68
T. Ashur and A. Luykx
Moreover, it is a known secret that differential and linear paths do not give the
full picture due to the “multipath effect”. 4 The designers also acknowledge this and
wrote for Simon:
As has been noted by various authors [3, 4, 19, 138, 490, 523], Simon has a strong
multipath effect, largely because of the simplicity of its round function . . . We might very
conservatively estimate that the number of rounds admitting detectable linear correlations
(12, 16, 20, 29, and 37) increases by 50% or so, in the worst case.
How this number (50%) was obtained remains unknown.
Similarly, the multipath effect for differences in Speck is simply stated without
explanation:
For Speck, there is also a slight multipath effect for differences and so an additional round
or two can be gained, as noted by Song et al. [537]
and the multipath effect for linear approximation is not quantified at all:
The linear paths tend to exhibit a stronger multipath effect, but the best linear attacks for
Speck are still worse in every case than the best differential attacks.
To understand how the design team determined these numbers is crucial not only
for understanding the security of Simon and Speck, but if properly done it can help
in improving the security of other algorithms.
4.3.2 Choice of the Number of Rounds
A major source of contention within ISO was the lack of any information on how the
round numbers were chosen. Table 4.1 gives the number of rounds for the various
variants of Simon. We can see from this table that there does not seem to be any
rule for choosing the number of rounds (or “stepping”, as it is called in [66]). For
example, moving from Simon48 with m = 3 to m = 4 does not change the number
of rounds, while the same change adds two more rounds for Simon64 and Simon96,
and 3 more rounds for Simon128.
The only concrete claim in [66] is about the security margins. 5 The designers
say:
Thus, the design team set the stepping with the aim of having security margins comparable
to those of existing and trusted algorithms, like AES-128. After 4 years of concerted effort
by academic researchers, the various variants of Simon and Speck retain a margin averaging
around 30%, and in every case over 25%. The design team’s analysis when making stepping
decisions was consistent with these numbers.
4 The term “multipath effect” used by the designers is also known as the “clustering effect”,
“differential effect”, or “linear hull effect”.
5 The security margin is the difference between the number of rounds that can be attacked and the
actual number of rounds.
T. Ashur and A. Luykx
Moreover, it is a known secret that differential and linear paths do not give the
full picture due to the “multipath effect”. 4 The designers also acknowledge this and
wrote for Simon:
As has been noted by various authors [3, 4, 19, 138, 490, 523], Simon has a strong
multipath effect, largely because of the simplicity of its round function . . . We might very
conservatively estimate that the number of rounds admitting detectable linear correlations
(12, 16, 20, 29, and 37) increases by 50% or so, in the worst case.
How this number (50%) was obtained remains unknown.
Similarly, the multipath effect for differences in Speck is simply stated without
explanation:
For Speck, there is also a slight multipath effect for differences and so an additional round
or two can be gained, as noted by Song et al. [537]
and the multipath effect for linear approximation is not quantified at all:
The linear paths tend to exhibit a stronger multipath effect, but the best linear attacks for
Speck are still worse in every case than the best differential attacks.
To understand how the design team determined these numbers is crucial not only
for understanding the security of Simon and Speck, but if properly done it can help
in improving the security of other algorithms.
4.3.2 Choice of the Number of Rounds
A major source of contention within ISO was the lack of any information on how the
round numbers were chosen. Table 4.1 gives the number of rounds for the various
variants of Simon. We can see from this table that there does not seem to be any
rule for choosing the number of rounds (or “stepping”, as it is called in [66]). For
example, moving from Simon48 with m = 3 to m = 4 does not change the number
of rounds, while the same change adds two more rounds for Simon64 and Simon96,
and 3 more rounds for Simon128.
The only concrete claim in [66] is about the security margins. 5 The designers
say:
Thus, the design team set the stepping with the aim of having security margins comparable
to those of existing and trusted algorithms, like AES-128. After 4 years of concerted effort
by academic researchers, the various variants of Simon and Speck retain a margin averaging
around 30%, and in every case over 25%. The design team’s analysis when making stepping
decisions was consistent with these numbers.
4 The term “multipath effect” used by the designers is also known as the “clustering effect”,
“differential effect”, or “linear hull effect”.
5 The security margin is the difference between the number of rounds that can be attacked and the
actual number of rounds.