On the upper bound of squared correlation of SIMON‐like functions and its applications

IET Information SecurityVolume 16, Issue 3 p. 220-234 ORIGINAL RESEARCHOpen Access On the upper bound of squared correlation of SIMON-like functions and its applications Zhengbin Liu, Zhengbin Liu Science and Technology on Communication Security Laboratory, Chengdu, China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorYongqiang Li, Corresponding Author Yongqiang Li yongq.lee@gmail.com State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China Correspondence Yongqiang Li, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China. Email: yongq.lee@gmail.com; Lin Jiao, State Key Laboratory of Cryptology, Beijing 5159, China. Email: jiaolin_jl@126.comSearch for more papers by this authorLin Jiao, Corresponding Author Lin Jiao jiaolin_jl@126.com orcid.org/0000-0001-6394-6619 State Key Laboratory of Cryptology, Beijing, China Correspondence Yongqiang Li, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China. Email: yongq.lee@gmail.com; Lin Jiao, State Key Laboratory of Cryptology, Beijing 5159, China. Email: jiaolin_jl@126.comSearch for more papers by this authorMingsheng Wang, Mingsheng Wang State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this author Zhengbin Liu, Zhengbin Liu Science and Technology on Communication Security Laboratory, Chengdu, China State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this authorYongqiang Li, Corresponding Author Yongqiang Li yongq.lee@gmail.com State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China Correspondence Yongqiang Li, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China. Email: yongq.lee@gmail.com; Lin Jiao, State Key Laboratory of Cryptology, Beijing 5159, China. Email: jiaolin_jl@126.comSearch for more papers by this authorLin Jiao, Corresponding Author Lin Jiao jiaolin_jl@126.com orcid.org/0000-0001-6394-6619 State Key Laboratory of Cryptology, Beijing, China Correspondence Yongqiang Li, State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China. Email: yongq.lee@gmail.com; Lin Jiao, State Key Laboratory of Cryptology, Beijing 5159, China. Email: jiaolin_jl@126.comSearch for more papers by this authorMingsheng Wang, Mingsheng Wang State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, ChinaSearch for more papers by this author First published: 21 February 2022 https://doi.org/10.1049/ise2.12057AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract SIMON is one of the lightweight block ciphers designed by the National Security Agency in 2013, and a technical report including security analysis was published by the design team nearly 4 years later. As for the linear attack, it is claimed that 'the single-path probabilities (and linear correlations) dip below 2−block size for 12, 16, 20, 29, and 38 rounds for SIMON32, 48, 64, 96, and 128, respectively'. However, the design team does not show details on how to get the result and there are also no published papers verified the result yet. In the present paper, an upper bound of squared correlation of SIMON-like functions is given. As an important application of this bound, how to find optimal linear characteristics of SIMON and SIMECK under the Markov assumption with Matsui's branch-and-bound algorithm is shown. The authors' results confirm the claim of the design team. Furthermore, the best-known linear-hull distinguishers for SIMON and SIMECK is also given. 