**Two-Round AES Differentials**

*Joan Daemen and Vincent Rijmen*

**Abstract: **In this paper we study the probability of differentials and
characteristics over 2 rounds of the AES with the objective to
understand how the components of the AES round transformation
interact.
We extend and correct the analysis of the differential properties
of the multiplicative inverse in GF($2^n$). We show that AES has characteristics with a
fixed-key probability that is many times larger than the EDP. For
instance, in the case of 2-round AES, we measured factors up to
$2^{100}$.
We study the number of characteristics with EDP $>0$ whose
probability adds up to the probability of a differential and
derive formulas that allow to produce a close estimate of this
number for any differential. We show how the properties discovered
in our study can be used to explain the values of the
differentials with the largest EDP values and to construct new
distinguishers using truncated differentials.

**Category / Keywords: **secret-key cryptography / AES, cryptanalysis

**Publication Info: **J. Daemen, V. Rijmen, ``Understanding two-round differentials in AES,'' in R. De Prisco, M. Yung (Eds.), SCN 2006, LNCS 4116, pp. 78-94, 2006; J. Daemen, V. Rijmen, ``Plateau characteristics and AES,'' IET Information Security, Volume 1, No. 1, March 2007, pp. 11--17.

**Date: **received 3 Feb 2006, last revised 6 Feb 2009

**Contact author: **vincent rijmen at iaik tugraz at

**Available format(s): **PDF | BibTeX Citation

**Note: **Corrected a typo. Thanks to Ralph Wernsdorf.

**Version: **20090206:085259 (All versions of this report)

**Short URL: **ia.cr/2006/039

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]