What an Attack Result Actually Shows

Keep five quantities separate

A useful attack card identifies the target configuration, attacker access, data requirement, computational work and success criterion. A measured throughput is not an observed full-key recovery, and a theoretical keyspace is not necessarily the effective keyspace of a deployment.

GPU search: which keyspace?

The 2025 ToSC paper “GPU Assisted Brute Force Cryptanalysis of GPRS, GSM, RFID, and TETRA” compares optimized implementations and time–memory trade-offs. Its KASUMI-64 setting uses a repeated 64-bit key in a 128-bit-key primitive. That deployment is not equivalent to searching all independent 128-bit KASUMI keys.

The paper’s TETRA target here is TEA3, not TEA1. Its extrapolated SPECK-96 and TEA3 exhaustive-search costs remain enormous. Reporting fast GPU throughput as a practical break of every listed cipher would erase the paper’s distinctions.

Separate measured RTX 4090 throughput from extrapolated total search time, preprocessing, memory, and probability of success. Hardware and cost assumptions are dated measurements, not current cloud-price quotes.

Primary journal paper (2025) · Institutional full text, PDF pp. 1–3 and 12–15. Compare DES’s finite keyspace and SoDark’s related-tweak attacks.

Power observation: a model of the implementation

A passive power attack observes executions; active fault injection tries to alter them. In correlation power analysis, an analyst selects a key-dependent intermediate, predicts it under small subkey hypotheses, models its leakage, and compares those predictions with associated power traces.

This needs repeated executions under the relevant key, known associated inputs that vary, aligned traces or a way to align them, an appropriate leakage model, and sufficient signal relative to noise. Hamming weight HW counts one-bits in a value. Hamming distance models a transition: HD(a,b) = HW(a XOR b). Neither model is an exact law for every device’s consumption.

A high correlation or candidate rank is evidence to test, not recovery confirmed against a known answer. Noise, mismatched models and acquisition conditions affect the result; there is no universal trace count or recovery time. A physical implementation can leak without a mathematical break of AES.

Power Trace computes CPA/DPA statistics over simulated leakage; those results are not measured-device evidence. For the effect of combining masked observations, see the Museum’s exact masking example and Masked Core.

Stefan Mangard, Elisabeth Oswald and Thomas Popp, Power Analysis Attacks: Revealing the Secrets of Smart Cards (2007), introduction, pp. 1–13; §3.3, pp. 38–42; §§6.1–6.2, pp. 119–124. These implementation conditions differ from the induced-fault model below.

GPRS faults: physical access changes the model

“Practical Differential Fault Attacks on the GPRS Standard Ciphers” studies GEA-1 and GEA-2 under a random fault model. The authors’ abstract reports validation by simulating the attacks on ChipWhisperer Lite, with the experimental attacks completing within sixteen minutes on a common laptop.

This is evidence about the tested implementation and fault model. It is not a demonstration of passive traffic interception or a universal attack on arbitrary commercial phones. The abstract does not establish that the required faults can be induced in every deployed device. Detailed fault-injection and reinitialization requirements require the full paper, which was unavailable during this review.

Compare the need for controlled physical faults with the data/oracle access in SoDark and the authentication/configuration conditions in NFC. The point of the comparison is to ask what an attacker must actually be able to do.

Zhengting Li and coauthors, IEEE Transactions on Dependable and Secure Computing 23(3), pp. 7129–7142 (2026). The authors’ institutional record identifies a peer-reviewed journal article; ePrint 2026/1806 is a minor revision of that published work. This summary uses the verified abstract and publication records.

Historic full-DES differential attack: collection is not analysis

Biham and Shamir’s attack targets all 16 rounds with the standard DES key schedule. Its chosen-plaintext form requires access to encrypt structured inputs with the needed XOR differences. Table 5.2 of their book separates these rounded resource estimates:

Possessing 2³⁶ arbitrary ciphertexts does not supply the selected data. Nor is 2³⁷ the total end-to-end work. The more precise metastructure estimates in §5.1 are 2^47.2 chosen plaintexts and 2^37.2 analysis operations.

Success is probabilistic. The book’s base schedule uses about 2³⁵ structures of 2¹³ inputs (2⁴⁸ plaintexts) and gives about a 58% chance of at least one right pair. Metastructures obtain four times as many pairs from twice as many inputs, reducing the rounded collection requirement to 2⁴⁷. The 58% figure describes that base schedule; it is not an exact success guarantee for every rounded estimate. Restricted input alphabets also matter: the original differences cannot be realized using only ASCII inputs; the book’s adapted attack needs about 2⁴⁹ chosen ASCII plaintexts.

Start with the DES S1 worked example or explore differential methods in Biham Lens. Those bounded exercises do not execute this full-DES attack.

Eli Biham and Adi Shamir, Differential Cryptanalysis of the Data Encryption Standard (1993), chapter 5 and §5.1, Table 5.2. Numbered pp. 78–86, especially pp. 84–86, refer to the authors’ repaginated 7 December 2009 recompilation.

Conditional-linear DES: discard data to gain bias

Biham and Perle’s 2018 conditional-linear analysis conditions linear approximations on observable information. Keeping a selected subset can increase statistical bias, trading discarded data against a stronger distinguisher.

One reported full-DES operating point uses about 2^41.9 known plaintexts and analysis work at 85% success. These are separate quantities even when their exponents coincide. The paper includes statistical/reduced-round experiments and selected full-DES checks; §4.7 counts the candidate keys preceding the correct key instead of executing that search; §4.7.1 reports 79 full-DES data/analysis runs using this distinction. It is not a guaranteed, ciphertext-only or laptop-speed recovery claim.

This is conditional-linear analysis. Crypto Lab’s Matsui Line differential–linear composition lesson is a different technique. The museum’s contribution is a dated explanation of the result and its evidence conditions.

Biham and Perle, primary ToSC paper (2018), Tables 1–2 and §4.7–4.7.1, PDF pp. 5–6 and 30–34. Journal full text. Return to the DES exhibit.

Continue the research trail

UA-8295 firmware forensics · SoDark radio linking · NFC deployment · Historical decipherment evidence

The companion Crypto Lab encyclopedia roadmap tracks attack-engine development. These museum pages supply source interpretation without duplicating that implementation work.