I figured I should try to learn about linear cryptanalysis with a super simple cipher with only one Sbox. The problem is that with that approach the last subkey bits seem to be involved in the linear approximation.
It looks like I need at least 2 Sboxes, keeping the last one to bring randomness in case of a bad guess on the bits of the last subkey. So obviously, the last one should also not appear in the linear approximation.
Is that understanding of Linear Cryptanalysis correct?