The Effectiveness of the Linear性线的E字形.pdfVIP

The Effectiveness of the Linear Hull Effect S. Murphy Information Security Group Department of Mathematics Royal Holloway University of London Egham, Surrey TW20 0EX, U.K. Abstract. There is no linear hull effect in linear cryptanalysis. Keywords. Linear cryptanalysis, linear hull effect, Jensen’s inequality. 1 Introduction Linear cryptanalysis [7] is one of the standard techniques of assessing the se- curity of block ciphers and is based on linear approximations to the plaintext, ciphertext and key. In our discussion of linear approximations, we consider an iterated block cipher encryption with plaintext p , ciphertext c and extended key k, where p , c and k are binary column vectors. We define the extended key k as the concatenation of the the round subkeys derived from the block cipher key through the key schedule. A linear approximation in its most basic form is usually regarded as a statement of the form αT p = αT p + αT c = γT k with probability 1 (1 + γ ). P C 2 c The vectors α, αP and αC are known respectively as the (overall) data mask, the plaintext mask and the ciphertext mask, with αT = αT αT , and the vector γ as P C the key mask. The value γ is known as the imbalance or correlation of the linear approximation, and 1 γ as the bias of the linear approximation. If the linear 2 expression is unbiased, that is γ = 0, then the linear expression can potentially be used to give an estimate of one bit γT k