{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.tr.linear-cryptanalysis","code":"thing-q1826463","url":"https://ver.cy/models/thing/q1826463/","name":"linear cryptanalysis","alternateNames":[],"kind":"thing","status":"published","version":"0.1.0-research.1","language":"en","classifiers":{"family":"Thing Registry","category":"Activities and processes","entryKind":"thing","plane":"ACT","domain":["ACT.ACT"],"industry":[],"navPath":"","tags":[],"facets":{}},"whatItIs":"Linear cryptanalysis is a statistical method for analysing symmetric ciphers, especially block ciphers, that exploits biased affine relations among plaintext, ciphertext and key bits to distinguish cipher behaviour from an ideal random mapping or recover key information.","purpose":"Enable an AI agent to recognise linear cryptanalysis, assess the evidence and resources supporting a proposed attack, and select justified analysis or validation steps.","scope":{"in":["Binary masks, parity relations, approximation endpoints and round coverage","Linear trails, linear hulls and key-dependent correlation estimates","Single, multiple and multidimensional approximation methods, with explicitly identified extensions","Plaintext-ciphertext sampling assumptions and statistical distinguishers","Key-bit inference, partial-key ranking and remaining key-search requirements","Attack complexity, experimental validation and limits of security conclusions"],"out":["Complete specifications and implementation histories of target ciphers","Differential cryptanalysis except where a hybrid explicitly incorporates a linear stage","General algebraic equation solving without a statistical linear-approximation mechanism","Physical leakage acquisition and side-channel instrumentation","Operational intrusion, credential management and exploitation of deployed systems"],"boundaries":[]},"distinguishingFeatures":["The proposed mechanism identifies binary parity masks over cryptographic inputs, outputs or intermediate states and explains how their statistical behaviour supports inference.","A classical biased approximation specifies a parity event whose probability differs from one half; a zero-correlation extension must explicitly identify its different distinguishing mechanism.","The evidence concerns parity distributions across samples, whereas differential cryptanalysis concerns propagation of differences between related inputs.","The relation is evaluated statistically rather than assumed to be an exact equation that every encryption satisfies.","A key-recovery claim identifies how parity statistics reveal key information or rank guesses; a distinguisher alone does not establish full key recovery."],"structure":{"bundles":[{"id":"attack-identity-and-target","name":"Attack identity and target","description":"Record what qualifies the activity as linear cryptanalysis and exactly which cryptographic transformation it addresses.","layers":[{"id":"method-boundary","name":"Method boundary","description":"Separate classical biased approximations from extensions and neighbouring attack families.","findings":[{"id":"linear-inference-mechanism","name":"Linear inference mechanism","description":"Identify the parity observable, its expected statistical behaviour and the inference it supports.","questions":[{"text":"Which binary linear relation and statistical property make this an instance of linear cryptanalysis?","id":"linear-inference-mechanism-q01","kind":"definition"},{"text":"If described as zero-correlation, differential-linear or another extension, which stage belongs to this model and which belongs to a neighbouring method?","id":"linear-inference-mechanism-q02","kind":"boundary"}]}]},{"id":"cipher-coverage","name":"Cipher coverage","description":"Bind the analysis to the actual cipher variant and round interval.","findings":[{"id":"specified-target","name":"Specified target","description":"Record block size, key size, round count, key schedule assumptions and any altered or omitted operations.","questions":[{"text":"Which specification and parameter set define the attacked transformation, including whitening and the key schedule?","id":"specified-target-q01","kind":"provenance"},{"text":"Which rounds form the approximation and which additional rounds are handled through key guessing?","id":"specified-target-q02","kind":"boundary"}]}]}]},{"id":"approximation-construction","name":"Approximation construction","description":"Represent how local parity relations become a candidate approximation over the target interval.","layers":[{"id":"local-mask-relations","name":"Local mask relations","description":"Identify the component relations and numerical conventions used in