Improved rotational‐XOR cryptanalysis of Simon‐like block ciphers

IET Information SecurityEarly View ORIGINAL RESEARCHOpen Access Improved rotational-XOR cryptanalysis of Simon-like block ciphers Jinyu Lu, Jinyu Lu orcid.org/0000-0002-7299-0934 College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this authorYunwen Liu, Corresponding Author Yunwen Liu univerlyw@hotmail.com College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, China Correspondence Yunwen Liu, College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, China. Email: univerlyw@hotmail.comSearch for more papers by this authorTomer Ashur, Tomer Ashur imec-COSIC KU Leuven, Leuven, The NetherlandsSearch for more papers by this authorBing Sun, Bing Sun College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this authorChao Li, Chao Li College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this author Jinyu Lu, Jinyu Lu orcid.org/0000-0002-7299-0934 College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this authorYunwen Liu, Corresponding Author Yunwen Liu univerlyw@hotmail.com College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, China Correspondence Yunwen Liu, College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, China. Email: univerlyw@hotmail.comSearch for more papers by this authorTomer Ashur, Tomer Ashur imec-COSIC KU Leuven, Leuven, The NetherlandsSearch for more papers by this authorBing Sun, Bing Sun College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this authorChao Li, Chao Li College of Liberal Arts and Sciences, National University of Defense Technology, Changsha, ChinaSearch for more papers by this author First published: 29 March 2022 https://doi.org/10.1049/ise2.12061AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Rotational-XOR (RX) cryptanalysis is a cryptanalytic method aimed at finding distinguishable statistical properties in Addition-Rotation-XOR-C ciphers, that is, ciphers that can be described only by using modular addition, cyclic rotation, XOR and the injection of constants. In this study, we extend RX-cryptanalysis to AND-RX ciphers, a similar design paradigm where the modular addition is replaced by vectorial bitwise AND; such ciphers include the block cipher families Simon and Simeck. We analyse the propagation of RX-differences through AND-RX rounds and develop a closed form formula for their expected probability. Inspired by the MILP verification model proposed by Sadeghi et al., we develop a SAT/SMT model for searching compatible RX-characteristics in Simon-like ciphers, that is, that there is at least one right pair of messages/keys to satisfy the RK-characteristics. To the best of our knowledge, this is the first model that takes the RX-difference transitions and value transitions simultaneously into account in Simon-like ciphers. Meanwhile, we investigate how the choice of the round constants affects the resistance of Simon-like ciphers against RX-cryptanalysis. Finally, we show how to use an RX-distinguisher for a key recovery attack. Evaluating our model we find compatible RX-characteristics of up to 20, 27 and 34 rounds with respective probabilities of 2−26, 2−44 and 2−56 for versions of Simeck with block sizes of 32, 48 and 64 bits, respectively, for large classes of weak keys in the related-key model. In most cases, these are the longest published distinguishers for the respective variants of Simeck. In the case of Simon, we present compatible RX-characteristics for round-reduced versions of all 10 instances. We observe that for equal block and key sizes, the RX-distinguishers cover fewer rounds in Simon than in Simeck. Concluding the paper, we present a key recovery attack on Simeck 64 reduced to 28 rounds using a 23-round RX-characteristic. 