From Differential Cryptanalysis to Ciphertext-Only Attacks

. We present a method for efficient conversion of differential (chosen plaintext) attacks into the more practical known plaintext and ciphertext-only attacks. Our observation may save up to a factor of 2 20 in data over the known methods, assuming that plaintext is ASCII encoded English (or some other types of highly redundant data). We demonstrate the effectiveness of our method by practical attacks on the block-cipher Madryga and on round-reduced versions of RC5 and DES. Keywords: block-ciphers, Madryga, RC5, DES, ciphertext-only attack, differential cryptanalysis, differential-linear attack. 1 Introduction Differential cryptanalysis [1, 12] is a very powerful technique for the analysis of block-ciphers. It has been used with success against many block-ciphers, e.g. [1, 2, 3, 18, 4]. One weakness of differential cryptanalysis is that it finds chosen plaintext attacks; these are much less practical than known-plaintext and certainly than ciphertext-only attacks. Ciphertext-only a..