# Improved Neural Differential Distinguisher Model for Lightweight Cipher Speck
## 3 Improved Neural Distinguishers Model for Speck32
### Data Format  
As the number of Spec cipher rounds increases, the features of the Spec cipher algorithm are not easily recognized by the neural network. Therefore, as the data format contains more features from previous cipher rounds, it will help improve the accuracy of the neural network. Once the ciphertext pair of the \(i\)-round \((C_{l},C_{r},C_{l}^{\prime},C_{r}^{\prime})\) is known, one can straightforwardly compute \((C\_{r},C\_{r^{\prime}})\) without knowing the \((i-1)\)-round subkey (K) according to the algorithmic structure of the Spec cipher. Expressed in the formula as:  
\[ \begin{cases}C\_r=(C_{l}\oplus C_{r})\gg\beta\\ C\_{r^{\prime}}=(C_{l}^{\prime}\oplus C_{r}^{\prime})\gg\beta\end{cases}  \tag{1}\]  
But one needs to know the \((i-1)\)-round subkey(K) to calculate \((C\_{l},C\_{l^{\prime}})\), which is expressed in the formula:  
\[ \begin{cases}C\_l=((C_{l}\oplus K)\boxminus C\_r)\ll\alpha\\ C\_l^{\prime}=((C_{l}^{\prime}\oplus K)\boxminus C\_r^{\prime})\ll\alpha\end{cases}  \tag{2}\]  
where \(\boxminus\) is modular minus. The difference \(d\_{real}\) of \(C\_{l}\) and \(C\_{l}^{\prime}\) is:  
\[d\_{real}=C\_{l}\oplus C\_{l}^{\prime}=(((C_{l}\oplus K)\boxminus C\_r)\oplus ((C_{l}^{\prime}\oplus K)\boxminus C\_{r^{\prime}}))\ll\alpha \tag{3}\]  
**Definition 1**. : _Denote \((C_{l}\oplus K),C\_{r},(C_{l}^{\prime}\oplus K),C\_{r}^{\prime}\) by vectors, respectively:_  
\[ \begin{cases}C_{l}\oplus K=(a_{1}\oplus k_{1},a_{2}\oplus k_{2},\ldots,a_{n} \oplus k_{n})\in\{0,1\}^{n},n=16\\ C\_{r}=(b_{1},b_{2},\ldots,b_{n})\in\{0,1\}^{n},n=16\\ C_{l}^{\prime}\oplus K=(x_{1}\oplus k_{1},x_{2}\oplus k_{2},\ldots,x_{n} \oplus k_{n})\in\{0,1\}^{n},n=16\\ C\_{r}^{\prime}=(y_{1},y_{2},\ldots,y_{n})\in\{0,1\}^{n},n=16\end{cases}  \tag{4}\]  
**Definition 2**. : _Denote \(d\_{l}\) as the difference of \(C\_{l}\) and \(C\_{l}^{\prime}\) without the effect of the (\(i-1\))-round subkey (K):_  
\[d\_{l}=((C_{l}\boxminus C\_r)\oplus(C_{l}^{\prime}\boxminus C\_r^{\prime})) \ll\alpha \tag{5}\]  
**Proposition 1**. : _Part of the bits of \(d\_{real}\) that are not affected by (\(i-1\))-round subkey can be captured by \(d\_{l}\)._  
Proof. : Without loss of generality, let \(a_{i}\oplus k_{i}>b_{i}(i\
eq 2),a_{2}\oplus k_{2}\leq b_{2},n=16\). Converting \((C_{l}\oplus K)\boxminus C\_r\) to number field will obtain:  
\[ \begin{split}(C_{l}\oplus K)&\boxminus C\_r=((a_{1 }\oplus k_{1})2^{n-1}+(a_{2}\oplus k_{2})2^{n-2}+(a_{3}\oplus k_{3})2^{n-3}\\ &+\cdots+(a_{n}\oplus k_{n})-b_{1}2^{n-1}-b_{2}2^{n-2}-\cdots-b_{ n})mod2^{n}\end{split}  \tag{6}\]  
We can obtain:  
\[ \begin{split}(C_{l}\oplus K)&\boxminus C\_r=((1+a_{ 1}\oplus k_{1}\oplus b_{1}\oplus a_{2}\oplus k_{2}\oplus b_{2})2^{n-2}\\ &+(a_{3}\oplus k_{3}\oplus b_{3})2^{n-3}+\cdots+(a_{n}\oplus k_{ n}\oplus b_{n}))mod2^{n}\end{split}  \tag{7}\]  
In the same way, we get:  
\[ \begin{split}(C_{l}^{\prime}\oplus K)&\boxminus C\_r^{ \prime}=((1+x_{1}\oplus k_{1}\oplus y_{1}\oplus x_{2}\oplus k_{2}\oplus y_{2}) 2^{n-2}\\ &+(x_{3}\oplus k_{3}\oplus y_{3})2^{n-3}+\cdots+(x_{n}\oplus k_{n} \oplus y_{n}))mod2^{n}\end{split}  \tag{8}\]  
When the XOR operation is performed on \(((C_{l}\oplus K)\boxminus C\_r)\) and \(((C_{l}^{\prime}\oplus K)\boxminus C\_r^{\prime})\), it is obtained that the other bits of K has no effect on the operation except for \(k_{1},k_{2}\). Thatis, the results of \((C_{l}\boxminus C_{r})\oplus(C_{l}^{\prime}\boxminus C_{-r}^{\prime})\) and \(((C_{l}\oplus K)\boxminus C_{-r})\oplus((C_{l}^{\prime}\oplus K)\boxminus C_{-r} ^{\prime})\) are the same for all bits except \(k_{1},k_{2}\). The bit-wise rotation operation does not affect the number of captured bits in the vector. Therefore \(d\_l\) captures the rest of the bits in \(d\_l_{real}\) that are not affected by \((i-1)\)-round subkey (K). Extending this proof, \(d\_l\) can capture part of the bits of the \(d\_l_{real}\) and the number of bits captured is different in each sample. It is certain that the accuracy of the neural network will improve as \(d\_l\) captures more bits of \(d\_l_{real}\).