we are dealing with are independent; that is, the state of one has no effect on the state of any of the others. Thus we can expand the probability function as follows: {| |- | | |- | | |- | | |- | | |} Now we express the probabilities p1 and p2 as ½ + ε1 and ½ + ε2, where the ε's are the probability biases — the amount the probability deviates from ½. {| |- | | |- | | |- | | |} Thus the probability bias ε1,2 for the XOR sum above is 2ε1ε2. This formula can be extended to more Xs as follows: Note that if any of the ε's is zero; that is, one of the binary variables is unbiased, the entire probability function will be unbiased — equal to ½. A related slightly different definition of the bias is in fact minus two times the previous value. The advantage is that now with we have adding random variables amounts to multiplying their (2nd definition) biases. Practice In practice, the Xs are approximations to the S-boxes (substitution components) of block ciphers. Typically, X values are inputs to the S-box and Y values are the corresponding outputs. By simply looking at the S-boxes, the cryptanalyst can tell what the probability biases are. The trick is to find combinations of input and output values that have probabilities of zero or one. The closer the approximation is to zero or one, the more helpful the approximation is in linear cryptanalysis. However, in practice, the binary variables are not independent, as is assumed in the derivation of the piling-up lemma. This consideration has to be kept in mind when applying the lemma; it is not an automatic cryptanalysis formula. See also Variance of a sum of independent real variables References Cryptographic attacks Lemmas