# How should we interpret the cryptanalysis results of SIMON and SPECK?

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for the same SIMON and SPECK.

But how should we interpret those results? Are they considered good or bad?

For example:

1. Attack complexity of key-recovery attack for SPECK32/64 is it requires $2^{29}$ plain texts…
2. Rectangle attacks need $2^{30}$ plain texts…
-

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64.

Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but I can give you an idea. SPECK32/64 uses a block size of 32 bits, or 4 bytes. This means that after encrypting 2.1 GB of plaintexts your key could be recovered.

Whether that is deadly for security or not is up to you to decide, not me.

-
Oh ok , what about SIMON ? or in general what to look for when interpreting cryptanalysis results –  sashank Nov 13 '13 at 10:36
@sashank In general, the #1 most important part of cryptanalysis is how many rounds of a primitive it breaks, with attacks against full-round ciphers being the best possible. But this isn't the only aspect, important is what the requirements of the attack are: chosen-plaintext vs passive listener, how many plaintexts, related keys, etc and finally the complexity. –  orlp Nov 13 '13 at 11:45
One relevant measure is how many plaintext blocks is required relative to how many plaintext blocks there are. Usually, the number of blocks a block cipher can safely encrypt is just a small fraction of the number of possible blocks. If an attack requires more than that, it is probably not realistic. (Attacks only get better etc. applies, of course.) –  K.G. Nov 13 '13 at 13:12

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed.

I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo a reviewing process.

-