Multiple Related-Key Differential Attacks on Pure DDP-Based Cipher

By constructing three types of related-key differential characteristics, we present three corresponding related-key differential attacks on the cipher. As the independence of the characteristics, we could recover 64 bits of the cipher's master key with 2^58.6 chosen plain-texts, 2^58.8 full-round DDP-64 encryptions and 2^12.8 bits of storage resources. To break the cipher, we only need to implement an exhaustive search for the rest 64 bits of the master key.