Whats the probability a random cipher has a high probability differential?

Question

This is a bit vauge and long winded. Any partial answers or comments/ways to make this more precise would be greatly appreciated.

Fix some general structure for a cipher, for example Sbox then Permutation then add round key iterated n times.

Consider all ciphers obtained by this method where we choose the S-box and permutation randomly from some set. For each such cipher form a tuple consisting of the probabilities of each (n-1)-round differential. Due to compounding randomness going on here, these tuples should have some limiting distribution.

If we can calculate this distribution, we can estimate How likley it is a random cipher of this structure can be broken via differentials.

My two questions:

Should such a limiting distribution exists?
What conditions on the cipher structure make this distribution uniform?

The random SBOX is tested for DES ( couldn't find the article yet). S-Box Modifications and Their Effect in DES-like Encryption Systems and here a related question S-box design criteria and random sboxes — kelalaka, May 24 '20 at 20:21
Great, thank you. I suppose a way forward for my question would be to look through all this research to find the bad properties of sboxes, then count all the random functions which satisfy these bad properties. — , May 24 '20 at 20:40
There is a great SBox package in SageMath S-Boxes and Their Algebraic Representations that might be helpful in your cause. — kelalaka, May 24 '20 at 20:44
@zz7948 You told that you want to calculate the distribution with some fixed cipher structure and a random sbox. I guess by random sbox you mean before starting any encryption you generate one sbox randomly. Now, to calculate the (n-1) round differential you need one DDT. There will be a potential set of DDT for the corresponding sbox set. As the sbox is random so is the DDT. Now, I am just curious if the brute force(or if there is any better way to get DDT) complexity of the getting the proper DDT from the potential set is considered while analyzing the difficulty of this attack. — Radium, Nov 25 '20 at 03:41

Whats the probability a random cipher has a high probability differential?

0 Answers0