Abstract

Differential cryptanalysis analyzes ciphers by studying the development of differences during encryption. Linear cryptanalysis is similar but is based on studying approximate hnear relations. In 1994, Langford and Hellman showed that both kinds of analysis can be combined together by a technique called differential-linear cryptanalysis, in which the differential part creates a hnear approximation with probabihty 1. They apphed their technique to 8-round DES. In this paper we present an enhancement of differential-linear cryptanalysis in which the inherited hnear probabihty is smaller than 1. We use this extension to describe a differential-hnear distinguisher for a 7-round reducedversion of DES, and to present the best known key-recovery attack on a 9-round reduced-version of DES. We use our enhanced technique to attack COCONUT98 with time complexity 233'7 encryptions and 227'7 chosen plaintexts.

Citations