Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} Prob\{a\cdot x+b\cdot F(x)=0 \} \end{equation*} is there any good algorithm?
Same question for differential cryptanalysis ,If the input differential is $a$ and output differential is $b$, how to calculate the probability of that \begin{equation*} Prob\{ F(x)+F(x+a)=b \} \end{equation*}

  • $\begingroup$ cs.bc.edu/~straubin/crypto2017/heys.pdf $\endgroup$
    – kelalaka
    Commented Jan 8 at 18:55
  • $\begingroup$ One way to approximately estimate the linear bias is to find the minimum number of active sboxes and multiply it with linear bias probability of the sbox $\endgroup$
    – hardyrama
    Commented Jan 12 at 12:04


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.