Differential-Linear Cryptanalsis on SIMECK32/64 and SIMON32/64

Abstract

In this paper, we give differential-linear cryptanalysis of SIMON, which is a family of lightweight block ciphers published by the National Security Agency, and SIMECK, which is a family of lightweight block ciphers proposed by Yang et al. Firstly, all input difference and output masks with one active bit are traversed to obtain a 9-round SIMON32/64 differential-linear distinguisher and a 10-round SIMECK32/64 differential-linear distinguisher. Then, a 12-round SIMON32/64 differential-linear distinguisher with bias 2−12.69 and a 13-round SIMECK32/64 differential-linear distinguisher with bias 2−14.03 can be obtained by searching one round of differential characteristics forward and two rounds of linear approximations backward. The dynamic key guessing technique proposed by Wang et al. has excellent advantages in the SIMON-like cipher key recovery process. Therefore, we have applied it to differential-linear cryptanalysis. Then, the 12-round SIMON32/64 differential-linear distinguisher is extended forward by four rounds and backward by four rounds to attack the 20-round SIMON32/64 with time complexity 255.68 and data complexity 228. And the 13-round SIMECk32/64 differential-linear distinguisher is extended forward by four rounds and backward by four rounds to attack the 21-round SIMECK32/64 with time complexity 250.67 and data complexity 230. These are the best differential-linear cryptanalysis results for SIMON32/64 and SIMECK32/64 in the open literature.