# Multiple Differential Distinguisher of SIMECK32/64 Based on Deep Learning

Authors: Huijiao Wang; Jiapeng Tian; Xin Zhang; Yongzhuang Wei; Hua Jiang
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Currently, deep learning has provided an important means to solve problems in various fields. Intelligent computing will bring a new solution to the security analysis of lightweight block cipher as its analysis becomes more and more intelligent and automatic. In this study, the novel multiple differential distinguishers of round-reduced SIMECK32/64 based on deep learning are proposed. Two kinds of SIMECK32/64’s 6–11 rounds deep learning distinguishers are designed by using the neural network to simulate the case of the multiple input differences and multiple output differences in multiple differential cryptanalysis. The general models of the two distinguishers and the neural network structures are presented. The random multiple ciphertext pairs and the associated multiple ciphertext pairs are exploited as the input of the model. The generation method of the data set is given. The performance of the two proposed distinguishers is compared. The experimental results confirm that the proposed distinguishers have higher accuracy and rounds than the distinguisher with a single difference. The relationship between the quantity of multiple differences and the performance of the distinguishers is also verified. The differential distinguisher based on deep learning needs less time complexity and data complexity than the traditional distinguisher. The accuracy of filtering error ciphertext of our 8-round neural distinguisher is up to 96.10%.


---

## Body

## 1. Introduction

The size of computing device has been decreasing, and some Internet of things applications such as smart homes and wearable systems have widely emerged in recent years [1, 2]. In these resource-constrained applications, lightweight block cipher usually plays a key role in ensuring data security [3]. This has also led to design new lightweight block cipher [4]. The balance between security and low consumption of lightweight block ciphers should be fully considered in design, which may be accompanied by the reduction of security. Therefore, the security analysis of lightweight block cipher is the first thing in its wide application.The cipher distinguisher distinguishes the random permutation from the cipher according to the structure of the cipher algorithm or the characteristics of its components. The common construction methods of distinguisher include differential distinguisher [5], linear distinguisher [6], and integral distinguisher [7]. Among them, the differential distinguisher is the primary tool for differential attack, which was first proposed by Biham et al. in 1990 [8]. Differential attack takes advantage of the unbalanced distribution of difference statistics in the iterative process of block cipher algorithm. It has become the most basic and effective means for cryptanalysis of block cipher. The multiple differential cryptanalysis was introduced in reference [9]. It usually has the general form of multiple inputs and multiple outputs.The deep learning technology is developing rapidly in the area of the artificial intelligence, such as computer vision [10], biological information [11], and natural language processing [12]. Deep learning uses the rule that is discovered from data to predict and judge the future moment and unknown situation. The cipher distinction task is coincided with the classification in form. A neural network model for classification can be established by abstracting plaintext pairs, ciphertext pairs, and the round function. The author in reference [13] first proposed a lightweight block cipher cryptanalysis based on deep learning. It successfully provides a new cryptanalysis approach using deep learning. Since then, the cryptanalysis of lightweight block cipher based on deep learning has become more and more active.Lightweight block cipher will be fully considered to resist differential cryptanalysis at the beginning of design. Nevertheless, it will be of great significance to design a new distinguisher and explore the unknown defects of block cipher. Based on the attack idea of multiple differential cryptanalysis in this study, the deep learning is applied to construct the distinguisher in multiple differential cryptanalysis for round-reduced SIMECK32/64. The structure of multiple ciphertext pairs with multiple input differences is exploited to train the distinguisher. Our contributions are as follows:(1)
The deep learning distinguisher of SIMECK32/64’s 6–11 rounds for multiple differential cryptanalysis is presented. Our neural network structure adopts different multiple input differences, which is different from others.(2)
The general models of two novel kinds of distinguishers are given. The inputs of the two models adopt random ciphertext pairs and associated ciphertext pairs respectively, both of them are based on the multiple input differences. The method of data set generation is put forward.(3)
The multiple differential distinguishers based on deep learning have low complexity and high accuracy of filtering error ciphertext.The rest of the study is structured as follows: in Section2, the security analysis of relevant lightweight block cipher and the study of the cryptography combined with deep learning are presented. In Section 3, the preliminaries are provided, which include the overview of SIMECK, the differential distinguisher, and the deep learning model. In Section 4, two kinds of neural distinguishers are proposed and discussed in detail. In Section 5, the experiment of our distinguishers and the comparisons are carried out, and the results are given. Section 6 summarizes the work of the full study. Table 1 lists the main symbols and their meanings used in this study.Table 1
Symbols and meanings.
SymbolDescription of the symbol meaningtQuantity of the input differencenBlock sizerRoundΔiDifferenceP0,P1,...,PiPlaintext pairsC0,C1,...,CiCiphertext pairsNTraining sample sizeNDrmDistinguisher trained with random ciphertext pairsNDamDistinguisher trained with associated ciphertext pairs


