We discuss the security of the block cipher Camellia against differential attack and linear attack. The security of Camellia
against these attacks has been evaluated by upper bounds of maximum differential characteristic probability (MDCP) and maximum
linear characteristic probability (MLCP) calculated by the least numbers of active S-boxes which are found by a search method[2]. However, we found some truncated differential paths generated by the method have wrong properties. We show a new evaluation
method for truncated differential and linear paths to discard such wrong paths by using linear equations systems and sets
of nonzero conditions. By applying this technique to Camellia, we found tighter upper bounds of MDCP and MLCP for reduced-round
Camellia. As a result, 10-round Camellia without FL/FL
−1 has no differential and linear characteristic with probability higher than 2−128.