Cryptanalysis of DES with a reduced number of rounds: Sequences of linear factors in block ciphers

A blockcipher is said to have a linear factor if, for all plaintexts and keys, there is a fixed non-empty set of key bits whose simultaneous complementation leaves the exclusive-or sum of a fixed non-empty set of ciphertext bits unchanged