---
title: Impulse-Step Differential Attack
url: https://www.emergentmind.com/topics/impulse-step-based-differential-attack-isbda
type: topic
---

# Impulse-Step Differential Attack

Searching arXiv for the cited paper to ground the article and citations.
Impulse-step-based differential attack (ISBDA) is a chosen-plaintext differential attack introduced for plaintext non-delayed chaotic ciphers (PNDCCs), a class of sequential chaos-based image ciphers whose diffusion stage depends on the current plaintext symbol and previous ciphertext but contains no plaintext delay term. In the formulation examined in "Cryptanalysis and design for a family of plaintext non-delayed chaotic ciphers" [2509.11158], ISBDA exploits an impulse-input / step-output condition: a one-position plaintext differential, after the pre-permutation, induces a ciphertext differential that is zero before a certain internal index and nonzero from that index onward. This deterministic time-domain behavior allows recovery of the pre-permutation, after which the diffusion and post-permutation can also be recovered in the worked three-stage permutation-diffusion-permutation example [2509.11158].

## 1. Placement within plaintext non-delayed chaotic ciphers

A PNDCC is defined by a diffusion equation of the form
\[
C(k) = f_D\big(P(k), C(k-1), K(k)\big), \quad k = 1,\dots, MN,
\]
where \(P(k)\) is the permuted plaintext pixel at position \(k\), \(C(k)\) is the ciphertext pixel, \(C(k-1)\) is a ciphertext feedback term, and \(K(k)\) is key material, typically derived from chaotic maps [2509.11158]. The defining structural property is that the diffusion equation contains no plaintext delay term such as \(P(k-1)\) or \(P(k-2)\), but does contain ciphertext feedback.

The broad cipher family discussed in the source paper follows a classical permutation-diffusion-permutation architecture. A pre-permutation rearranges plaintext positions, the diffusion stage applies a sequential recurrence with feedback, and a post-permutation shuffles the resulting ciphertext positions. In the worked three-stage example, the diffusion is
\[
C(k) = \bmod\big(P(k) - C(k-1) - K(k), 256\big).
\]
Although the permutation and key-generation components are driven by chaotic maps, the operative diffusion structure is regular, modular-additive or XOR-based, and sequential [2509.11158].

This structural characterization is central to ISBDA. The attack does not rely on statistical deficiencies in ciphertext images. The source paper states that the example cipher passes standard statistical indicators including histogram, correlation, NPCR, UACI, and entropy, yet remains breakable. This suggests that ISBDA targets the recurrence structure of PNDCC diffusion rather than the visual or distributional properties usually emphasized in chaos-based image-encryption literature [2509.11158].

## 2. Differential model and the impulse-step condition

ISBDA models the cipher as a system with plaintext sequence as input, ciphertext sequence as output, and feedback through \(C(k-1)\). Differences are defined under an operation \(\otimes\in\{\oplus,\dot{-}\}\), where \(\oplus\) denotes XOR difference and \(\dot{-}\) denotes modular subtraction difference. For two encryption runs \(X^{(a)}\) and \(X^{(b)}\), the differential is
\[
\Delta X(k) = X^{(a)}(k) \otimes X^{(b)}(k).
\]
The attack constructs a baseline monochrome plaintext
\[
\hat P^{(V_1)}(k)=V_1,\quad \forall k,
\]
and a perturbed plaintext with a single impulse at position \(k_0\),
\[
\hat P^{(k_0)}(k)=
\begin{cases}
V_2\neq V_1 & \text{if } k=k_0,\\
V_1 & \text{if } k\neq k_0.
\end{cases}
\]
The resulting input differential is therefore a discrete unit impulse [2509.11158].

After the unknown pre-permutation, the impulse is relocated from \(k_0\) to some internal position \(k_1\). The decisive property is the corresponding output behavior:
\[
\Delta C^{(k_1)}(k)=
\begin{cases}
0 & \text{if } k<k_1,\\
\neq 0 & \text{if } k\ge k_1.
\end{cases}
\]
The source paper designates this as the impulse-input / step-output condition. In its terminology, an impulse is a differential pattern with exactly one nonzero sample, while a step is a differential pattern in which all samples from some index onward are nonzero [2509.11158].

For a general PNDCC diffusion, the authors write the recurrence in expanded form as
\[
C(k)=g_k\big(P(1),\dots,P(k)\big),
\]
with key and initial state fixed during analysis. Under this representation, a change at a single input position cannot influence earlier outputs, but can propagate forward through the feedback chain. ISBDA exploits precisely this onset index and persistence behavior. The trailing post-permutation alters only the positions of the nonzero differential values, not the number of such values, which is what enables permutation recovery in the attack [2509.11158].

