Improved Linear Hull Attack on Round-Reduced Simon with Dynamic Key-Guessing Techniques

Abstract

Simon is a lightweight block cipher family proposed by NSA in 2013. It has drawn many cryptanalysts' attention and varieties of cryptanalysis results have been published, including differential, linear, impossible differential, integral cryptanalysis and so on. In this paper, we give the improved linear attacks on all reduced versions of Simon with dynamic key-guessing technique, which was proposed to improve the differential attack on Simon recently. By establishing the boolean function of parity bit in the linear hull distinguisher and reducing the function according to the property of AND operation, we can guess different subkeys (or equivalent subkeys) for different situations, which decrease the number of key bits involved in the attack and decrease the time complexity in a further step. As a result, 23-round Simon32/64, 24-round Simon48/72, 25-round Simon48/96, 30-round Simon64/96, 31-round Simon64/128, 37-round Simon96/96, 38-round Simon96/144, 49-round Simon128/128, 51round Simon128/192 and 53-round Simon128/256 can be attacked. As far as we know, our attacks on most reduced versions of Simon are the best compared with the previous cryptanalysis results. However, this does not shake the security of Simon family with full rounds. Corresponding AuthorAlso, there are some results with other attack models, such as impossible differential cryptanalysis [15][16][17][18], zero-correlation cryptanalysis [16] and integral cryptanalysis [16].Our Contributions. In this paper, we give the improved linear hull attacks on all reduced versions of Simon family with dynamic key-guessing technique, which was proposed initially to improve the differential attack on Simon [14], using existing linear hull distinguishers. In linear attack, one important point is to compute the empirical correlations (bias) of the parity bit, which derives from the Xor-sum of the active bits at both sides of the linear hull distinguisher, under some key guess. Our attack on Simon improves this procedure efficiently.The non-linear part in the round function of Simon is mainly derived from the bitwise AND (&) operation while it has a significant feature. For details, if one of the two elements is equal to zero, the result of their AND will be zero, no matter what value the other element takes. For a function f = f 1 (x 1 , k 1 )&f 2 (x 2 , k 2 ), if we

Improved Integral Attacks on SIMON32 and SIMON48 with Dynamic Key-Guessing Techniques

“…Later in [7], with the equivalentsubkey technique, Fu et al presented integral attacks on 22-round SIMON32, 22-round SIMON48/72, and 23-round SIMON48/96. Good results [6,13,20] were achieved in differential and linear cryptanalysis, as well. The cryptanalytic results that attack the most rounds of SIMON were obtained in [6], and these results were achieved by linear hull cryptanalysis.…”

“…Good results [6,13,20] were achieved in differential and linear cryptanalysis, as well. The cryptanalytic results that attack the most rounds of SIMON were obtained in [6], and these results were achieved by linear hull cryptanalysis. The most efficient differential and linear attacks on SIMON were presented with the help of dynamic keyguessing techniques.…”

“…Due to 10 = 3 ⊕ 5 , 6,10 is uniquely determined by 5,6 . Besides, 3-bit information is independent of the value [ 0,2,4 , 5,6 , 8,9 , 6,10 , 11 , 12 , 13 , 13,14 , 9,15 , 4,16 ].…”

“…The techniques, which exploit the property of AND operation, help reduce the average number of guessed key bits significantly in differential cryptanalysis. Then they were applied to linear hull attacks on SIMON [6]. In both [6,20], with the techniques above, the adversaries are able to extend previous differential (resp., linear hull) results on SIMON by 2 to 4 more rounds, using existing differential (resp., linear hull) distinguishers.…”

“…Then they were applied to linear hull attacks on SIMON [6]. In both [6,20], with the techniques above, the adversaries are able to extend previous differential (resp., linear hull) results on SIMON by 2 to 4 more rounds, using existing differential (resp., linear hull) distinguishers. Subsequently, Qiao et al [13] released a tool, which provides the differential security evaluation of SIMON given differential distinguishers of high probability.…”