Linear Approximations of Addition Modulo 2n
We present an in-depth algorithmic study of the linear approximations of addition modulo 2 n . Our results are based on a fairly simple classification of the linear approximations of the carry function. Using this classification, we derive an Θ(logn)-time algorithm for computing the correlation of linear approximation of addition modulo 2 n , an optimal algorithm for generating all linear approximations with a given non-zero correlation coefficient, and determine the distribution of the correlation coefficients. In the generation algorithms, one or two of the selection vectors can optionally be fixed. The algorithms are practical and easy to implement.
KeywordsLinear approximations correlation modular addition linear cryptanalysis
- 4.Daemen, J.: Cipher and Hash Function Design: Methods Based on Linear and Differential Cryptanalysis. PhD thesis, Katholieke Universiteit Leuven (March 1995)Google Scholar
- 8.Matsui, M.: Linear cryptanalysis method for DES cipher. In: Helleseth, T. (ed.) EUROCRYPT 1993. LNCS, vol. 765, pp. 386–397. Springer, Heidelberg (1994)Google Scholar
- 10.Matsui, M.: New structure of block ciphers with provable security against differential and linear cryptanalysis. In: Gollmann, D. (ed.) FSE 1996. LNCS, vol. 1039, pp. 205–218. Springer, Heidelberg (1996)Google Scholar