IT lexicon › Security › Linear hull

Linear hull

Security På svenska → Updated: 2026-10-13

The set of all linear paths through a cipher, whose biases add up rather than being counted one at a time.

Linear cryptanalysis chains linear approximations of individual rounds into an approximation of the whole cipher. For a given input and output mask, however, several intermediate paths can contribute, and their biases add together. The set of all such paths is called the linear hull. Kaisa Nyberg described the effect in the 1990s and showed that the naive chaining, which follows only the best path, can give the wrong strength.

The difference matters in practice. An attack that counts a single path can overestimate or underestimate how many known pairs it needs. The hull effect is therefore part of measuring the security margin of a block cipher, and anyone who finds a strong linear approximation should check that it is not just one of many contributing paths.

← Back to the lexicon