Table 7 Partial encryption and decryption on 27-round TWINE-128

Step Guess Time Obtained States Size
1 $$K_{1}^{3}, K_{1}^{5}, K_{2}^{4}$$ N·24×9·2·10 $$X_{1}^{2}\left |X_{2}^{0}\right | X_{4}^{4}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{27}^{2}\left |X_{27}^{9}\right |$$ 260·2
$$K_{1}^{7}, K_{1}^{2}, K_{2}^{6}$$   $$X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right | X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}$$
$$K_{3}^{5},\left (K_{4}^{1}\right)$$
$$K_{1}^{0}, K_{2}^{0}$$
2 $$K_{3}^{0}$$ 260·236+4·2 $$X_{4}^{5}\left |X_{4}^{4}\right | X_{27}^{6}\left |X_{27}^{13}\right | X_{27}^{11}\left |X_{27}^{2}\right | X_{27}^{9}\left |X_{27}^{4}\right |$$ 256·2
$$X_{27}^{1}\left |X_{27}^{12}\right | X_{27}^{7}\left |X_{27}^{15}\right | X_{27}^{8} | X_{27}^{3}$$
3 $$K_{5}^{2}$$ 256·240+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{27}^{2}\left |X_{27}^{9}\right | X_{27}^{4}\left |X_{27}^{1}\right |$$ 252·2
$$X_{27}^{12}\left |X_{27}^{7}\right | X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}$$
4 $$K_{27}^{5}$$ 252·244+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{27}^{11}\right | X_{26}^{11}\left |X_{27}^{4}\right | X_{27}^{1}\left |X_{27}^{12}\right |$$ 248·2
$$X_{27}^{7}\left |X_{27}^{15}\right | X_{27}^{8} | X_{27}^{3}$$
5 $$K_{26}^{7}$$ 248·248+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |$$ 244·2
$$X_{27}^{15}\left |X_{27}^{8}\right | X_{27}^{3}$$
6 $$K_{27}^{3}$$ 244·252+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |$$ 240·2
$$X_{27}^{15} | X_{26}^{7}$$
7 $$K_{26}^{2}$$ 240·256+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{25}^{4}\left |X_{27}^{1}\right | X_{27}^{12}\left |X_{27}^{7}\right |$$ 236·2
$$X_{25}^{5}$$
8 $$K_{27}^{2}$$ 236·260+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{27}^{4}\left |X_{27}^{1}\right | X_{26}^{5} | X_{25}^{5}$$ 232·2
9 $$K_{27}^{1}$$ 232·264+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3}\left |X_{26}^{5}\right | X_{25}^{5}$$ 228·2
10 $$K_{25}^{0}$$ 228·268+4·2 $$X_{5}^{12}\left |X_{27}^{6}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3} | X_{24}^{1}$$ 224·2
11 $$K_{27}^{4}$$ 224·272+4·2 $$X_{5}^{12}\left |X_{26}^{9}\right | X_{27}^{13}\left |X_{25}^{15}\right | X_{26}^{3} | X_{24}^{1}$$ 224·2
12 $$K_{26}^{3}$$ 224·276+4·2 $$X_{5}^{12}\left |X_{26}^{9}\right | X_{25}^{15}\left |X_{25}^{7}\right | X_{24}^{1}$$ 220·2
13 $$K_{25}^{6}$$ 220·280+4·2 $$X_{5}^{12}\left |X_{23}^{8}\right | X_{25}^{7} | X_{24}^{1}$$ 216·2
14 $$K_{24}^{1}$$ 216·284+4·2 $$X_{5}^{12}\left |X_{23}^{8}\right | X_{23}^{3}$$ 212·2
15 $$K_{23}^{3}$$ 212·288+4·2 $$X_{5}^{12} | X_{22}^{7}$$ 28·2