## 3. Proof mechanism in the three-stage worked example

For the example diffusion
\[
C(k)=\bmod\big(P(k)-C(k-1)-K(k),256\big),
\]
the source paper derives the differential recurrence
\[
\Delta C^{(k_1)}(k)=\Delta P^{(k_1)}(k)\dot{-}\Delta C^{(k_1)}(k-1),
\]
assuming equal initial conditions in the compared runs [2509.11158].

When the plaintext differential is an impulse at \(k_1\), the recursion yields three regimes. For \(k<k_1\), both \(\Delta P^{(k_1)}(k)\) and the preceding ciphertext difference are zero, so the output difference remains zero. At \(k=k_1\), the ciphertext difference becomes \(V_2\dot{-}V_1\neq 0\). At \(k=k_1+1\), the recursion gives
\[
\Delta C^{(k_1)}(k_1+1)=0\dot{-}(V_2\dot{-}V_1)=256-(V_2\dot{-}V_1)\neq 0.
\]
For all later positions, the difference alternates between \(V_2\dot{-}V_1\) and \(256-(V_2\dot{-}V_1)\), so it never returns to zero [2509.11158].

This establishes the step property explicitly:
\[
\Delta C^{(k_1)}(k)=
\begin{cases}
0 & k<k_1,\\
\neq 0 & k\ge k_1.
\end{cases}
\]
The key mathematical point is that the difference dynamics are linear in the modular-difference domain. The support of the output differential is therefore a contiguous suffix \([k_1,MN]\). Because the post-permutation preserves the cardinality of that support, counting nonzero entries in the observed ciphertext difference reveals the onset position \(k_1\) even though the suffix has been permuted [2509.11158].

A plausible implication is that ISBDA is best understood as a structural differential method for one-dimensional recurrences rather than as a variant of classical block-cipher trail analysis. The source paper itself contrasts it with conventional differential cryptanalysis, which centers on S-box differentials, mixing layers, and probabilistic trails; ISBDA instead uses deterministic positional propagation in a feedback-driven sequential system [2509.11158].

## 4. Attack workflow and recovery of cipher components

The worked ISBDA against the three-stage permutation-diffusion-permutation PNDCC proceeds in three stages. First, the attacker recovers the pre-permutation using chosen plaintexts. One baseline plaintext is formed with all pixels equal to \(V_1\), and for every position \(k_0\in\{1,\dots,MN\}\), an additional plaintext is formed with the same constant value except for a single pixel set to \(V_2\neq V_1\). After encryption, output differentials relative to the baseline ciphertext are computed [2509.11158].

Because the internal differential has nonzero support on all positions \(k\ge k_1\), the number of nonzero pixels before the final permutation is exactly \(MN+1-k_1\). The post-permutation changes only location, not count. Hence
\[
\#\{k:\Delta C^{(k_0)}(k)\neq 0\}=MN+1-k_1,
\]
and therefore
\[
k_1 = MN + 1 - \text{count}.
\]
Since each experiment identifies both the original perturbed index \(k_0\) and the corresponding internal index \(k_1\), the mapping \(k_0\mapsto k_1\) is fully determined. The source paper identifies this mapping as the pre-permutation \(f_{S0}\) [2509.11158].

Second, with the pre-permutation known, the attacker recovers the diffusion and neutralizes the post-permutation by a chosen-ciphertext strategy. The paper states that one may choose an all-zero ciphertext \(\widehat C=0\) to neutralize the post-permutation, yielding \(C=0\). Using the corresponding plaintext returned by a decryption oracle, the attacker obtains known values at the input and output boundaries of the diffusion stage. For the example diffusion, the keystream is then recovered directly from
\[
K(k)=\bmod\big(P(k)-C(k-1)-C(k),256\big),
\]
once initial values are fixed [2509.11158].

Third, once the diffusion is known, internal ciphertexts before the post-permutation can be reconstructed, and the remaining position permutation is deduced by comparing internal and observed external positions. In the paper’s description, all three stages—pre-permutation, diffusion, and post-permutation—are thereby broken [2509.11158].

The source paper also gives a generic ISBDA flow for more complicated diffusions. The first step is to test whether the diffusion satisfies the impulse-input / step-output condition, empirically if necessary. If the condition holds, the impulse-based chosen-plaintext procedure can be used to recover permutations and then diffusion. If it does not hold, the paper states that ISBDA may not apply [2509.11158].

