On the Complexity of Matsui's Attack

Linear cryptanalysis remains the most powerful attack against DES at this time. Given 243 known plaintext-ciphertext pairs, Matsui expected a complexity of less than 243 DES evaluations in 85 % of the cases for recovering the key. In this paper, we present a theoretical and experimental complexity analysis of this attack, which has been simulated 21 times using the idle time of several computers. The experimental results suggest a complexity upper-bounded by 241 DES evaluations in 85 % of the case, while more than the half of the experiments needed less than 239 DES evaluations. In addition, we give a detailed theoretical analysis of the attack complexity.

• Type: Conference
• Year: 2001
• Where: SACRYPT
• Authors: Pascal Junod
• Keywords: Cryptology, DES Evaluations, Linear Cryptanalysis, Powerful Attack, SACRYPT 2001