Skip to main content

Table 4 Partial encryption and decryption on 25-round LBlock

From: Multidimensional linear cryptanalysis with key difference invariant bias for block ciphers

Step Guess Time Obtained States Size
1 \(K_{25}^{6}, K_{25}^{7}\) N·218·10 \(x_{1}(x'_{1})=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{0}^{9}\right | X_{0}^{6}\left |X_{0}^{1}\right | X_{0}^{8} | X_{0}^{4}\) 260·2
  \(K_{23}^{2}[2:3]\)   \(X_{25}^{3}\left |X_{25}^{10}\right | X_{25}^{13}\left |X_{23}^{7}\right | X_{25}^{6}\left |X_{25}^{12}\right | X_{21}^{5}\)  
  \( K_{24}^{1}, K_{25}^{3}\)    
2 \(K_{1}^{4}\) 260·218+4·2 \(x_{2}\left (x_{2}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{0}^{9}\right | X_{0}^{6}\left |X_{0}^{1}\right | X_{1}^{6} |\) 256·2
    \(X_{25}^{3}\left |X_{25}^{10}\right | X_{25}^{13}\left |X_{23}^{7}\right | X_{25}^{6}\left |X_{25}^{12}\right | X_{21}^{5}\)  
3 \(K_{2}^{6}\) 256·222+4·2 \(x_{3}\left (x_{3}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{0}^{9}\right | X_{0}^{6}\left |X_{2}^{7}\right | X_{25}^{3} |\) 252·2
    \(X_{25}^{10}\left |X_{25}^{13}\right | X_{23}^{7}\left |X_{25}^{6}\right | X_{25}^{12} | X_{21}^{5}\)  
4 \(K_{24}^{7} \) 252·226+3·2 \(x_{4}\left (x_{4}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{0}^{9}\right | X_{0}^{6}\left |X_{2}^{7}\right | X_{25}^{3} |\) 248·2
  23 possible values   \(X_{25}^{10}\left |X_{22}^{7}\right | X_{25}^{6}\left |X_{25}^{12}\right | X_{21}^{5}\)  
5 \(K_{1}^{6}\) 248·229+4·2 \(x_{5}\left (x_{5}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{1}^{7}\right | X_{2}^{7}\left |X_{25}^{3}\right | X_{25}^{10} |\) 244·2
    \(X_{22}^{7}\left |X_{25}^{6}\right | X_{25}^{12} | X_{21}^{5}\)  
6 \(K_{3}^{7}\) 244·233+1·2 \(x_{6}\left (x_{6}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{3}^{5}\right | X_{25}^{3}\left |X_{25}^{10}\right | X_{22}^{7} |\) 240·2
  2 possible values   \(X_{25}^{6}\left |X_{25}^{12}\right | X_{21}^{5}\)  
7 \(K_{25}^{4}\) 240·234+4·2 \(x_{7}\left (x_{7}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{3}^{5}\right | X_{25}^{3}\left |X_{25}^{10}\right | X_{22}^{7} |\) 236·2
    \(X_{23}^{0} | X_{21}^{5}\)  
8 \(K_{24}^{0}\left (K_{22}^{5}\right)\) 236·238+4·4 \(x_{8}\left (x_{8}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{3}^{5}\right | X_{25}^{3}\left |X_{25}^{10}\right | X_{22}^{7} |\) 232·2
    \(X_{20}^{6}\)  
9 \(K_{25}^{2}\) 232·242+3·2 \(x_{9}\left (x_{9}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{3}^{5}\right | X_{23}^{5}\left |X_{22}^{7}\right | X_{20}^{6}\) 228·2
  23 possible values    
10 \(K_{23}^{7}[0]\) 228·245+1·2 \(x_{10}\left (x_{10}^{\prime }\right)=X_{0}^{0}\left |X_{0}^{14}\right | X_{0}^{5}\left |X_{3}^{5}\right | X_{21}^{7} | X_{20}^{6}\) 224·2
11 \(K_{1}^{5}\) 224·246+4·2 \(x_{11}\left (x_{11}^{\prime }\right)=X_{0}^{0}\left |X_{1}^{4}\right | X_{3}^{5}\left |X_{21}^{7}\right | X_{20}^{6}\) 220·2
12 \(K_{2}^{4}\) 220·250+4·2 \(x_{12}\left (x_{12}^{\prime }\right)=X_{3}^{14}\left |X_{3}^{5}\right | X_{21}^{7} | X_{20}^{6}\) 216·2
13 \(K_{4}^{5}[1]\) 216·254+1·2 \(x_{13}\left (x_{13}^{\prime }\right)=X_{4}^{4}\left |X_{21}^{7}\right | X_{20}^{6}\) 212·2
14 \(K_{21}^{6}\) 212·255+4·2 \(x_{14}\left (x_{14}^{\prime }\right)=X_{4}^{4} | X_{20}^{9}\) 28·2