Linear approximations of addition modulo 2n

We present an in-depth algorithmic study of the linear approximations of addition modulo 2n. Our results are based on a fairly simple classification of the linear approximations of the carry function. Using this classification, we derive an θ(log n)-time algorithm for computing the correlation of linear approximation of addition modulo 2n, an optimal algorithm for generating all linear approximations with a given non-zero correlation coefficient, and determine the distribution of the correlation coefficients. In the generation algorithms, one or two of the selection vectors can optionally be fixed. The algorithms are practical and easy to implement. © International Association for Cryptologic Research 2003.