Differential Trace
Start here. Two plaintexts P₁ and P₂ flow through every sub-stage of the cipher. The colored dots on each row are the XOR difference at that point. Watch the difference not change on XOR-K rows, get scrambled by S-box rows, and relocate on permute rows. Once you have seen a difference survive the key and mutate at the S-box, the Live Attack tab lets you exploit exactly that fact.
Stage 0 of 11.
Live Differential Attack
A real chosen-plaintext differential attack on the 4-round toy SPN cipher: we exploit a high-probability differential to recover the last round subkey.
Cipher setup
Active S-box: Weak (toy) change →
Master key K: 0x5A69
Last round subkey K₄ (hidden from attacker):
Reproducibility
Same seed → identical pair stream → reproducible bias chart.
Step 1: Choose Plaintext Difference
Step 1½: Target Differential
We attack the last round by guessing K₄, partially decrypting, and counting how many pairs hit the difference we expect just before the last S-box. A 3-round characteristic is simply the difference that reliably survives the first three rounds — the peak of the propagation you watched in the Trace tab.
This value is auto-derived on load by sampling the cipher. Hover the field to see where it comes from, or click re-derive to re-sample.
Step 2: Collect Ciphertext Pairs
0 pairs collected. Need ~500 for reliable recovery.
Step 3: Run Attack
Ready to analyze pairs.
Differential vs. Brute Force
The toy cipher is small enough that brute force is competitive. The win scales: on real ciphers a differential characteristic can save you tens of bits of search.
| Cipher | Brute force (key search) | Differential cost | Reference |
|---|---|---|---|
| Toy SPN (16-bit key, this demo) | 2¹⁶ ≈ 65 536 | — | K₄ alone is 8 bits |
| DES (56-bit) | 2⁵⁶ ≈ 7.2 × 10¹⁶ | 2⁴⁷ ≈ 1.4 × 10¹⁴ | Biham & Shamir 1991 |
| AES-128 | 2¹²⁸ | no usable characteristic | Daemen & Rijmen 2002 |
Operations performed by the most recent attack: 0
FEAL-4 · A published cipher
The toy SPN introduced chosen plaintexts and the last-round peel. FEAL-4 applies the same idea to a published 1987 cipher: a 64-bit Feistel block cipher whose round function uses addition modulo 256 and a two-bit rotation. Here a probability-1 difference filters key guesses instead of ranking a statistical bias.
1 · Encrypt a block
2 · Follow the difference
Pair Δ = 8080000080800000. Each row shows the XOR difference of the two round states.
- Chosen pair
— - After input XOR
— - After round 1
— - Round 2 f output
—
| Round | Δ left | Δ right | Δ f output |
|---|
3 · Peel four rounds
Collect two structured sets from an encryption oracle, then filter exact round-function differences in a Web Worker. Set A peels rounds 4 and 3; set B peels round 2; all observations constrain round 1.
Below 6 A + 4 B pairs, the search may take much longer or fail.
Collect chosen plaintexts to begin.
Inspect oracle queries
These plaintext and ciphertext pairs are the attack’s entire input. The Worker receives the observations; the 64-bit master key stays on this page.
| Set | P | P′ | C | C′ |
|---|
Each round starts with 2³² possible effective f-key values. The counts below are surviving partial key combinations; branching may increase a later count before the final consistency check.
4 · Test on fresh ciphertexts
The fresh blocks are generated after recovery and never used to filter candidates.
Equivalent key, not the 64-bit master key
The recovered round-key material and two whitening combinations decrypt blocks. The attack treats the round subkeys as independent and never uses the key schedule. Murphy (1990) goes further and recovers the master key.
One block the attack never saw
- Fresh plaintext
- Oracle ciphertext
- Decrypted with equivalent key
Cipher specification and cross-check: CrypTool 2 FEAL implementation. This is a classroom round-peeling variant, not a reproduction of Murphy’s exact procedure.
S-box Analysis
The S-box is the only non-linear component of the cipher. Its differential properties determine whether the cipher falls to a differential attack — swap it below to feel the difference.
Swapping resets the cipher, clears collected pairs, and recomputes the DDT.
S-box Substitution
Input (outer number) → Output (colored square)
Difference Distribution Table (DDT)
Rows: Input Difference • Columns: Output Difference • Counts out of 16 input pairs
S-box Strength Assessment
Historical Impact: Differential Cryptanalysis
Differential cryptanalysis was the cryptanalytic breakthrough of the late 20th century.
Eli Biham
Affiliation: Technion — Israel Institute of Technology
Co-inventor of differential cryptanalysis. Later designed Serpent cipher to resist his own technique.
Adi Shamir
Affiliation: Weizmann Institute of Science, Israel
Co-inventor of differential cryptanalysis. Legendary cryptographer and co-founder of RSA cryptosystem.
Timeline of Discovery
Original Paper:
Eli Biham and Adi Shamir. "Differential Cryptanalysis of DES-like Cryptosystems." Journal of Cryptology, vol. 4, no. 1, pp. 3–72, 1991.
Why Serpent Survived: Defense Against Differential Cryptanalysis
Eli Biham designed Serpent specifically to be immune to differential cryptanalysis and other attacks he had discovered.
Cipher Defense Comparison
| Property | DES (1977) | AES (2001) | Serpent (1998) |
|---|---|---|---|
| S-box Max DDT | 8 | 4 | 4 |
| Rounds | 16 | 10/12/14 | 32 |
| Differential Reach | 8 rounds | Beyond attack | Beyond attack |
| Design Philosophy | Proven secure (classified) | Resistant to known attacks | Hardened by attack inventor |
Portfolio Thread: A Cipher's Journey
This demo is part of a series exploring cipher design and cryptanalysis:
- biham-lens (you are here) — Attack-side: differential cryptanalysis
- iron-serpent — Defense-side: Serpent cipher designed to defeat differential attacks
- dead-sea-cipher — Historical failures: why ciphers break
- shamir-gate — The mind of Adi Shamir: RSA, differential cryptanalysis, secret sharing
Research context: reduced-round ChaCha
EUROCRYPT 2025: Improved Cryptanalysis of ChaCha — Beating PNBs with Bit Puncturing studies differential-linear attacks on 6, 7 and 7.5 rounds. Its reported costs are paper estimates, not browser measurements. This does not break the full 20-round ChaCha20 construction.
The ChaCha20 Stream encryption path remains 20 rounds (80 quarter-round operations per block), with RFC 8439 controls. Matsui Line and Biham Lens teach linear and differential attacks at their own toy/published-cipher scales; they do not execute this ChaCha attack. Reviewed 12 October 2026.