The piling-up approximation in linear cryptanalysis

One of the key identities in linear cryptanalysis is the piling-up lemma, which allows one to compute the probability distribution of a sum modulo 2 of binary random variables, when the probability that these are zero is known. However, the lemma holds only for independent random variables. In linear cryptanalysis, one often (mis)uses this identity without knowing whether the random variables are independent or not. This paper investigates the problems that may arise when using this identity for dependent random variables. In particular, it is shown that the identity holds in almost all cases if one replaces equality by an approximation sign. The amplitude of departure from equality is also given.