## 2. Related Work

The family of SIMECK cipher similar to SIMON’s structure was designed in reference [14] on CHES’ 2015. The ciphers of SPECK and SIMON were released by the National Security Agency (NSA) in 2013 [15]. SIMECK continued the good design component of SPECK and SIMON and has an excellent performance in both hardware and software implementation. The designer has initially done the security analysis of SIMECK. The differential cryptanalysis, impossible differential cryptanalysis, and linear cryptanalysis were given.The ability of SIMECK to resist linear attack was evaluated in reference [16]. The better results of differential cryptanalysis for SIMECK were presented in reference [17]. The authors in reference [18] proposed the novel algorithm for finding the more perfect differential trails and gave the differential trails of rounds 14, 21, and 27 of SIMECK32/48/64, respectively. The authors in reference [19] studied different versions of related-key impossible differential distinguisher of SIMECK. They proposed distinguishers of SIMECK32 for round 15 using the middle encounter method. With the help of MILP, when the difference between input and output was limited to one active key bit, the optimal related-key impossible differential of SIMECK was proposed. The authors in reference [20] introduced a cube attack based on SMT by using the additional information provided by the intermediate state cube feature for the SMT solver in attacking the round-reduced SIMECK32/64. A series of new distinguishers for statistical fault analysis of SIMECK based on the ciphertext-only attack was presented in reference [21]. The results showed that the distinguishers can restore the keys on the basis of reducing errors and improve the reliability and accuracy.Deep learning technology is very useful for big data analysis, which can help to discover the small links among data. In cryptography, identifying the subtle relationship among data plays a very important role because the subtle relationship usually defines the security strength. The authors in reference [22] applied deep learning to side channel analysis and discussed the applicability of deep learning technology in classical cryptanalysis. The authors in reference [23] evaluated the various relations between deep learning and cryptography and proposed some possible research directions of using deep learning in cryptanalysis. A feedforward neural network (FNN) was developed in reference [24], which can find plaintext from the ciphertext of AES without using key information.On CRYPTO’19, the author in reference [13] proposed the improved differential attack of round-reduced SPECK32/64 based on deep learning. The distinguisher was constructed by training the ResNet to distinguish the ciphertext pairs with the encryption using fixed plaintext difference and random data. It confirmed the effectiveness of deep learning on security analysis of symmetric ciphers and put forward a new research direction. The authors in reference [25] proposed a framework of using machine learning to extend the classical distinguisher. The distinguisher used a single differential trail and was implemented on SPECK, SIMON, and GIFT64. This method can reduce the data complexity, but the accuracy was not as high as that of the distinguisher trained by random difference. In reference [26], convolutional neural network (CNN) and multilayer perceptron (MLP) were applied to construct the neural network distinguisher of round-reduced TEA and RAIDEN cipher. The distinguishing task was proposed where the traditional distinguisher could not be applied. The 3–6 rounds of neural network distinguisher for PRESENT cipher were constructed [27]. The distinguisher can distinguish ciphertext data from random data with high probability, which further expanded the application of deep learning in block cipher. In reference [28], deep learning was applied to perform the cryptanalysis on the simplified DES, SPECK, and SIMON under the limited key space, and the key bits were recovered successfully. However, this method was not applicable when the key space was not limited. The authors in reference [29] used neural network to simulate the “single input-multiple output” difference of non-Markov cipher and simplified the distinguish task into classification task. Several distinguishers of four ciphers Gimli, ASCON, Knot, and Chaskey were shown. It was proved that the complexity of each distinguisher was very low. The authors in reference [30] proposed the neural network distinguisher for Chaskey, PRESENT, and DES. The multiple ciphertext pairs use one difference as the input. The module was added to extract the derived features, so as to improve the accuracy of the distinguisher.


