number of active s-boxes in a block cipher?

Question

How can we find the minimum number of differentially active s-boxes in a block cipher (actually a Feistel network with several input cells) in a truncated characteristic form? In a recursive algorithm when we get to the situation that there are binary cases, I don't know what to do? For example when I get a xor of two nonzero characteristics, there are two cases nonzero and zero, How can recursive algorithm be applied in this state?

Answer 1

There many methods to find the number of active sboxes such as:

1. search algorithm , you input different scenarios , it is time-expensive process.

2. Matsui algorithm. code

3. Mixed integer linear programming.

   I recommend you to try MIxed integer linear programming

References:

Differential and Linear Cryptanalysis using Mixed-Integer Linear Programming

Automatic Security Evaluation of Block Ciphers with S-bP Structures against Related-key Differential Attacks

New Impossible Differential Search Tool from Design and Cryptanalysis Aspects