ALGORITHMS FOR SOLVING LINEAR AND POLYNOMIAL ...

We require, for our attack, g −1k (E k( ⃗ P )), which will need an additional 16rounds. Even if we use the whole dictionary of 2 32 possible plaintexts, this comes to(528 + 16)2 32 ≈ 2 41.087 rounds, which is about 2 14.04 times faster than brute force.If instead we use (528 + 16)(3/5)2 32 (which is now an expected value based on thelast paragraph of the previous section), we require 2 40.77 rounds.2.4.8 Some LemmasThis section provides some of the probability calculations needed in the previoussections. The argument in this section is that if (for random k) the functionf k : GF(2) n → GF(2) n is computationally indistinguishable from a random permutationfrom S 2 n, then f k and f (8)khave various properties. Our f k and f (8)kare notrandom permutations, but are based off of the Keeloq specification. Since we arediscussing the cryptanalysis of a block cipher, we conjecture that modeling f k as arandom permutation is a good model (as is common). If not, much easier attacksmight exist. This is a standard assumption.However, we only need 3 facts from this analysis. First, the expected numberof fixed points, if there are two, is about 2.3922. Second, the probability of havingtwo or more fixed points is about 26.424%. Third, the number of fixed points off (8) is around 5.39. These particular facts were verified by simulations, given inTable 2.1 on page 22, and found to be reasonable.Lemma 1 Both f and g are bijections.Proof: Note E k is a permutation (bijection) for any specific fixed key, as must26