Explanation of unexpected fixed-key behaviours in light-weight block ciphers

Differential cryptanalysis, developed in the 1990s, generally relies on the stochastic equivalence hypothesis: the behavior of a cipher for a fixed key is assumed to be close to its average behavior over all keys.

However, this assumption is generally false. For instance, all differential characteristics over 2 rounds of AES are plateau, which implies a strong dependence of their probability on the key. While such deviations were initially expected only for a small number of rounds, recent counterexamples (notably Midori64 and Scream) have shown that the phenomenon can persist well beyond that.

In this talk, we will show that the gap between average behavior and fixed-key behavior can be even more pronounced at the level of differentials than at the level of characteristics. In particular, we will explain how the aggregation of a large number of plateau characteristics leads to the fixed-key differential behaviors observed in Midori64 and Scream.