On the Division Property of Simon48 and Simon64.

Zejun Xiang,Wentao Zhang,Dongdai Lin

DOI: https://doi.org/10.1007/978-3-319-44524-3_9

2016-01-01

Abstract:SIMON is a family of lightweight block ciphers published by the U.S. National Security Agency (NSA) in 2013. Due to its novel and bit-based design, integral cryptanalysis on SIMON seems a tough job. At EUROCRYPT 2015 Todo proposed division property which is a generalized integral property, and he applied this technique to searching integral distinguishers of SIMON block ciphers by considering the left and right halves of SIMON independently. As a result, he found 11-round integral distinguishers for both SIMON48 and SIMON64. Recently, at FSE 2016 Todo et al. proposed bit-based division property that considered each bit independently. This technique can find more accurate distinguishers, however, as pointed out by Todo et al. the time and memory complexity is bounded by 2(n) for an n-bit block cipher. Thus, bit-based division property is only applicable to SIMON32.In this paper we propose a new technique that achieves a trade-off between considering each bit independently and considering left and right halves as a whole, which is actually a trade-off between time-memory and the accuracy of the distinguishers. We proceed by splitting the state of SIMON into small pieces and study the division property propagations of circular shift and bitwise AND operations under the state partition. Moreover, we propose two different state partitions and study the influences of different partitions on the propagation of division property. We find that different partitions greatly impact the division property propagation of circular shift which will finally result in a big difference on the length of integral distinguishers. By using a tailored search algorithm for SIMON, we find 12-round integral distinguishers for Simon48 and Simon64 respectively, which improve Todo's results by one round for both variants.