construction.","findings":[{"id":"mask-and-table-conventions","name":"Mask and table conventions","description":"Record mask orientation, bit numbering and whether local table entries represent counts, biases, correlations or another normalisation.","questions":[{"text":"What exact parity equation does each mask encode, including any affine constant or key parity?","id":"mask-and-table-conventions-q01","kind":"definition"},{"text":"How were component approximation values computed, and what normalisation and input distribution do they use?","id":"mask-and-table-conventions-q02","kind":"measurement"}]}]},{"id":"trail-and-hull-composition","name":"Trail and hull composition","description":"Separate an individual sequence of internal masks from the combined endpoint relation.","findings":[{"id":"composed-correlation-basis","name":"Composed correlation basis","description":"Require the derivation to identify included trails, signs, omitted contributions and assumptions about round keys or statistical independence.","questions":[{"text":"Does the reported correlation describe one trail, a partial hull sum or the complete endpoint relation?","id":"composed-correlation-basis-q01","kind":"definition"},{"text":"Which composition assumptions are justified, and how are key-dependent signs and cancellation between trails handled?","id":"composed-correlation-basis-q02","kind":"boundary"}]}]}]},{"id":"sampling-and-statistical-evidence","name":"Sampling and statistical evidence","description":"Connect approximation predictions to observations under a declared data-generating process.","layers":[{"id":"data-population","name":"Data population","description":"Specify how plaintext-ciphertext pairs are generated, selected and grouped by key.","findings":[{"id":"usable-sample-accounting","name":"Usable sample accounting","description":"Record sample counts, repeated inputs, input restrictions and whether observations share the key assumed by the analysis.","questions":[{"text":"What plaintext distribution, access model and key-reuse conditions does the statistical prediction require?","id":"usable-sample-accounting-q01","kind":"boundary"},{"text":"How many usable pairs remain after filtering, and how do duplicates or sampling without replacement affect the calculation?","id":"usable-sample-accounting-q02","kind":"measurement"}]}]},{"id":"test-and-dependence-model","name":"Test and dependence model","description":"Identify the test statistic and treatment of relationships between approximation outputs.","findings":[{"id":"calibrated-parity-test","name":"Calibrated parity test","description":"Record null and alternative distributions, thresholds and approximation dependencies. Multidimensional methods can model joint behaviour without assuming independent approximation outputs. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).","questions":[{"text":"Which statistic and threshold achieve the stated false-positive and success probabilities under the declared sampling regime?","id":"calibrated-parity-test-q01","kind":"measurement"},{"text":"How are dependencies among approximations and selection effects from searching many masks incorporated or experimentally checked?","id":"calibrated-parity-test-q02","kind":"measurement"}]}]}]},{"id":"key-inference-and-cost","name":"Key inference and cost","description":"Explain what information the statistics recover and what work remains to obtain a verified key.","layers":[{"id":"recovery-mechanism","name":"Recovery mechanism","description":"Map statistical outcomes to key parities, guessed subkeys and candidate rankings.","findings":[{"id":"key-information-yield","name":"Key information yield","description":"Separate key-parity inference from partial-key ranking: Matsui's Algorithm 1 and Algorithm 2 exemplify these distinct outcomes. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).","questions":[{"text":"Which key parity or subkey bits are inferred, guessed or left unresolved by the statistical stage?","id":"key-information-yield-q01","kind":"definition"},{"text":"How are surviving subkey candidates mapped through the key schedule and verified against additional encryption pairs?","id":"key-information-yield-q02","kind":"action"}]}]},{"id":"end-to-end-complexity","name":"End-to-end complexity","description":"Account for the complete attack under a stated performance target.","findings":[{"id":"comparable-resource-estimate","name":"Comparable resource estimate","description":"Include data acquisition, preprocessing, guess evaluation, ranking, memory and residual search with clearly stated cost units.","questions":[{"text":"What are the total data, time and memory costs at the claimed success probability, including residual key