1 INTRODUCTION Rotational-XOR cryptanalysis is a cryptanalytic technique for Addition-Rotation-XOR (ARX) ciphers proposed by Ashur and Liu [1]. RX-cryptanalysis generalises rotational cryptanalysis by investigating the influence of round constants on the probabilistic propagation of rotational pairs passing through the ARX operations. The successful application of RX-cryptanalysis to Speck [2] reveals that the round constants sometimes interact in a constructive way between the rounds, that is, that a broken symmetry caused by a round constant in round i may be restored—either fully or partially—by another constant injection in round j > i. As a result, new designs such as [3] now show resistance to RX-cryptanalysis as part of their security argument. AND-RX ciphers, defined as a counterpart of ARX ciphers where the modular addition is replaced by bitwise AND, are of contemporary interest owing to the design of the block cipher Simon [4] which was followed by other Simon-like ciphers such as Simeck [5]. Since the AND-RX operations in Simon-like ciphers are bitwise, the resulting statistical properties of individual bits remain independent of the bit-position. We say that such properties are rotation-invariant. To break rotation-invariant properties, the round constants are usually injected into the state. In the case of Simon and Simeck, the constants are injected to the key schedule and propagate into the round function via the round subkey. Searching for (related key) differential characteristics in most models based on MILP or SAT/SMT only involves differential transitions and they are considered independent in different rounds. Previous studies have reported exceptions where such characteristics are incompatible [6]. Sadeghi et al. [7] developed a MILP model to verify the existence of right pairs with respect to a given characteristic. Observing that sometimes this set is empty, they conclude that the concatenation of valid transitions may result in an incompatible characteristic due to globally contradicting constraints. Our contribution. In this study, we extend the idea of RX-cryptanalysis to AND-RX ciphers with applications to Simon and Simeck. The propagation of RX-differences through the AND-RX operations is fully analysed and a closed algebraic formula is derived for its expected probability. We show that an RX-difference with translation α passes through the vectorial AND operation with the same probability as that of an α XOR-difference. Due to the different nature of RX-differences and XOR-differences, characteristics of the former type would depend more on the key schedule and choice of round constants than those of the latter type. Inspired by the MILP verification model proposed by Sadeghi et al., we develop a SAT/SMT model to search compatible RX-characteristics, that is, that they are consistent with at least one right pair of messages/keys. This model can automatically avoid the incompatible problem when searching RX-characteristics. Using the automatic search model we find compatible RX-distinguishers for all versions of Simeck and Simon; these results are summarised in Tables 1 and 2. TABLE 1. Comparison of RX-characteristics for rotation offset γ = 1 with the longest published distinguishers for Simeck32, Simeck48 and Simeck64aa Differential characteristics, ID, integral distinguishers; RKDC, related-key differential characteristics; RX, RX-characteristics. Cipher Attack rounds Data complexity Size of week key class Type Reference Simeck32 13 232 Full DC [9] 15 231 Full ID [10] 224 254 RKDC [11] 218 244 RX Section 5.1 19 224 230 RX Section 5.1 20 226 230 RX Section 5.1 Simeck48 16 224 280 RKDC [11] 218 268 RX Section 5.1 18 247 Full ID [10] 222 266 RX Section 5.1 19 248 Full DC [9] 224 262 RX Section 5.1 27 244 246 RX Section 5.1 Simeck64 21 263 Full ID [10] 25 264 Full DC [9] 234 280 RX Section 5.1 34 256 258 RX Section 5.1 a Differential characteristics, ID, integral distinguishers; RKDC, related-key