Unveiling the Neutral Difference and Its Automated Search

Table 4

The subspace for 2-round differential of SPECK32, which is spanned by the first 26 neutral differences with non-zero neutral probabilities.

No.	Neutral diff.						No.	Neutral diff.
				EST	EXP						EST	EXP
1				1.00^2	1.00^3	1.00^4	17			256	0.68	0.75	1.00
2			45	1.00^5	1.00	1.00	18			69	0.75	0.75	1.00
3			8	1.00	1.00	1.00	19			256	0.62	0.75	1.00
4			4	1.00	1.00	1.00	20			3	0.38	0.37	1.00
5			111	1.00	1.00	1.00	21			7	0.75	0.75	1.00
6			53	1.00	1.00	1.00	22			256	0.45	0.50	1.00
7			42	1.00	1.00	1.00	23			24	0.50	0.50	1.00
8			30	1.00	1.00	1.00	24			1	0.50	0.51	0.00
9			45	1.00	1.00	1.00	25			2	0.50	0.50	0.00
10			256	0.99	1.00	1.00	26			9	0.50	0.50	0.00
11			114	1.00	1.00	1.00	27				No	No	No
12			61	1.00	1.00	1.00	28				No	No	No
13			135	0.88	0.87	1.00	29				No	No	No
14			256	0.79	0.87	1.00	30				No	No	No
15			70	0.75	0.75	1.00	31				No	No	No
16			26	0.75	0.75	1.00	32				No	No	No^6

represents the theoretical estimation of the neutral probability obtained from a single EBCT trial.  = neutral probability. EST is a theoretical estimation of the neutral probability using EBCT trails. The search program is set to find 256 single trails, while indicates that there are only EBCT trails found. EXP represents the empirical results of the neutral probabilities for these neutral differences. The neutral probability is verified using plaintext pairs that satisfy the expected differential characteristic. represents the empirical results of the neutral probabilities for these neutral differences under the conditions specified in Table 5. These conditions are common for all 32 neutral differences. The input difference is definitely a neutral difference with a probability of 1, but it is generally of no value for further cryptanalysis. Consequently, the input difference should be excluded out of the neutral space used for subsequent cryptanalysis. No represents the neutral probability is 0. These 32 differences form a basis for the vector space .