## 3. Preliminaries

### 3.1. Description of SIMECK

The family of SIMECK cipher is denoted as SIMECK2n/mn, where 2n (n  = 16,24,32) is the block size, and mn is the master key size [14]. For example, SIMECK 32/64 refers to the encryption of 32-bit block, and the length of master key is 64 bit. SIMECK is designed to follow Feistel structure. The plaintext is firstly divided into L0 and R0, then these two parts are encrypted by round function for r rounds, and the last two outputs Lr and Rr consist of a complete ciphertext. Figure 1 shows the single round encryption process of SIMECK. The round function Fki (the round i) is defined as follows:(1)FkiLi+1,Ri+1=Ri⊕fLi⊕ki,Li,where Li and Ri are the intermediate state of SIMECK, and ki is the round key. The function f is defined as follows:(2)fx=x⊙x≪5⊕x≪1,where ⊙ is bitwise AND, ⊕ is exclusive-or (XOR), and x≪i represents that x is cyclically shifted left by i bits. The encryption process of SIMECK is given in Algorithm 1.Figure 1
Single round encryption of SIMECK.Algorithm 2 gives the process of generating round keyki from the master key K. In order from high to low, the 64-bit master key K’s initial condition t2,t1,t0,k0 is 4 words. Z0 and Z1 are described in reference [14]. C is a constant. The function f is the reusing of SIMECK’s round function. The update operation of intermediate state can be defined as follows:(3)ki+3=titi+3=ki⊕fti⊕C⊕zji,where 0≤i≤r−1, and ki is key of round i.Algorithm 1: Encryption of SIMECK.
Input:P = (L0, R0)∈{0,1}2nOutput:C = (Lr, Rr)∈{0,1}2n(1)
fori = 1 to rdo(2)
Li =  Ri−1, ⊕ ((Li−1≪5∧Li−1 \(3)
Li =  Li⊕ki−1⊕Li−1≪1(4)
Ri =  Li−1(5)
end for(6)
return (Lr, Rr)Algorithm 2: Encryption of SIMECK.
Input:K∈{0,1}mnOutput:ki, 0  ≤  i ≤ r − 1(1)
ifn = 16 orn = 24 then(2)
j = 0(3)
elsej = 1(5)
i = 0(4)
end if(6)
fori = 1 to r − 1 do(7)
ki+3 = ti(8)
ti+3 = ki ⊕ f (ti) ⊕ C ⊕ (zj)i(9)
end for(10)
returnki


### 3.2. Differential and Distinguisher

Differential cryptanalysis exploits the differential (α,β) with high probability to distinguish random data from ciphertext, and the key recovery attack is carried out on this basis. Therefore, the first step of differential cryptoanalysis is to look for high probability differential. The differential trail of a block cipher with j rounds is defined as (α,β):(4)α=Δi⟶Δi+1⟶⋯⟶Δi+j=β,where Δi and Δi+1 are the input difference and the output difference of round i respectively. The difference operation generally adopts XOR and modular subtraction. In this study, the difference operation uses XOR; that is, Δ=P0i⊕P1i, P0i and P1i are the input pairs.Letα and β be two correlation differences with n bits, x is a n-bit input. The differential probability of the block cipher is denoted as DPα⟶β, which refers to the probability that α propagates to β under round function F. It can be calculated as follows:(5)DPα⟶β=2−n⋅x:Fx⊕α⊕Fx=β.The differential trail generally is composed with a sequence of the tripletΔi,Δi+1,pi, respectively representing the input differences, output differences, and corresponding probability of the round i. The differential gives all states in the whole difference chain.Multiple differential cryptanalysis is a case of multiple linear cryptanalysis [9]. A group of input differences has no structure, and the corresponding output differences may be different due to the input differences. In multiple differential cryptanalysis, an attacker will adopt a collection Δ of differentials. The input differences set is denoted as Δα, Δα=Δα0,Δα1,…,Δαt. For a given input difference Δαi∈Δα, the set of the output differences Δβ can be obtained, and Δβ is expressed as Δβ=Δβi,j|Δαi,Δβi,j∈Δ. Therefore, the collection Δ of differentials is described as Δ=Δαi,Δβi,j|i=0,1,…,tandj=0,1,…,Δβi,j.The cryptography distinguisherD, or simply called distinguisher, is a probability algorithm. A random permutation O or cipher encryption C as its input. If the distinguisher infers that the input comes from C, then the output will be 1; otherwise, the output will be 0. When determining the success rate of a distinguisher, there are usually two situations. One is to identify the positive sample as the correct output, the other is to identify the negative sample as the correct output. A useful distinguisher often requires that its success rate be greater than 0.5. In deep learning, we use the accuracy to represent the success rate of the distinguisher. The accuracy of the distinguisher can be improved by learning more about the hidden statistical rules and structural features in ciphertexts.