search?","id":"comparable-resource-estimate-q01","kind":"measurement"},{"text":"Under matching resources and success criteria, does the complete procedure improve on exhaustive search or another stated baseline?","id":"comparable-resource-estimate-q02","kind":"measurement"}]}]}]},{"id":"validation-and-security-interpretation","name":"Validation and security interpretation","description":"Establish what has been demonstrated and how far the result supports a security conclusion.","layers":[{"id":"reproducible-evaluation","name":"Reproducible evaluation","description":"Preserve enough derivation and experimental context to independently test the claim.","findings":[{"id":"prediction-versus-observation","name":"Prediction versus observation","description":"Compare predicted correlations and recovery rates with measurements across explicitly selected keys and datasets.","questions":[{"text":"Which paper sections, derivations, code versions and experiment settings support each reported attack result?","id":"prediction-versus-observation-q01","kind":"provenance"},{"text":"Across how many independently sampled keys and trials do observed correlations, candidate ranks and success rates match the prediction?","id":"prediction-versus-observation-q02","kind":"measurement"}]}]},{"id":"claim-limits-and-next-actions","name":"Claim limits and next actions","description":"Translate the evidence into a bounded conclusion and a useful follow-up decision.","findings":[{"id":"supported-security-conclusion","name":"Supported security conclusion","description":"State whether the evidence establishes a component property, reduced-round distinguisher, partial recovery or complete attack under specific conditions.","questions":[{"text":"Which restrictions on rounds, keys, data access or resources prevent this result from establishing a practical break of the deployed cipher?","id":"supported-security-conclusion-q01","kind":"boundary"},{"text":"Which next experiment would most directly test the assumption currently limiting the attack claim?","id":"supported-security-conclusion-q02","kind":"action"}]}]}]},{"id":"evidence-and-external-alignment","name":"Evidence and external alignment","description":"What the world already says about this thing, gathered so the model can be checked against it.","layers":[{"id":"reported-evidence","name":"Reported evidence","description":"Findings from the breadth pass, kept separate from the structural claims.","findings":[{"id":"evidence-confidence-notes","name":"Check these first","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these check these first hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-confidence-notes-q01","kind":"provenance"}]},{"id":"evidence-kinds","name":"Kinds and varieties","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these kinds and varieties hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-kinds-q01","kind":"provenance"}]},{"id":"evidence-real-world-use","name":"Real-world use","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these real-world use hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-real-world-use-q01","kind":"provenance"}]},{"id":"evidence-measurements","name":"Typical measurements","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these typical measurements hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-measurements-q01","kind":"provenance"}]},{"id":"evidence-failure-modes-and-hazards","name":"Failure modes and hazards","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these failure modes and hazards hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-failure-modes-and-hazards-q01","kind":"provenance"}]},{"id":"evidence-neighbours","name":"Neighbouring kinds and how to tell them apart","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these neighbouring kinds and how to tell them apart hold for the sense of linear cryptanalysis this model covers, and on what evidence?","id":"evidence-neighbours-q01","kind":"provenance"}]}]}]}]},"agentConduct":{"may":["Explain linear cryptanalysis at a conceptual level and its role in cipher design.","Assess cipher designs the agent's user owns or is authorized to test."],"mustNot":["Attack encryption protecting systems or data the agent's user is not authorized to test.","Help break the confidentiality of other people's communications.","Claim a cipher is secure based only on resisting this one method."],"requiresHuman":["Publishing new attacks on ciphers in active use."]