5

The NSA recently released SIMON and SPECK light weight block ciphers. Although initial spec release did not have much of cryptanalysis details, two works later appeared providing the cryptanalysis for the same SIMON and SPECK.

But how should we interpret those results? Are they considered good or bad?

For example:

  1. Attack complexity of key-recovery attack for SPECK32/64 is it requires $2^{29}$ plain texts…
    Is that good or bad?
  2. Rectangle attacks need $2^{30}$ plain texts…
    Is this good or bad?
orlp
  • 4,355
  • 21
  • 31
sashank
  • 6,234
  • 4
  • 36
  • 68

2 Answers2

7

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64.

Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but I can give you an idea. SPECK32/64 uses a block size of 32 bits, or 4 bytes. This means that after encrypting 2.1 GB of plaintexts your key could be recovered.

Whether that is deadly for security or not is up to you to decide, not me.

orlp
  • 4,355
  • 21
  • 31
2

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed.

I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo a reviewing process.

Dmitry Khovratovich
  • 5,737
  • 23
  • 25