The Simon and Speck families of block ciphers were designed specifically to offer security on constrained devices, where simplicity of design is crucial. However, the intended use cases are diverse and demand flexibility in implementation. Simplicity, security, and flexibility are ever-present yet conflicting goals in cryptographic design. This paper outlines how these goals were balanced in the design of Simon and Speck.

The SIMON and SPECK lightweight block ciphers

We give a provable-security treatment for the key-wrap problem, providing definitions, constructions, and proofs. We suggest that key-wrap's goal is security in the sense of deterministic authenticated-encryption (DAE), a notion that we put forward. We also provide an alternative notion, a pseudorandom injection (PRI), which we prove to be equivalent. We provide a DAE construction, SIV, analyze its concrete security, develop a blockcipher-based instantiation of it, and suggest that the method makes a desirable alternative to the schemes of the X9.102 draft standard. The construction incorporates a method to turn a PRF that operates on a string into an equally efficient PRF that operates on a vector of strings, a problem of independent interest. Finally, we consider IV-based authenticated-encryption (AE) schemes that are maximally forgiving of repeated IVs, a goal we formalize as misuse-resistant AE. We show that a DAE scheme with a vector-valued header, such as SIV, directly realizes this goal.

A provable-security treatment of the key-wrap problem

We propose two systematic methods to describe the differential property of an S-box with linear inequalities based on logical condition modelling and computational geometry respectively. In one method, inequalities are generated according to some conditional differential properties of the S-box; in the other method, inequalities are extracted from the H-representation of the convex hull of all possible differential patterns of the S-box. For the second method, we develop a greedy algorithm for selecting a given number of inequalities from the convex hull. Using these inequalities combined with Mixed-integer Linear Programming (MILP) technique, we propose an automatic method for evaluating the security of bit-oriented block ciphers against the (related-key) differential attack with several techniques for obtaining tighter security bounds, and a new tool for finding (related-key) differential characteristics automatically for bit-oriented block ciphers.

/pdf/automatic-security-evaluation-and-related-key-differential-5erle8kbwv.pdf

Automatic Security Evaluation and (Related-key) Differential Characteristic Search: Application to SIMON, PRESENT, LBlock, DES(L) and Other Bit-Oriented Block Ciphers

Due to Shor's algorithm, quantum computers are a severe threat for public key cryptography. This motivated the cryptographic community to search for quantum-safe solutions. On the other hand, the impact of quantum computing on secret key cryptography is much less understood. In this paper, we consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in it.

We study applications of a quantum procedure called Simon's algorithm the simplest quantum period finding algorithm in order to attack symmetric cryptosystems in this model. Following previous works in this direction, we show that several classical attacks based on finding collisions can be dramatically sped up using Simon's algorithm: finding a collision requires $$\varOmega 2^{n/2}$$ queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only On queries in the quantum model.

We obtain attacks with very strong implications. First, we show that the most widely used modes of operation for authentication and authenticated encryption e.g. CBC-MAC, PMAC, GMAC, GCM, and OCB are completely broken in this security model. Our attacks are also applicable to many CAESAR candidates: CLOC, AEZ, COPA, OTR, POET, OMD, and Minalpher. This is quite surprising compared to the situation with encryption modes: Anand et al. show that standard modes are secure with a quantum-secure PRF.

Second, we show that Simon's algorithm can also be applied to slide attacks, leading to an exponential speed-up of a classical symmetric cryptanalysis technique in the quantum model.

/pdf/breaking-symmetric-cryptosystems-usingzquantumzperiod-40xjh0ou6p.pdf

Breaking Symmetric Cryptosystems UsingźQuantumźPeriod Finding

The U.S. National Security Agency (NSA) developed the Simon and Speck families of lightweight block ciphers as an aid for securing applications in very constrained environments where AES may not be suitable. This paper summarizes the algorithms, their design rationale, along with current cryptanalysis and implementation results.

/pdf/simon-and-speck-block-ciphers-for-the-internet-of-things-2vkz23sw1g.pdf

SIMON and SPECK: Block Ciphers for the Internet of Things.

Simon and Speck are two families of ultra-lightweight block ciphers which were announced by the U.S. National Security Agency in June 2013. This paper presents differential and rectangle attacks for almost all members of the Speck family of ciphers, where we target up to 11/22, 12/23, 15/27, 15/29, and 18/34 rounds of the 32-, 48-, 64-, 96-, and 128-bit version, respectively.

/pdf/cryptanalysis-of-the-speck-family-of-block-ciphers-570rpptygi.pdf

Cryptanalysis of the Speck Family of Block Ciphers.

/pdf/on-the-security-of-the-core-of-prince-against-biclique-and-g8y9jmanav.pdf

On the Security of the Core of PRINCE Against Biclique and Differential Cryptanalysis.

At CRYPTO’16, Beierle et al. presented SKINNY, a family of lightweight tweakable block ciphers intended to compete with the NSA designs SIMON and SPECK. SKINNY can be implemented efficiently in both soft- and hardware and supports block sizes of 64 and 128 bits as well as tweakey sizes of 64, 128, 192 and 128, 256, 384 bits respectively. This paper presents a related-tweakey impossible-differential attack on up to 23 (out of 36) rounds of SKINNY-64/128 for different tweak sizes. All our attacks can be trivially extended to SKINNY-128/128.

Related-Key Impossible-Differential Attack on Reduced-Round SKINNY

Farzaneh Abed Bauhaus-Universität Weimar, farzaneh.abed(at)uni-weimar.de Scott Fluhrer Cisco Systems, sfluhrer(at)cisco.com John Foley Cisco Systems , foleyj(at)cisco.com Christian Forler Huawei Technologies, christian.forler(at)huawei.com Eik List Bauhaus-Universität Weimar, eik.list(at)uni-weimar.de Stefan Lucks Bauhaus-Universität Weimar, stefan.lucks(at)uni-weimar.de David McGrew Cisco Systems, mcgrewd(at)cisco.com Jakob Wenzel Bauhaus-Universität Weimar, jakob.wenzel(at)uni-weimar.de

/pdf/the-poet-family-of-on-line-authenticated-encryption-schemes-zx0qpmpq70.pdf

The POET Family of On-Line Authenticated Encryption Schemes Submission to the CAESAR competition

/pdf/related-key-impossible-differential-attack-on-reduced-round-2ltw5epl7m.pdf

Eik List

Papers

Cryptanalysis of the Speck Family of Block Ciphers.

On the Security of the Core of PRINCE Against Biclique and Differential Cryptanalysis.

Related-Key Impossible-Differential Attack on Reduced-Round SKINNY

The POET Family of On-Line Authenticated Encryption Schemes Submission to the CAESAR competition

Related-Key Impossible-Differential Attack on Reduced-Round SKINNY.