Linear cryptanalysis