## 5. Complexity, effectiveness, and relation to other attacks

For the three-stage PNDCC studied in the source paper, the data complexity of ISBDA is \(MN+1\) chosen plaintext-ciphertext pairs: one baseline plaintext and \(MN\) impulse plaintexts, one per position. The computational work per experiment consists of encryption and counting nonzero differences, with the paper noting that the total cost is dominated by the number of encryptions and is entirely practical for an image cipher. The same \(MN+1\) pairs are stated to suffice for diffusion-key recovery once permutations are known, so the total attack complexity remains \(MN+1\) pairs [2509.11158].

The paper reports experimental demonstration on a three-stage permutation-diffusion-permutation PNDCC with the diffusion equation above, under 2-round encryption and image size \(M\times N\), with the Cameraman image given as an example. The cipher reportedly shows visually uniform histograms, near-zero ciphertext adjacent-pixel correlation, NPCR/UACI values around \(99\%\) and \(33\%\), and ciphertext entropy near 8 bits per pixel. Despite this, ISBDA completely recovers the plaintext, and the reconstructed Cameraman image in Figure 6 is described as indistinguishable from the original [2509.11158].

Within the paper’s broader cryptanalytic framework, ISBDA is one of four attacks demonstrated against PNDCC:

| Attack | Basis | Characterization in the source paper |
|---|---|---|
| Homogeneous-operation differential attack | Modular/XOR homogeneity | Effective but relies heavily on specific algebraic forms |
| S-PTC attack | Plaintext intersection and unidirectional diffusion | Eventually requires a codebook |
| ISBDA | Dynamic impulse/step behavior | Relatively simple and low complexity when applicable |
| Chain attack | Positional chains induced by recurrence | More universal for multi-stage PNDCC, but more involved |

The paper attributes the S-PTC attack to Zhou and Yu and presents both ISBDA and the chain attack as new attacks in that work [2509.11158]. Its own comparison places ISBDA between specialized homogeneous-operation attacks and the more universal but more complex chain attack.

## 6. Scope, failure conditions, and design implications

ISBDA is explicitly designed for PNDCC-type diffusions of the form
\[
C(k)=f_D\big(P(k),C(k-1),K(k)\big),
\]
with no plaintext delay, ciphertext feedback, and satisfaction of the impulse-input / step-output condition [2509.11158]. The paper states that this covers a large family of chaotic image ciphers in the literature. It further notes that the mathematics is not chaotic-specific and depends on the recurrence structure. This suggests that analogous sequential systems outside the chaos-based image-cipher domain could, in principle, admit similar analysis if they exhibit the same deterministic impulse-to-step propagation.

The source paper also delineates cases in which ISBDA fails. It does not apply when the impulse-input / step-output condition does not hold, including settings in which a single input difference does not produce a contiguous nonzero suffix at the output. The paper lists several circumstances that can destroy this behavior: plaintext delays, more complex nonlinear mixing, cancellation of differences, interleaving or multi-branch feedback that breaks one-dimensional recursion, and strong nonlinearity in the difference domain [2509.11158].

These limitations motivate the paper’s proposed secure improvement, the plaintext-delayed chaotic cipher (PDCC). In the PDCC formulation, diffusion includes plaintext delays and ciphertext-history terms:
\[
\left\{
\begin{aligned}
P_1(k) &= f_{D1}^{-1}\Big( P_1(k-1),\dots, P_1(k-n_1),\ C_1(k),\dots,C_1(k-m_1),\ K_1(k)\Big),\\
P_2(k) &= f_{D2}^{-1}\Big( P_2(k-1),\dots, P_2(k-n_2),\ C_2(k),\dots,C_2(k-m_2),\ K_2(k)\Big),
\end{aligned}
\right.
\]
with \(n_1,n_2,m_1,m_2>0\), and \(f_{D1}^{-1},f_{D2}^{-1}\) described as heterogeneous composite functions [2509.11158]. The paper states that once plaintext delays are introduced, the neat step property disappears, generalized iteration equations analogous to those for PNDCC cannot be derived, and both ISBDA and the chain attack no longer work.

A central conclusion of the source paper is therefore methodological rather than merely attack-specific: statistical criteria such as histogram uniformity, low correlation, high NPCR/UACI, and near-8-bit entropy are not sufficient indicators of security for PNDCCs. ISBDA demonstrates that even when ciphertexts satisfy these empirical benchmarks, a cipher can remain vulnerable if its diffusion is a simple feed-forward recurrence without plaintext delay [2509.11158]. In that sense, ISBDA functions both as a concrete chosen-plaintext attack and as a diagnostic framework for analyzing whether a sequential chaotic diffusion exhibits a deterministic impulse response that leaks positional structure.

Source: https://www.emergentmind.com/topics/impulse-step-based-differential-attack-isbda