Improving the Upper Bound on the Maximum Average Linear Hull Probability for Rijndael

In 15], Keliher et al. present a new method for upper bounding the maximum average linear hull probability (MALHP) for SPNs, a value which is required to make claims about provable security against linear cryptanalysis. Application of this method to Rijndael (AES) yields an upper bound of UB = 2 ?75 when 7 or more rounds are approximated, corresponding to a lower bound on the data complexity of 32 UB = 2 80 (for a 96.7% success rate). In the current paper, we improve this upper bound for Rijndael by taking into consideration the distribution of linear probability values for the (unique) Rijndael 88 s-box. Our new upper bound on the MALHP when 9 rounds are approximated is 2 ?92 , corresponding to a lower bound on the data complexity of 2 97 (again for a 96.7% success rate). This is after completing 43% of the computation; however, we believe that values have stabilized|see Section 7.]