Background TheData Encryption Standard (DES) [] has been around for more than  years. During this time, the standard was revised three times: as FIPS-- in , as FIPS-- in , and as FIPS-- in . DES was an outcome of a call for primitives in , which did not result in many serious candidates except for a predecessor of DES, Lucifer [, ] designed by IBM around . It took another year for a joint IBM–NSA effort to turn Lucifer intoDES.The structure of Lucifer was significantly altered: Since the design rationale was never made public and the secret key size was reduced from -bit to -bits, this initially resulted in controversy, and some distrust among the public. After some delay, FIPS- was published by NBS (National Bureau of Standards) – nowNIST (National Institute of Standards and Technology) – on January ,  [] (see [] for a discussion of the standardization process). However, in spite of all the controversy it is hard to underestimate the role of DES []. DES was one of the first commercially developed (as opposed to government developed) ciphers whose structure was fully published. This effectively created a community of researchers who could analyze it and propose their own designs. This led to a wave of public interest in cryptography, from which much of the cryptography as we know it today was born.

Due to their fast performance in software, an increasing number of cryptographic primitives are constructed using the operations addition modulo 2n, bit rotation and XOR (ARX). However, the resistance of ARX-based ciphers against differential cryptanalysis is not well understood. In this paper, we propose a new tool for evaluating more accurately the probabilities of additive differentials over multiple rounds of a cryptographic primitive. First, we introduce a special set of additive differences, called UNAF (unsigned non-adjacent form) differences. Then, we show how to apply them to find good differential trails using an algorithm for the automatic search for differentials. Finally, we describe a key-recovery attack on stream cipher Salsa20 reduced to five rounds, based on UNAF differences.

P.O. Box 47877 Olympia, WA 98504-7877 360-236-4700 Credential Verification To be completed by the applicant: Please complete the top section of this form and send it to the state(s) and/or jurisdiction(s) where you are or have been licensed, certified, or registered as a healthcare provider. Instruct them to send the form directly to the address listed above. Note: Credentialing agencies may require a fee to verify a license, registration, or certification. Check in advance to help expedite the process. Applicant Demographics: First Name Middle Last Name