1 INTRODUCTION In 2013, the National Security Agency (NSA) published two families of lightweight block ciphers called SIMON and SPECK [1], and they have very competitive performances in both hardware and software platforms. At first, the design team did not release design rationale and security evaluation of SIMON and SPECK in Ref. [1]. This inspired the cryptanalysts' curiosity, and they took a lot of investigations for a deeper understanding of these ciphers. Since the publication of SIMON and SPECK, there has been a large variety of papers evaluating the security of SIMON [2-12]. In 2017, the design team finally published a technical report that includes design rationale and analysis of SIMON and SPECK [13]. Among the public cryptanalytic results, linear cryptanalysis [14] and differential cryptanalysis [15] are the most promising attacks. The performance of SIMON against differential analysis is known clearly, since the optimal differential characteristics of all versions of SIMON are found in Ref. [12]. These results are also confirmed by the design team in their technical report [13]. On the other hand, the performance of SIMON against linear analysis is not known by the public, especially for the versions of large state. At CRYPTO 2015, Kölbl et al. derived an explicit formula for the squared correlation of SIMON-like round functions [16]. Based on this formula and Boolean Satisfiability Problem (SAT)/Satisfiability Modulo Theories (SMT) solvers, they gave an approach to find the optimal linear characteristics for SIMON. They reported the provably optimal linear characteristics for SIMON32, SIMON48, and a 16-round optimal linear characteristic with squared correlation 2−54 for SIMON64. However, Kölbl et al. did not report the provably optimal linear characteristics for SIMON with block sizes of 64, 96 and 128 bits. Also, it takes much time for the SAT/SMT solver to find the optimal linear characteristics in SIMON-like ciphers, which may limit its application to SIMON-like ciphers with large block sizes, such as 96 and 128 bits. However, the security of SIMON against linear analysis is known to the NSA. In the design team's technical report, it is demonstrated that 'the single-path probabilities (and linear correlations) dip below 2−block size for 12, 16, 20, 29, and 38 rounds for Simon32, 48, 64, 96, and 128, respectively' [13]. The design team does not show details on how to get the results, and they claim that the result is found by using 'standard techniques (Matsui's algorithm and SAT/SMT solvers)'. In the present paper, we investigate the problem of finding optimal linear characteristics of SIMON-like ciphers. Our approach is similar to Ref. [12]. The main contributions are summarised as follows: Based on the results given by Kölbl et al. [16], we get an upper bound on the squared correlation of SIMON-like round functions. It is shown that the upper bound on the squared correlation of SIMON-like round functions decreases as the Hamming weight of the output mask increases. Based on the above bound, we derive a theoretical upper bound on the squared correlation of linear characteristics of SIMON-like ciphers. It is shown that for R-round SIMON-like ciphers, the squared correlation of linear characteristics is less than or equal to 2−2R+2. With Matsui's branch-and-bound algorithm [17] and the bound on the squared correlation of SIMON-like round functions, we are able to find the provably optimal linear characteristics for all versions of SIMON. For SIMON with block sizes of 32, 48, 64, 96 and 128 bits, we find the optimal linear characteristics on 12, 16, 19, 28 and 37 rounds with squared correlation 2−34, 2−50, 2−64, 2−96 and 2−128 respectively. These results confirm the claim of the design team of SIMON. The key reason that we can find optimal linear characteristics for SIMON with large state is that we can break the unnecessary branches as soon as possible by using the bound. Finally, we find the 23-, 31- and 41-round linear hulls for SIMON64/96/128, with potential 2−62.84, 2−93.8 and 2−123.15, respectively. The 13-, 