### Table 3. Resistance to Cryptanalysis for Networks

1996

"... In PAGE 28: ... 8673. Summary of Results In Table3 , for SPNs of 8 rounds, we have summarized lower bounds on the values of 7868... In PAGE 29: ... Results are presented for networks using permutations from the set 5 and for networks using a linear transformation of the form of equation (23). Note that the analysis of Table3 is equally applicable to the decryption as well as the encryption network. (This is important since the decryption network may also be attacked using either cryptanalysis method.... ..."

Cited by 26

### Table 3. Resistance to Cryptanalysis for Networks

1994

"... In PAGE 28: ... a36a38a37 . Summary of Results In Table3 , for SPNs of 8 rounds, we have summarized lower bounds on the values of a108 a40a39... In PAGE 29: ... Results are presented for networks using permutations from the set a115 and for networks using a linear transformation of the form of equation (23). Note that the analysis of Table3 is equally applicable to the decryption as well as the encryption network. (This is important since the decryption network may also be attacked using either cryptanalysis method.... ..."

### Table 1. Complexity of 6-Round Impossible Differential Attack

"... In PAGE 10: ...ryptions, or 293.5 plaintexts, 2110.5 encryptions and 2104.5 bytes of memory. We summarize the complexities of our attacks together with those of previous works in Table1 . We expect that this method can be applied to other block ciphers... ..."

### Table 5: Multiple levels of cryptanalytic difficulty in RC5 [31] Rounds 4 6 8 10 12 14 16

2003

"... In PAGE 4: ....1.5 Energy Consumption Versus Security Trade-offs If different security levels can be provided in a cryptographic al- gorithm, each with associated energy consumption characteristics, a security protocol can be adapted to a level of security commensurate with the current state of the battery of the system. Table5 identifies different security levels for the RC5 cipher, obtained by changing the number of rounds used in the cipher, for a given key and block size (128 bits). Each entry indicates the data (number of attempts) needed for a successful attack against RC5 using differential and linear crypt- analysis techniques.... ..."

Cited by 22

### Table 1: Parallelism between square and impossible differential characteris- tics

### Table 1: Material Properties

"... In PAGE 8: ...Structural Design of Urban Roads, Mohamed and Nofal 142 asphalt surface layer to represent the type of analysis made possible by the newly introduced developments incorporated in the proposed method of analysis. Material properties for all layers used in this exercise are shown in Table1 . Analysis was limited to a single pavement temperature (-20oC).... ..."

### Table 9. FFS: Testing Knowledge Differentials Using PPS Matching Methods

2004

"... In PAGE 20: ...2. Estimation based on PPS matching methods Table9 reports estimates of FFS program impact based on the Propensity Score Matching methods. The average difference in test scores between participants and their matches provides an estimate of the Average Treatment Effect on the Treated ATE 1PSM ().... In PAGE 24: ...ignificantly different coefficient of knowledge on yield of 0.29 (s.e. 0.18), suggesting that the OLS estimate is unlikely to be upward biased. Using the coefficients from the regression in Table 12 and the score differentials reported in Table9 , we simulate the potential impact of FFS participation on productivity. Using the calculated score differential of 14 percentage points from FFS participation, this implies that farmer field school participation would have resulted in an increase of 2.... ..."

Cited by 1

### Table 1- Methods for solving differential equations Method Message Description

"... In PAGE 3: ... In the more optimistic synchronization strategy we are currently developing, the objects encapsulating analog behavior may use a sufficient small time step as needed by the numerical integration, while synchronization with other objects will be made only when objects have to communicate events on interface signals. The analog objects have default methods, where the equations and parameters are included, as shown in Table1 . The Start method is responsible for the initialization of parameters, such as the integration step.... ..."

### Table 3. Linear approximations for fMAJ(a, b, c), fIF(e, f, g) and the corresponding (x1, x2, x3, y1, y2, y3). Case A has been considered by Gilbert-Handschuh. It has one impossible condition each for both fMAJ and fIF . Cases B to E have one impossible condition for fMAJ and none for fIF .

"... In PAGE 6: ... There are four linear approximations of fIF which do not have any impossible conditions. In Table3 we consider the situation where fMAJ is approximated by zero and fIF is approximated by zero and the four other linear functions which do not have impossible conditions. From Table 2, we find that there are 16 possible combinations of linear approximations of fMAJ and fIF which do not have any impossible conditions.... In PAGE 7: ... On the other hand, the equations do have a pattern, which we have exploited to obtain solutions. We explain our method for k = 9 for Case B of Table3 . Similar methods have been applied to the other two cases.... In PAGE 11: ... For example in [7] a 19 Step 1 bit near collision for SHA-256 is reported which is obtained by using 23 GH local collisions. 8 Results The detailed differential paths for the cases of Table3 are shown in Table 6. The differential paths for the cases in Table 4 are shown in Tables 8 to 11 in Section C.... In PAGE 12: ... provides the probability of the differential path; and NIC provides the number of impossible conditions. The cases are from Table3 and 4. Case A is the GH local collision, rest are new local collisions.... In PAGE 13: ...Table3 . Probability calculations are done taking x to be 231 for SHA-256 and 263 for SHA-512.... ..."

### Table 3. Linear approximations for fMAJ(a, b, c), fIF(e, f, g) and the corresponding (x1, x2, x3, y1, y2, y3). Case A has been considered by Gilbert-Handschuh. It has one impossible condition each for both fMAJ and fIF . Cases B to E have one impossible condition for fMAJ and none for fIF .

"... In PAGE 6: ... There are four linear approximations of fIF which do not have any impossible conditions. In Table3 we consider the situation where fMAJ is approximated by zero and fIF is approximated by zero and the four other linear functions which do not have impossible conditions. From Table 2, we find that there are 16 possible combinations of linear approximations of fMAJ and fIF which do not have any impossible conditions.... In PAGE 7: ... On the other hand, the equations do have a pattern, which we have exploited to obtain solutions. We explain our method for k = 9 for Case B of Table3 . Similar methods have been applied to the other two cases.... In PAGE 11: ... For example in [7] a 19 Step 1 bit near collision for SHA-256 is reported which is obtained by using 23 GH local collisions. 8 Results The detailed differential paths for the cases of Table3 are shown in Table 6. The differential paths for the cases in Table 4 are shown in Tables 8 to 11 in Section C.... In PAGE 12: ... provides the probability of the differential path; and NIC provides the number of impossible conditions. The cases are from Table3 and 4. Case A is the GH local collision, rest are new local collisions.... In PAGE 13: ...Table3 . Probability calculations are done taking x to be 231 for SHA-256 and 263 for SHA-512.... ..."