# Differential Analysis of a Cryptographic Hashing Algorithm HBC-256
## 4 Results and Discussion  
The first stage of the analysis is the analysis of nonlinear elements and the construction of a table with the results of differential properties. For the HBC-256 algorithm, such nonlinear elements are the substitution S-boxes presented in Table 2. As a result of the analysis of the differential properties of these S-boxes according to [23, 25], Tables 2-5 were constructed. From these tables, it can be seen that the maximum possible probability of non-zero differences is \(1/4\). \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline  & **0** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9**  
The analysis of S-boxes is as follows. All possible combinations of two inputs are considered to form the input difference. Input difference values are specified horizontally. For each combination of input difference, the value of the output difference is determined. These values are presented vertically from 0 to F. At the intersection of rows and columns, the number of occurrences of each output difference for each input difference is indicated. To determine the probability, it is necessary to divide the values of Tables 2-5 by 16, since the S-box takes 4 bits as input, which means it has 16 possible combinations. Thus, for an input difference of 0, the output difference will always be 0 and there will never be any other output differences. This follows from the fact that at difference 0 the texts forming the difference are identical. This means that the output is identical texts, for which add modulo 2 is 0 (at the intersection of input difference 0 and output difference 0, the number of repetitions is 16, which corresponds to a probability of \(16/16=1\)). After a careful study of the data conversion scheme, it was noticed that, according to Figure 2, the S-boxes from Table 1 actually form 16 S-boxes of 8 \(\times\) 8 bits. Depending on the byte to which they are applied, combinations of small S-box from Table 1 are used to form a large S-box. Thus, 16 S-blocks were formed and analyzed for each of the state bytes. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c} \hline \hline  & **0** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **A** & **B** & **C  
An important feature of the HBC-256 hashing algorithm is the fact that the same value is received at the input of the production of the round keys and at the input of the function itself. At the same time, the processing of these values is insignificantly different, which adds additional complexity to the analysis. We start with the analysis of the function for generating subkeys. The function contains Stage-1, Stage-2, Stage-3 conversions. Note that in Stage-2 only a shift to the left by 1 bit is performed, without the XOR operation, which is present in the Stage-2 operation in the direct hashing function. All three conversions occur 8 times one after another. After that, the original (input) matrix is added to the resulting (output) matrix. The input matrix goes to the Stage-1 operation. The transformation starts with the element with the index 00. All elements in the same row and the same column with the selected element are added, and the selected element is also taken into account. After that, the obtained new element is changed by the S-box of replacement to a new one, according to the index, and is overwritten in the matrix. Then we move on to the element with index 01 and so on up to element 33. The complexity lies in the element overwriting and in the fact that each element, according to the index, is replaced by its own S-box. The idea for finding the right pairs of texts was to find such differences in texts that, having gone through the transformation, would involve the least number of array elements. The work began with the search for a suitable matrix fill. Many different combinations were tried.