Equation (27) contains the unknown key K2. Therefore, we have to search all possible values of K2 for each pair (X, Y ); (X1, Y 1). If (27) holds, it contains the sought slide pair with the key K2. The values of K1 can be easily found with (25) and (26). The search space for the correct slide pair comprises 264 ・ 2128 = 2192 values with the probability of 0.5, which is, although fewer than 2256, render the attack practically inapplicable.