This work is motivated by the observation that in DES-like ciphexs it is possible to choose the round functions in such a way that every non-trivial one-round characteristic has small probability. This gives rise to the following definition. A mapping is called differentially uniform if for every non-mro input difference and any output difference the number of possible inputs has a uniform upper bound. The examples of differentially uniform mappings provided in this paper have also other desirable cryptographic properties: large distance from ailbe functions, high nonlinear order and efficient computability.

Abstract. A perfect nonlinear

The results of this paper give the theoretical fundaments on which Matsui's linear cryptanalysis of the DES is based. As a result we obtain precise information on the assumptions expficitely or impficitely stated in [2] and show that the success of Algorithm 2 is underestimated in [2]. We also derive a formula for the strength of Algorithm 2 for DES-fike ciphers and see what is its dependence on the plaintext distribution. Finally, it is shown how to achieve proven resistance against linear cryptanalysis. Linear Cryptanalysis of a DES-like CipherWe consider a DES-like iterated cipher consisting of r rounds of iterationat the rounds i = 1,2,...,r-1, and eL = XL(r) -]-f(E(XR(r)) + Kr) cR = xR(r) Here we have denoted by Ki the round key used at the ith round and by X(i) ----(XL(i), XR(i)) the input to the ith round with its left and right halves. Hence X(1) = P = (PL, PR) is the plaintext and C = (CL, CR) is the ciphertext.In [2] M. Matsui introduces the linear cryptanalysis method to recover with high probability certain key bits using sufficient large number of known plaintextciphertext pairs. The main part of this attack is a procedure called Algorithm 2 which can be used to recover 12 bits of a DES-key. Let us give a short description of this procedure. First the round function is analyzed to find linear approximations of the function f of the form b(i). f(Z) = ci " Z

No abstract