New answers tagged

2

This is the code i used to simulate your Sbox (no intelligence, pure application with lots of mask for security). virtual uint8 apply_s(uint16 input, int numBits) { uint16 mask = 1; for (int i = 1; i < numBits; ++i) { mask |= mask << 1; } uint32 res = input & mask; res = res * res; res = (res >> ...


1

The attack, as stated in sections 6.2 & 6.3, actually can only recover the quantity $K_1[1,3]\oplus K_2[1,3]$. What you would hope to do is, to use a similar approach via another high probability linear relation [usually there is more than one] and recover more relations between subkey bits. Eventually, the goal is recovering all the original key bits. ...



Top 50 recent answers are included