### 3.3. Neural Network

Feedforward neural network (FNN), or called multilayer perceptron (MLP), is one of the deep learning models. FNN approximates a functionf∗. In classification, y=fx;θ means that the input x is mapped to a category y, and the parameter θ is learned, so that the optimal approximation of the function is obtained. The framework of FNN is generally composed of the input layer, some hidden layers, and the output layer. Finally, the learning model is a chain structure formed by many different functions. The depth of the network usually refers to the length of the chain. Assumed that the layer l has M units, the layer l+1 has N units, wijl is the weight of the unit i in the layer l to the unit j of the layer l+1, and bjl+1 and fjl+1 are the bias and activation functions of the unit j in the layer l+1, respectively. The output of the unit j in the layer l of the FNN model is formally defined as follows:(6)xjl+1=fjl+1∑i=1Mwijlxij+bjl+1.Convolutional neural network (CNN) uses the convolution operations. CNN is a special structure of FNN. CNN can accept matrices as input and has repetitive neuron blocks (convolution kernels) that can across space (images) or time (audio signals). This special design structure makes the convolution network has partial translation invariance. Convolution operations are generally expressed as follows:(7)st=x∗wt,where x represents the input and w represents the kernel function. st represents the output, which is called feature mapping, and t represents the current coordinate. CNN learning framework generally consists of the input layer, several convolution layers, the pooling layer, the full connection layer, and the output layer. The convolution layer and pooling layer are responsible for data processing, followed by the full connection layer. Therefore, CNNs are also known as FNN with data preprocessing.


## 3.1. Description of SIMECK

The family of SIMECK cipher is denoted as SIMECK2n/mn, where 2n (n  = 16,24,32) is the block size, and mn is the master key size [14]. For example, SIMECK 32/64 refers to the encryption of 32-bit block, and the length of master key is 64 bit. SIMECK is designed to follow Feistel structure. The plaintext is firstly divided into L0 and R0, then these two parts are encrypted by round function for r rounds, and the last two outputs Lr and Rr consist of a complete ciphertext. Figure 1 shows the single round encryption process of SIMECK. The round function Fki (the round i) is defined as follows:(1)FkiLi+1,Ri+1=Ri⊕fLi⊕ki,Li,where Li and Ri are the intermediate state of SIMECK, and ki is the round key. The function f is defined as follows:(2)fx=x⊙x≪5⊕x≪1,where ⊙ is bitwise AND, ⊕ is exclusive-or (XOR), and x≪i represents that x is cyclically shifted left by i bits. The encryption process of SIMECK is given in Algorithm 1.Figure 1
Single round encryption of SIMECK.Algorithm 2 gives the process of generating round keyki from the master key K. In order from high to low, the 64-bit master key K’s initial condition t2,t1,t0,k0 is 4 words. Z0 and Z1 are described in reference [14]. C is a constant. The function f is the reusing of SIMECK’s round function. The update operation of intermediate state can be defined as follows:(3)ki+3=titi+3=ki⊕fti⊕C⊕zji,where 0≤i≤r−1, and ki is key of round i.Algorithm 1: Encryption of SIMECK.
Input:P = (L0, R0)∈{0,1}2nOutput:C = (Lr, Rr)∈{0,1}2n(1)
fori = 1 to rdo(2)
Li =  Ri−1, ⊕ ((Li−1≪5∧Li−1 \(3)
Li =  Li⊕ki−1⊕Li−1≪1(4)
Ri =  Li−1(5)
end for(6)
return (Lr, Rr)Algorithm 2: Encryption of SIMECK.
Input:K∈{0,1}mnOutput:ki, 0  ≤  i ≤ r − 1(1)
ifn = 16 orn = 24 then(2)
j = 0(3)
elsej = 1(5)
i = 0(4)
end if(6)
fori = 1 to r − 1 do(7)
ki+3 = ti(8)
ti+3 = ki ⊕ f (ti) ⊕ C ⊕ (zj)i(9)
end for(10)
returnki


## 3.2. Differential and Distinguisher

Differential cryptanalysis exploits the differential (α,β) with high probability to distinguish random data from ciphertext, and the key recovery attack is carried out on this basis. Therefore, the first step of differential cryptoanalysis is to look for high probability differential. The differential trail of a block cipher with j rounds is defined as (α,β):(4)α=Δi⟶Δi+1⟶⋯⟶Δi+j=β,where Δi and Δi+1 are the input difference and the output difference of round i respectively. The difference operation generally adopts XOR and modular subtraction. In this study, the difference operation uses XOR; that is, Δ=P0i⊕P1i, P0i and P1i are the input pairs.Letα and β be two correlation differences with n bits, x is a n-bit input. The differential probability of the block cipher is denoted as DPα⟶β, which refers to the probability that α propagates to β under round function F. It can be calculated as follows:(5)DPα⟶β=2−n⋅x:Fx⊕α⊕Fx=β.The differential trail generally is composed with a sequence of the tripletΔi,Δi+1,pi, respectively representing the input differences, output differences, and corresponding probability of the round i. The differential gives all states in the whole difference chain.Multiple differential cryptanalysis is a case of multiple linear cryptanalysis [9]. A group of input differences has no structure, and the corresponding output differences may be different due to the input differences. In multiple differential cryptanalysis, an attacker will adopt a collection Δ of differentials. The input differences set is denoted as Δα, Δα=Δα0,Δα1,…,Δαt. For a given input difference Δαi∈Δα, the set of the output differences Δβ can be obtained, and Δβ is expressed as Δβ=Δβi,j|Δαi,Δβi,j∈Δ. Therefore, the collection Δ of differentials is described as Δ=Δαi,Δβi,j|i=0,1,…,tandj=0,1,…,Δβi,j.The cryptography distinguisherD, or simply called distinguisher, is a probability algorithm. A random permutation O or cipher encryption C as its input. If the distinguisher infers that the input comes from C, then the output will be 1; otherwise, the output will be 0. When determining the success rate of a distinguisher, there are usually two situations. One is to identify the positive sample as the correct output, the other is to identify the negative sample as the correct output. A useful distinguisher often requires that its success rate be greater than 0.5. In deep learning, we use the accuracy to represent the success rate of the distinguisher. The accuracy of the distinguisher can be improved by learning more about the hidden statistical rules and structural features in ciphertexts.


