Differential and Linear trail propagation in Noekeon












4












$begingroup$


In the Noekeon Cipher Specification they write the following :




The propagation through Lambda is denoted by $(a rightarrow A)$, also called a
step. Because of the linearity of Lambda it is fully deterministic:
both for LC and DC patterns, we have: $A = operatorname{Lambda}(a)$. The fact that the
relation is the same for LC and DC is thanks to the fact that the
Lambda is an orthogonal function. If represented in a matrix, its
inverse is its transpose.




I'm having a hard time understanding why the orthogonality of Lambda affects the relation with regards to selection patterns (LC).



Why does the orthogonality of Lambda make it so that the relationship is the same as for DC ? How would the selection pattern propagate through the linear layer if Lambda was not orthogonal ?






cryptanalysis block-cipher linear-cryptanalysis differential-analysis







share|improve this question











$endgroup$

















    4












    $begingroup$


    In the Noekeon Cipher Specification they write the following :




    The propagation through Lambda is denoted by $(a rightarrow A)$, also called a
    step. Because of the linearity of Lambda it is fully deterministic:
    both for LC and DC patterns, we have: $A = operatorname{Lambda}(a)$. The fact that the
    relation is the same for LC and DC is thanks to the fact that the
    Lambda is an orthogonal function. If represented in a matrix, its
    inverse is its transpose.




    I'm having a hard time understanding why the orthogonality of Lambda affects the relation with regards to selection patterns (LC).



    Why does the orthogonality of Lambda make it so that the relationship is the same as for DC ? How would the selection pattern propagate through the linear layer if Lambda was not orthogonal ?






    cryptanalysis block-cipher linear-cryptanalysis differential-analysis







    share|improve this question











    $endgroup$















      4












      4








      4


      2



      $begingroup$


      In the Noekeon Cipher Specification they write the following :




      The propagation through Lambda is denoted by $(a rightarrow A)$, also called a
      step. Because of the linearity of Lambda it is fully deterministic:
      both for LC and DC patterns, we have: $A = operatorname{Lambda}(a)$. The fact that the
      relation is the same for LC and DC is thanks to the fact that the
      Lambda is an orthogonal function. If represented in a matrix, its
      inverse is its transpose.




      I'm having a hard time understanding why the orthogonality of Lambda affects the relation with regards to selection patterns (LC).



      Why does the orthogonality of Lambda make it so that the relationship is the same as for DC ? How would the selection pattern propagate through the linear layer if Lambda was not orthogonal ?






      cryptanalysis block-cipher linear-cryptanalysis differential-analysis







      share|improve this question











      $endgroup$




      In the Noekeon Cipher Specification they write the following :




      The propagation through Lambda is denoted by $(a rightarrow A)$, also called a
      step. Because of the linearity of Lambda it is fully deterministic:
      both for LC and DC patterns, we have: $A = operatorname{Lambda}(a)$. The fact that the
      relation is the same for LC and DC is thanks to the fact that the
      Lambda is an orthogonal function. If represented in a matrix, its
      inverse is its transpose.




      I'm having a hard time understanding why the orthogonality of Lambda affects the relation with regards to selection patterns (LC).



      Why does the orthogonality of Lambda make it so that the relationship is the same as for DC ? How would the selection pattern propagate through the linear layer if Lambda was not orthogonal ?






      cryptanalysis block-cipher linear-cryptanalysis differential-analysis




      cryptanalysis block-cipher linear-cryptanalysis differential-analysis






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited 7 hours ago







      Yuon

















      asked 7 hours ago









      YuonYuon

      737




      737






















          1 Answer
          1






          active

          oldest

          votes


















          2












          $begingroup$

          This is due to the duality between linear and differential trails.
          Let $L$ be an invertible linear map on $mathbb{F}_2^n$, think of it as a matrix for convenience.
          In general, a nonzero differential $Delta_1 to Delta_2$ over $L$ must satisfy



          $$Delta_2 = L,Delta_1.$$



          A nonzero linear approximation $u_1 to u_2$, however, must satisfy



          $$u_2 = L^{-top},u_1$$



          An elementary way to see this is to observe that $u_1^top x = u_2^top (Lx)$ is equivalent to $u_1^top x = (L^top,u_2)^top x$. This holds for all $x in mathbb{F}_2^n$ whenever $u_2 = L^{-top},u_1$, and otherwise for half (some hyperplane) the $x$.



