Diierential-linear Cryptanalysis of Idea

In this paper we describe an attack on 3 rounds of IDEA, making use of linear as well as diierential cryptanalytic techniques. The attack is independent of the key schedule. The main attack requires at most 2 29 chosen plaintext pairs and a workload of about 2 49 additions modulo 2 16 + 1 to nd two subkeys or their additive inverses modulo 2 16 + 1. Further we describe a method, which then can nd two more subkeys or their additive inverses modulo 2 16 + 1, which needs less than 10 of the already encrypted pairs and a total workload of at most 2 33 multiplications modulo 2 16 +1. This attack is more powerful than all previously published general attacks on the IDEA structure.