Chair for Embedded Security – Prof. Dr.-Ing. Christof Paar

Differential cryptanalysis is about finding trails which involve a low amount of active S-box operations. Such patterns simplify the difference propagation and thus the computations of the secret round keys. The weight of a trail expresses the total number of non-zero S-box input differences within the cipher for a certain execution and is highly dependent on the specified permutation layers. This work copes with analyzing possible permutations in AES-like structures in order to guarantee high-weight trails. The main focus lies on cubed state dimensions. After providing a formalization on the concept of guaranteed trail weights, some characteristcs of equivalent permutation layers due to this definition are shown. One of the advantages is that the definition of guaranteed active S-boxes is made independently of the concrete mixings and the used S-box function. In the experimental part of this thesis, lots of possibilities are tested, using a mixed-integer linear programming approach. A certain focus lies on cyclic rotations within the rows, a generalization of the AES ShiftRows permutation, since they are rather easy to implement. As one result it turns out that an eight-round trail weight o