For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations?

Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be done fairly easily. But I’m having a problems applying the same on ciphers that use more than one s-box. I’m mainly stuck on how to derive those linear equations after constructing the LAT tables for all such different s-boxes of a round.

For example: in the first round, my plaintext and key are passed as inputs to s-box 1, followed by permutation 1. Then, that output is passed to s-box 2. Now, having this final output, how can I identify which one is the linear expression that is with maximum/high probability bias? Meaning: which LAT table should be considered?

  • $\begingroup$ To get the correlation of a trail, you just need to multiply the correlation for the approximation over the first S-box with correlation for the approximation over the second S-box. $\endgroup$
    – Aleph
    Nov 19 '17 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.