Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If Linear Cryptanalysis exploits the fact that the plaintext and ciphertext are not completely unrelated, is the attack possible without having access to the plaintext?

share|improve this question
up vote 2 down vote accepted

Yes, linear cryptanalysis may still be possible, depending upon the distribution on the plaintexts and the specifics of the block cipher.

For instance, suppose we know that the plaintext is English encoded in ASCII. Then we know that the high bit of each 8-bit byte is zero. We may also know some additional linear approximations that hold on the plaintext that hold with non-zero bias. This may be enough to mount linear cryptanalysis, e.g., if you can find a linear characteristic for the whole cipher that only involves those bits of the plaintext (only the high bits of each byte) and not any other bits of the plaintext.

As I recall, there has been results showing that ciphertext-only linear cryptanalysis of DES is possible, assuming that the plaintexts are ASCII-encoded English text. This result might even have been included in Matsui's original paper on linear cryptanalysis; I cannot remember.

share|improve this answer

To apply this kind if cryptoanalysis you need to have at least few pair of plaintext-ciphertext. Without knowing plaintext you could not build correct linear expression, because you will not know where to start. Quote from Tutorial on Linear and Differential Cryptanalysis:

Linear cryptanalysis tries to take advantage of high probability occurrences of linear expressions involving plaintext bits, "ciphertext" bits, and subkey bits. It is a known plaintext attack: that is, it is premised on the attacker having information on a set of plaintexts and the corresponding ciphertexts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.