Improving the Search Algorithm for the Best Linear Expression

It is important to find the best linear expression to estimate the vulnerability of cryptosystems to Linear Cryptanalysis. This paper presents a method to improve Matsui’s search algorithm which determines the best linear expression. This method is based on analyzing the dominant factor of search complexity. We introduce the search pattern in order to reduce unnecessary search candidates, and apply the proposed search algorithm to DES and FEAL. The n-round best linear expressions of DES are found as fast as Matsui’s algorithm for n ≤ 32. Those of FEAL are found much faster than his algorithm; the required time is decreased from over three months to about two and a half days. New results for FEAL are also described; we find the n-round best linear expressions (n ≤ 32) with higher deviations than those derived from Biham’s 4-round iterative linear approximations.