In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says

The maximum bias of a linear approximation through one S-box is $2^{-4}$ , which gives a linear probability of $2^{-6}$

what does this mean? isn't the linear approximation probability $2^{-4}$?

See This Question Too

  • $\begingroup$ Can you specify the exact location of your quote? $\endgroup$
    – kodlu
    Commented Nov 21, 2016 at 21:47
  • $\begingroup$ check the referenced paper $\endgroup$
    – crypt
    Commented Nov 22, 2016 at 5:36

1 Answer 1


Let $LP$ be the linear probability (also called "correlation potential"), $Cor$ be the correlation coefficient and $\epsilon$ be the bias of a linear approximation. Then

$LP = Cor^2 = (2\times \epsilon)^2$.

So, if $\epsilon=2^{-4}$, then $LP = ({2\times 2^{-4}})^2=2^{-6}$.

[1] Daemen, J., Rijmen, V.: Probability distributions of correlation and differentials in block ciphers. J. Mathematical Cryptology 1(3), 221–242 (2007). DOI 10.1515/JMC.2007.011. URL http://jda.noekeon.org/JDA_VRI_Stat_2007.pdf


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.