          If $L$ is orthogonal, then $L^{-T} = L$. So then we have both $Delta_2 = LDelta_1$ and $u_2 = L u_1$.






          share|improve this answer









          $endgroup$













          • $begingroup$
            I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
            $endgroup$
            – Yuon
            2 hours ago













          Your Answer





          StackExchange.ifUsing("editor", function () {
          return StackExchange.using("mathjaxEditing", function () {
          StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
          StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
          });
          });
          }, "mathjax-editing");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "281"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          noCode: true, onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














          draft saved

          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68085%2fdifferential-and-linear-trail-propagation-in-noekeon%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          2












          $begingroup$

          This is due to the duality between linear and differential trails.
          Let $L$ be an invertible linear map on $mathbb{F}_2^n$, think of it as a matrix for convenience.
          In general, a nonzero differential $Delta_1 to Delta_2$ over $L$ must satisfy



          $$Delta_2 = L,Delta_1.$$



          A nonzero linear approximation $u_1 to u_2$, however, must satisfy



          $$u_2 = L^{-top},u_1$$



          An elementary way to see this is to observe that $u_1^top x = u_2^top (Lx)$ is equivalent to $u_1^top x = (L^top,u_2)^top x$. This holds for all $x in mathbb{F}_2^n$ whenever $u_2 = L^{-top},u_1$, and otherwise for half (some hyperplane) the $x$.



          If $L$ is orthogonal, then $L^{-T} = L$. So then we have both $Delta_2 = LDelta_1$ and $u_2 = L u_1$.






          share|improve this answer









          $endgroup$













          • $begingroup$
            I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
            $endgroup$
            – Yuon
            2 hours ago


















          2












          $begingroup$

          This is due to the duality between linear and differential trails.
          Let $L$ be an invertible linear map on $mathbb{F}_2^n$, think of it as a matrix for convenience.
          In general, a nonzero differential $Delta_1 to Delta_2$ over $L$ must satisfy



          $$Delta_2 = L,Delta_1.$$



          A nonzero linear approximation $u_1 to u_2$, however, must satisfy



          $$u_2 = L^{-top},u_1$$



          An elementary way to see this is to observe that $u_1^top x = u_2^top (Lx)$ is equivalent to $u_1^top x = (L^top,u_2)^top x$. This holds for all $x in mathbb{F}_2^n$ whenever $u_2 = L^{-top},u_1$, and otherwise for half (some hyperplane) the $x$.



          If $L$ is orthogonal, then $L^{-T} = L$. So then we have both $Delta_2 = LDelta_1$ and $u_2 = L u_1$.






          share|improve this answer









          $endgroup$













          • $begingroup$
            I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
            $endgroup$
            – Yuon
            2 hours ago
















          2












          2








          2





          $begingroup$

          This is due to the duality between linear and differential trails.
          Let $L$ be an invertible linear map on $mathbb{F}_2^n$, think of it as a matrix for convenience.
          In general, a nonzero differential $Delta_1 to Delta_2$ over $L$ must satisfy



          $$Delta_2 = L,Delta_1.$$



          A nonzero linear approximation $u_1 to u_2$, however, must satisfy



          $$u_2 = L^{-top},u_1$$



          An elementary way to see this is to observe that $u_1^top x = u_2^top (Lx)$ is equivalent to $u_1^top x = (L^top,u_2)^top x$. This holds for all $x in mathbb{F}_2^n$ whenever $u_2 = L^{-top},u_1$, and otherwise for half (some hyperplane) the $x$.



          If $L$ is orthogonal, then $L^{-T} = L$. So then we have both $Delta_2 = LDelta_1$ and $u_2 = L u_1$.






          share|improve this answer









          $endgroup$



          This is due to the duality between linear and differential trails.
          Let $L$ be an invertible linear map on $mathbb{F}_2^n$, think of it as a matrix for convenience.
          In general, a nonzero differential $Delta_1 to Delta_2$ over $L$ must satisfy



          $$Delta_2 = L,Delta_1.$$



          A nonzero linear approximation $u_1 to u_2$, however, must satisfy



          $$u_2 = L^{-top},u_1$$



          An elementary way to see this is to observe that $u_1^top x = u_2^top (Lx)$ is equivalent to $u_1^top x = (L^top,u_2)^top x$. This holds for all $x in mathbb{F}_2^n$ whenever $u_2 = L^{-top},u_1$, and otherwise for half (some hyperplane) the $x$.



