One Page 7, of Document Camellia Design and Analysis

The author says,

In the case of Camellia, the maximum diferential/linear probabilities of s-boxes are $2^{-6}$.

Since Camellia S-boxes are made up from Affine-Inverse-Affine Transformation in $GF(2^8)$ which has Linear Approximation Probability of $2^{-4}$, then why authors wrote it $2^{-6}$.

Does Camellia S-boxes have Linear Approximation probability of $2^{-6}$ or $2^{-4}$?

any body calculated it?

  • $\begingroup$ it has been answered at crypto.stackexchange.com/questions/41702/… $\endgroup$ – abraza Aug 22 '17 at 7:29
  • $\begingroup$ The same question is asked elsewhere , you can find the answer here $\endgroup$ – hardyrama Nov 25 '17 at 12:50
  • $\begingroup$ @hardyrama your referred link is already mentioned in the above comment. $\endgroup$ – abraza Nov 26 '17 at 14:49

Browse other questions tagged or ask your own question.