# Improved Neural Differential Distinguisher Model for Lightweight Cipher Speck
## 5 Key-Recovery Attack against Speck32  
To demonstrate the utility of the neural distinguisher, this paper constructs a partial key recovery attack based on a 7-round distinguisher. The basic idea is the decryption of the resultant ciphertext under all final subkeys for each plaintext pair with a difference \(\Delta=0x0040/0000\), and the sorting of each partially decrypted ciphertext using the neural distinguisher in this paper. Then the scores of the returned individual ciphertext pairs are combined into the scores of the keys, and finally, the keys are sorted in descending order according to their scores. A brief description of the attack steps is detailed below in Algorithm 2. 1. Generate n randomly chosen plaintext pairs \((P_{1},P_{1}^{\prime})\) with a difference \(\Delta=0x0040/0000\), such that it obtains the corresponding sample data ciphertext pair \((C_{1},C_{1}^{\prime})\) in encryption 8 rounds. 2. For each last-round subkey \(k\), decrypt the \(C_{i}\) under \(k\) to get \((C_{k},C_{k}^{\prime})\). 3. Using the neural distinguisher in this paper, the score \(x_{i}^{k}\) is obtained for each partially decrypted ciphertext pair \((C_{k},C_{k}^{\prime})\). 4. For each k, the scores \(x_{i}^{k}\) are combined into one score \(x^{k}\) and arranged in descending order. Figure 8: Training a neural network to distinguish 7-round Speck32 output for parameters \(s\in\{1,2,4,8,16,32,64,128\}\) from random data. ```
0: Speck cipher Oracle, Number of randomly selected plaintext pairs n, an 8 round neural distinguisher N.
0: A descending sorted list of candidate keys \(L_{ck}\). 1:\((P_{1},P_{1}{}^{\prime})\gets n\) random plaintext pairs with a difference of \(\Delta=0x0040/0000\)
2:\((C_{k},C_{k}{}^{\prime})\gets Oracle(P_{1},P_{1}{}^{\prime})\)
3:\(L_{ck}\leftarrow\{\cdot\}\)
4:for k in subkeys do
5:for\(i=0\) to \(n-1\)do
6:\((C_{k},C_{k}{}^{\prime})\leftarrow DecryptOneRound((C_{i},C_{i}{}^{\prime}),k)\)
7:\(x_{i}^{k}\gets N(C_{k},C_{k}{}^{\prime})\)
8:endfor
9:\(x^{k}\leftarrow\sum_{i=0}^{n-1}log_{2}(x_{i}{}^{k}/(1-x_{i}{}^{k}))\)
10: Append \((k,x^{k})toL_{ck}\)
11:endfor
12:return\(L_{ck}\)
```  
**Algorithm 2** Key-recovery Attack Against Speck32. In this attack, the step 3 key ranking score is likely to be high when the 8-round subkey is guessed correctly. So, when a key guess is returned, the distinguisher can be sure that the correct 8-round key has been found. In this paper, we repeated the key recovery attack 50 times for different keys. The attack is considered successful if the correct key is in the top five in \(L_{ck}\). Finally, 46 keys were successfully recovered, with a success rate of about 92% for the experimental attack. The key ranking results are shown in Table 4. Of course, the success rate obtained with different success criteria can be different, so this success rate can only be used as a reference for the effectiveness of the key recovery algorithm. In addition, in order to obtain in detail the correctness of each bit during the key recovery attack. In this paper, the subkey with the highest score is selected as the candidate key for guessing compared with the correct key, and the guess is considered successful if the last subkey is incorrect within only two bits. Then an exhaustive method can be used to eliminate the incorrect bits. The experimental results are shown in Tables 5 and 6. Table 5 shows that the neural network distinguisher in this paper guessed no more than 2 bits of the subkey incorrectly in 8 rounds of Speck experiments, and 23 experiments had exactly correct subkey guesses, accounting for 46%. Among the experiments with incorrect \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Ranking of the Correct Subkeys** & **1 st** & **2 nd** & **3 rd** & **4 th** & **5 th** & **Others** \\ \hline Number of trials & 23 & 11 & 7 & 4 & 1 & 4 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The result of the ranking of the correct subkeys in the list \(L_{ck}\).