Skip to main content

Table 6 Partial encryption and decryption on 28-round TWINE-128

From: Multidimensional linear cryptanalysis with key difference invariant bias for block ciphers

Step Guess Time Obtained States Size
1 \(K_{28}^{5}, K_{28}^{3}, K_{27}^{2}\) N·264·2·17 \(y_{1}\left (y_{1}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\) 260·2
  \(K_{28}^{7}, K_{28}^{1}, K_{27}^{3}\)   \(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{0}^{5}\left |X_{0}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |\)  
  \(K_{26}^{2}, K_{25}^{0}, K_{28}^{0}\)   \(X_{23}^{3}\)  
  \(K_{27}^{1}, K_{28}^{6}, K_{26}^{3}\)    
  \(\left (K_{24}^{1}\right), K_{27}^{4}\)    
  \(\left (K_{28}^{5}\right), K_{27}^{5}, K_{26}^{7} \)    
2 \(K_{1}^{2}\) 260·264+4·2 \(y_{2}\left (y_{2}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\) 256·2
    \(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{1}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)  
3 \(K_{2}^{6}\) 256·268+4·2 \(y_{3}\left (y_{3}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\) 252·2
    \(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{2}^{10}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)  
4 \(K_{1}^{7}\) 252·272+4·2 \(y_{4}\left (y_{4}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\) 248·2
    \(X_{0}^{6}\left |X_{1}^{14}\right | X_{2}^{10}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)  
5 \(K_{3}^{5}\) 248·276+4·2 \(y_{5}\left (y_{5}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\) 244·2
    \(X_{0}^{6}\left |X_{3}^{2}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)  
6 \(K_{1}^{3}\) 244·280+4·2 \(y_{6}\left (y_{6}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{1}^{8}\right |\) 240·2
    \(X_{3}^{2}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)  
7 \(K_{2}^{4}\left (K_{4}^{1}\right)\) 240·284+4·4 \(y_{7}\left (y_{7}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{4}^{4}\right |\) 236·2
    \(X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)  
8 \(K_{1}^{5}\) 236·288+4·2 \(y_{8}\left (y_{8}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{0}^{1}\left |X_{0}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right |\) 232·2
    \(X_{25}^{15} | X_{23}^{3}\)  
9 \(K_{1}^{0}\) 232·292+4·2 \(y_{9}\left (y_{9}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{1}^{0}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |\) 228·2
    \(X_{23}^{3}\)  
10 \(K_{2}^{0}\) 228·296+4·2 \(y_{10}\left (y_{10}^{\prime }\right)=X_{1}^{2}\left |X_{2}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\) 224·2
11 \(K_{3}^{0}\) 224·2100+4·2 \(y_{11}\left (y_{11}^{\prime }\right)=X_{4}^{5}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\) 220·2
12 \(K_{5}^{2}\) 220·2104+4·2 \(y_{12}\left (y_{12}^{\prime }\right)=X_{5}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\) 216·2
13 \(K_{25}^{6}\) 216·2108+4·2 \(y_{13}\left (y_{13}^{\prime }\right)=X_{5}^{12}\left |X_{23}^{8}\right | X_{23}^{3}\) 212·2
14 \(K_{23}^{3}\) 212·2112+4·2 \(y_{14}\left (y_{14}^{\prime }\right)=X_{5}^{12} | X_{22}^{7}\) 28·2