Finding Efficient Distinguishers for Cryptographic Mappings, with an Application to the Block Cipher TEA

The construction of a distinguisher (Knudsen and Meier 2000) (i.e., an algorithm that is able of distinguishing a random permutation or random mapping from a given cryptographic primitive, such as a block cipher or hash function) is one of the main objectives of a cryptanalyst. Although a distinguisher may or may not be used to recover some of the plaintext or key bits, the existence of an efficient and effective distinguisher always means the cryptographic primitive in question is weak (Knudsen and Meier 2000; Shimoyama, Takeuchi, and Hayakawa 2000) and must be discarded for any cryptographic usage.