differential characteristics; RX, RX-characteristics. TABLE 2. RX-distinguishers and their probabilities in round-reduced Simon instances Simon 32/64 48/72 48/96 64/96 64/128 96/96 96/144 128/128 128/192 128/256 Rds. 14 14 15 16 16 15 18 16 20 22 Pr. 2−32 2−48 2−46 2−64 2−64 2−93 2−96 2−98 2−120 2−120 Note: The distinguishers work in a related-key model for all keys. The compatible RX-characteristics we found for Simeck variants with block sizes of 32-, 48- and 64-bit improve the previously longest published results by 5, 8 and 9 rounds, respectively, albeit sometimes in a weaker attack model. When comparing for the same number of rounds, our results offer different trade-offs between the size of the affected key class and the distinguisher's probability. For Simon2n/4n we present compatible RX-characteristics of up to 14, 15, 16, 18 and 22 rounds, respectively. These are not the longest distinguishers for the respective versions of Simon. Finally, we show how to exploit an RX-characteristic in a key recovery attack and apply it to reduced-round versions of Simeck64. We present an attack on 28 out of 44 rounds for Simeck 64/128 with data complexity 236 and time complexity 279.5. To the best of our knowledge, this is the first extension of RX-cryptanalysis to key recovery. This study is an extension of [6, 8]. The original paper included the following contributions: An analysis of the propagation of RX-characteristics in AND-RX algorithms; A SAT/SMT automatic search model for RX-characteristics in Simon-like ciphers; Applications to Simeck and Simon32; A preliminary exploration of how different key schedules affect the probability and automatic search of RX-characteristics. The extended version includes the following additional contributions: To the best of our knowledge, for the first time we developed a SAT/SMT model capturing the RX-difference transitions and value transitions simultaneously in Simon-like ciphers. This model finds the compatible characteristics as well as the right pairs simultaneously, moreover, it can be directly applied in the detection of incompatible characteristics. In contrast, the method of Sadeghi et al. is aimed at detecting the incompatibility distinguisher. In this paper, we consider more about how to obtain compatible distinguishers directly. This model makes the cryptanalyst get rid of the complex, tedious and time-consuming process from a large number of searches to detection, making the analysis more concise and efficient. Simultaneously, it plays a very important role for the distinguisher attack and the key recovery attack. Based on this model, we re-evaluate Simeck32, Simeck48 and Simeck64. We see that previously published distinguishers cover up to 15, 19 and 25 rounds of Simeck32, Simeck48 and Simeck64, respectively, whereas our RX-characteristics improve the number of distinguished rounds by 5, 8 and 9 rounds, albeit for a smaller key class than previous results. Benchmarking for the same number of rounds, detecting our distinguishers requires fewer data. At the same time, we also evaluated all the 10 versions of Simon. For Simon32/64, we find longer RX-characteristics than previously presented. We evaluate a sequence of round constants and see how different round constants reflect in the resistance of the resulting cipher against RX-cryptanalysis. We find that the ability of the ciphers to resist RX-cryptanalysis can be affected by the hamming weight of the Δγc and the specific choices of the round constants. To circumvent RX-differential attack, we give some suggestions to design the round constants. Moreover, we show how an RX-characteristic can be used to mount a key recovery attack, and apply this method to the reduced-round version Simeck64. Organisation: In Section 2, we recall RX-cryptanalysis, the structure of Simon-like ciphers with emphasis on the key