## On the Complexity of Matsui's Attack

Linear cryptanalysis remains the most powerful attack against DES at this time. Given $2^{43}$ known plaintext-ciphertext pairs, Matsui expected a complexity of less than $2^{43}$ DES evaluations in 85% of the cases for recovering the key. In this paper, we present a theoretical and experimental complexity analysis of this attack, which has been simulated 21 times using the idle time of several computers. The experimental results suggest a complexity upper-bounded by $2^{41}$ DES evaluations in 85% of the case, while more than the half of the experiments needed less than $2^{39}$ DES evaluations. In addition, we give a detailed theoretical analysis of the attack complexity.

Published in:
Selected Areas in Cryptography, 8th Annual International Workshop, SAC 2001, 2259, 199-211
Presented at:
Selected Areas in Cryptography, 8th Annual International Workshop, SAC 2001, Toronto, Ontario, Canada, August 16-17, 2001
Year:
2001
Laboratories: