Two open problems on using Matsui’s Algorithm 2 with multiple linear approximations posed earlier by Biryukov, De Cannière and M. Quisquater at Crypto’04 are solved in the present paper. That improves the linear cryptanalysis of 16-round DES reported by Matsui at Crypto’94. keywords: linear cryptanalysis, multiple linear approximations, success probability, MRHS linear equations, gluing algorithm.

Abstract: In the paper we present the results which enable to calculate the nonlinearity of the round function with quite large dimensions, e.g. 32× 32 bits, which are used in some block ciphers. It can be used to estimate resistance of these ciphers against linear cryptanalysis. We give the application to linear cryptanalysis of the TGR block cipher.

Most last-round attacks on iterated block ciphers provide some design criteria for the round function. Here, we focus on the links between the underlying properties. Most notably, we investigate the relations between the functions which oppose a high resistance to linear cryptanalysis and to differential cryptanalysis.