5
$\begingroup$

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for the same SIMON and SPECK.

But how should we interpret those results? Are they considered good or bad?

For example:

  1. Attack complexity of key-recovery attack for SPECK32/64 is it requires $2^{29}$ plain texts…
    Is that good or bad?
  2. Rectangle attacks need $2^{30}$ plain texts…
    Is this good or bad?
Improve this question
$\endgroup$

2 Answers 2

Reset to default
7
$\begingroup$

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64.

Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but I can give you an idea. SPECK32/64 uses a block size of 32 bits, or 4 bytes. This means that after encrypting 2.1 GB of plaintexts your key could be recovered.

Whether that is deadly for security or not is up to you to decide, not me.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Oh ok , what about SIMON ? or in general what to look for when interpreting cryptanalysis results $\endgroup$
    – sashank
    Nov 13, 2013 at 10:36
  • 2
    $\begingroup$ @sashank In general, the #1 most important part of cryptanalysis is how many rounds of a primitive it breaks, with attacks against full-round ciphers being the best possible. But this isn't the only aspect, important is what the requirements of the attack are: chosen-plaintext vs passive listener, how many plaintexts, related keys, etc and finally the complexity. $\endgroup$
    – orlp
    Nov 13, 2013 at 11:45
  • 2
    $\begingroup$ One relevant measure is how many plaintext blocks is required relative to how many plaintext blocks there are. Usually, the number of blocks a block cipher can safely encrypt is just a small fraction of the number of possible blocks. If an attack requires more than that, it is probably not realistic. (Attacks only get better etc. applies, of course.) $\endgroup$
    – K.G.
    Nov 13, 2013 at 13:12
2
$\begingroup$

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed.

I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo a reviewing process.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.