 2.

As you can see, I don't get at all the criteria for selecting the s-boxes y de decisions about assigning certain ∆X and ∆Y to the s-boxes.

Could you experts be so kind to give me a hand in this? If it's better to discuss this with a particular example, I could post the difference distribution table to clarify my questions.

Thanks in advance!