schedule of Simon and Simeck, and relevant previous work. In Section 3, we generalise RX-cryptanalysis to AND-RX algorithms. We give a closed-form algebraic formula for the probabilistic propagation of an RX-difference in AND-RX and for the special case of Simon-like ciphers. In Section 4, we devise an automated search model for finding good RX-characteristics in Simon-like ciphers. This model is then evaluated in Section 5 on all versions of Simeck and Simon. In Section 6, we investigate the effect of the round constants on the resistance of Simon-like ciphers against RX-cryptanalysis. In Section 7, we employ our distinguishers in key recovery attacks on reduced-round versions of Simeck64. The attacks work in the related-key chosen-plaintext model. Section 8 concludes the paper. 2 PRELIMINARIES In this section, we give a brief overview of the structure of Simon-like ciphers and recall the general idea of rotational-XOR cryptanalysis. Table 3 presents the notation we use. TABLE 3. The notations used throughout the paper Notation Description x = (xn−1, …, x1, x0) Binary vector of n bits; xi is the bit in position i with x0 the least significant one x ⊙ y Vectorial bitwise AND between x and y x ⊕ y Vectorial bitwise XOR between x and y x‖y Concatenation of x and y x|y Vectorial bitwise OR between x and y wt(x) Hamming weight of x x ⋘ γ, Sγ(x) Circular left shift of x by γ bits x ⋙ γ, S−γ(x) Circular right shift of x by γ bits (I ⊕ Sγ) (x) x ⊕ Sγ(x) x ‾ Bitwise negation x ⃖ x ⋘ 1 2.1 Simon-like ciphers Simon is a family of block ciphers following the AND-RX design paradigm, that is, members of the family can be described using only the bitwise operations AND (⊙), XOR (⊕) and cyclic rotation by γ bits (Sγ). Simon-like ciphers generalise the structure of Simon's round function with parameters different from the original ones. 2.1.1 The round function Simon is a family of lightweight block ciphers designed by the NSA in 2013. A member of the family is denoted by Simon2n/mn, to specify a block size of 2n for n ∈ {16, 24, 32, 48, 64}, and key size of mn for m ∈ {2, 3, 4}. The round function of Simon is defined as f ( x ) = S 8 x ⊙ S 1 x ⊕ S 2 ( x ) . Simon-like ciphers are ciphers that share the same round structure as Simon, but generalise it to arbitrary rotation amounts (a, b, c) such that the round function becomes f a , b , c ( x ) = S a x ⊙ S b x ⊕ S c ( x ) . Of particular interest in this paper is the Simeck family of lightweight block ciphers designed by Yang et al. [5], aiming at improving the hardware implementation cost of Simon. Simeck2n/4n denotes an instance with a 2n-bit block and a 4n-bit key for n ∈ {16, 24, 32}. Since the key length of Simeck is always 4n we use lazy writing in the sequel and simply write Simeck2n throughout the study. The rotation amounts for all Simeck versions are (a, b, c) = (5, 0, 1). 2.1.2 The key schedule The non-linear key schedule of Simeck reuses the cipher's round function to generate the round keys. Let K = (t2, t1, t0, k0) be the 4n-bit master key for Simeck2n. The registers of the key schedule are loaded with K = k 3 ‖ k 2 ‖ k 1 ‖ k 0 for K the master key, and the sequence of round keys (k0, …, kT−1) is generated with k r + 1 = t r where t r + 3 = k i ⊕ f 5 , 0 , 1 t r ⊕ c r , and the round constants are c r ∈ { 0 x f f f c , 0 x f f f d } . A single round of Simeck is depicted in Figure 1a. FIGURE 1Open in figure viewerPowerPoint Illustration of the Simeck and Simon ciphers. (a) One round of Simeck. (b) One round of Simon with m = 4 Simon, conversely, uses a linear key schedule to generate the round keys. Let K = (km−1, …, k1, k0) be a master key for Simon2n, where k i ∈ F 2 n . The sequence of round keys kr is generated by k i + m = k r ⊕ I ⊕ S − 1 S − 3 k r + 1 ⊕ c r , if m = 2 k r ⊕ I ⊕ S − 1 S − 3 k r + 2 ⊕ c r , if m = 3 k r ⊕ I ⊕ S − 1 S − 3 k r + 3 ⊕ k r + 1 ⊕ c r , if m = 4 where c r ∈ { 0 x f f f c , 0 x f f f d } , and 0 ≤ r ≤ (T − 1). A single round of Simon with m = 4 is depicted in Figure 1b. 2.1.3 Previous work The security of Simon-like ciphers has been widely explored over the last few years and a large number of cryptanalytic techniques were applied to it. To name just a few: linear cryptanalysis [12, 13], differential cryptanalysis [9, 12, 14], impossible differential cryptanalysis [9, 12, 14], related-key differential cryptanalysis [9, 12, 14], integral cryptanalysis and the division property [16-19]. For a comparison of our results with relevant previous work see Table 1. 2.2 Rotational-XOR cryptanalysis Rotational cryptanalysis [20, 21] is a related-key chosen-plaintext attack investigating the propagation of rotational pairs, that is, pairs of the form (x, x ⋘ γ). This attack is thwarted when a constant that is not rotation-invariant, that is, a constant c such that c ≠ (c ⋘ γ) is injected into the rotational pair. Rotational-XOR cryptanalysis [1] is a generalized attack method which takes these constants into account. Whereas, the original technique was thwarted by the injection of round constants that are not rotational-invariant, RX-cryptanalysis overcomes this problem by integrating their effect into the analysis of the propagation probability. Rather than considering just a rotational pair as in the case of rotational cryptanalysis, RX-cryptanalysis considers an RX-pair of the form (x, Sγ(x) ⊕ α) where α is called the translation. The technique was successfully applied to ARX-based primitives, including the block cipher Speck [20, 21] and the PRF SipHash [20, 21]. 3 ROTATIONAL-XOR CRYPTANALYSIS OF AND-RX CONSTRUCTIONS AND-RX constructions are similar in concept to ARX constructions where the non-linear operation (i.e., modular addition) is replaced with a vectorial bitwise AND. Since all operations are now bit oriented, such constructions are always rotation-invariant. More generally, they are structurally invariant under any affine transformation of the bit-indices as was shown in [20, 21]. Superficially, it is believed that this invariance cannot be preserved over a large number of rounds if non-invariant constants are injected into the state since they will break the symmetry between bits in different positions. Despite their close relation to ARX constructions, the security of AND-RX ciphers against RX-cryptanalysis has not received much attention. Now we are set to rectify this omission. 3.1 The expected probability of an RX-transition In [1], an RX-pair was defined to be a rotational pair with rotational offset γ under translations δ1 and δ2, that is, it is the pair x ⊕ δ 1 , ( x ⋘ γ ) ⊕ δ 2 . We opt for a slightly different notation with x and x′ = (x ⋘ γ) ⊕ δ, or x , ( x ⋘ γ ) ⊕ δ as an RX-pair. Definition 3.1.([1] (adapted)). The RX-difference of x and x′ = (x ⋘ γ) ⊕ δ is denoted by Δ γ x , x ′ = x ′ ⊕ ( x ⋘ γ ) , where δ ∈ F 2 n is a constant and γ is the rotational offset with 0 < γ < n. The propagation of an RX-difference Δr(x, x′) through linear operations of the AND-RX structure is deterministic and follows these rules: XOR. For two input RX-pairs x , ( x ⋘ γ ) ⊕ δ 1 and y , ( y ⋘ γ ) ⊕ δ 2 , their XOR is the RX-pair z , z ′ = x ⊕ y , ( x ⊕ y ) ⋘ γ ⊕ δ 1 ⊕ δ 2 ; Cyclic rotation by η bits. The cyclic rotation of each of the values in x , ( x ⋘ γ ) ⊕ δ by η bits is the RX-pair z , z ′ = x ⋘ η , x ⋘ ( γ + η ) ⊕ ( δ ⋘ η ) ; XOR with a constant c. The XOR of a constant c to each of the values in the RX-pair x , ( x ⋘ γ ) ⊕ δ is the RX-pair z , z ′ = x ⊕ c , ( x ⋘ γ ) ⊕ δ ⊕ c , the corresponding RX-difference is Δγc = c ⊕ (c ⋘ γ) all with probability 1. Intuitively, the bitwise nature of the AND operation restricts the propagation of an RX-difference compared to modular addition. When two rotational pairs enter into the vectorial AND