High Probability Linear Hulls in

In this paper, we demonstrate that the linear hull eeect is signiicant for the Q cipher. The designer of Q performs preliminary linear cryptanalysis by discussing linear characteristics involving only a single active bit at each stage 13]. We present a simple algorithm which combines all such linear characteristics with identical rst and last masks into a linear hull. The expected linear probability of the best such linear hull over 7.5 rounds (8 full rounds minus the rst S substitution) is 2 ?90:1. In contrast, the best known expected diierential probability over the same rounds is 2 ?110:5 2]. Choosing a sequence of linear hulls, we get a straightforward attack which can recover a 128-bit key with success rate 98.4%, using 2 97 known hplaintext; ciphertexti pairs and no trial encryptions.