Unveiling the Neutral Difference and Its Automated Search

Table 8

DL distinguishers combined with the neutral difference technique, denoted by DL (ND).

Cipher		Weak keys	Input diff.	Intermediate diff.	Output mask						Ref.
SPECK32	1 + 9	Full				^, 2		28^3	21/1.0^3	^, 4	[9]
	1 + 10							25	25/		[9]
	2 + 9							25	21/1.0		This work
	2 + 9							28	21/1.0		This work
LEA	4 + 12	Full		0x8000_0000	[0,9,61,91,105]			34	21/		[6]
	4 + 13				[0,29,37,38,61,68,88,; 91,101,102,105,114]			61	53/		This work

indicates a DL (ND) that combines an -round differential and a -round DL trail, where the -round differential starts from input diff. and ends at intermediate diff.  = theoretical probability of the prepended short-round differential. is the experimental correlation of the bottom DL trail. The number of (conditional) neutral differences for the above -round differential presented in the original paper is denoted by . denotes the current DL distinguisher utilizing (conditional) neutral differences simultaneously, where the product of the probabilities of these neutral differences is . To evaluate the DL (ND) using the same criteria, we set as the smallest integer such that . Denote the overall correlation of the differential-linear trails by . Here, we regard the (equivalent) correlations of DL (ND) as , since the data complexity required is . represents the input difference listed in Table 9.