21- and 27-round linear hulls with potential 2−29.43, 2−46.3 and 2−61.14 are also found for SIMECK32/48/64. As far as we know, these are the best linear-hull distinguishers for SIMON and SIMECK so far. The paper is organised as follows. In Section 2, we give some preliminaries of SIMON-like functions. In Section 3, an upper bound on the squared correlation of SIMON-like round functions is given, which plays an important role in the paper. In Section 4, we give some applications of the bound. In Section 4.1, a theoretical upper bound on the squared correlation of linear characteristics for SIMON-like ciphers is given. In Section 4.2, we show how to find the optimal linear characteristics of SIMON-like ciphers. In Section 4.3, we give some linear hulls found for block ciphers SIMON and SIMECK. A short conclusion is given in Section 5. 2 PRELIMINARIES Notations used in the present paper are defined in Table 1. Next, we give brief descriptions of SIMON and SIMECK. SIMON is based on the Feistel construction and operates on 2n-bit state for n = 16, 24, 32, 48 and 64. The key is composed of m n-bit words, where m = 2, 3 and 4 depending on the block size. SIMON with block size 2n bits and key size mn bits is referred to as SIMON2n/mn. TABLE 1. Notations Notation Description x ‾ Bitwise NOT of x x ⊕ y Bitwise exclusive OR (XOR) of x and y x ∧ y Bitwise AND of x and y x ∨ y Bitwise OR of x and y x ≪ r Shift of x to the left by r positions x ≫ r Shift of x to the right by r positions x ⋘ r Rotation of x to the left by r positions x ⋙ r Rotation of x to the right by r positions x‖y Concatenation of bit strings x and y wt(x) The hamming weight of x x ⋅ y Dot product of x and y : x ⋅ y = ⊕ i = 0 n − 1 x i y i xi The ith bit of the n-bit word x 0 An n-bit vector with all entries equal 0 The round function of SIMON consists of only three bitwise operations: AND (∧), XOR (⊕) and rotation (⋘), and it is defined as f(x) = ((x ⋘ 1) ∧ (x ⋘ 8)) ⊕ (x ⋘ 2). Let (Li, Ri) be the input of ith round, and (Li+1, Ri+1) be the output of ith round. Then, (Li+1, Ri+1) is computed as follows: L i + 1 = f L i ⊕ R i ⊕ K i , R i + 1 = L i . The SIMECK family of lightweight block ciphers was proposed by Yang et al. at CHES 2015 [18]. Its design combines the components of SIMON and SPECK to get a more efficient hardware implementation. The SIMECK family includes three variants: SIMECK32/64, SIMECK48/96 and SIMECK64/128. The round function of SIMECK is defined as f(x) = (x ∧ (x ⋘ 5)) ⊕ (x ⋘ 1). The subkeys are derived from a master key by key scheduling. As the key schedule is irrelevant to the search algorithm, we omit its description and the readers can refer to Ref. [1, 18] for the detailed description of SIMON and SIMECK. The round functions of SIMON and SIMECK are shown in Figure 1, and they can be generalised to SIMON-like functions as follows. FIGURE 1Open in figure viewerPowerPoint The round functions of SIMON and SIMECK Definition 1.(SIMON-like round functions [16]). Let x ∈ F 2 n , a , b , c ∈ N be non-negative integers. SIMON-like functions are defined as follows: f(x) = ((x ⋘ a) ∧ (x ⋘ b)) ⊕ (x ⋘ c), where a, b, c are the rotational constants. In Ref. [19], Beierle gave a more generic definition of SIMON-like round functions, which uses a quadratic, rotational invariant function as the non-linear component and an F 2 -linear function as the linear component. In the present paper, SIMON-like round functions mean the functions in Definition 1. A SIMON-like cipher is defined as an iterated cipher using the SIMON-like round functions in a Feistel construction. The block ciphers SIMON and SIMECK, whose rotational constants are (1, 8, 2) and (0, 5, 1), respectively, are two particular cases of SIMON-like ciphers. For a Boolean function f : F 2 n ↦ F 2 , the Walsh coefficient with input mask α and output mask β is defined as λ f ( α , β ) = ∑ x ∈ F 2 n ( − 1 ) β ⋅ f ( x ) + α ⋅ x , where α ⋅ x means the dot product of α and x. The squared correlation of f is defined as C 2 ( α , β ) = λ f ( α , β ) 2 n 2 . Kölbl et al. derived a closed expression for the squared correlation of SIMON-like round functions as follows. Theorem 1.