# Extracting key bits from linear cryptanalysis equation for SDES

From the linear cryptanalysis of SDES, we get a linear equation consisting the K[1, 3] of the round key 1 and 2. From this how will I retrieve the key bit?

How do we solve the linear equation we get from the linear cryptanalysis to predict the key bits?

The 1 and 3 bits of the round key 1 and 2 are present in the final relation. Form this we apply the algorithm 1, as stated in the paper by Matsui on linear cryptanalysis(The second image)

But from this how do we predict the bits of the actual/original key?

• You need to provide more details to make a self contained question and provide the equation you are referring to. Don't expect others to do your work for you. – kodlu Feb 11 '16 at 7:37
• Tried to clear the question. – levi1696 Feb 11 '16 at 10:22

The attack, as stated in sections 6.2 & 6.3, actually can only recover the quantity $K_1[1,3]\oplus K_2[1,3]$.