Truncated and higher-order differential cryptanalysis

turned out to be much less difficult than I feared. Truncated just means you consider sets of differentials of the form a -> b, where a is fixed but b can be any member of a set S; subkeys that suggest any b in S get their counters incremented. Higher-order just means you consider differences in differences; some functions have no good differential characteristics but excellent higher-order differential characteristics.

And it was the fact that I still didn't understand these two after all these years that was a big part of me getting depressed on the train back from Leuven!

Right, now to see if I can find a copy of the paper on differential-linear cryptanalysis. I think it's just a kind of truncated differential cryptanalysis where S is the set of texts that meet some affine constraint.

Hey, if duranorak can post incomprehensible things I don't see why I shouldn't :-)