We consider linear approximations of an iterated block cipher in the presence of several strong linear approximation trails. The eect of such trails in Matsui's Algorithm 2, also called the linear hull eect, has been previously studied by a number of authors. However, the eect on Matsui's Algorithm 1 has not been investigated until now. In this paper, we ll this gap and examine how to exploit the linear hull in Matsui's Algorithm 1. We develop the mathematical framework for this kind of attacks. The complexity of the attack increases with the number of strong linear trails. We show how to reduce the number of trails and thus the complexity using related keys. Further, we illustrate our theory by experimental results on a reduced round version of the block cipher PRESENT.
['Andrea Röck', 'Kaisa Nyberg']
Exploiting Linear Hull in Matsui's Algorithm 1 (extended version) ?;??