Linear Cryptanalysis Using Multiple Approximations

Abstract

We present a technique which aids in the linear cryptanalysis of a block cipher and allows for a reduction in the amount of d a t a required for a successful attack. We note the limits of this extension when applied to DES, but illustrate that it, is generally applicable and might be exceptionally successful when applied to other block ciphers. This forces us to reconsider some of the initial attempts to quantify the resistance of block ciphers to linear cryptanalysis, and by taking account of this new technique we cover several issues which have riot yet been considered.

Multiple Differential Cryptanalysis Using LLR and χ 2 Statistics

“…Premise of this approach have already been proposed in some papers by independently considering different differentials [4] (different analysis phases for different characterics) or by summing the information coming from the different characterics to perform all in one step. In the context of linear cryptanalysis, the method known as multiple linear cryptanalysis [18,5,13] considers each characteristic independently and proposes to analyze the vectors of information for each key candidate. While the question of characteristics combination have been deeply studied for linear cryptanalysis [18,5,[13][14][15], the lack of a comprehensive study on this topic in the context of differential cryptanalysis motivates the present work.…”

Cryptanalysis on Block Ciphers

“…Several extensions to linear cryptanalysis have been proposed, including bilinear cryptanalysis [17], linear cryptanalysis using multiple approximations [46], linear cryptanalysis using nonlinear approximations [59] and linear cryptanalysis using chosen plaintexts [58].…”

The Cryptanalysis of Reduced-Round SMS4

“…Multiple linear approximations were first proposed in [6,7] and they have been the subject of much recent analysis [3,5]. Here we take m different linear approximations, where we use κ j to denote a single bit of key information, The purpose is to use several approximations to reduce the number of plaintexts when keeping the same probability of sucess.…”