Accurate Estimate of the Advantage of Impossible Differential Attacks

Impossible differential attacks, which are taking advantage of differentials that cannot occur, are powerful attacks for block cipher primitives. The power of such attacks is often measured in terms of the advantage — number of key-bits found during the key sieving phase — which determines the time complexity of the exhaustive key search phase. The statistical model used to compute this advantage has been introduced in the seminal work about the resistance of the DEAL cipher to impossible differential attacks. This model, which has not been modified since the end of the 1990s, is implicitly based on the Poisson approximation of the binomial distribution. In this paper, we investigate this commonly used model and experimentally illustrate that random permutations do not follow it. Based on this observation, we propose more accurate estimates of the advantage of an impossible differential attack. The experiments illustrate the accuracy of the estimate derived from the multivariate hypergeometric distribution. The maximal advantage –using the full codebook– of an impossible differential attack is also derived.

The numerics of Premium Bonds

Premium Bonds sold by the UK National Savings and Investments (NS&I) agency are the possibly most popular example of lottery bonds. Premium Bonds holders renounce interest payments but instead participate in a lottery which distributes the equivalent of aggregate interest payments among them. While the random mechanism used in the lottery is well-documented the details of how to determine the probability distribution of a single bond holder's lottery prizes seem to be less well-known. We observe that the lottery prizes distribution is a multivariate hypergeometric distribution and discuss how to exactly calculate its probability masses as well as how to approximate the distribution by means of the Panjer recursion and Fourier transforms. We find that there are good reasons to prefer the approximations based on Panjer recursionor Fourier transforms to exact calculation of the lottery prize value distribution.

A non-central multivariate hypergeometric distribution arising from biased sampling with application to selective predation

Selective predation is an example of biased sampling which gives rise to a non-central multivariate hypergeometric distribution. The probability distribution function of this distribution is derived.