Differential-linear cryptanalysis of SIMON32/64

Abstract

Simon is a family of lightweight block ciphers designed by the U.S National Security Agency in 2013. Simon 2n/k is a cipher in this family with k-bit key and 2n-bit block. So far, there have been several cryptanalytic results on this cipher by means of differential cryptanalysis, linear cryptanalysis and impossible differential cryptanalysis. In this paper, we improve the previous linear cryptanalysis by differential-linear cryptanalysis, which is based on the use of a differential-linear distinguisher constructed by concatenating a linear approximation with a differential. The number of attacks is not increased, but the time complexity of attacks on 18-round Simon32 is reduced from 232 to 219. In addition, we present a key recovery attack on 18 and 19 rounds of Simon32 based on differential-linear distinguisher.