I'm using Howard Hey's tutorial on linear cryptanalysis, however I don't understand the final stages. I understand using exhaustive partial subkeys to turn the ciphertext into the final round output, however I don't understand how to invert and pass these values back through the final round S Boxes. I'm not looking for an exact answer, just a generalisation on how to invert the final round S Box thanks


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.