3

In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says

The maximum bias of a linear approximation through one S-box is $2^{-4}$ , which gives a linear probability of $2^{-6}$

what does this mean? isn't the linear approximation probability $2^{-4}$?

See This Question Too

Community
  • 1
crypt
  • 2,522
  • 22
  • 33

1 Answers1

6

Let $LP$ be the linear probability (also called "correlation potential"), $Cor$ be the correlation coefficient and $\epsilon$ be the bias of a linear approximation. Then

$LP = Cor^2 = (2\times \epsilon)^2$.

So, if $\epsilon=2^{-4}$, then $LP = ({2\times 2^{-4}})^2=2^{-6}$.

[1] Daemen, J., Rijmen, V.: Probability distributions of correlation and differentials in block ciphers. J. Mathematical Cryptology 1(3), 221–242 (2007). DOI 10.1515/JMC.2007.011. URL http://jda.noekeon.org/JDA_VRI_Stat_2007.pdf

FreeDisciplina
  • 61
  • 1