Multidimensional linear cryptanalysis with key difference invariant bias for block ciphers

Abstract For block ciphers, Bogdanov et al. found that there are some linear approximations satisfying their biases deterministically invariant under key difference. This property is called difference bias. Based on this property, proposed a related-key statistical distinguisher and turned it into key-recovery attacks LBlock TWINE-128. In paper, we propose new model by combining multidimensional cryptanalysis with The main theoretical advantage our does not depend independence of approximations. We demonstrate technique performing recovery By using the relations involved round keys to reduce number guessed subkey bits. Moreover, partial-compression used time complexity. can recover master up 25 rounds about 2 60.4 distinct known plaintexts, 78.85 complexity 61 bytes memory requirements. Our attack TWINE-128 28 61.5 126.15 results currently best ones