The attack utilises a differential characteristic over part of the cipher with a probability of 1 (for a few rounds—this probability would be much lower for the whole cipher). The rounds immediately following the differential characteristic have a linear approximation defined, and we expect that for eachchosen plaintext pair, the probability of the linear approximation holding for one chosen plaintext but not the other will be lower for the correct key. Hellman and Langford have shown that this attack can recover 10 key bits of an 8-roundDES with only 512 chosen plaintexts and an 80% chance of success.
The attack was generalised byEli Biham et al. to use differential characteristics with probability less than 1. Besides DES, it has been applied toFEAL,IDEA,Serpent,Camellia, and even thestream cipherPhelix.
