Obtain an initial difference and a conditions set by MILP technique;
{conditions chosen from in the previous rounds to make sure that the number of key bits and plaintext bits involved in conditions should not exceed the enumeration capability};
{the probability of the difference of each bit at round from which conditions just cease being applied. It is derived from and };
{the probabilities of the differences of each subsequent update bit after round calculated by using the method described in Section 3.2};
the bit derived from having the nonzero bias and at the highest possible number of rounds;
for{enumerate equivalent key bits involved in } do
;
;
for{enumerate plaintext bits involved in } do
if satisfy then
calculate from and ;
ifthen
;
else
;
end
end
end
;
;
end
searching in for the max ;
return in accordance with the max .
Algorithm 1. The framework of the conditional differential attack.
