1
$\begingroup$

In Matsui's paper, Section 5 ‘Linear Approximation of DES Cipher’, Matsui gives two similar equations: Eq. (6) for the first round and Eq. (7) for the third round. The two equations give an approximation of bit $K_1[22]$ and bit $K_3[22]$. Then he derives in Eq. (8) from Eqs. (6) and (7) an approximation of $K_1[22] \oplus K_3[22].$

From what I understand, the 3-round DES linear approximation is supposed to give an approximation of only one bit of the key, but here I see two bits from the partial key.

Which bit of the actual key does this approximation refer to?

$\endgroup$
1
$\begingroup$

The equation in (8) is obtained by summing (6) and (7), and is an approximation for the bit $$ K_1[22]\oplus K_3[22]. $$ The sum of two key bits is still a bit.

$\endgroup$
  • $\begingroup$ is it the 22 bit of the key after the permutation (meaning the 22 bit of the 56 bit key) or before? and the count is from right to left or the other way? $\endgroup$ – ReDragon Apr 26 '17 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.