linear cryptanalysis

Linear inference mechanism

Identify the parity observable, its expected statistical behaviour and the inference it supports.

1. Which binary linear relation and statistical property make this an instance of linear cryptanalysis? definition
2. If described as zero-correlation, differential-linear or another extension, which stage belongs to this model and which belongs to a neighbouring method? boundary

Specified target

Record block size, key size, round count, key schedule assumptions and any altered or omitted operations.

1. Which specification and parameter set define the attacked transformation, including whitening and the key schedule? provenance
2. Which rounds form the approximation and which additional rounds are handled through key guessing? boundary

Mask and table conventions

Record mask orientation, bit numbering and whether local table entries represent counts, biases, correlations or another normalisation.

1. What exact parity equation does each mask encode, including any affine constant or key parity? definition
2. How were component approximation values computed, and what normalisation and input distribution do they use? measurement

Composed correlation basis

Require the derivation to identify included trails, signs, omitted contributions and assumptions about round keys or statistical independence.

1. Does the reported correlation describe one trail, a partial hull sum or the complete endpoint relation? definition
2. Which composition assumptions are justified, and how are key-dependent signs and cancellation between trails handled? boundary

Usable sample accounting

Record sample counts, repeated inputs, input restrictions and whether observations share the key assumed by the analysis.

1. What plaintext distribution, access model and key-reuse conditions does the statistical prediction require? boundary
2. How many usable pairs remain after filtering, and how do duplicates or sampling without replacement affect the calculation? measurement

Calibrated parity test

Record null and alternative distributions, thresholds and approximation dependencies. Multidimensional methods can model joint behaviour without assuming independent approximation outputs. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).

1. Which statistic and threshold achieve the stated false-positive and success probabilities under the declared sampling regime? measurement
2. How are dependencies among approximations and selection effects from searching many masks incorporated or experimentally checked? measurement

Key information yield

Separate key-parity inference from partial-key ranking: Matsui's Algorithm 1 and Algorithm 2 exemplify these distinct outcomes. [Hermelin, Cho and Nyberg](https://link.springer.com/article/10.1007/s00145-018-9308-x).

1. Which key parity or subkey bits are inferred, guessed or left unresolved by the statistical stage? definition
2. How are surviving subkey candidates mapped through the key schedule and verified against additional encryption pairs? action

Comparable resource estimate

Include data acquisition, preprocessing, guess evaluation, ranking, memory and residual search with clearly stated cost units.

1. What are the total data, time and memory costs at the claimed success probability, including residual key search? measurement
2. Under matching resources and success criteria, does the complete procedure improve on exhaustive search or another stated baseline? measurement

Prediction versus observation

Compare predicted correlations and recovery rates with measurements across explicitly selected keys and datasets.

1. Which paper sections, derivations, code versions and experiment settings support each reported attack result? provenance
2. Across how many independently sampled keys and trials do observed correlations, candidate ranks and success rates match the prediction? measurement

Supported security conclusion

State whether the evidence establishes a component property, reduced-round distinguisher, partial recovery or complete attack under specific conditions.

1. Which restrictions on rounds, keys, data access or resources prevent this result from establishing a practical break of the deployed cipher? boundary
2. Which next experiment would most directly test the assumption currently limiting the attack claim? action

Check these first

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these check these first hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance

Kinds and varieties

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these kinds and varieties hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance

Real-world use

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these real-world use hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance

Typical measurements

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these typical measurements hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance

Failure modes and hazards

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these failure modes and hazards hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance

Neighbouring kinds and how to tell them apart

Recalled without web access and unsourced; every item is a lead to verify.

1. Which of these neighbouring kinds and how to tell them apart hold for the sense of linear cryptanalysis this model covers, and on what evidence? provenance