## 3.3. Neural Network

Feedforward neural network (FNN), or called multilayer perceptron (MLP), is one of the deep learning models. FNN approximates a functionf∗. In classification, y=fx;θ means that the input x is mapped to a category y, and the parameter θ is learned, so that the optimal approximation of the function is obtained. The framework of FNN is generally composed of the input layer, some hidden layers, and the output layer. Finally, the learning model is a chain structure formed by many different functions. The depth of the network usually refers to the length of the chain. Assumed that the layer l has M units, the layer l+1 has N units, wijl is the weight of the unit i in the layer l to the unit j of the layer l+1, and bjl+1 and fjl+1 are the bias and activation functions of the unit j in the layer l+1, respectively. The output of the unit j in the layer l of the FNN model is formally defined as follows:(6)xjl+1=fjl+1∑i=1Mwijlxij+bjl+1.Convolutional neural network (CNN) uses the convolution operations. CNN is a special structure of FNN. CNN can accept matrices as input and has repetitive neuron blocks (convolution kernels) that can across space (images) or time (audio signals). This special design structure makes the convolution network has partial translation invariance. Convolution operations are generally expressed as follows:(7)st=x∗wt,where x represents the input and w represents the kernel function. st represents the output, which is called feature mapping, and t represents the current coordinate. CNN learning framework generally consists of the input layer, several convolution layers, the pooling layer, the full connection layer, and the output layer. The convolution layer and pooling layer are responsible for data processing, followed by the full connection layer. Therefore, CNNs are also known as FNN with data preprocessing.


## 4. Multiple Differential Distinguisher of SIMECK 32/64

In this section, the multiple differential distinguishers of SIMECK32/64 based on deep learning are given. The input structure of the model adopts the composite multiple ciphertexts with multiple differences. Ciphertexts use two composite methods: random ciphertext pairs and associated ciphertext pairs.


### 4.1. Distinguisher Model

The plaintexts are generated through multiple differencesΔi, and the corresponding ciphertexts are obtained by encrypting these plaintexts. The distinguisher will classify the random data and the ciphertext. The label vector Y is used to represent the classification results. If Yi is 0, it represents the random data. If Yi is 1, it represents the encrypted ciphertext. The definition of Y is given as follows:(8)Y=1,Pi⊕Pi+1=Δi2andΔa≠Δb,a,b∈0,1,...,t−1,i∈0,2,4,...,2t0,Pi∈Random,i∈0,1,2,...,2t+1.Then, the general model of distinguisherD is defined as follows:(9)PrY=1|X1,X2,...,Xk=Ff2f1X1,...,f1Xk,k∈0,1,...,N−1,where Xk is the ciphertext sample. f1Xk represents the feature extracted from the set of ciphertext pairs Xk, and f2y1,y2,…,ym represents the composite feature re-extraction among multiple ciphertext information. The function F is the posteriori probability estimation function after integrating global features. In this study, two composite forms are designed. Formula (8) gives the structure of plaintext pair using random multiple differences. Another structure of plaintext pairs using multiple differences is proposed that link the plaintext pairs in series, named associated multidifferences. Multiple ciphertext pairs are combined to investigate the extraction of composite features by the distinguisher. The associated composite form is defined as follows:(10)Y=1,Pi−1⊕Pi=Δi−1andΔa≠Δb,a,b,i∈1,2,...,t−10,Pi∈Random,i∈0,1,2,...,t.Figure 2
Neural network structure of CNN for SIMECK32/64 distinguisher.


