Rotational-XOR Rectangle Cryptanalysis on Round-Reduced Simon

Abstract

Recently, Ashur and Liu introduced the Rotational-XOR-difference approach which is a modification of rotational cryptanalysis, for an ARX cipher Speck (Ashur and Liu, 2016). In this paper, we apply the Rotational-XOR-difference (RXD) approach to a non-ARX cipher Simon and evaluate its security. First, we studied how to calculate the probability of an RXD for bitwise AND operation that the round function of Simon is based on unlike Speck is on modular addition. Next, we prove that two RXD trails can be connected such that it becomes possible to construct a boomerang/rectangle distinguisher similar to the case using differential characteristics. Finally, we construct related-key rectangle distinguishers for round-reduced versions of Simon with block lengths of 32, 48, and 64, and we suggest a five- or six-round key recovery attack. To our knowledge, it is the first attempt to apply the notion of rotational cryptanalysis for a non-ARX cipher. Although our attack does not show the best results for Simon thus far, the attempt here to define and apply a new cryptanalytic characteristic is meaningful, and we expect further improvements and applications to other ciphers to be made in subsequent studies.

On Boomerang Attacks on Quadratic Feistel Ciphers

“…The boomerangs from [KJK20] together with the ones presented in [CZX + 23] rely on the notion of rotational-xor cryptanalysis, that we now recall.…”

“…We then construct an SMT model to find boomerang distinguishers on KATAN32 and Simon-32/64. We obtained related-key distinguishers for up to 151 rounds of KATAN32 and 17 rounds of Simon-32/64, rotational-xor related-key distinguishers for up to 19 rounds of Simon-32/64 and rotational-xor differential related-key distinguishers for up (RK) 25 † -2 123.0 2 61.5 CP [KJK20] In what follows, we prove that the results marked by † are invalid while the distinguishers with ▷ have an experimental probability significantly higher than theoretically expected.…”

“…As we are going to detail in Section 2.5.2 and 2.5.3, [KJK20] and [CZX + 23] defined variants of the boomerang distinguisher based on rotational-xor differences instead of standard differences.…”

“…To the best of our knowledge, there are three articles studying the resistance of Simon to boomerang techniques: [ALLW13], [KJK20] and [CZX + 23]. While the first one is a standard boomerang, the latter two use rotational-xor differentials.…”

“…As λ is fixed for a given analysis, we denote − Definition of the rotational-xor rectangle. One of the contributions of the article of Koo et al [KJK20] is the definition of the rotational-xor rectangle characteristic as the analogue of the usual differential-based rectangle characteristic. The authors propose to construct rotational-xor rectangle distinguishers in the same way as naive rectangle distinguishers: the cipher is split in two (E = E 1 • E 0 ) and an RX characteristic is searched for each part: if the RX characteristic (α → β) is satisfied with probability p for E 0 and the RX characteristic (γ → δ) is satisfied with probability q for E 1 then a rotational-xor rectangle of expected probability p 2 q 2 2 −n is obtained.…”