3
$\begingroup$

In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says

The maximum bias of a linear approximation through one S-box is $2^{-4}$ , which gives a linear probability of $2^{-6}$

what does this mean? isn't the linear approximation probability $2^{-4}$?

See This Question Too

Improve this question
$\endgroup$
2
  • $\begingroup$ Can you specify the exact location of your quote? $\endgroup$
    – kodlu
    Nov 21, 2016 at 21:47
  • $\begingroup$ check the referenced paper $\endgroup$
    – crypt
    Nov 22, 2016 at 5:36

1 Answer 1

Reset to default
6
$\begingroup$

Let $LP$ be the linear probability (also called "correlation potential"), $Cor$ be the correlation coefficient and $\epsilon$ be the bias of a linear approximation. Then

$LP = Cor^2 = (2\times \epsilon)^2$.

So, if $\epsilon=2^{-4}$, then $LP = ({2\times 2^{-4}})^2=2^{-6}$.

[1] Daemen, J., Rijmen, V.: Probability distributions of correlation and differentials in block ciphers. J. Mathematical Cryptology 1(3), 221–242 (2007). DOI 10.1515/JMC.2007.011. URL http://jda.noekeon.org/JDA_VRI_Stat_2007.pdf

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.