operation, the rotational relation is preserved with probability 1 due to the localised nature of bit-oriented operations. If the inputs form an RX-pair with translation δ ≠ 0 the propagation of the RX-difference through the vectorial AND is probabilistic and its probability is given by the following theorem. Theorem 1.Let (x, (x ⋘ γ) ⊕ α) and (y, (y ⋘ γ) ⊕ β) be two RX-pairs where γ is the rotation offset and (α, β) the translations, respectively. α , β ∈ F 2 n are independent constants, and 0 < γ < n. Then, for an output translation Δ (Δ is a constant) it holds that: Pr [ ( x ⊙ y ) ⋘ γ ⊕ Δ = ( x ⋘ γ ) ⊕ α ⊙ ( y ⋘ γ ) ⊕ β = (1) Pr ( x ⊙ y ) ⊕ Δ = ( x ⊕ α ) ⊙ ( y ⊕ β ) , (2)that is, the propagation probability of an RX-difference with translations (α, β) through ⊙ is the same as that of a normal XOR-difference through the same operation when the translations are considered as input XOR-differences. Proof.To prove the theorem, we distribute the right hand side of (1) as ( x ⋘ γ ) ⊕ α ⊙ ( y ⋘ γ ) ⊕ β = ( x ⊙ y ) ⋘ γ ⊕ ( x ⋘ γ ) ⊙ β ⊕ ( y ⋘ γ ) ⊙ α ⊕ ( α ⊙ β ) . Similarly, distributing the right hand side of (2) we get x ⊕ α ⊙ y ⊕ β = x ⊙ y ⊕ x ⊙ β ⊕ y ⊙ α ⊕ α ⊙ β . Rewriting Theorem 1 as Pr ( x ⊙ y ) ⋘ γ ⊕ Δ = ( x ⊙ y ) ⋘ γ ⊕ ( x ⋘ γ ) ⊙ β ⊕ ( y ⋘ γ ) ⊙ α ⊕ α ⊙ β = (3) Pr ( x ⊙ y ) ⊕ Δ = ( x ⊙ y ) ⊕ ( x ⊙ β ) ⊕ ( y ⊙ α ) ⊕ ( α ⊙ β ) , (4)the proof is completed by observing that (x ⊙ y) ⋘ γ, x ⋘ γ, and y ⋘ γ have the same probability distribution as x ⊙ y, x, and y, respectively, due to the rotation-invariance of bit-oriented operations. □ Kölbl et al. showed in [20, 21] that in the special case of Simon-like ciphers (e.g., Simon and Simeck) where y = Sa−b(x), the difference propagation distribution (and thus, the RX-propagation distribution) is given by the following proposition. Proposition 1.For Sa(x) ⊙ Sb(x) where gcd(n, a − b) = 1, n is even, a > b and x = x n − 1 , … , x 1 , x 0 ∈ F 2 n , the difference propagation distribution table and RX-propagation distribution are given by P ( α → β ) = 2 − n + 1 if α = 0 x f ⋯ f , w t ( β ) ≡ 0 mod 2 ; 2 − ω if α ≠ 0 x f ⋯ f , β ⊙ S a ( α ) ∣ S b ( α ) ‾ = 0 , β ⊕ S a − b ( β ) ⊙ S a ( α ) ‾ ⊙ S 2 a − b ( α ) ⊙ S b ( α ) = 0 ; 0 o t h e r w i s e where ω = w t S a ( α ) ∣ S b ( α ) ⊕ S a ( α ) ‾ ⊙ S 2 a − b ( α ) ⊙ S b ( α ) . Proof.The proof for the difference propagation distribution was given in [20, 21]. The case for RX-propagation follows then from Theorem 1. □ 3.2 Discussion Based on Theorem 1, it can be seen that the RX-difference passes through the vectorial AND component of a cipher with the same probability as an XOR-difference. However, the resulting RX-characteristics are in general different from the corresponding (related-key) differential characteristics, due to the XOR of constants in the round function which affects the propagation. It is interesting to see that in ARX ciphers, the probability for the rotational-transition part of the RX-transition is maximised with 2−1.415 when γ ∈ {1, n − 1} and decreases for other γ. Conversely, the same transition passes with probability 1 through the vectorial AND in AND-RX ciphers. In other words, a rotational pair would propagate with probability 1 through all AND-RX operations, but only with some probability p < 1 through the ARX operations. We conclude that in general, round constants are more critical in AND-RX constructions compared to ARX ones, and hence that the former are more susceptible to RX-cryptanalysis than the latter. 