Improved linear cryptanalysis of reduced-round SIMON-32 and SIMON-48

In this paper we analyse two variants of SIMON family of light-weight block ciphers against variants of linear cryptanalysis and present the best linear cryptanalytic results on these variants of reduced-round SIMON to date. We propose a time-memory trade-off method that finds differential/linear trails for any permutation allowing low Hamming weight differential/linear trails. Our method combines low Hamming weight trails found by the correlation matrix representing the target permutation with heavy Hamming weight trails found using a Mixed Integer Programming model representing the target differential/linear trail. Our method enables us to find a 17-round linear approximation for SIMON-48 which is the best current linear approximation for SIMON-48. Using only the correlation matrix method, we are able to find a 14-round linear approximation for SIMON-32 which is also the current best linear approximation for SIMON-32. The presented linear approximations allow us to mount a 23-round key recovery attack on SIMON-32 and a 24-round Key recovery attack on SIMON-48/96 which are the current best results on SIMON-32 and SIMON-48. In addition we have an attack on 24 rounds of SIMON-32 with marginal complexity.

linear cryptanalysis of nush block cipher

IEEE Computer Society

Cryptanalysis of SIMON Variants with Connections

SIMON is a family of 10 lightweight block ciphers published by Beaulieu et al. from the United States National Security Agency (NSA). A cipher in this family with K -bit key and N -bit block is called SIMON N/K . We present several linear characteristics for reduced-round SIMON32/64 that can be used for a key-recovery attack and extend them further to attack other variants of SIMON. Moreover, we provide results of key recovery analysis using several impossible differential characteristics starting from 14 out of 32 rounds for SIMON32/64 to 22 out of 72 rounds for SIMON128/256. In some cases the presented observations do not directly yield an attack, but provide a basis for further analysis for the specific SIMON variant. Finally, we exploit a connection between linear and differential characteristics for SIMON to construct linear characteristics for different variants of reduced-round SIMON. Our attacks extend to all variants of SIMON covering more rounds compared to any known results using linear cryptanalysis. We present a key recovery attack against SIMON128/256 which covers 35 out of 72 rounds with data complexity 2123 . We have implemented our attacks for small scale variants of SIMON and our experiments confirm the theoretical bias presented in this work.

LOKI97的线性密码分析

该文利用线性密码分析对 L OKI97进行了攻击 ,结果显示 ,L OKI97的安全性并没有达到高级加密标准的要求 ;利用线性密码分析中的算法 1和 2 50 个明密文对 ,以 0 .977的成功率预测 92比特子密钥 ;利用线性密码分析中的算法 2和 2 4 5个明密文对 ,以 0 .96 7的成功率预测 LOKI97的种子密钥 .

截断差分-线性密码分析

对差分 -线性密码分析方法进行推广 ,提出了截断差分 -线性密码分析方法 .对 9-轮和 11-轮 DES( dataencryption standard)密码算法的分析表明 ,该方法具有更加方便、灵活 ,适用范围更广的特点 .同时 ,利用截断差分 -线性密码分析方法得出 ,在类似 DES结构的算法中 ,S-盒的摆放顺序对密码的强度有较大的影响 .由此 ,截断差分 -线性分析方法给出了优化 S-盒排序的一种参考判别准则

一类广义Feistel密码的安全性评估

该文评估一类广义Feistel密码（GFC）抵抗差分和线性密码分析的能力：如果轮函数是双射且它的最大差分和线性特征的概率分别是p和q，则16轮GFC的差分和线性特征的概率的上界为p~7和q~7；如果轮函数采用SP结构且是双射，S盒的最大差分和线性特征的概率是pS和qS，P变换的分支数为P_d，则16轮GFC的差分和线性特征的概率的上界为(pS)~(3P_d+1)和(qS)~(3P_d+1)。

Q的线性密码分析

对NESSIE公布的17个分组密码之一的Q进行了线性密码分析，攻击所需的数据复杂不大于2^118(相应的成功率为0．785），空间复杂度不大于2^33+2^19+2^18+2^12+2^11+2^10。此结果显示Q对线性密码分析是不免疫的。

一类基于混沌函数的分组密码的安全性评估

评估了一类基于混沌函数的分组密码（generalized Feistel structure,简称GFS）抵抗差分密码分析和线性密码分析的能力，如果轮函数是双射且它的最大差分特征概率和线性逼近概率分别是p和q，则r轮GFS的最大差分特征和线性逼近的概率分别以p^r-1和q^r-1为其上界。

AC分组密码的差分和线性密码分析

讨论AC分组密码对差分和线性密码分析的安全性，通过估计3轮AC的差分活动盒子的个数下界和12轮AC的线性活动盒子的个数下界，本文得到AC的12轮差分特征概率不大于2－128和线性逼近优势不大于2－67，因此，AC分组密码对差分和线性密码分析是安全的。

关于Noekeon分组密码

Noekeon是NESSIE公布的17个候选算法之一,讨论了Noekeon各个模块的密码特性及它们在整个密码中的作用,从中体会Noekeon的设计技巧.