(Squared Correlation of SIMON-like round functions [16]). Let f(x) = x ∧ (x ⋘ (a − b)), where x ∈ F 2 n , n is even, a > b and gcd(n, a − b) = 1. Let α and β be an input and an output mask, Uβ is defined as Uβ = {x∣(β ∧ (x ⋘ (a − b))) ⊕ ((β ∧ x) ⋙ (a − b)) = 0} and d = dim Uβ. Then, the squared correlation that α goes to β can be calculated as C 2 ( α , β ) = 2 − n + 2 i f β = 2 n − 1 a n d α ∈ U β ⊥ 2 − n + d i f β ≠ 2 n − 1 a n d α ∈ U β ⊥ 0 e l s e , where U β ⊥ = x ∈ F 2 n ∣ k ⋅ x = 0 for all k ∈ U β . Note that f(x) is the only non-linear component of SIMON-like round functions, so C2(α, β) is the squared correlation of SIMON-like round functions. According to Theorem 1, for a given output mask β0, the squared correlation C2(α, β0) ≠ 0 if and only if α ∈ U β 0 ⊥ . Furthermore, the squared correlation C2(α, β0) is the same for all input masks α ∈ U β 0 ⊥ . Then, we use C β 2 instead of C2(α, β) in the paper, since we only care about non-zero square correlations in the searching. Ashur and Rijmen investigated the linear hulls of SIMON-like round function and computed the correlation of f(x) by summing the correlation contributions of linear trails [20]. However, they ignored the fact that the two inputs of AND operation are not independent. As a result, the trails in Ref. [20] are only subsets of the linear hull. In Appendix A, we use the examples given in Ref. [20] to illustrate that the correlation of linear hull is equal to that computed with Theorem 1. 3 UPPER BOUND ON THE SQUARED CORRELATION OF SIMON-LIKE ROUND FUNCTIONS In this section, we give an upper bound on the squared correlation of SIMON-like round functions, which plays an important role in the paper. First, the following lemma is useful. Lemma 1.Suppose M is an n × n symmetric matrix over F 2 with M[i, i] = 0, 0 ≤ i ≤ n − 1. Then, rank(M) is even. Proof: Note that M is a matrix over F 2 , then there are two types of elementary row operations of M, which are interchanging two rows and adding a row to another one. Let ρ be an elementary row operation as above. Note that the entries of M are in F 2 , then ρMρT is symmetric and the diagonal entries equal 0. Based on this fact and rank(M) = rank(ρMρT), then it is easy to see that there exist elementary row operations ρi, 1 ≤ i ≤ r, such that ρ r ⋯ ρ 1 M ρ 1 T ⋯ ρ r T is of the following from Thus rank(M) must be even and we complete the proof. □ Theorem 2.Let f(x) = ((x ⋘ a) ∧ (x ⋘ b)) ⊕ (x ⋘ c), where x ∈ F 2 n , n is even, a > b and gcd(n, a − b) = 1. Let β be an output mask of f(x). Then, for the squared correlation, it holds that (1) If β ≠ 2n − 1 and wt(β) is even, then C β 2 ≤ 2 − w t ( β ) ; (2) If β ≠ 2n − 1 and wt(β) is odd, then C β 2 ≤ 2 − w t ( β ) − 1 ; (3) If β = 2n − 1, then C β 2 ≤ 2 − n + 2 . Proof: Let Δ = a − b, Lβ(x) = β ∧ SΔ(x) ⊕ Sn−Δ(β ∧ x), and U = ker(Lβ(x)), where Si(x) = x ⋘ i for 0 ≤ i ≤ n − 1. Then, as shown in Theorem 4 of Ref. [16], it holds λ f 2 ( α , β ) = ∑ x ∈ F 2 n ( − 1 ) ( β ⋅ f ( x ) ) ⊕ ( α ⋅ x ) 2 ≤ | ker L β ( x ) | 2 n . Let M β = β n − 1 … … 0 ⋮ β n − 2 ⋮ ⋮ ⋱ ⋮ 0 … … β 0 , M S i = 0 n − i , i I n − i , n − i I i , i 0 i , n − i . Then, L β ( x ) = M β M S Δ ⊕ M S n − Δ M β × x T , where x = x n − 1 , … , x 0 ∈ F 2 n and xT means the transpose of x. Let L β = M β M S Δ ⊕ M S n − Δ M β . Then, | ker L β ( x ) | = 2 n − r a n k L β , and hence C 2 ( α , β ) = λ f 2 ( α , β ) 2 2 n ≤ 2 n − r a n k L β 2 n = 2 − r a n k L β . This means we only need to investigate the rank of Lβ. In the following, for a matrix M and 0 ≤ i, j ≤ n − 1, M[i] means the ith row of M, and M[i, j] means the jth entry in the ith row of M. For example, Mβ[0] = [βn−1, 0, …, 0]. Let L = M β M S Δ . Then, for 0 ≤ i, j ≤ n − 1, it holds L [ i , j ] = β n − 1 − i i f j = i + Δ mod n 0 e l s e and L T [ i , j ] = β Δ − 1 − i i f j = i − Δ mod n 0 e l s e , where Δ − 1 − i is computed in Z n . Note that M S n − Δ M β = L T , then we have Lβ = L ⊕ LT and equals This means Lβ is a symmetric matrix. Furthermore, for 0 ≤ i ≤ n − 1, the ith row of Lβ has only two entries that may be nonzero, which are Lβ[i, i + Δ] and Lβ[i, i − Δ]. Similarly, for 0 ≤ i ≤ n − 1, the ith column of Lβ has only two entries that may be nonzero, which are Lβ[i − Δ, i] and Lβ[i + Δ, i].Note that i ± Δ means (i ± Δ) mod n in the proof. Let Srow denote the non-zero rows of L, then Srow = {i∣Lβ[i, i + Δ] = 1, 0 ≤ i ≤ n − 1}, and |Srow| = wt(β). Suppose there exists Sdep ⊆ Srow such that {Lβ[i]∣i ∈ Sdep} are linearly dependent, that is, ∑ i ∈ S d e p L β [ i ] = 0 . (1) Then, for any i ∈ Sdep ⊆ Srow, we have Lβ[i, i + Δ] = 1. Note that Lβ[i, i + Δ] and Lβ[i + 2Δ, i + Δ] are the only two entries of (i + Δ)-column of Lβ that may be nonzero. Then, equality (1) means for any i ∈ Sdep, it holds Lβ[i + 2Δ, i + Δ] = 1 = Lβ[i + Δ, i + 2Δ], from which we get i + 2Δ ∈ Sdep ⊆ Srow and i + Δ ∈ Srow. Choosing i0 ∈ Sdep and using the above fact recursively, we can get that there exists 0 < l < n, such that i0 + 2lΔ = i0 mod n. Note that n is even and gcd(Δ, n) = 1, then we have l = n 2 . This means equality (1) holds if and only if S d e p = i 0 + 2 j Δ ∣ 0 ≤ j ≤ n 2 − 1 for some 0 ≤ i0 ≤ n − 1, which is equivalent to that S d e p = 1 + 2 j Δ ∣ 0 ≤ j ≤ n 2 − 1 or S d e p = 2 j Δ ∣ 0 ≤ j ≤ n 2 − 1 . For the two cases, we can get that Srow = {i∣0 ≤ i ≤ n − 1}, which is equivalent to wt(β) = n. Therefore, when wt(β) = n, rank(Lβ) = n − 2 since both the odd rows and even rows of Lβ are linearly dependent. When wt(β) < n, r a n k L β ≥ w t ( β ) (2)since ∑ i ∈ S d e p L β [ i ] ≠ 0 for any subset Sdep ⊆ Srow. This means {Lβ[i]∣i ∈ Srow} are linearly independent. This has proved the items (1) and (3). As for item (2), according to inequality (2) and Lemma 1, it is easy to see that rank(Lβ) ≥ wt(β) + 1. Then, we complete the proof. □ Remark 1.It should be noticed that the bound of Theorem 2 is tight. In the following, we give two types of β = (βn−1, …, β0) such that the equality of the above result holds. It should be remembered that Δ = a − b. Suppose 0 < t < n is an even integer, and β i 0 = 1 for some 0 ≤ i0 ≤ n − 1. Define other entries of β as follows: β i = 1 i = i 0 − d Δ mod n for some 1 ≤ d ≤ t − 1 ; 0 others . Furthermore, choose 0 ≤ j ≤ n − 1 such that βj = 0. Define β ′ = β n − 1 ′ , … , β 0 ′ as follows: β i ′ = 1 i = j β i i ≠ j . Then, β and β′ are vectors with even and odd Hamming weight, respectively. It can be checked that rank(Lβ) = t = wt(β), rank(Lβ′) = t + 2 = wt(β′) + 1, which means the bound in Theorem 2 is tight. 4 THE APPLICATIONS OF THE UPPER BOUND In this section, we give some applications of the bound in Theorem 2. 