Evidence of security against linear cryptanalysis is usually expected of new cipher designs.

There are two parts to linear cryptanalysis.

Some limited analysis has been done on simplified variants, showing that they are likely resistant to both differential and linear cryptanalysis.

Developed by Carlo Harpes in 1995, the attack is a generalization of linear cryptanalysis.

Both differential and linear cryptanalysis arose out of studies on the DES design.

Unlike other forms of cryptanalysis, such as differential and linear cryptanalysis, only one or two known plaintexts are required.

Differential and linear cryptanalysis are the two major general techniques known for the cryptanalysis of block ciphers.

It was introduced by Mitsuru Matsui (1993) as an analytical tool for linear cryptanalysis.

Linear cryptanalysis is one of the two most widely used attacks on block ciphers; the other being differential cryptanalysis.

It has been shown that linear cryptanalysis can break NUSH with less effort than a brute force attack.

The closer the approximation is to zero or one, the more helpful the approximation is in linear cryptanalysis.

MBAL has been shown to be susceptible to both differential cryptanalysis and linear cryptanalysis.

Linear cryptanalysis is a form of cryptanalysis based on finding affine approximations to the action of a cipher.

Harpes originally replaced the bit sums (affine transformations) of linear cryptanalysis with more general balanced Boolean functions.

Since the equations dealt with in linear cryptanalysis will vary in probability, they are more accurately referred to as linear approximations.

He demonstrated a toy cipher that exhibits resistance against ordinary linear cryptanalysis but is susceptible to this sort of partitioning cryptanalysis.

A similar reduction in data complexity can be obtained in a chosen-plaintext variant of linear cryptanalysis (Knudsen and Mathiassen, 2000).

The cipher is susceptible to various forms of cryptanalysis, and has acted as a catalyst in the discovery of differential and linear cryptanalysis.

Q is vulnerable to linear cryptanalysis; Keliher, Meijer, and Tavares have an attack that succeeds with 98.4% probability using 2 known plaintexts.

Symmetric ciphers have historically been susceptible to known-plaintext attacks, chosen plaintext attacks, differential cryptanalysis and linear cryptanalysis.

Differential-linear cryptanalysis was proposed by Langford and Hellman in 1994, and combines differential and linear cryptanalysis into a single attack.

In cryptanalysis, the piling-up lemma is a principle used in linear cryptanalysis to construct linear approximation to the action of block ciphers.

Introduced by Martin Hellman and Susan K. Langford in 1994, the differential-linear attack is a mix of both linear cryptanalysis and differential cryptanalysis.

But this may not be enough assurance; a linear cryptanalysis attack against DES requires 2 known plaintexts and approximately 2 DES operations.

DES's S-boxes are its only non-linear component, and flaws in them are what both differential cryptanalysis and linear cryptanalysis seek to exploit.