Rotational-XOR Cryptanalysis of Simon-Like Block Ciphers

Abstract

Rotational-XOR cryptanalysis is a cryptanalytic method aimed at finding distinguishable statistical properties in ARX-C ciphers, i.e., ciphers that can be described only by using modular addition, cyclic rotation, XOR, and the injection of constants. In this paper we extend RX-cryptanalysis to AND-RX ciphers, a similar design paradigm where the modular addition is replaced by vectorial bitwise AND; such ciphers include the block cipher families Simon and Simeck. We analyze the propagation of RX-differences through AND-RX rounds and develop closed form formula for their expected probability. Finally, we formulate an SMT model for searching RX-characteristics in Simon and Simeck.Evaluating our model we find RX-characteristics of up to 20, 27, and 35 rounds with respective probabilities of 2 −26 , 2 −42 , and 2 −54 for versions of Simeck with block sizes of 32, 48, and 64 bits, respectively, for large classes of weak keys in the related-key model. In most cases, these are the longest published distinguishers for the respective variants of Simeck.Interestingly, when we apply the model to the block cipher Simon, the best characteristic we are able to find covers 11 rounds of Simon32 with probability 2 −24 . To explain the gap between Simon and Simeck in terms of the number of distinguished rounds we study the impact of the key schedule and the specific rotation amounts of the round function on the propagation of RX-characteristics in Simon-like ciphers.

Improved rotational‐XOR cryptanalysis of Simon‐like block ciphers

“…Collection Phase We use a set ρ of 2 36 plaintext pairs (p, p 0 ), such that their RX-difference is (00000000, 00000113). We ask for the 28-round encryption of all the pairs in ρ, under the related-key pair (K, K 0 ) in the weak key class to obtain their respective ciphertexts C ¼ Enc 28 K ðPÞ; C 0 ¼ Enc 28 K 0 P 0 ð Þ:…”

“…In [7], Sadeghi et al presented a MILP model for outputting a solution with respect to a given RX-characteristic, that is, a pair of related keys and a right pair satisfying the said characteristic. They observed that some of the RX-characteristics in [6,8] cannot produce right pairs with respect to any key due to global contradictions; such RX-characteristics are said to be incompatible.…”

“…These results are presented in Table 4. Whereas distinguishers of similar length were presented in [6,8], this section replaces some of them with compatible ones (for a discussion on compatibility, see Section 4.5). We further prove that there exists no RXcharacteristic with w d + w k ≤ 64 for more than 20 rounds of Simeck32; therefore, our 20-round RX-characteristic gives a tight bound on the number of rounds that can be distinguished using RX-cryptanalysis.…”

“…Searching for (related key) differential characteristics in most models based on MILP or SAT/SMT only involves differential transitions and they are considered independent in different rounds. Previous studies have reported exceptions where such characteristics are incompatible [6]. Sadeghi et al [7] developed a MILP model to verify the existence of right pairs with respect to a given characteristic.…”

Status report on the second round of the NIST lightweight cryptography standardization process

“…Liu et al[74] constructed two 8-step impossible differentials for the ACE permutation and showed that there are no impossible differential distinguishers longer than nine steps. Various analyses[75][76][77][78] on Simeck64/128 describe attacks exceeding the 5…”