Abstract:Differential and linear cryptanalysis are two important methods to evaluate the security of block ciphers. Building on these two methods, differential‐linear (DL) cryptanalysis was introduced by Langford and Hellman in 1994. This cryptanalytic method has been not only extensively researched but also proven to be effective. In this paper, a security evaluation framework for AND‐RX ciphers against DL cryptanalysis is proposed, which is denoted as K6. In addition to modeling the structure of all the possible differential trails and linear trails at the bit level, we introduce a method to calculate this structure round by round. Based on this approach, an automatic algorithm is proposed to construct the DL distinguisher. Unlike previous methods, K6 uses a truncated differential and a linear hull instead of a differential characteristic and a linear approximation, which brings the bias of the DL distinguisher close to the experimental value. To validate the effectiveness of the framework, K6 is applied to Simon and Simeck, which are two typical AND‐RX ciphers. With the automatic algorithm, we discover an 11‐round DL distinguisher of Simon32 with bias 2−14.89 and a 12‐round DL distinguisher of Simeck32 with bias 2−14.89. Moreover, the 14‐round DL distinguisher of Simon48 with bias 2−22.30 is longer than the longest DL distinguisher currently known. In addition, the framework K6 shows advantages when analyzing ciphers with large block sizes. As far as we know, for Simon64/96/128 and Simeck48/64, the first DL distinguishers are obtained with our framework. The DL distinguishers are 16, 23, 32, 17, and 22 rounds of Simon64/96/128 and Simeck48/64 with bias 2−24.31, 2−47.57, 2−60.75, 2−22.54, and 2−31.41, respectively. To prove the correctness of distinguishers, experiments on Simon32 and Simeck32 have been performed. The experimental bias are 2−13.76 and 2−14.82, respectively. Comparisons of the theoretical and experimental results show good agreement.

Weak Rotational Property and Its Application.

MILP/MIQCP-Based Fully Automatic Method of Searching for Differential-Linear Distinguishers for SIMON-Like Ciphers

Improved Linear Hull Attack On Round-Reduced Simon With Dynamic Key-Guessing Techniques

New Automatic Tool for Finding Impossible Differentials and Zero-Correlation Linear Approximations

Fault-cube attack on SIMON family of lightweight block ciphers

Differential Attacks on Reduced SIMON Versions with Dynamic Key-Guessing Techniques.

Mixture Differential Cryptanalysis on Round-Reduced SIMON32/64 Using Machine Learning

Automated Differential‐Linear Cryptanalysis for AND‐RX Ciphers

Improved Integral Attacks on SIMON32 and SIMON48 with Dynamic Key-Guessing Techniques.

Enhancing the MILP/MIQCP-based Automatic Search for Differential-Linear Distinguishers of Simon-Like Ciphers

Breaking the Symmetry: a Way to Resist the New Differential Attack.

Machine Learning Assisted Differential Distinguishers for Lightweight Ciphers.

Impossible Differential Attack on Simpira V2.

Towards Key-recovery-attack Friendly Distinguishers: Application to GIFT-128

Meet-in-the-Middle Technique for Truncated Differential and Its Applications to CLEFIA and Camellia

Differential Invariant Subspace Cryptanalysis – A Realtime Attack against IoT-friendly Word-based Block Ciphers

Quantum impossible differential and truncated differential cryptanalysis

Deep Learning based Differential Distinguisher for Lightweight Block Ciphers

Automatic Search of Differential Characteristics and Improved Differential Cryptanalysis for PRINCE, QARMA, and MANTIS

New Impossible Differential Cryptanalysis of Reduced-Round Camellia

SAT-based Analysis of Related-key Impossible Distinguishers on Piccolo and (Tweakable) TWINE