The Complete Distribution of Linear Probabilities of MARS' s-box

This paper shows the complete linear probability distribution of MARS’ s-box. The best bias is 84 29 (= 2−2.61), while the designers’ estimation is 64 29 and the best previously known bias is 82 29 . Knudsen showed that the designers’ estimation of the maximum linear probability of MARS’ s-box is not rigorous in their submission document for AES [1]. The fact was also pointed out by Robshaw and Yin [2]. However, two papers said that they had insufficient computational power to calculate all linear probabilities of MARS’ s-box. When reading their papers, we wanted to know the maximum bias, and fortunately, we have sufficient computational power to calculate all linear probabilities of MARS’ s-box. Using about 2 months idle time of our processors, we successfully calculated all linear probabilities of MARS’ s-box. As a result, we have the following equation. #{x ∈ GF(2) | x • 0x185 = s(x) • 0x8c29952a} = 2 + 84 The complete distribution is shown in Table 1. Note that Table 1 does not show the 0 frequency. Table 1: Linear Probability Distribution of MARS’ s-box bias×29 frequency bias×29 frequency bias×29 frequency bias×29 frequency 0 77498737588 22 23436811453 44 78537345 66 5116 1 154403399557 23 19654715551 45 55634661 67 2956 2 152613000039 24 16354783059 46 38766823 68 1748 3 149664380489 25 13508041742 47 26922474 69 1040 4 145634858332 26 11061383868 48 18356631 70 568 5 140608578512 27 8988754470 49 12658700 71 309 6 134709616782 28 7248964608 50 8593540 72 200 7 128054979415 29 5797310622 51 5751620 73 112 8 120762019591 30 4599995243 52 3800517 74 54 9 113025372318 31 3624000238 53 2482800 75 31 1