A Brief Comparison of Simon and Simeck

Abstract

Abstract. Simeck is a new lightweight block cipher design based on combining the design principles of the Simon and Speck block cipher. While the design allows a smaller and more efficient hardware implementation, its security margins are not well understood. The lack of design rationals of its predecessors further leaves some uncertainty on the security of Simeck. In this work we give a short analysis of the impact of the design changes by comparing the upper bounds on the probability of differential and linear trails with Simon. We also give a comparison of the effort of finding those bounds, which surprisingly is significantly lower for Simeck while covering a larger number of rounds at the same time. Furthermore, we provide new differentials for Simeck which can cover more rounds compared to previous results on Simon and study how to choose good differentials for attacks and show that one can find better differentials by building them from a larger set of trail with initially lower probability. We also provide experimental results for the differentials for Simon32 and Simeck32 which show that there exist keys for which the probability of the differential is significantly higher than expected. Based on this we mount key recovery attacks on 19/26/33 rounds of Simeck32/48/64, which also give insights on the reduced key guessing effort due to the different set of rotation constants.

Differential Security Evaluation of Simeck with Dynamic Key-guessing Techniques

“…For Simeck32/64, we adapt two differentials. The first one is (0x8000, 0x4011) → (0x4000, 0x0) that covers 13 rounds with probability 2 −27.28 (Kölbl and Roy, 2015). We prefix 3 rounds and append 5 rounds to the differential.…”

“…Though several differentials with high probability of Simeck family were given (Kölbl and Roy, 2015), we want to get new differentials with lower hamming weight. Using automatic search method with MILP techniques (Qiao et al, 2015;Sun et al, 2014a;Sun et al, 2014b;Sun et al, 2014c), we find a 13round differential characteristic of Simeck32/64 with probability 2 −38 (see Table 2).…”

“…The designers of Simeck give some other security analysis results including differential attacks (Biham and Shamir, 1991), linear attacks (Matsui, 1994), impossible differential attacks (Biham et al, 1999), etc., mainly following the attack procedure of SIMON due to their similarity. Recently, cryptanalysis covering more rounds are given (Bagheri, 2015;Kölbl and Roy, 2015). Kölbl and Roy give differentials with high probability of all three versions and launch differential attacks covering 19, 26 and 33 rounds of Simeck32/64, Simeck48/96 and Simeck64/128 respectively (Kölbl and Roy, 2015).…”

“…Recently, cryptanalysis covering more rounds are given (Bagheri, 2015;Kölbl and Roy, 2015). Kölbl and Roy give differentials with high probability of all three versions and launch differential attacks covering 19, 26 and 33 rounds of Simeck32/64, Simeck48/96 and Simeck64/128 respectively (Kölbl and Roy, 2015). Though they noticed the dynamic key-guessing method, they did not implement it.…”

Secure Data Encryption for Cloud-Based Human Care Services

“…Kölbl and Roy [5] presented brief comparison results between SIMON and Simeck. Bagheri [6] proposed a linear cryptanalysis method and results with the reduced-round Simeck block cipher.…”