### 4.2. Design of Neural Network Distinguisher

(1)
Input Data Format. The input layer adopts the form of ciphertext pairs set. CNN accepts the matrix as input. Two input data formats of SIMECK32/64 are constructed: 2t+2×16 and 4t×16. The input data formats represent the byte-oriented structure of ciphertext pairs based on multiple differences.(2)
Network Structure. The network structure consists of four modules, as shown in Figure 2. Module 1 uses 32 parallel convolution kernels with size 1 for bit slicing operation. The matrices of 2t+2×16 and 4t×16 are mapped to 16 × 32 matrix. The size of the matrix remains unchanged during the mapping process. Then, several repeated modules 2 are connected to adjust the depth of the network. Each module 2 contains two convolution layers. Each layer uses 32 convolution kernels whose size is ks, which is able to study the features from the input ciphertext pairs. The result of the addition of the output of module 2 and the output of module 1 is a residual connection. Finally, module 3 and module 4 are fully connected layers. Each layer has d1 and d2 neurons respectively, which are used to synthesize global features. Each layer of the neural network applies L2-based kernel regularizer, batch normalization module, and a rectifier nonlinearly to ensure the universality of the network.(3)
Activation Function. The gradient may disappear when the function sigmoid is used as the activation function. The reason is that the gradient value of sigmoid function is too small in the interval of x>4. In contrast, the output of the function ReLU is relatively stable, which is a linear function when x>0. At the same time, the problem of sparsity is solved. Therefore, ReLU is used as activation function while training the distinguisher for lower number of rounds. The function of ReLU is defined as follows:(11)ReLUx=max0,x.While training the distinguisher with a high number of rounds, the gradient explosion often occurs in the training process because there is no obvious difference between ciphertext pairs and random data in the data set. The training model may bias to two directions. Therefore, this study selects tanh function, whose function expression is as follows:(12)tanhx=sinhxcoshx=ex−e−xex+e−x.(4)
Super Parameter Setting. The mean square error is added to L2 norm. The effect of parameter penalty and regularization are achieved. The loss function is set as follows:(13)Ly;fx=1n∑i=1nyi−fxi2+λw2,where fxi represents the neural network’s output, w represents the neural network’s parameters, yi represents the true label, and λ represents the penalty factor, which is 0.0001. The optimizer uses the Adam algorithm, which corrects the learning rate of each parameter in real time by first-order and second-order matrix estimates of gradients. The learning rate decreases with the increment of training rounds and does not decrease after 40 epochs. Therefore, the training cycle in the algorithm is set to 40 epochs. Meanwhile, the ModelCheckPoint method is triggered by the callback function to save the best learning model.


### 4.3. Model Training and Testing

#### 4.3.1. Data Generation

The data set generation of the distinguisherNDrm is shown in Algorithm 3. The initial plaintext of the distinguisher NDrm is obtained by the random generator. They are expressed as Pi0,Pi2,…,Pi(2k), where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. For the given t different differences Δi, i∈0,1,…,t, the bitwise XOR is performed between the initial plaintexts and the given differences. The corresponding other half of plaintexts are Pi1,Pi3,…,Pi2k+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1 are obtained. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Ci2k+1, i∈0,1,2,…,N−1, and k∈0,1,2,…,t−1. The bitwise AND operation is performed between the sample data and 1 to ensure that the encrypted data and random data in the sample space account for half respectively.The data set generation of the distinguisherNDam is shown in Algorithm 4 from line 1 to line 18. The initial plaintext P0 of the distinguisher NDam is obtained by the random generator. Given a difference sequence Δ0,Δ1,…,Δt−1, next plaintext Pi is obtained by the bitwise XOR between the previous plaintext Pi−1 and the corresponding given difference Δi−1, namely, Pi=Pi−1⊕Δi−1. t plaintexts are generated. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Cik+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. The construction of the sample space adopts the method similar to that in NDrm.


#### 4.3.2. Training

Algorithm 4 is the training ofNDam model. The set used for training is composed of ciphertexts and random data. First, t associated plaintext pairs are generated by the given P0 and the multiple input differences Δ0,Δ1,…,Δt−1. Then, the ciphertext pairs are obtained. In order to make the encrypted data and random data account for half of the sample, half of the data is replaced with random data. Finally, the trained neural network model is saved and returned.Algorithm 3: Data generation for NDrm.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: TD’’(1)
TD″ ← (⋅)/∗initial data set∗/(2)
K ← Random()(3)
fori = 0 to t − 1 do(4)
P2i = Random()(5)
end for(6)
fori = 0 to t − 1 do(7)
P2i + 1 = P2i ⊕ Δi(8)
end for(9)
forj = 0 to N − 1 do(10)
Cj ← encrypt (Pj, Kj)(11)
end for(12)
fori = 0 to N − 1 do/∗set label∗/(13)
ifi&1 = 0 then(14)
Ci ← Random()(15)
Yi ← 0(16)
else(17)
Yi ← 1(18)
end if(19)
end for(20)
return TD’’ ← (X(C0…CN − 1), Y)Algorithm 4: Training NDam model.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: model(1)
TD ← (⋅); /∗initial training set∗/(2)
K ← Random()(3)
P0 = Random()(4)
fori = 1 to tdo(5)
Pi = Pt − 1 ⊕ Δi − 1(6)
end for(7)
forj = 0 to N − 1 do(8)
Cj ← encrypt (Pj, Kj)(9)
end for(10)
fori = 0 to N − 1 do/∗set training label∗/(11)
ifi&1 = 0 then(12)
Ci ← Random()(13)
Yi ← 0(14)
else(15)
Yi ← 1(16)
end if(17)
end for(18)
TD ← (X(C0…CN − 1), Y)(19)
model ← Training with TD(20)
return model


