# 3-round DES: what bit do we find? (Regarding matsui's Paper on Linear Cryptanalysis of DES)

In Matsui's paper, Section 5 ‘Linear Approximation of DES Cipher’, Matsui gives two similar equations: Eq. (6) for the first round and Eq. (7) for the third round. The two equations give an approximation of bit $K_1[22]$ and bit $K_3[22]$. Then he derives in Eq. (8) from Eqs. (6) and (7) an approximation of $K_1[22] \oplus K_3[22].$

From what I understand, the 3-round DES linear approximation is supposed to give an approximation of only one bit of the key, but here I see two bits from the partial key.

Which bit of the actual key does this approximation refer to?

The equation in (8) is obtained by summing (6) and (7), and is an approximation for the bit $$K_1[22]\oplus K_3[22].$$ The sum of two key bits is still a bit.