4.1 Theoretical upper bound on the squared correlation of linear characteristics for SIMON-like ciphers In Ref. [19], Beierle gave an upper bound on the probability of differential characteristics for SIMON and SIMECK. In this section, we derive the theoretical upper bound on the squared correlation of linear characteristics. In the following, xi represents the ith bit of an n-bit vector x = x n − 1 , … , x 1 , x 0 ∈ F 2 n . As for a Feistel cipher, the input mask of the ith round is denoted as (δi−1, δi), and the output mask is denoted as (δi, δi+1). Lemma 2.For r ≥ 1 and non-zero masks α and β, let p(r) be the upper bound on the squared correlation of r-round linear characteristics starting with (α, 0) and ending with (β, 0). Let p(0) = 1 and q = maxβ≠0,αC2(α, β). Then, for any non-trivial R-round linear characteristic Ω, it holds that C 2 ( Ω ) ≤ max i ≤ R p ( i ) q R − i − 1 . Proof: For an R-round linear characteristic Ω = (δ−1, δ0) → ⋯ → (δR−1, δR), it holds that C 2 ( Ω ) = ∏ i = 0 R − 1 C 2 δ i − 1 ⊕ δ i + 1 , δ i , where C2(δi−1 ⊕ δi+1, δi) represents the squared correlation of the ith (i = 0, …, R − 1) round. Then, we have the following two cases. (1). There exist 0 ≤ i < j ≤ R − 1, such that δi = δj = 0. Without loss of generality, let δi = δj = 0 and δk ≠ 0 for all k < i and all k > j. Then, we have C2((δi−1, δi) → ⋯ → (δj−1, δj)) ≤ p(j − i). Since δi = δj = 0 and δk ≠ 0 for k < i and k > j, then C 2 ( Ω ) ≤ p ( j − i ) ∏ k = 0 i − 1 C 2 δ k − 1 ⊕ δ k + 1 , δ k × ∏ k = j + 1 R − 1 C 2 δ k − 1 ⊕ δ k + 1 , δ k ≤ p ( j − i ) q i q R − ( j + 1 ) = p ( j − i ) q R − ( j − i ) − 1 . (2). δi = 0 for at most one 0 ≤ i ≤ R − 1. Then, ∏ k < R C 2 δ k − 1 ⊕ δ k + 1 , δ k ≤ ∏ k ≠ i C 2 δ k − 1 ⊕ δ k + 1 , δ k ≤ q R − 1 , where qR−1 = p(0)qR−1, and we complete the proof. □ Lemma 2 is a general statement for Feistel ciphers. It shows that the squared correlation of any linear characteristic can be bounded by the upper bounds of the squared correlation of linear characteristics starting with (α, 0) and ending with (β, 0). As for SIMON-like ciphers, we have the following result, which gives a theoretical upper bound on the squared correlation of linear characteristics. Theorem 3.(Upper Bounds for SIMON-like Ciphers). Let a, b, c ∈ N, a > b, c ≠ a and c ≠ b. Let f(x) = ((x ⋘ a) ∧ (x ⋘ b)) ⊕ (x ⋘ c), where x ∈ F 2 n , n is even and gcd(n, a − b) = 1. The squared correlation of any R-round linear characteristic is upper bounded by 2−2R+2. Proof: Without loss of generality, we prove this result for the case of a = 1, b = 8, c = 2, that is, the case of SIMON cipher. Fix an r-round linear characteristic of the form ( μ , 0 ) → 0 , δ 1 = μ → δ 1 , δ 2 → ⋯ → δ r − 2 , δ r − 1 → ( ν , 0 ) with δi ≠ 0 for all i ∈ {1, …, r − 1}. First, the result is equivalent to prove p(r) ≤ 2−2r. From Theorem 2, we derived that q = max β ≠ 0 C β 2 = 2 − 2 . Then, according to Lemma 2, it holds C 2 ( Ω ) ≤ max k ≤ R p ( k ) q R − k − 1 = max k ≤ R 2 − 2 k 2 − 2 R + 2 k + 2 = 2 − 2 R + 2 for any R-round linear characteristic Ω. Therefore, we only need to prove p(r) ≤ 2−2r. Note that C 0 2 = 1, then proving p(r) ≤ 2−2r is equivalent to prove that C δ i 2 ≤ 2 − 4 for some 1 ≤ i ≤ r − 1. According to Theorem 2, C δ 1 2 = C μ 2 ≤ 2 − 4 when wt(μ) ≥ 3. Then, we have the following two cases, and the symbol * indicates an unknown bit in the proof. (1) wt(μ) = 1. Considering the rotational equivalence, let μ = (1, 0, …, 0). Then, we have δ 2 = 0 , * 1 , 1 , 0 , 0 , 0 , 0 , 0 , * 2 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , … . If at least one of *1 and *2 equal to one, then C δ 2 2 ≤ 2 − 4 according to Theorem 2. Next, suppose both *1 and *2 equal to zero. Then, we have δ 2 = ( 0 , 0 , 1 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , … ) , δ 3 = 1 , 0 , 0 , * 1 , 1 , 0 , 0 , 0 , 0 , 0 , * 2 , 0 , 0 , 0 , 0 , 0 , … . Thus C δ 3 2 ≤ 2 − 4 according to Theorem 2. (2) wt(μ) = 2. According to the proof of Theorem 2, when wt(β) = 2, C β 2 = 2 − 2 if and only if β satisfies βi = 1 and βi−(a−b) mod n = 1. Then, considering the rotational equivalence, we can let μ = ( 1 , 0 , 0 , 0 , 0 , 0 , 0 , 1 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , … ) . Otherwise, C δ 1 2 ≤ 2 − 4 . Thus, we have δ 2 = 0 , * 1 , 1 , 0 , 0 , 0 , 0 , 0 , * 2 , 1 , 0 , 0 , 0 , 0 , 0 , * 1 , … . If at least one of *1 and *2 equals to one, then, C δ 2 2 ≤ 2 − 4 according to Theorem 1. Next, suppose both *1 and *2 equal zero. Then, δ 2 = ( 0 , 0 , 1 , 0 , 0 , 0 , 0 , 0 , 0 , 1 , 0 , 0 , 0 , 0 , 0 , 0 , … ) , δ 3 = 1 , 0 , 0 , * 1 , 1 , 0 , 0 , 1 , 0 , 0 , * 2 , 1 , 0 , 0 , 0 , 0 , 0 , * 1 , 0 , 0 , … . Therefore, C δ 3 2 ≤ 2 − 4 according to Theorem 2. □ The theoretical upper bounds above give a rough estimation of the security of SIMON-like ciphers against linear cryptanalysis. As for SIMON and SIMECK, it turns out that they are sufficient to bound the squared correlation of linear characteristics below 2−2n, where 2n is the block size. We give a comparison of the rounds needed for bounding the squared correlation and the security margin for every instance of SIMON and SIMECK in Table 2. TABLE 2. Number of rounds needed for bounding the squared correlation of linear characteristics by 2−2n for SIMON and SIMECK SIMON SIMECK Block size 32 48 64 96 128 32 48 64 Key size 64 72 96 96 128 96 144 128 192 256 64 96 128 Rounds 32 36 36 42 44 52 54 68 69 72 32 36 44 Rounds 17 25 25 33 33 49 49 65 65 65 17 25 33 Needed Security 15 11 11 9 11 3 5 3 4 7 15 11 11 Margin From Table 2, the security margin of SIMECK and SIMON with block size less than or equal to 64 bits is reasonable. However, as for SIMON with block sizes of 96 and 128 bits, the security margin is too small, and it may not guarantee the security against linear cryptanalysis with these upper bounds. 4.2 Finding optimal linear characteristics of SIMON-like ciphers In order to give a precise evaluation of SIMON-like ciphers against linear cryptanalysis, it needs to get optimal linear characteristics of SIMON-like ciphers under the Markov assumption. The propagation of linear masks in SIMON-like round functions is depicted in Figure 2. FIGURE 2Open in figure viewerPowerPoint Propagation of linear masks in SIMON-like round functions. The sign '•' denotes 'three-forked branch' and acts as XOR on the linear masks 4.2.1 Search algorithms With the upper bounds in Theorem 2 and Matsui's algorithm, we can get optimal linear characteristics of all versions of SIMON. The pseudo-code of the searching algorithm is similar as the algorithm for searching optimal differential characteristics in Ref. [12]. See Algorithm 1 for details. Algorithm 1. Search for optimal linear characteristics in SIMON like ciphers 1: Procedure Main: 2: Begin the program 3: Let B ‾ n = 2 × B n − 1 , and Bn = 1. 4: Do 5: Let B ‾ n = 2 − 1 × B ‾ n ; Call Procedure Round-1; 6: while B ‾ n ≠ B n . 7: Exit the program 8: Procedure Round-1: 9: For each candidate for ΓX1 with wt(ΓX1) from 0 to n, do the following: 10: If C max 2 × B n − 1 < B ‾ n , then Return to the upper procedure; // C max 2 is precomputed according to Theorem 2. 11: Else 12: Let β = ΓX1 and C β 2 is computed according to Theorem 1; 13: If C β 2 × B n − 1 ≥ B ‾ n , then 14: Let c 1 2 = C β 2 ; 15: For each candidate of α ∈ U β ⊥ // U β ⊥ is computed with Algorithm 2. 16: Let f(β) = (α ⋙ b) ⊕ (β ⋙ c), and Call Procedure Round-2; 17: Return to the upper procedure; 18: Procedure Round-2: 19: For each candidate for ΓX2 with wt(ΓX2) from 0 to n, do the following: 20: If c 1 2 × C max 2 × B n − 2 < B ‾ n , then 21: Return to the upper procedure; 22: Else 23: Let β = ΓX2, and C β 2 is computed according to Theorem 1; 24: If c 1 2 × C β 2 × B n − 2 ≥ B ‾ n , then 25: Let c 2 2 = C β 2 ; 26: For each candidate of α ∈ U β ⊥ , Let f(β) = (α ⋙ b) ⊕ (β ⋙ c), and Call Procedure Round-3; 27: Return to the upper procedure; 28: Procedure Round-i (3 ≤ i ≤ n − 1): 29: Let ΓXi = ΓXi−2 ⊕ f(ΓXi−1); 30: Let β = ΓXi, and C β 2 is computed according to Theorem 1; 31: If c 1 2 × ⋯ × c i − 1 2 × C β 2 × B n − i ≥ B ‾ n , then 32: Let