Unveiling the Neutral Difference and Its Automated Search

Algorithm 1

Pseudocode for the Key Recovery of Differential-Linear Attack.

Input: neutral differences and corresponding subspace , number of replications , plaintext structures for , threshold .

Output: List of key candidates, denoted by .

1

2 fordo

3   Choose the th plaintext structure

    / Denote the ciphertext pairs, encrypted from , by /

4   foreach possible do

5    

6    fordo

      // A filtering process that enhances advantages.

      / represents one round decryption with . represents the output mask, and is the       number of ciphertext pairs to calculate this correlation. /

7     if is useful for current then

8      end

8     else

10      Continue

    // Without losing generality, let the correlation of the bottom DL distinguisher be less     than 0 and .

11   ifthen

12    Store the key candidate to .