},"ethics":{"considerations":["Cryptanalysis protects people by revealing weak ciphers but can also expose private data.","Responsible disclosure gives users time to switch to stronger systems."],"affectedParties":["Users of encrypted systems","Cipher designers"]},"owners":{"steward":"Nobody owns the method; researchers answer for its use.","roles":[],"masterSystems":[]},"relations":[{"target":"Q19845322","type":"parent","note":"registry parent class"}],"interaction":{"identity":{"applicability":"required","items":["Vercy registry: vr.tr.linear-cryptanalysis","Wikidata: Q1826463 (https://www.wikidata.org/wiki/Q1826463)"]},"properties":{"applicability":"not-applicable","items":["Target and approximation interval: Cipher specification, parameter set, total rounds, approximation start and end states","Method family: Single approximation; multiple approximations; multidimensional; zero-correlation extension; explicitly described hybrid","Approximation masks: Input, output, intermediate and optional key masks with bit ordering and parity convention","Signed bias and correlation: For the declared parity-zero event: p in [0,1], bias ε=p−1/2, correlation c=2p−1; dimensionless","Approximation-set dimension: Binary rank of the mask basis, alongside the number of approximations evaluated","Sampling regime: Known or chosen plaintext; fixed or varying key; sampling with or without replacement; declared input distribution","Attack resources: Data pairs, bytes of memory, operations in a declared unit, and optional measured runtime","Inference performance: Success probability, false-positive probability, retained key-candidate fraction and confidence intervals","Evidence maturity: Proposed; analytically derived; simulated; experimentally reproduced; contradicted"]},"recognition":{"applicability":"optional","items":["Appears in research papers and cipher design documents as linear approximations and bias tables."]},"capabilities":{"applicability":"required","items":["Construct or inspect masks for a specified cipher interval and check their parity conventions.","Compare candidate approximations while preserving trail, hull and key-dependence distinctions.","Estimate data requirements under explicit sampling and statistical assumptions.","Evaluate parity statistics on controlled datasets and rank partial-key candidates.","Compare complete attack costs and success rates with a matching search baseline.","Identify unsupported extrapolations and choose experiments that resolve them."]},"hazards":{"applicability":"required","items":["Weak ciphers left in use expose data.","Misuse against systems without authorization."]},"interfaces":{"applicability":"not-applicable","items":[]},"context":{"applicability":"required","items":["Linear cryptanalysis is used in cryptographic research to evaluate whether statistical biases weaken a symmetric cipher.","It supports comparisons of cipher designs and security claims by relating exploitable bias to data requirements and computational effort."]}},"sources":[{"title":"Wikidata item Q1826463: linear cryptanalysis","url":"https://www.wikidata.org/wiki/Q1826463","note":"identity and sense of the item"},{"title":"Wikipedia: Linear cryptanalysis","url":"https://en.wikipedia.org/wiki/Linear_cryptanalysis","note":"general description of the item"}],"openQuestions":["Should zero-correlation linear cryptanalysis be represented as a subtype here or linked to a separately registered method, given its different statistical mechanism?","Which primary references should anchor the distinctions among classical, multiple, multidimensional and hybrid variants?","For each modelled attack, how much do full-hull contributions and the actual key schedule change estimates obtained from selected trails?","Which right-key and wrong-key statistical assumptions remain accurate for the target cipher, sampling regime and number of key hypotheses?","What evidence threshold should distinguish a reproduced research attack from a practical security compromise when data acquisition and residual key search are included?"],"resources":{"spec":"/models/things/publications/thing-q1826463/spec.json"},"provenance":{"origin":"thing registry research (pass 2)","builtFrom":["models/things/publications/thing-q1826463/spec.json"],"providers":["Codex"],"researchStatus":"unreviewed","generatedAt":"2026-09-12T10:58:19Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"filled","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"not-applicable","interaction.context":"filled","sources":"filled"},"notes":{"_gate":"Published through the thing publication gate 1.0 on 2026-10-07T10:10:27+00:00: completeness 1.00; sense: Wikidata description; 2 live sources; review by codex: pass","interaction.properties":"Plane ACT: no invented physical properties.","interaction.interfaces":"No specific standard or official classification governs linear cryptanalysis as a general analytical method."},"score":1.0}}