#### 4.3.3. Testing

The data sets of testing and training are generated in the same way. The model can be regarded as a functionF, which accepts inputs, judges, and outputs. If the label is 0 and it is judged that the data belong to random data, the output is 0. Similarly, if the label is 1 and the model judged that the data belong to cipher, the output is 1. Finally, the test accuracy of neural network model is returned. Algorithm 5 describes the process of testing neural network distinguisher model. The process of training and testing of the distinguisher NDrm is similar to the above NDam model, which will not be repeated here.Algorithm 5: Testing NDam model.
Input: model Fsample number MOutput: acc(1)
TD’← (X (C0…Cm − 1), Y)/∗generate test data set∗/(2)
sum = 0(3)
fori = 0 to M − 1 do(4)
ifF(Ci) = 1(5)
sum++(6)
end if(7)
end for(8)
return acc = sum/m


## 4.1. Distinguisher Model

The plaintexts are generated through multiple differencesΔi, and the corresponding ciphertexts are obtained by encrypting these plaintexts. The distinguisher will classify the random data and the ciphertext. The label vector Y is used to represent the classification results. If Yi is 0, it represents the random data. If Yi is 1, it represents the encrypted ciphertext. The definition of Y is given as follows:(8)Y=1,Pi⊕Pi+1=Δi2andΔa≠Δb,a,b∈0,1,...,t−1,i∈0,2,4,...,2t0,Pi∈Random,i∈0,1,2,...,2t+1.Then, the general model of distinguisherD is defined as follows:(9)PrY=1|X1,X2,...,Xk=Ff2f1X1,...,f1Xk,k∈0,1,...,N−1,where Xk is the ciphertext sample. f1Xk represents the feature extracted from the set of ciphertext pairs Xk, and f2y1,y2,…,ym represents the composite feature re-extraction among multiple ciphertext information. The function F is the posteriori probability estimation function after integrating global features. In this study, two composite forms are designed. Formula (8) gives the structure of plaintext pair using random multiple differences. Another structure of plaintext pairs using multiple differences is proposed that link the plaintext pairs in series, named associated multidifferences. Multiple ciphertext pairs are combined to investigate the extraction of composite features by the distinguisher. The associated composite form is defined as follows:(10)Y=1,Pi−1⊕Pi=Δi−1andΔa≠Δb,a,b,i∈1,2,...,t−10,Pi∈Random,i∈0,1,2,...,t.Figure 2
Neural network structure of CNN for SIMECK32/64 distinguisher.


## 4.2. Design of Neural Network Distinguisher

(1)
Input Data Format. The input layer adopts the form of ciphertext pairs set. CNN accepts the matrix as input. Two input data formats of SIMECK32/64 are constructed: 2t+2×16 and 4t×16. The input data formats represent the byte-oriented structure of ciphertext pairs based on multiple differences.(2)
Network Structure. The network structure consists of four modules, as shown in Figure 2. Module 1 uses 32 parallel convolution kernels with size 1 for bit slicing operation. The matrices of 2t+2×16 and 4t×16 are mapped to 16 × 32 matrix. The size of the matrix remains unchanged during the mapping process. Then, several repeated modules 2 are connected to adjust the depth of the network. Each module 2 contains two convolution layers. Each layer uses 32 convolution kernels whose size is ks, which is able to study the features from the input ciphertext pairs. The result of the addition of the output of module 2 and the output of module 1 is a residual connection. Finally, module 3 and module 4 are fully connected layers. Each layer has d1 and d2 neurons respectively, which are used to synthesize global features. Each layer of the neural network applies L2-based kernel regularizer, batch normalization module, and a rectifier nonlinearly to ensure the universality of the network.(3)
Activation Function. The gradient may disappear when the function sigmoid is used as the activation function. The reason is that the gradient value of sigmoid function is too small in the interval of x>4. In contrast, the output of the function ReLU is relatively stable, which is a linear function when x>0. At the same time, the problem of sparsity is solved. Therefore, ReLU is used as activation function while training the distinguisher for lower number of rounds. The function of ReLU is defined as follows:(11)ReLUx=max0,x.While training the distinguisher with a high number of rounds, the gradient explosion often occurs in the training process because there is no obvious difference between ciphertext pairs and random data in the data set. The training model may bias to two directions. Therefore, this study selects tanh function, whose function expression is as follows:(12)tanhx=sinhxcoshx=ex−e−xex+e−x.(4)
Super Parameter Setting. The mean square error is added to L2 norm. The effect of parameter penalty and regularization are achieved. The loss function is set as follows:(13)Ly;fx=1n∑i=1nyi−fxi2+λw2,where fxi represents the neural network’s output, w represents the neural network’s parameters, yi represents the true label, and λ represents the penalty factor, which is 0.0001. The optimizer uses the Adam algorithm, which corrects the learning rate of each parameter in real time by first-order and second-order matrix estimates of gradients. The learning rate decreases with the increment of training rounds and does not decrease after 40 epochs. Therefore, the training cycle in the algorithm is set to 40 epochs. Meanwhile, the ModelCheckPoint method is triggered by the callback function to save the best learning model.


