Results of Linear Cryptanalysis Using Linear Sieve Methods

Yukiyasu TSUNOO  Hiroki NAKASHIMA  Hiroyasu KUBO  Teruo SAITO  Takeshi KAWABATA  

IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences   Vol.E92-A   No.5   pp.1347-1355
Publication Date: 2009/05/01
Online ISSN: 1745-1337
DOI: 10.1587/transfun.E92.A.1347
Print ISSN: 0916-8508
Type of Manuscript: PAPER
Category: Cryptography and Information Security
block cipher,  linear cryptanalysis,  linear sieve method,  

Full Text: PDF(355KB)>>
Buy this Article

Linear cryptanalysis using sieve methods is a technique proposed by Takeda et al. in 1998 as an attack capable of breaking ciphers with smaller amounts of data than linear cryptanalysis (LC) by using data that satisfies linear sieve conditions. This paper shows that when considering the amount of data required for cryptanalysis in Takeda et al.'s proposed sieved linear cryptanalysis (S-LC), it is necessary to take into account the independence of keys relating to the linear mask (Linear key) and keys relating to the linear sieve mask (Sieve key) in rounds that are affected by these keys. If p is the probability that the linear approximate expression holds and p* is the probability after applying the linear sieve, then it has been shown that when the Linear keys are independent of the Sieve keys, then it is necessary to select the linear mask and linear sieve mask so that a larger value of p*-p is obtained. It is also shown that the amount of data needed for S-LC cannot be reduced below the amount of data needed for LC when the Linear key and Sieve key are not independent. In fixed sieve linear cryptanalysis, it is shown that the amount of data needed for cryptanalysis cannot be reduced regardless of the independence of the Linear key and Sieve key.