Linear Cryptanalysis of Reduced-Round Simon Using Super Rounds

Proceedings of the 13th International Joint Conference on e-Business and Telecommunications, 2016

There are two major families in cryptanalytic attacks on symmetric ciphers: statistical attacks and algebraic attacks. In this position paper we argue that algebraic cryptanalysis has not yet been developed properly due to the weakness of the theory which has substantial difficulty to prove most basic results on the number of linearly independent equations in algebraic attacks. Consequently most authors present a restricted range of attacks which are shown experimentally to work with their computer but refrain from claiming results which would work on a larger computer but have not yet been tested. For example in recent 2015 work of Raddum we discover that (experimentally) ElimLin attack breaks up to 16 rounds of Simon block cipher however it is hard to know what happens for 17 rounds. In this paper we argue that one CAN predict and model the behavior of such attacks and evaluate complexity of the attacks which we cannot yet execute. To the best of our knowledge this has never been done before.

SIMON is a recent, light-weight block cipher developed by NSA. Previous work on SIMON shows that it is a very promising alternative of AES for resource-constrained platforms. While SIMON offers a range of block sizes and key lengths, a straightforward implementation would select fixed values in order to achieve a compact design. In contrast, we propose a flexible hardware architecture on FPGAs that still preserves the compactness of SIMON. The proposed implementation can execute all configurations of SIMON, and thus provides a versatile architecture that enables adaptive security using a variable key-size. Moreover, it also reduces the inefficiency of encrypting slightly longer messages by supporting a variable block-size. The implementation results show that the proposed architecture occupies 90 and 32 slices on Spartan-3 and Spartan-6 FPGAs, respectively. To our best knowledge, these area results are smaller than other block ciphers of similar security level. Furthermore, we also quantify the cost of flexibility and show the trade-off between the security level, throughput and area.

Volume 17, Issue 2, 2025

Given the rapid evolution of emerging technologies, such as the Internet of Things (IoT), there is a growing interest in lightweight block ciphers. This paper focuses on the security assessment of SAND-128, a newly proposed lightweight block cipher based on SIMON, recognized for its reliance on S-box-based security evaluation approaches. By employing Xiang's MILP-aided method for integral distinguisher search, this study utilizes a MILP optimizer to identify a 16-round integral characteristic for SAND-128 with nine balanced bits. Furthermore, by extending the distinguisher to 17 rounds utilizing a novel idea without an increase in data complexity, we propose a comprehensive 20-round integral attack on SAND-128, including the key recovery step. This attack leverages the partial sums technique, resulting in a time complexity of 2 119 , memory complexity of 2 76 bytes, and data complexity of 2 127. This cryptanalysis is, to the best of our knowledge, the best integral attack on reduced-round SAND-128 presented thus far.

2019

The need of an hour is the research on design and impacts of Hardware Trojan Horse in a crypto module to serve the purpose of secret key recovery. SIMON is a light weight block cipher that indulges to optimally work with hardware environment. Few papers have come up with the fault attack on SIMON cipher. In this paper, two bit toggle fault attack on 29\(^{th}\) round of the SIMON by intruding Hardware Trojan Horse is realized. The structural design of Hardware Trojan includes activation of two payloads with a single trigger. In consequence, the round key of SIMON cipher is retrieved by executing Differential Fault Analysis, using the fault free and completely faulty ciphertext. The power consumption of the SIMON design for both with and without Hardware Trojan is estimated using Simulation Activity Information File (.saif) on ZYNQ 7000 SoC family FPGA board and observed that there is minimal overhead of 1.32%. Provided, almost negligible difference of one LUT in area utilization is ...

IACR Cryptology ePrint Archive, 2017

* This may not be wise; Zhang and Wu [ZW16] "conclude that it is not advisable for Simon-like ciphers to re-use the round function in the key schedule." Also, we note that a similar reduction in area is not obtained by this method for the five versions of Simon with two or three words of key. † An example of a nonlimiting cryptanalytic feature is the Boolean degree. Compare [ZWW16] and [CW15]: the best reduced-round attack based on degrees for Simon 64/128, for example, is an integral attack on 24 of 44 rounds, whereas the best linear attack works for 31 of 44 rounds. (We note that the 24-round attack is based on a 17-round distinguisher, and Xiang et al. [XZL16] give an 18-round distinguisher, so the 24-round attack likely extends to a 25-round attack.) ‡ 10% is surely an overestimate! Although we have not done the analysis, we suspect that the stepping would not be reduced at all.

