# Tag Info

9

Analyzable in this case means "simple to study". If your cipher consists of a small function that mixes a few things together, and then you repeat that often then your cipher is more easily understood and more easily fit into previous research knowledge than a overclomplicated large design. This is the case with Simon and Speck. Being easy to analyze is a ...

6

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64. Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but ...

4

From a quick read, there are a couple of potential issues. decrypt_128_256 is iterating rounds in the same order as in encrypt_128_256, so the round keys are being applied in the wrong order on decrypt. decrypt_128_256 needs to iterate through the round keys starting from the last round and working backwards. 68 rounds are being used for Speck128/256 (...

3

As one of the authors of the paper, let me give you an answer. The operation $F$ is indeed applied to both $x$ and $x'$. By stating that $\oplus$ is invariant under rotation, we mean that if you first rotate $x$ and $x'$ and take the difference with $\oplus$, you get the same result as if you first take the difference with $\oplus$ and then rotate the ...

3

If I understand you correctly, you are using the Simon key expansion process, so that the input to your block is the 256 bit Simon key, and the output is the 256 bit last round key (and you're ignoring the Simon encryption process entirely). If so, three nits: I believe that you can find preimages for your hash function in $O(2^{64})$ compression function ...

2

The main advantage I have heard is reducing the amount of data the client has to send to the cloud. As said in A Comparison of the Homomorphic Encryption Schemes FV and YASHE: [...] ciphertext expansion (i.e. the ciphertext size divided by the plaintext size) of current FHE schemes is prohibitive (thousands to millions). For example using ...

1

The paper also discusses linear characteristics for multiple rounds: We present several approaches to produce linear characteristics for SIMON32/64 and present the best known linear characteristic for 11-round SIMON 32/64 with the bias of $2^{-16}$. We then extend this characteristic to 13 rounds of the cipher. We present several approaches ...

1

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed. I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo ...

Only top voted, non community-wiki answers of a minimum length are eligible