Differential-linear cryptanalysis