Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for the same SIMON and SPECK.

But how should we interpret those results? Are they considered good or bad?

For example:

  1. Attack complexity of key-recovery attack for SPECK32/64 is it requires $2^{29}$ plain texts…
    Is that good or bad?
  2. Rectangle attacks need $2^{30}$ plain texts…
    Is this good or bad?
share|improve this question
add comment

2 Answers

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64.

Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but I can give you an idea. SPECK32/64 uses a block size of 32 bits, or 4 bytes. This means that after encrypting 2.1 GB of plaintexts your key could be recovered.

Whether that is deadly for security or not is up to you to decide, not me.

share|improve this answer
    
Oh ok , what about SIMON ? or in general what to look for when interpreting cryptanalysis results –  sashank Nov 13 '13 at 10:36
1  
@sashank In general, the #1 most important part of cryptanalysis is how many rounds of a primitive it breaks, with attacks against full-round ciphers being the best possible. But this isn't the only aspect, important is what the requirements of the attack are: chosen-plaintext vs passive listener, how many plaintexts, related keys, etc and finally the complexity. –  nightcracker Nov 13 '13 at 11:45
1  
One relevant measure is how many plaintext blocks is required relative to how many plaintext blocks there are. Usually, the number of blocks a block cipher can safely encrypt is just a small fraction of the number of possible blocks. If an attack requires more than that, it is probably not realistic. (Attacks only get better etc. applies, of course.) –  K.G. Nov 13 '13 at 13:12
add comment

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed.

I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo a reviewing process.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.