Notes in Computer Science 1372

We show that the linear cryptanalytic attack on RC5 that was published by Kaliski and Yin at Crypto’95 does not work as expected due to the failure of some hidden assumptions involved. Then we present new linear attacks on RC5. Our attacks use the same linear approximation as the one used by Kaliski and Yin. Therefore, the plaintext requirement of our attack is around 4w2r−2 which is impractically high for reasonably high values of w and r. These new attacks has also significances beyond the linear cryptanalysis of RC5 to show how linear cryptanalysis can carry on when the approximation used has a non-zero bias for the wrong key values. We also discuss certain issues about linear cryptanalysis of RC5 that need to be resolved for a better linear attack.