On the Distribution of Characteristics in Composite Permutations

Diierential cryptanalysis is a method of attacking iterated mappings which has been applied with varying success to a number of product ciphers and hash functions 1, 2]. Let : Z c 2 Z m 2 ! Z m 2 be a mapping that consists of c `control' bits and m `data' bits. The mapping mapping contains 2 c m-bit permutations i : Z m 2 ! Z m 2 ; 0 i 2 c ? 1, one of which is selected (multiplexed) by the control bits, and a substitution is then performed on the data bits using the selected permutation. Such mappings will be called composite permutations. The S-boxes of DES are composite permutations of the form Si : Z 2 2 Z 4 2 ! Z 4 2 with 2 control bits and 4 data bits. In diierential cryptanalysis the attacker is interested in the largest entry in a given XOR table, and the fraction of the XOR table that is zero. In this paper we determine the distribution of characteristics in the XOR tables of composite permutations, which leads to approximations for the largest entry in the XOR table and the density of zero entries.