determining differential characteristics

I am currently going through the Schneier self-study course, and have
managed now to break several of the recommended early breaks.
However, I am learning enough to know that there are some big holes in
my basic technique that I should be patching. The biggest of these is
in characteristic determination.

To be sure, one can make some intelligent guesses as to some emergent
characteristics just after reading the algorithm description (ie, the
1-round characteristic with p=1 in DES pops right out at you), but for
the more complicated ones, I'm confident that there is a method better
than a kind of linear cryptanalysis -- examining the relationship
between every possible plaintext under every possible key (in fact, if
you do this once you will never need it, even if it completed, due to
just being able to look up the plaintext/ciphertext combination).

I have been reading some of the papers on differential cryptanalysis,
including Biham and Shamir, but they tend to present cryptanalysis
with the characteristic more as a given and then discuss determining
right pairs to meet said characteristic, which is only helpful if you
are trying to extend or reproduce their attacks, not create new ones.

Any hints out there on how to get started in finding and choosing good
differential characteristics? Obviously, every algorithm is
different, but are there key things to look for in an algorithm
description, or something of that nature?

.

Relevant Pages

  • Re: quantum computing
    ... very fast (Shor's algorithm is one type of search). ... grover unstructured search algorithm is only a square root speedup, ... Nothing works against OTP since any message is a potentially valid mesage. ... once the entire plaintext is know it is possible to recover the key ...
    (sci.crypt)
  • Re: Pseudorandom keystream ciphers
    ... be warned that most responses will tear your algorithm to pieces. ... This is obviously a One Time Pad. ... This must be the correct OTP because it gives a readable plaintext: ... component of the chain destroys the communication chain. ...
    (sci.crypt)
  • Re: Customised Extra Entanglement in Vector Cryptography.
    ... Adacrypt has ... you have to publish the _exact_ algorithm that you are going to use to ... stop with the "known plaintext attacks are too hard" nonsense. ... ramblings about vector cryptography on sci.crypt. ...
    (sci.crypt)
  • Re: Can you decrypt this?
    ... in order for effective cryptanalysis the attacker must first ... cryptanalysis is how easy is it to go from the ciphertext to the plaintext ... ciphertext can remain unbroken if one of two things apply. ... see the above paragraph on enigma and the japanese purple code. ...
    (sci.crypt)
  • Re: Encryption key longer than text to encrypt
    ... under the Uniticy distance assumption and the assumption that plaintext ... There must be some algorithm which determines how the message is scattered ... would be dynamic based on the state of the rotors. ... It depends what you consider a 'maximal effect' to be. ...
    (sci.crypt)