4 The ISO/IEC Standardization of Simon and Speck
69
In an attempt to determine the real security margins, ISO experts tried to piece
together all the claims made by the designers. First, we looked at the best paths
given in [66]:
The design team determined that the single path probabilities (and linear correlations) dip
below 2 −block size for 12, 16, 20, 29, and 37 rounds for Simon 32, 48, 64, 96, and 128,
respectively.
Then, for the multipath effect they argue:
Simon has a strong multipath effect, largely because of the simplicity of its round function
. . . We might very conservatively estimate that the number of rounds admitting detectable
linear correlations (12, 16, 20, 29, and 37) increases by 50% or so, in the worst case.
That an additional round on each side of a Feistel network can be attacked is
acknowledged:
And then first/last round attack ideas must be factored in.
Pasting all these pieces of information together reveals that except for the case
of Simon32/64, which retains a security margin of 37.5%, the remaining security
margins for all other variants are below 30%, ranging between 12.5–27.8% with
numbers that tend to decrease for the larger block sizes. The exact figures can be
found in Table 4.3.
For Speck, the so-called design rationale focuses on differential cryptanalysis:
the stepping was based on the best differential paths, which tend to be stronger than the best
linear paths. See [223]. The single difference path probabilities dip below 2 −block size for 10,
12, 16, 18, and 21 rounds for Speck 32, 48, 64, 96, and 128, respectively.
The multipath effect is not quantified and the report only reads:
For Speck, there is also a slight multipath effect for differences and so an additional round
or two can be gained, as noted by Song et al. [537].
Table 4.3 Remaining security margins for Simon
Number of
Longest
150% + first/last
Remaining security
Variant
rounds
path
150%
round trick
margin (rounds)
32/64
32
12
18
20
37.5% (12)
48/72
36
16
24
26
27.8% (10)
48/96
36
16
24
26
27.8% (10)
64/96
42
20
30
32
23.8% (10)
64/144
44
20
30
32
27.3% (12)
96/96
52
29
43.5
45.5
12.5% (6.5)
96/144
54
29
43.5
45.5
15.7% (8.5)
128/128
68
37
55.5
57.5
15.4% (10.5)
128/192
69
37
55.5
57.5
16.7% (11.5)
128/256
72
37
55.5
57.5
20.1% (14.5)
69
In an attempt to determine the real security margins, ISO experts tried to piece
together all the claims made by the designers. First, we looked at the best paths
given in [66]:
The design team determined that the single path probabilities (and linear correlations) dip
below 2 −block size for 12, 16, 20, 29, and 37 rounds for Simon 32, 48, 64, 96, and 128,
respectively.
Then, for the multipath effect they argue:
Simon has a strong multipath effect, largely because of the simplicity of its round function
. . . We might very conservatively estimate that the number of rounds admitting detectable
linear correlations (12, 16, 20, 29, and 37) increases by 50% or so, in the worst case.
That an additional round on each side of a Feistel network can be attacked is
acknowledged:
And then first/last round attack ideas must be factored in.
Pasting all these pieces of information together reveals that except for the case
of Simon32/64, which retains a security margin of 37.5%, the remaining security
margins for all other variants are below 30%, ranging between 12.5–27.8% with
numbers that tend to decrease for the larger block sizes. The exact figures can be
found in Table 4.3.
For Speck, the so-called design rationale focuses on differential cryptanalysis:
the stepping was based on the best differential paths, which tend to be stronger than the best
linear paths. See [223]. The single difference path probabilities dip below 2 −block size for 10,
12, 16, 18, and 21 rounds for Speck 32, 48, 64, 96, and 128, respectively.
The multipath effect is not quantified and the report only reads:
For Speck, there is also a slight multipath effect for differences and so an additional round
or two can be gained, as noted by Song et al. [537].
Table 4.3 Remaining security margins for Simon
Number of
Longest
150% + first/last
Remaining security
Variant
rounds
path
150%
round trick
margin (rounds)
32/64
32
12
18
20
37.5% (12)
48/72
36
16
24
26
27.8% (10)
48/96
36
16
24
26
27.8% (10)
64/96
42
20
30
32
23.8% (10)
64/144
44
20
30
32
27.3% (12)
96/96
52
29
43.5
45.5
12.5% (6.5)
96/144
54
29
43.5
45.5
15.7% (8.5)
128/128
68
37
55.5
57.5
15.4% (10.5)
128/192
69
37
55.5
57.5
16.7% (11.5)
128/256
72
37
55.5
57.5
20.1% (14.5)