Solving Systems of Differential Equations of Addition

(Extended Abstract)
  • Souradyuti Paul
  • Bart Preneel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3574)


Mixing addition modulo 2 n (+) and exclusive-or (⊕) have a host of applications in symmetric cryptography as the operations are fast and nonlinear over GF(2). We deal with a frequently encountered equation (x+y)⊕((xα)+(yβ))=γ. The difficulty of solving an arbitrary system of such equations – named differential equations of addition (DEA) – is an important consideration in the evaluation of the security of many ciphers against differential attacks. This paper shows that the satisfiability of an arbitrary set of DEA – which has so far been assumed hard for large n – is in the complexity class P. We also design an efficient algorithm to obtain all solutions to an arbitrary system of DEA with running time linear in the number of solutions.

Our second contribution is solving DEA in an adaptive query model where an equation is formed by a query (α,β) and oracle output γ. The challenge is to optimize the number of queries to solve (x+y)⊕((xα)+(yβ))=γ. Our algorithm solves this equation with only 3 queries in the worst case. Another algorithm solves the equation (x+y)⊕(x+(yβ))=γ with (nt–1) queries in the worst case (t is the position of the least significant ‘1’ of x), and thus, outperforms the previous best known algorithm by Muller – presented at FSE ’04 – which required 3(n–1) queries. Most importantly, we show that the upper bounds, for our algorithms, on the number of queries match worst case lower bounds. This, essentially, closes further research in this direction as our lower bounds are optimal. Finally we describe applications of our results in differential cryptanalysis.


Block Cipher Stream Cipher Arbitrary System Addition Modulo Random Access Machine 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Aho, A., Hopcroft, J., Ullman, J.: The Design and Analysis of Computer Algorithms. Addison-Wesley, Reading (1974)zbMATHGoogle Scholar
  2. 2.
    Ajwa, I.A., Liu, Z., Wang, P.S.: Gröbner Bases Algorithm. ICM Technical Report (February 1995), Available Online at
  3. 3.
    Berson, T.A.: Differential Cryptanalysis Mod 232 with Applications to MD5. In: Rueppel, R.A. (ed.) EUROCRYPT 1992. LNCS, vol. 658, pp. 71–80. Springer, Heidelberg (1993)CrossRefGoogle Scholar
  4. 4.
    Burwick, C., Coppersmith, D., D’Avignon, E., Gennaro, Y., Halevi, S., Jutla, C., Matyas Jr., S.M., O’Connor, L., Peyravian, M., Safford, D., Zunic, N.: MARS – A Candidate Cipher for AES (June 1998), Available Online at
  5. 5.
    Biham, E., Shamir, A.: Differential Cryptanalysis of DES-like Cryptosystems. In: Menezes, A., Vanstone, S.A. (eds.) CRYPTO 1990. LNCS, vol. 537, pp. 2–21. Springer, Heidelberg (1991)Google Scholar
  6. 6.
    Cormen, T.H., Leiserson, C.E., Rivest, R.L.: Introduction to Algorithms. MIT Press, CambridgeGoogle Scholar
  7. 7.
    Faugère, J.: A new effecient algorithm for computing Gröbner bases (F4). Journal of Pure and Applied Algebra 139, 61–88 (1999), Available Online at zbMATHCrossRefMathSciNetGoogle Scholar
  8. 8.
    Floyd, R., Beigel, R.: The Language of Machines. W.H. Freeman, New York (1994)Google Scholar
  9. 9.
    Ferguson, N., Whiting, D., Schneier, B., Kelsey, J., Lucks, S., Kohno, T.: Helix: Fast Encryption and Authentication in a Single Cryptographic Primitive. In: Johansson, T. (ed.) FSE 2003. LNCS, vol. 2887, pp. 330–346. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  10. 10.
    Hopcroft, J.E., Motwani, R., Ullman, J.D.: Introduction to Automata Theory, Languages and Computation, 2nd edn. Pearson Education, London (2004)Google Scholar
  11. 11.
    Klimov, A., Shamir, A.: Cryptographic Applications of T-Functions. In: Matsui, M., Zuccherato, R.J. (eds.) SAC 2003. LNCS, vol. 3006, pp. 248–261. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  12. 12.
    Klimov, A., Shamir, A.: New Cryptographic Primitives Based on Multiword TFunctions. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017, pp. 1–15. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  13. 13.
    Kipnis, A., Shamir, A.: Cryptanalysis of the HFE Public Key Cryptosystems by Relinearization. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 19–30. Springer, Heidelberg (1999)Google Scholar
  14. 14.
    Lai, X., Massey, J.L., Murphy, S.: Markov Ciphers and Differential Cryptanalysis. In: Davies, D.W. (ed.) EUROCRYPT 1991. LNCS, vol. 547, pp. 17–38. Springer, Heidelberg (1991)Google Scholar
  15. 15.
    Lipmaa, H., Moriai, S.: Efficient Algorithms for Computing Differential Properties of Addition. In: Matsui, M. (ed.) FSE 2001. LNCS, vol. 2355, pp. 336–350. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  16. 16.
    Lipmaa, L., Wallén, J., Dumas, P.: On the Additive Differential Probability of Exclusive-Or. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017, pp. 317–331. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  17. 17.
    Muller, F.: Differential Attacks against the Helix Stream Cipher. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017, pp. 94–108. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  18. 18.
    Nyberg, K., Knudsen, L.: Provable Security Against a Differential Attack. Journal of Cryptology 8(1), 27–37 (1991)MathSciNetGoogle Scholar
  19. 19.
    Paul, S., Preneel, B.: Solving Systems of Differential Equations of Addition. Cryptology ePrint Archive, Report 2004/294 (2004), Available Online at
  20. 20.
    Rivest, R.L., Robshaw, M., Sidney, R., Yin, Y.L.: The RC6 Block Cipher (June 1998), Available Online at
  21. 21.
    Schneier, B., Kelsey, J., Whiting, D., Wagner, D., Hall, C., Ferguson, N.: The Twofish Encryption Algorithm: A 128-Bit Block Cipher, April 1999. John Wiley & Sons, Chichester (1999) ISBN: 0471353817Google Scholar
  22. 22.
    Staffelbach, O., Meier, W.: Cryptographic Significance of the Carry for Ciphers Based on Integer Addition. In: Menezes, A., Vanstone, S.A. (eds.) CRYPTO 1990. LNCS, vol. 537, pp. 601–614. Springer, Heidelberg (1991)Google Scholar
  23. 23.
    Yoshida, H., Biryukov, A., De Cannière, C., Lano, J., Preneel, B.: Nonrandomness of the Full 4 and 5-Pass HAVAL. In: Blundo, C., Cimato, S. (eds.) SCN 2004. LNCS, vol. 3352, pp. 324–336. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  24. 24.
    Wallén, J.: Linear Approximations of Addition Modulo 2n. In: Johansson, T. (ed.) FSE 2003. LNCS, vol. 2887, pp. 261–273. Springer, Heidelberg (2003)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Souradyuti Paul
    • 1
  • Bart Preneel
    • 1
  1. 1.Dept. ESAT/COSICKatholieke Universiteit LeuvenLeuven-HeverleeBelgium

Personalised recommendations