1
$\begingroup$

In Matsui's paper, Section 5 ‘Linear Approximation of DES Cipher’, Matsui gives two similar equations: Eq. (6) for the first round and Eq. (7) for the third round. The two equations give an approximation of bit $K_1[22]$ and bit $K_3[22]$. Then he derives in Eq. (8) from Eqs. (6) and (7) an approximation of $K_1[22] \oplus K_3[22].$

From what I understand, the 3-round DES linear approximation is supposed to give an approximation of only one bit of the key, but here I see two bits from the partial key.

Which bit of the actual key does this approximation refer to?

$\endgroup$

1 Answer 1

1
$\begingroup$

The equation in (8) is obtained by summing (6) and (7), and is an approximation for the bit $$ K_1[22]\oplus K_3[22]. $$ The sum of two key bits is still a bit.

$\endgroup$
1
  • $\begingroup$ is it the 22 bit of the key after the permutation (meaning the 22 bit of the 56 bit key) or before? and the count is from right to left or the other way? $\endgroup$
    – ReDragon
    Apr 26, 2017 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.