SPECK, a family of lightweight block ciphers proposed by the National Security Agency (NSA), is widely used under resource constrained environment. There are many cryptanalytic results on SPECK concentrated on differential and linear attacks. However, the security evaluation against other popular cryptanalysis methods seems to lag behind. In this paper, we investigate both the security of SPECK against impossible differential, zero-correlation linear, and integral attacks as well as the design choice of NSA. First, we construct the satisfiability (SAT)-based model to automatically search impossible differentials and zero-correlation linear hulls and then obtain several integral distinguishers based on the links between the zero-correlation linear hull and integral distinguisher. Second, based on the new distinguishers, we propose the first zero-correlation attack on 11-round SPECK64 and integral attack on 11-round SPECK32, SPECK48, and SPECK64 by exploring the iterated expression of the modulo subtraction operation and utilizing the partial-sum technique. Finally, we study the design principle of the rotation parameters selection of SPECK32. We show that SPECK32 with parameters (8, 3) is better than SPECK32 with the original parameters (7, 2) with respect to security against impossible differential, zero-correlation linear and integral cryptanalysis. INDEX TERMS Block cipher, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, integral cryptanalysis, SPECK, design rationale.

Deep learning has played an important role in many fields, which shows significant potential for cryptanalysis. Although these existing works opened a new direction of machine learning aided cryptanalysis, there is still a research gap that researchers are eager to fill. How to further improve neural distinguishers? In this paper, we propose a new algorithm and model to improve neural distinguishers in terms of accuracy and the number of rounds. First, we design an algorithm based on SAT to improve neural distinguishers. With the help of SAT/SMT solver, we obtain new effective neural distinguishers of SIMON using the input differences of high-probability differential characteristics. Second, we propose a new neural distinguisher model using multiple output differences. Inspired by the existing works and data augmentation in deep learning, we use the output differences to exploit more derived features and train neural distinguishers, by splicing output differences into a matrix as a sample. Based on the new model, we construct neural distinguishers of SIMON and SPECK with round and accuracy promotion. Utilizing our neural distinguishers, we can distinguish reduced-round SIMON or SPECK from pseudorandom permutation better.

Simeck, a family of lightweight block ciphers utilizing Simon-like structure, is widely used under resource constrained environment. So far, many cryptanalysis methods have been used to attack Simeck. In this paper, we give the new results of integral cryptanalysis on reduced-round Simeck. First, the exact algebraic degree of Simeck32 is given by parallel computing, and then the 13-round theoretical integral distinguisher is proposed to attack 20-round Simeck32(64). Besides, by using the equivalent-subkey and partial-sum technology, combined with the meet-in-the-middle strategy and subkey relationship, the 22-round Simeck32(64) integral attack is first proposed based on the 15-round integral distinguisher. Furthermore, based on 18-round and 21-round integral distinguishers, the new integral attacks on 26-round Simeck48(96) and 30-round Simeck64(128) are proposed, respectively. These new attacks greatly improve the results of the previous integral attacks for Simeck. INDEX TERMS Cryptanalysis, lightweight block cipher, Simeck, integral attack, equivalent-subkey.

At CRYPTO’19, Gohr built a bridge between deep learning and cryptanalysis. Based on deep neural networks, he trained neural distinguishers of SPECK32/64. Besides, with the help of neural distinguishers, he attacked 11-round SPECK32/64 using Bayesian optimization. Compared with the traditional attack, its complexity was reduced. Although his work opened a new direction of machine learning aided cryptanalysis, there are still two research gaps that researchers are eager to fill in. (i) Can the attack using neural distinguishers be used to other block ciphers? (ii) Are there effective key recovery attacks on large-size block ciphers adopting neural distinguishers? In this paper, our core target is to propose an effective neural-aided key recovery policy to attack large-size block ciphers. For large-size block ciphers, it costs too much time in pre-computation, especially in wrong key response profile, which is the main reason why there are almost no neural aided attacks on large-size block ciphers. Fortunately, we find that there is a fatal flaw in the wrong key profile. In the some experiments of SIMON32/64 and SIMON48/96, there is a regular of change in response profiles, which implies that we can use partial response instead of the complete response. Based on this, we propose a generic key recovery attack scheme which can attack large-size block ciphers. As an application, we perform a key recovery attack on 13-round SIMON64/128, which is the first practical attack using neural distinguishers to large-size ciphers. In addition, we also attack 13-round SIMON32/64 and SIMON48/96, which also shows that the neural distinguishers can be used to other block ciphers.