# Tag Info

The attack, as stated in sections 6.2 & 6.3, actually can only recover the quantity $K_1[1,3]\oplus K_2[1,3]$. What you would hope to do is, to use a similar approach via another high probability linear relation [usually there is more than one] and recover more relations between subkey bits. Eventually, the goal is recovering all the original key bits. ...