# Linear Approximation and Linear Probability of Camellia Sbox

In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says

The maximum bias of a linear approximation through one S-box is $2^{-4}$ , which gives a linear probability of $2^{-6}$

what does this mean? isn't the linear approximation probability $2^{-4}$?

See This Question Too

• Can you specify the exact location of your quote? – kodlu Nov 21 '16 at 21:47
• check the referenced paper – abraza Nov 22 '16 at 5:36

Let $LP$ be the linear probability (also called "correlation potential"), $Cor$ be the correlation coefficient and $\epsilon$ be the bias of a linear approximation. Then

$LP = Cor^2 = (2\times \epsilon)^2$.

So, if $\epsilon=2^{-4}$, then $LP = ({2\times 2^{-4}})^2=2^{-6}$.

[1] Daemen, J., Rijmen, V.: Probability distributions of correlation and differentials in block ciphers. J. Mathematical Cryptology 1(3), 221–242 (2007). DOI 10.1515/JMC.2007.011. URL http://jda.noekeon.org/JDA_VRI_Stat_2007.pdf