I am trying to derive the best linear approximation for one round DES.
I read the question and answer
Regarding matsui's Paper on Linear Cryptanalysis of DES
several times but still could not figure out the part
" y_3y_2y_1y_0 can be propagated to bits 7, 18, 24 and 29 of the output of the round function, this time taking into account the effect of the bit permutation P(.) "
The output of S box #5 is Y[13], Y[14], Y[15] and Y[16] (when counting from right). And after permutation these bits would be Y[26], Y[20], Y[10] and Y[1] respectively. I could not find the desired bit number i.e. F(X,K)_7, F(X,K)_18, ...