4 AUTOMATED SEARCH OF RX-CHARACTERISTICS IN SIMON-LIKE CIPHERS Similar to other statistical attacks, RX-cryptanalysis works in two phases: offline and online. In the offline phase, the adversary is searching for a distinguishable property with respect to the algorithm's structure. Having found such a property, the adversary tries to detect it from data collected in the online phase. Automated search methods are a common way to assist finding such a property (i.e., Phase 1). The idea behind these tools is to model the search problem as a set of constraints and solve it using one of the available constraint solvers. For ciphers using Boolean and arithmetic operations, the search problem can be converted into a Boolean Satisfiability Problem (SAT) or a satisfiability module problem (SMT). The respective solver then returns an answer on whether all constraints can be satisfied simultaneously, and if the answer is positive it also returns a valid assignment. A number of ARX and AND-RX ciphers were studied using automatic search tools, in the context of differential cryptanalysis, linear cryptanalysis, division property and RX-cryptanalysis [2, 23-27]. In this section, we give a detailed description of an automatic search model for RX-characteristics in Simon-like ciphers. 4.1 The common round function From Theorem 1, we learn that the propagation of RX-differences through the AND operation follows a probabilistic rule, with a probability distribution as in Proposition 1. We use Δ1ar and Δ1br to denote the two n-bit vectors representing RX-differences at the beginning of round r, and Δ1dr the n-bit vector representing the RX-difference at the output of the vectorial AND at the same round. A schematic view of this notation is depicted in Figure 2. FIGURE 2Open in figure viewerPowerPoint Notation of the RX-differences in the encryption function Then, the following two Boolean equations should be satisfied simultaneously for the propagation of RX-differences through the vectorial AND to be valid 0 = Δ 1 d r ⊙ S a Δ 1 a r ∣ S b Δ 1 a r ‾ ; (5) 0 = Δ 1 d r ⊕ S a − b Δ 1 d r ⊙ S a Δ 1 a r ‾ ⊙ S 2 a − b Δ 1 a r ⊙ S b Δ 1 a r . (6) In simple words, (5) ensures that any active bit in Δ1dr results from at least one active bit in the corresponding position of Δ1ar. If a bit Δ1dr was activated by exactly one bit from Δ1ar, (6) ensures that either a second bit in Δ1dr is active, or that another active bit in Δ1ar had deactivated the said bit. This encodes the implicit expansion function, that is, the dependency between the bit in position i and that in position i + a − b before they enter the vectorial AND. If the propagation is valid, the transition probability in round r is given by 2 − w d r , where w d r = w t ( S a Δ 1 a r ∣ S b Δ 1 a r ⊕ S a Δ 1 a r ‾ ⊙ S 2 a − b Δ 1 a r ⊙ S b Δ 1 a r ) , (7)is said to be the weight of the non-linear transition in round r. In addition, the propagation of an RX-difference through the linear operations is described by the following constraints: Δ 1 b r + 1 = Δ 1 a r ; (8) Δ 1 a r + 1 = Δ 1 d r ⊕ Δ 1 b r ⊕ S c Δ 1 a r ⊕ Δ 1 k r . (9) 4.2 The key schedule of Simeck The key schedule of Simeck is modelled analogously to the round function. Let Δ1kar, Δ1kbr and Δ1kdr be n-bit variables in round r which denote the left input RX-difference, the right input RX-difference, and the output RX-difference of the vectorial AND (see Figure 3a). As before, the following two Boolean equations should be satisfied simultaneously for the propagation of RX-differences through the non-linear part of Simeck's key schedule to be valid: 0 = Δ 1 k d r ⊙ S a Δ 1 k a r ∣ S b Δ 1 k a r ‾ ; (10) 0 = Δ 1 k d r ⊕ S a − b Δ 1 k d r ⊙ S a Δ 1 k a r ‾ ⊙ S 2 a − b Δ 1 k a r ⊙ S b Δ 1 k a r , (11)with weight w k r set as w k r = w t ( S a Δ 1 k a r ∣ S b Δ 1 k a r ⊕ S a Δ 1 k a r ‾ ⊙ S 2 a − b Δ 1 k a r ⊙ S b Δ 1 k a r ) . (12) FIGURE 3Open in figure viewerPowerPoint Notations of the RX-differences. (a) Notation of the RX-differences with a non-linear key schedule. (b) Notation of the RX-differences with a linear key schedule The propagation of RX-difference through the linear operations of the key schedule is modelled by the following constraints: Δ 1 k b r + 1 = Δ 1 k a r ; (13) Δ 1 k a r + 3 = Δ 1 k d r ⊕ Δ 1