A theoretical framework for the use of multiple linear approximations in the linear cryptanalysis of block ciphers is given. The covariance of two mask counts is derived, and it is shown that under ...