Cryptanalysis of the Lightweight Block Cipher BORON

Table 5

Linear trails with the optimal bias.

Round	Input mask of S-box	Output mask of S-box
3-round linear trail with bias
0	0x0D0000000006000B	0x0800000000010008
1	0x0000000000001000	0x0000000000003000
2	0x0000000000600060	0x0000000000100060
4-round linear trail with bias
0	0xD0000000006000B0	0x8000000000100080
1	0x0000000000000001	0x0000000000000007
2	0x000000000E000E00	0x0000000001000800
3	0x0010001000000010	0x0030003000000070
5-round linear trail with bias
0	0x0000000D00F00000	0x0000000200100000
1	0x0001000000000001	0x0007000000000003
2	0x000E000E06000600	0x0008000401000100
3	0x0000000200100000	0x0000000E00700000
4	0x0007000000000007	0x000C00000000000C
6-round linear trail with bias
0	0x0000009006000000	0x0000002001000000
1	0x0010000000000010	0x0070000000000030
2	0x00E000E060006000	0x0090004010001000
3	0x0020000001000000	0x0040000008000000
4	0x0000000000800000	0x0000000000500000
5	0x0005000500050000	0x0003000700030000
7-round linear trail with bias
0	0xD0000D00000D000D	0x4000080000080002
1	0x0000040080000000	0x00000A0050000000
2	0x0500000000000500	0x0300000000000300
3	0x0600060000060006	0x0B000C0000010003
4	0x0600000010000000	0x06000000C0000000
5	0x000000000C000000	0x0000000005000000
6	0x0050005000500000	0x0070007000300000
8-round linear trail with bias
0	0x00000D00F0000000	0x0000020010000000
1	0x0100000000000100	0x0700000000000300
2	0x0E000E0000060006	0x0800040000010001
3	0x0000020010000000	0x00000E0070000000
4	0x0700000000000700	0x0100000000000300
5	0x0200020000060006	0x0B000C0000010003
6	0x0600000010000000	0x06000000C0000000
7	0x000000000C000000	0x0000000005000000
9-round linear trail with bias
0	0x0000000F000D0000	0x0000000100080000
1	0x8000000000008000	0x5000000000007000
2	0xA000A00000E000E0	0x8000400000100010
3	0x0000200000010000	0x0000E00000070000
4	0x7000000000007000	0x1000000000003000
5	0x2000200000600060	0xB000C00000100030
6	0x6000000000010000	0x60000000000C0000
7	0x00000000C0000000	0x0000000070000000
8	0x0700070007000000	0x010001000C000000