# Table 6 Partial encryption and decryption on 28-round TWINE-128

Step Guess Time Obtained States Size
1 $$K_{28}^{5}, K_{28}^{3}, K_{27}^{2}$$ N·264·2·17 $$y_{1}\left (y_{1}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |$$ 260·2
$$K_{28}^{7}, K_{28}^{1}, K_{27}^{3}$$   $$X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{0}^{5}\left |X_{0}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |$$
$$K_{26}^{2}, K_{25}^{0}, K_{28}^{0}$$   $$X_{23}^{3}$$
$$K_{27}^{1}, K_{28}^{6}, K_{26}^{3}$$
$$\left (K_{24}^{1}\right), K_{27}^{4}$$
$$\left (K_{28}^{5}\right), K_{27}^{5}, K_{26}^{7}$$
2 $$K_{1}^{2}$$ 260·264+4·2 $$y_{2}\left (y_{2}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |$$ 256·2
$$X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{1}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}$$
3 $$K_{2}^{6}$$ 256·268+4·2 $$y_{3}\left (y_{3}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |$$ 252·2
$$X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{2}^{10}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}$$
4 $$K_{1}^{7}$$ 252·272+4·2 $$y_{4}\left (y_{4}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |$$ 248·2
$$X_{0}^{6}\left |X_{1}^{14}\right | X_{2}^{10}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}$$
5 $$K_{3}^{5}$$ 248·276+4·2 $$y_{5}\left (y_{5}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |$$ 244·2
$$X_{0}^{6}\left |X_{3}^{2}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}$$
6 $$K_{1}^{3}$$ 244·280+4·2 $$y_{6}\left (y_{6}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{1}^{8}\right |$$ 240·2
$$X_{3}^{2}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}$$
7 $$K_{2}^{4}\left (K_{4}^{1}\right)$$ 240·284+4·4 $$y_{7}\left (y_{7}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{4}^{4}\right |$$ 236·2
$$X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}$$
8 $$K_{1}^{5}$$ 236·288+4·2 $$y_{8}\left (y_{8}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{0}^{1}\left |X_{0}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right |$$ 232·2
$$X_{25}^{15} | X_{23}^{3}$$
9 $$K_{1}^{0}$$ 232·292+4·2 $$y_{9}\left (y_{9}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{1}^{0}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |$$ 228·2
$$X_{23}^{3}$$
10 $$K_{2}^{0}$$ 228·296+4·2 $$y_{10}\left (y_{10}^{\prime }\right)=X_{1}^{2}\left |X_{2}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}$$ 224·2
11 $$K_{3}^{0}$$ 224·2100+4·2 $$y_{11}\left (y_{11}^{\prime }\right)=X_{4}^{5}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}$$ 220·2
12 $$K_{5}^{2}$$ 220·2104+4·2 $$y_{12}\left (y_{12}^{\prime }\right)=X_{5}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}$$ 216·2
13 $$K_{25}^{6}$$ 216·2108+4·2 $$y_{13}\left (y_{13}^{\prime }\right)=X_{5}^{12}\left |X_{23}^{8}\right | X_{23}^{3}$$ 212·2
14 $$K_{23}^{3}$$ 212·2112+4·2 $$y_{14}\left (y_{14}^{\prime }\right)=X_{5}^{12} | X_{22}^{7}$$ 28·2