Analysis of Minimum Numbers of Linearly Active S-Boxes of a Class of Generalized Feistel Block Ciphers
Linear cryptanalysis and differential cryptanalysis, the two most significant analyzes methods applicable to block ciphers, were introduced by Matsui and Biham, Shamir, respectively. Whether a block cipher can resist the two analyzes is one of basic problems of the security of block ciphers. However, in the design of block ciphers, such ability is usually measured by minimum numbers of linearly or differentially active S-boxes. For AES, the branching number method is used to determine lower bounds for minimum numbers of linearly or differentially active S-boxes.