 Welcome to this video abstract about the paper Differential Cryptanalysis in the Fikski model, which I'll be presenting at crypto on Wednesday. To this paper is about Differential Cryptanalysis. What we're going to be doing here is we have a function f and we're going to take an input x and we're going to add a difference a to it and then we're going to see if the output pair that we get has a certain difference b. And ideally we would like to find a pair of differences a and b, also known as a differential, so that there are many solutions x to this different equation and the number of solutions divided by 2 to the n is what we call the probability of the differential. So the basic problem here is how do we compute this probability and this is a difficult problem because our function f is something complicated like a block cipher. So one technique that we can use for this is known as differential characteristics and it assumes that this function f can be written as a composition of a number of easier to understand functions. And what we're going to do is we're going to specify intermediate differences, so a sequence of such intermediate differences is what we call a differential characteristic and then the probability of your differential is the sum over the probabilities of all these differential characteristics. That somewhat simplifies things but it doesn't actually tell us how to compute the probability of those characteristics. For that we typically use a heuristic which says that the propagation through f1, f2 and so on can be treated as independent. Now this doesn't actually make sense but you can make it make some sense by saying that if we add uniform random round keys after each of those functions then the average probability of the characteristic can be expressed in this way, in an exact way. That's nice but it's not really what we want because in order to be able to actually compute data complexities and success probabilities accurately we would need to know the fixed key probability or at least more than the average. So what people have been doing is they've been assuming that the fixed key probabilities are usually close to the average probabilities. So let's take a look if that actually makes sense. So here's an example of a six round differential in spec 32. So the red line here is the computed average, so the expected number of right pairs, or same thing as the probability. And then what we would expect is that most of the keys would have a probability that is close to this red line but as you can see that's not really the case. So the probability for most keys is not close to the average and there's a lot of things going on here, you can see different peaks, but the main takeaway here is that if you would use the average to compute things like the data complexity here that would give us incorrect results. So the goal of this paper was essentially to explain figures like this one. And in order to do that we introduced what we call quasi differential trails. So we do that by first introducing an extension of the difference distribution table known as the quasi differential transition matrix and if you know linear cryptanalysis this can be thought of as sort of analogous to correlation matrices that you have there. The main property of this matrix is that if you have a composition of functions then you can just multiply the difference, the quasi differential transition matrices in order to obtain the quasi differential transition matrix of your composite function. And if you express that in terms of the coordinates of these matrices you get some sum over a certain amount of products. And the terms in this sum are going to correspond to what we call quasi differential trails and the things we're summing are going to be the correlations of those trails. And using this we can actually often get a pretty good model for how the probability behaves under a fixed key. So for example going back to the example that I showed before, so this six-round differential for spec. So there you find that there are actually five quasi differential trails which have an absolute correlation that's significantly larger than most of the other quasi differential trails. So using those five provides a pretty good model and as you can see on the figures so the red lines are the values that this model predicts for the probabilities. This is a pretty good match and you can increase the accuracy of this by including more quasi differential trails. So this is all I will say for the abstract. In the full version of this presentation I'll talk more about how we construct those quasi differential transition matrices and what their properties are and then I'll show how we go from there to quasi differential trails. And I'll also talk about some of the applications that we have in the paper. Thank you for your attention.