I have been reading the Simon Cipher paper. It has the line: "The SIMON key schedules employ a sequence of 1-bit round constants specifically for the purpose of eliminating slide properties and circular shift symmetries", and I am curious.

I have read on the theoretical attack, but I am trying to find an approach to learn about the actual attack. I hope to break the Simon key schedule to make it susceptible to a slide attack and the SIMON32/64 bit-width is small so it might be possible. If I remove the constant z0 that is added to protect from a slide attack, I should be able to succeed in the attack.

Is there a good primer for slide attacks?

  • $\begingroup$ I suggest going through the references listed on Wikipedia. $\endgroup$
    – SEJPM
    Jan 4, 2017 at 19:32
  • $\begingroup$ @SEJPM The references are difficult and I tried. Once I understand, I'll write a not English page. $\endgroup$
    – suigin
    Jan 5, 2017 at 21:33
  • 2
    $\begingroup$ The -u option on simontool (github.com/bpdegnan/simontool/tree/master/simontool) will set the LFSR to feed 0's if you uncomment line 750 in simon.c and recompile. I was playing with changing the "z" value when I found some symmetry in the SIMON32/64 key schedule. Simontool is slow as it emulates hardware, but for a quick attempt at something, it should be sufficient. $\endgroup$
    – b degnan
    Jan 6, 2017 at 0:35

1 Answer 1


You should read David Wagner's original paper. You can see all of his work here.

He authored the 'Slide Attack', 'Advanced Slide Attacks' and a few more related to the attack.

Wikipedia has a good introduction here

Feistel ciphers like Simon are very vulnerable to Slide Attacks and similar. Removing the round constants from the key schedule will likley lead to an easy break in the cipher. Partial attacks on the real cipher seem possible if multiple round keys can be forced to collide in a related key attack.

  • 1
    $\begingroup$ That first link is a goldmine, +1 for it $\endgroup$
    – Ella Rose
    Jan 5, 2017 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.