2026-07-22T11:08:37Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:1018 2024-03-06T11:07:15Z ddc:004 open_access

A Key-Recovery Attack on SOBER-128 Nyberg, Kaisa Hakala, Risto Linear approximations correlation linear cryptanalysis key recovery attack piling-up lemma SOBER-128 In this talk we consider linear approximations of layered cipher constructions with secret key-dependent constants that are inserted between layers, and where the layers have strong interdependency. Then clearly, averaging over the constant would clearly be wrong as it will break the interdependencies, and the Piling Up-lemma cannot be used. We show how to use linear approximations to divide the constants into constant classes, not necessary determined by a linear relation. As an example, a nonlinear filter generator SOBER-128 is considered and we show how to extend Matsui's Algorithm I in this case. Also the possibility of using multiple linear approximations simultaneously is considered. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Kaisa Nyberg and Risto Hakala 2007 Is Part Of Dagstuhl Seminar Proceedings, Volume 7021, Symmetric Cryptography (2007) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/DagSemProc.07021.4 urn:nbn:de:0030-drops-10188 https://drops.dagstuhl.de/entities/document/10.4230/DagSemProc.07021.4 eng https://creativecommons.org/licenses/by/4.0/legalcode