# Questions tagged [linear-cryptanalysis]

Linear cryptanalysis is a known plaintext attack and uses a linear approximation to describe the behavior of the block cipher. Given sufficient pairs of plaintext and corresponding ciphertext, bits of information about the key can be obtained and increased amounts of data will usually give a higher probability of success.

103 questions
Filter by
Sorted by
Tagged with
57 views

### How do I find an equivalent permutation of AES S-box which sends $0$ in $0$?

I am testing the quality of AES S-box and using the lookup table I built a function from GF($2^8$) to GF($2^8$) seen as vector spaces. I was wondering if there is a transformation that I can use to ...
18 views

### Fast implementations in c++ to find linearity of 16! sboxes?

I have to analize 16! of 16 bytes sboxes but my code is to slow to handle it. Anyone have any fast implementation on that? Thank you.
• 23
66 views

### Linearization attack on group with automorphism

Recently, I've had an exchange with Lorenz Panny about Xifrat. He says, that the quasigroup that I use can be linearized and then attacked, and he provided a script that linearized the quasigroup. His ...
• 6,541
51 views

### Linear approximation of modular addition of a constant?

In Linear Approximations of Additions Modulo $2^n$, Wallén shows how to compute the correlation of the modular addition of two binary bit vectors. A simple recursive procedure was given by Schulte-...
91 views

### How to find the optimal trail in linear cryptanalysis

I'm reading and implementing this tutorial, the author explains everything pretty clearly, the only thing I'm missing is how he decides which trail to use (pg. 12). I understand that one should prefer ...
1 vote
36 views

### How does one produce this in the linear cryptanalysis of DES

I understand how this linear approximation board below is produced, but I can't understand how this second board is produced using the first one and finally how the pilling-up lemma values are ...
123 views

### Matsui's linear attack on 5-round DES

I'm trying to understand Mitsuru Matsui's "Linear Cryptanalysis Method for DES Cipher", specifically the attack he describes at the end of section 5, on 5-round DES. I followed the attack on ...
1 vote
123 views

### Solving system of linear equtions over binary field with error

I have system of linear equations $f_1, \ldots, f_m$ over binary variables $x_1,\ldots,x_n$ where $m$ is much larger than $n$. We know if all equations are correct, we can find solution easily using ...
• 219
1 vote
49 views

### How does an attacker decrypt a hash function by looking for linearity?

Reading the selected answer to Designing a hash function from first principles rather than depending on heuristics is very insightful. The section on "nonlinearity" suggests that making ...
• 161
1 vote
51 views

### Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?

The context is iterated ciphers. Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
84 views

### How do we find differentials in differential cryptanalysis when we don't the details about the S-boxes

I m new to cryptanalysis and trying to understand differential cryptanalysis. I have read the paper by Howard M. Heys. I understood the concept of differentials but I m not able to understand how to ...
58 views

### LAT of sboxes, sum of coloms and rows

let we have sbox s: Vn -> Vn. If we make LAT table for s, fix any row and get a sum by columns, that sum would be $+-2^{n-1}$. And vice versa, if we fix any column and get a sum by rows, that sum ...
• 1
68 views

### ¿Can it be proved that both AES's ShiftRows and MixColumns are linear transformation? (if we leave out subBytes and key addition)

I've been researching a bit and found that the mixColumns step could be expressed as matrix multiplication like this: But I'm not sure what's the mathematical proof for it and I can't find an example ...
60 views

### Checking Independence of combination of uniform random variables to use pilling up lemma

My question is very basic one. Suppose $a_0, a_1, a_2, a_3, a_4, b_0, b_1, b_2, b_3, b_4$ are $10$ uniform random variables from $\{0,1\}$ independent of each other. Now there are expressions of the ...
• 133
122 views

### Problems with Matsui's Linear Cryptanalysis on round reduced DES

I'm trying to understand the known plaintext attack that is briefly explained in the paper Linear Cryptanalysis Method for DES Cipher by Mitsuru Matsui. I've almost understood it (since I'm ...
64 views

• 878
164 views

### Linear cryptanalysis of FEAL-4

I am trying to find the sub keys of a FEAL-4 cipher. I am able to get a number of possibilities for $K_0$ after using Michael Stamps formula using a as a constant and going through $2^{32}$ keys. The ...
94 views

### Enhancing Differential-Linear Cryptanalysis

I'm studying Differential-Linear Cryptanalysis, and I'm trying to understand the context from the article Enhancing Differential-Linear Cryptanalysis by Eli Biham et al. There are some difficult ...
• 89
1 vote
69 views

### In DES : Matsui's notation(LC) vs Biham's notation(DC)

I'm doing linear attack for 8 rounds DES. And I just wondering about the difference between Matsui's notation and Biham's notation. In Matsui's paper, numbers bits from 0 to 63 from right to left. In ...
• 89
1 vote
544 views

### Is the following s-box more linear or more non-linear?

I am trying to figure out whether the following simple s-box configuration I created is more linear than non-linear or vice versa more non-linear than linear? The parameters for this 16*4 table of ...
159 views

### What does it mean : "Canonical representative of Sbox is 0123468A5BCF79DE"? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
• 336
157 views

### Differential and Linear trail propagation in Noekeon

In the Noekeon Cipher Specification they write the following : The propagation through Lambda is denoted by $(a \rightarrow A)$, also called a step. Because of the linearity of Lambda it is fully ...
• 153
57 views

### Finding maximal $n$-affine subset

We obtained $l$ vectors $B_i$ of $c$ bits $b_{i,j}$. These are an altered form of vectors $A_i$ where the last $n$ bits of each $A_i$ are an affine function of the other bits of that $A_i$. We want ...
• 122k
113 views

• 1,980
1k views

### How does linear vs. non-linear operations relate to cryptographic security and differential cryptanalysis?

I understand what a linear operation is and what a non-linear operation is, but I would like an explanation of specifically how a non-linear operation on input data mitigates differential crytanalysis ...
218 views

### Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
187 views

### Linear cryptanalysis and number of linear approximations

I try to understand the linear cryptanalysis. Now I am reading as a secondary reference the book "Cryptanalysis of Block Ciphers: A Survey" by Standaert , Piret and Quisquater. In the first step, the ...
1k views

### How do you calculate the linear approximation of an S-BOX?

I've been following this very good tutorial on linear cryptanalysis, and I'm stuck at the linear approximation part. I have no idea what input and output masks are. I don't understand what he's doing ...
• 155
262 views

### When it comes to linear cryptanalysis, is there always a key that could work for every possible input/output?

Until now every tutorial I've seen about linear cryptanalysis, is written on the basis that we have all possible inputs/outputs. Is that a condition? And if not, how many should we have as a minimum? ...
• 155