# How can I identify the linear equations for a block cipher with 4 different s-boxes?

For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations?

Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be done fairly easily. But I’m having a problems applying the same on ciphers that use more than one s-box. I’m mainly stuck on how to derive those linear equations after constructing the LAT tables for all such different s-boxes of a round.

For example: in the first round, my plaintext and key are passed as inputs to s-box 1, followed by permutation 1. Then, that output is passed to s-box 2. Now, having this final output, how can I identify which one is the linear expression that is with maximum/high probability bias? Meaning: which LAT table should be considered?

• To get the correlation of a trail, you just need to multiply the correlation for the approximation over the first S-box with correlation for the approximation over the second S-box. – Aleph Nov 19 '17 at 10:41