70
T. Ashur and A. Luykx
A method which uses the key recovery procedure to attack additional rounds is
mentioned:
Dinur [183] shows that an r-round differential distinguisher yields at least an (r + m)-round
attack, where m is the number of words of key.
For linear cryptanalysis the designers make a vague statement:
The best linear paths for Speck are notably weaker than the best difference paths, with
squared correlations dropping below 2 −block size in fewer rounds than is necessary for the
difference path probabilities. This agrees with what was found (through non-exhaustive
searches) in [223].
Then they cite again someone else’s work, but only for Speck32, Speck48, and
Speck64:
In [377], it’s proven that for Speck 32, Speck 48, and Speck 64 the squared correlations fall
below 2 −block size in 10, 11, and 14 rounds, respectively.
The multipath effect is again mentioned, but not in a meaningful way:
The linear paths tend to exhibit a stronger multipath effect, but the best linear attacks for
Speck are still worse in every case than the best differential attacks.
In the case of Speck, not only does no variant retain a security margin of 30% as
is argued in [66], but also the largest security margin is 18.2% for Speck32/64. The
exact figures can be found in Table 4.4.
We stress that the estimation of the remaining security margin given here is very
generous. It assumes that no path longer than those already found exists (which
the designers refused to confirm), that the first/last round trick can indeed only be
applied to a single round on each side, and that unlike Speck, key recovery attacks
against Simon cannot extend beyond the statistical property being used.
Table 4.4 Remaining security margins for Speck
Multipath
effect + m +
Number
Longest Multipath Multipath first/last round Remaining security
Variant of rounds path
effect (+2) effect + m trick
margin (rounds)
32/64
22
10
12
16
18
18.2% (4)
48/72
22
12
14
17
19
13.6% (3)
48/96
23
12
14
18
20
13% (3)
64/96
26
16
18
21
23
11.5% (3)
64/144 27
16
18
22
24
11.1% (3)
96/96
28
18
20
22
24
14.3% (4)
96/144 29
18
20
23
25
13.8% (4)
128/128 32
21
23
25
27
15.6% (5)
128/192 33
21
23
26
28
15.2% (5)
128/256 34
21
23
27
29
14.7% (5)
T. Ashur and A. Luykx
A method which uses the key recovery procedure to attack additional rounds is
mentioned:
Dinur [183] shows that an r-round differential distinguisher yields at least an (r + m)-round
attack, where m is the number of words of key.
For linear cryptanalysis the designers make a vague statement:
The best linear paths for Speck are notably weaker than the best difference paths, with
squared correlations dropping below 2 −block size in fewer rounds than is necessary for the
difference path probabilities. This agrees with what was found (through non-exhaustive
searches) in [223].
Then they cite again someone else’s work, but only for Speck32, Speck48, and
Speck64:
In [377], it’s proven that for Speck 32, Speck 48, and Speck 64 the squared correlations fall
below 2 −block size in 10, 11, and 14 rounds, respectively.
The multipath effect is again mentioned, but not in a meaningful way:
The linear paths tend to exhibit a stronger multipath effect, but the best linear attacks for
Speck are still worse in every case than the best differential attacks.
In the case of Speck, not only does no variant retain a security margin of 30% as
is argued in [66], but also the largest security margin is 18.2% for Speck32/64. The
exact figures can be found in Table 4.4.
We stress that the estimation of the remaining security margin given here is very
generous. It assumes that no path longer than those already found exists (which
the designers refused to confirm), that the first/last round trick can indeed only be
applied to a single round on each side, and that unlike Speck, key recovery attacks
against Simon cannot extend beyond the statistical property being used.
Table 4.4 Remaining security margins for Speck
Multipath
effect + m +
Number
Longest Multipath Multipath first/last round Remaining security
Variant of rounds path
effect (+2) effect + m trick
margin (rounds)
32/64
22
10
12
16
18
18.2% (4)
48/72
22
12
14
17
19
13.6% (3)
48/96
23
12
14
18
20
13% (3)
64/96
26
16
18
21
23
11.5% (3)
64/144 27
16
18
22
24
11.1% (3)
96/96
28
18
20
22
24
14.3% (4)
96/144 29
18
20
23
25
13.8% (4)
128/128 32
21
23
25
27
15.6% (5)
128/192 33
21
23
26
28
15.2% (5)
128/256 34
21
23
27
29
14.7% (5)