A blockcipher is said to have a linear factor if, for all plaintexts and keys, there is a fixed non-empty set of key bits whose simultaneous complementation leaves the exclusive-or sum of a fixed non-empty set of ciphertext bits unchanged.

Additional Metadata
Persistent URL dx.doi.org/10.1007/3-540-39799-X_16
Conference Advances in Cryptology
Chaum, D, & Evertse, J.-H. (1985). Cryptanalysis of DES with a reduced number of rounds: Sequences of linear factors in block ciphers. In Lecture Notes in Computer Science/Lecture Notes in Artificial Intelligence (pp. 192–211). doi:10.1007/3-540-39799-X_16