1999

In this paper we present an attack on a reduced round version of Crypton. The attack is based on the dedicated Square attack. We explain why the attack also works on Crypton and prove that the entire 256-bit user key for 6 rounds of Crypton can be recovered with a complexity of 256 encryptions, whereas for Srypton 272 encryptions are required to recover the 128-bit user key.

Proceedings of the 52nd Annual Design Automation Conference, 2015

The Simon and Speck families of block ciphers were designed specifically to offer security on constrained devices, where simplicity of design is crucial. However, the intended use cases are diverse and demand flexibility in implementation. Simplicity, security, and flexibility are ever-present yet conflicting goals in cryptographic design. This paper outlines how these goals were balanced in the design of Simon and Speck.

IACR Cryptology ePrint Archive, 2015

Kalyna is an SPN-based block cipher that was selected during Ukrainian national public cryptographic competition (2007-2010), and its slight modification was approved as the new encryption standard of Ukraine (DSTU 7624:2014) in 2015. The cipher supports a block size and a key length of 128, 256 and 512 bits where the size of the key can be either double or equal to that of the block length. According to its designers, the cipher provides strength to several cryptanalytic methods after the fifth and sixth rounds of the 128-bit and 256-bit block versions, respectively. In this paper, we present a meet-in-the-middle attack on the 7-round reduced versions of Kalyna where the key size is double the block length. Our attack is based on the differential enumeration approach where we carefully deploy a four round distinguisher in the first four rounds to bypass the effect of the carry bits resulting from the pre-whitening modular key addition. We also exploit the linear relation between consecutive odd and even indexed round keys which enables us to attack seven rounds and recover all the round keys incrementally. The attack on Kalyna with 128-bit block has a data complexity of 2 89 chosen plaintexts, time complexity of 2 230.2 and a memory complexity of 2 202.64. The data, time and memory complexities of our attack on Kalyna with 256-bit block are 2 233 , 2 502.2 and 2 170 , respectively.

Electronics

The cube attack was proposed at the 2009 Eurocrypt. The attack derives linear polynomials for specific output bits of a BlackBox cipher. Cube attacks target recovery keys or secret states. In this paper, we present a cube attack on a 5-round Sycon permutation and a 6-round Sycon permutation with a 320-bit state, whose rate occupies 96 bits, and whose capacity is 224 bits. We found cube variables related to a superpoly with a secret state. Within the cube variables, we recovered 32 bits of the secret state. The target algorithm was Sycon with 5-round and 6-round versions of permutation. For the 5-round Sycon, we found a cube variable and recovered a state with a total of 2192 Sycon computations and 237 bits of memory. For the 6-round Sycon, we found cube variables and recovered a state with a total of 2192 Sycon computations and 270 bits of memory. When using brute force in a 5-round attack, 2224 operations were required, but the cube attack proposed in this paper had 248 offline ope...

2015

Khudra is a hardware-oriented lightweight block cipher that is designed to run efficiently on Field Programmable Gate Arrays. It employs an 18-rounds Generalized type-2 Feistel Structure with a 64bit block length and an 80-bit key. In this paper, we present Meet-inthe-Middle (MitM) attacks on 13 and 14 round-reduced Khudra. These attacks are based on finding a distinguisher that is evaluated offline independently of the key. Then in an online phase, some rounds are appended before and after the distinguisher and the correct key candidates for these rounds are checked whether they verify the distinguisher property or not. Using this technique, we find two 6-round distinguishers and use them to attack 13 and 14 rounds of Khudra with time complexity of 2 and 2, respectively. Both attacks require the same data and memory complexities of 2 chosen plaintexts and 2 64-bit blocks, respectively.