          If $L$ is orthogonal, then $L^{-T} = L$. So then we have both $Delta_2 = LDelta_1$ and $u_2 = L u_1$.







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered 4 hours ago









          AlephAleph

          1,2961220




          1,2961220












          • $begingroup$
            I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
            $endgroup$
            – Yuon
            2 hours ago




















          • $begingroup$
            I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
            $endgroup$
            – Yuon
            2 hours ago


















          $begingroup$
          I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
          $endgroup$
          – Yuon
          2 hours ago






          $begingroup$
          I suspected it was because of something like that. Could you just give some intuition as to why we want $u^T_1 x = u^T_2(Lx)$ in first place ? If I had to come up with that, I'd think it's the other way around $u^T_2 x = u^T_1 (Lx)$ just like the differential case.
          $endgroup$
          – Yuon
          2 hours ago




















          draft saved

          draft discarded




















































          Thanks for contributing an answer to Cryptography Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid …



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          Use MathJax to format equations. MathJax reference.


          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68085%2fdifferential-and-linear-trail-propagation-in-noekeon%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          -

          Popular posts from this blog

          What other Star Trek series did the main TNG cast show up in?

          Image
          .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0; } 4 I'm referring to Picard, Riker, Data, Worf, Geordi, Dr. Crusher, Wesley Crusher, Chief O'Brien and family, Deanna Troi, Guinan. I know Picard and Worf show up on DS9, though I haven't seen it myself. I'm curious what happened to the characters after that last episode of TNG? star-trek star-trek-tng share | improve this question edited 10 hours ago Ham Sandwich 6,051 2 25 75 ...
          Read more

          Berlina muro

          Image
          La berlina muro ĉe Bethaniendamm, 1986 La berlina muro aŭ simple la muro [1] , nomita ankaŭ "kontraŭfaŝisma remparo" en propaganda lingvo de la iama Germana Demokratia Respubliko, estis parto de la interngermana limo, kiu dividis de la 13-a de aŭgusto 1961 ĝis la 9-a de novembro 1989 okcidentan Berlinon de la orienta parto de la urbo kaj de la ĉirkaŭa tereno de la GDR. Ĝi estis unu el la plej famaj simboloj de la malvarma milito kaj de la disdivido de Germanio. Pli ol simpla muro, la berlina muro estis fakte tuta defendokonstruaĵo kun du muroj, ena malplena strio, rondirvojo, gardturoj kaj alarmsistemoj. Dum la provo transiri la severe garditan limon al okcidenta Berlino multaj homoj estis mortigitaj. La preciza nombro de viktimoj estas pridisputita kaj ne certa; la nombroj anoncataj varias inter 86 kaj 238 mortintoj. La malplifortiĝo de Sovetunio kaj la politiko de liberigo gvidita de Miĥail Gorbaĉov ebligis al la orientgermanoj faligi la 9-an de novembro 1989 l...
          Read more

          Berlina aerponto

          Image
          Flugkoridoroj dum la blokado de Berlino La Berlina aerponto estas la provizigo de okcidenta Berlino per aviadiloj fare de la aliancanoj inter la 23-a de junio 1948 kaj la 12-a de majo 1949 dum la blokado de Berlino fare de la sovetia armeo. Enhavo 1 Historio 1.1 La aerkoridoroj 1.2 Unuaj flugoj 1.3 Plibonigo de la aerponto 1.4 Fino de la aerponto 1.5 Rozinbombiloj 1.6 Bilanco 2 Flughavenoj 2.1 Berlino 2.2 Okcidenta Germanio 3 Aviadiloj de la berlina aerponto 4 15-a datreveno de la aerponto 5 Bibliografio 6 Referencoj 7 Eksteraj ligiloj Historio | General Lucius D. Clay, militguberniestro de la usona okupadzono Jam antaŭ la berlina aerponto estiĝis la malgranda aerponto . La estro de la sovetia militadministracio en Germanio, Vasili Daniloviĉ Sokolovski, ordonis la 1-an de aprilo 1948, kiel reago al la konferenco de Londono inter britoj, francoj kaj reprezentantoj de Benelukso pri aligo de Germa...
          Read more