An Average Case Analysis of a Diierential Attack on a Class of Sp-networks

We propose a diierential attack on tree-structured substitution-permutation networks. The number of chosen plaintexts required for the diierential attack to succeed is called the complexity. Our main result is to show that the expected complexity of the attack is linear in the size of the network. This is the rst rigorous result concerning the complexity of a diierential attack for a general class of product ciphers.