For a block cipher with 4 different s-boxes (each used in an individual round) how can I identify the linear equations?
Normally, for ciphers like AES with a single s-box, linear cryptanalysis can be done fairly easily. But I’m having a problems applying the same on ciphers that use more than one s-box. I’m mainly stuck on how to derive those linear equations after constructing the LAT tables for all such different s-boxes of a round.
For example: in the first round, my
key are passed as inputs to
s-box 1, followed by
permutation 1. Then, that output is passed to
s-box 2. Now, having this final output, how can I identify which one is the linear expression that is with maximum/high probability bias? Meaning: which LAT table should be considered?