Table 5 Attack 1 - equations to decrease the number of candidates of the secret key

$\left\{\right(S_9^{-1}\left[K_{32,7}\right])\gg 1\}=(K_{32,0}\&0x7)$

2⁻³

(K_32,2&0x 3) = (K_30,7 ≫ 2)

2⁻²

(K_32,1≫2) = (K_30,7&0x 3)

2⁻²

(K_32,1&0x 3) = (K_30,6 ≫ 2)

2⁻²

{(K_32,0 ≫ 2) ⊕ 0x 1} = (K_30,6&0x 3)

2⁻²

{(K_32,0&0x 3) ⊕ 0x 3} = (K_30,5 ≫ 2)

2⁻²

$\left\{\right(S_9^{-1}\left[K_{31,7}\right])\gg 1\}=(K_{30,0}\&0x7)$

2⁻³

$\left[\right\{\left(S_9^{-1}\right[K_{32,7}\left]\right)\gg 3\}\oplus 0x1]=(K_{29,6}\&0x1)$

2⁻¹

$\left[\right\{\left(S_9^{-1}\right[K_{32,7}\left]\right)\&0x7\}\oplus 0x7]=(K_{29,5}\gg 1)$

2⁻³

$\left\{\right(S_8^{-1}\left[K_{32,6}\right])\gg 3\}=(K_{29,5}\&0x1)$

2⁻¹

$\left\{\right(S_8^{-1}\left[K_{32,6}\right])\&0x7\}=(K_{29,4}\gg 3)$

2⁻³

(K_32,5 ≫ 3) = (K_29,4&0x 1)

2⁻¹

(K_32,5&0x 7) = (K_29,3 ≫ 1)

2⁻³

(K_32,4 ≫ 3) = (K_29,3&0x 1)

2⁻¹

(K_32,4&0x 7) = (K_29,2 ≫ 1)

2⁻³

(K_32,3 ≫ 3) = (K_29,2&0x 1)

2⁻¹

(K_32,3&0x 7) = (K_29,1 ≫ 1)

2⁻³

(K_32,2 ≫ 3) = (K_29,1&0x 1)

2⁻¹

{(K_32,2 ≫ 2)&0x 1} = (K_29,0 ≫ 3)

2⁻¹

$\left\{\right(S_9^{-1}\left[K_{30,7}\right])\gg 1\}=(K_{29,0}\&0x7)$

2⁻³