Skip to main content

Table 7 Partial encryption and decryption on 27-round TWINE-128

From: Multidimensional linear cryptanalysis with key difference invariant bias for block ciphers

Step Guess Time Obtained States Size
1 \( K_{1}^{3}, K_{1}^{5}, K_{2}^{4} \) N·24×9·2·10 \(X_{1}^{2}\left |X_{2}^{0}\right | X_{4}^{4}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{27}^{2}\left |X_{27}^{9}\right |\) 260·2
  \(K_{1}^{7}, K_{1}^{2}, K_{2}^{6}\)   \(X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right | X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}\)  
  \(K_{3}^{5},\left (K_{4}^{1}\right)\)    
  \(K_{1}^{0}, K_{2}^{0}\)    
2 \(K_{3}^{0}\) 260·236+4·2 \(X_{4}^{5}\left |X_{4}^{4}\right | X_{27}^{6}\left |X_{27}^{13}\right | X_{27}^{11}\left |X_{27}^{2}\right | X_{27}^{9}\left |X_{27}^{4}\right |\) 256·2
    \(X_{27}^{1}\left |X_{27}^{12}\right | X_{27}^{7}\left |X_{27}^{15}\right | X_{27}^{8} | X_{27}^{3}\)  
3 \(K_{5}^{2}\) 256·240+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{27}^{2}\left |X_{27}^{9}\right | X_{27}^{4}\left |X_{27}^{1}\right |\) 252·2
    \(X_{27}^{12}\left |X_{27}^{7}\right | X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}\)  
4 \(K_{27}^{5}\) 252·244+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{26}^{11}\left |X_{27}^{4}\right | X_{27}^{1}\left |X_{27}^{12}\right |\) 248·2
    \(X_{27}^{7}\left |X_{27}^{15}\right | X_{27}^{8} | X_{27}^{3}\)  
5 \(K_{26}^{7}\) 248·248+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |\) 244·2
    \(X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}\)  
6 \(K_{27}^{3}\) 244·252+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |\) 240·2
    \(X_{27}^{15} | X_{26}^{7}\)  
7 \(K_{26}^{2}\) 240·256+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{25}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |\) 236·2
    \(X_{25}^{5}\)  
8 \(K_{27}^{2}\) 236·260+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{26}^{5} | X_{25}^{5}\) 232·2
9 \(K_{27}^{1}\) 232·264+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3}\left |X_{26}^{5}\right | X_{25}^{5}\) 228·2
10 \(K_{25}^{0}\) 228·268+4·2 \(X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3} | X_{24}^{1}\) 224·2
11 \(K_{27}^{4}\) 224·272+4·2 \(X_{5}^{12}\left |X_{26}^{9}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3} | X_{24}^{1}\) 224·2
12 \(K_{26}^{3}\) 224·276+4·2 \(X_{5}^{12}\left |X_{26}^{9}\right | X_{25}^{15}\left |X_{25}^{7}\right | X_{24}^{1}\) 220·2
13 \(K_{25}^{6}\) 220·280+4·2 \(X_{5}^{12}\left |X_{23}^{8}\right | X_{25}^{7} | X_{24}^{1}\) 216·2
14 \(K_{24}^{1}\) 216·284+4·2 \(X_{5}^{12}\left |X_{23}^{8}\right | X_{23}^{3}\) 212·2
15 \(K_{23}^{3}\) 212·288+4·2 \(X_{5}^{12} | X_{22}^{7}\) 28·2