## 4.3. Model Training and Testing

### 4.3.1. Data Generation

The data set generation of the distinguisherNDrm is shown in Algorithm 3. The initial plaintext of the distinguisher NDrm is obtained by the random generator. They are expressed as Pi0,Pi2,…,Pi(2k), where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. For the given t different differences Δi, i∈0,1,…,t, the bitwise XOR is performed between the initial plaintexts and the given differences. The corresponding other half of plaintexts are Pi1,Pi3,…,Pi2k+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1 are obtained. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Ci2k+1, i∈0,1,2,…,N−1, and k∈0,1,2,…,t−1. The bitwise AND operation is performed between the sample data and 1 to ensure that the encrypted data and random data in the sample space account for half respectively.The data set generation of the distinguisherNDam is shown in Algorithm 4 from line 1 to line 18. The initial plaintext P0 of the distinguisher NDam is obtained by the random generator. Given a difference sequence Δ0,Δ1,…,Δt−1, next plaintext Pi is obtained by the bitwise XOR between the previous plaintext Pi−1 and the corresponding given difference Δi−1, namely, Pi=Pi−1⊕Δi−1. t plaintexts are generated. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Cik+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. The construction of the sample space adopts the method similar to that in NDrm.


### 4.3.2. Training

Algorithm 4 is the training ofNDam model. The set used for training is composed of ciphertexts and random data. First, t associated plaintext pairs are generated by the given P0 and the multiple input differences Δ0,Δ1,…,Δt−1. Then, the ciphertext pairs are obtained. In order to make the encrypted data and random data account for half of the sample, half of the data is replaced with random data. Finally, the trained neural network model is saved and returned.Algorithm 3: Data generation for NDrm.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: TD’’(1)
TD″ ← (⋅)/∗initial data set∗/(2)
K ← Random()(3)
fori = 0 to t − 1 do(4)
P2i = Random()(5)
end for(6)
fori = 0 to t − 1 do(7)
P2i + 1 = P2i ⊕ Δi(8)
end for(9)
forj = 0 to N − 1 do(10)
Cj ← encrypt (Pj, Kj)(11)
end for(12)
fori = 0 to N − 1 do/∗set label∗/(13)
ifi&1 = 0 then(14)
Ci ← Random()(15)
Yi ← 0(16)
else(17)
Yi ← 1(18)
end if(19)
end for(20)
return TD’’ ← (X(C0…CN − 1), Y)Algorithm 4: Training NDam model.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: model(1)
TD ← (⋅); /∗initial training set∗/(2)
K ← Random()(3)
P0 = Random()(4)
fori = 1 to tdo(5)
Pi = Pt − 1 ⊕ Δi − 1(6)
end for(7)
forj = 0 to N − 1 do(8)
Cj ← encrypt (Pj, Kj)(9)
end for(10)
fori = 0 to N − 1 do/∗set training label∗/(11)
ifi&1 = 0 then(12)
Ci ← Random()(13)
Yi ← 0(14)
else(15)
Yi ← 1(16)
end if(17)
end for(18)
TD ← (X(C0…CN − 1), Y)(19)
model ← Training with TD(20)
return model


### 4.3.3. Testing

The data sets of testing and training are generated in the same way. The model can be regarded as a functionF, which accepts inputs, judges, and outputs. If the label is 0 and it is judged that the data belong to random data, the output is 0. Similarly, if the label is 1 and the model judged that the data belong to cipher, the output is 1. Finally, the test accuracy of neural network model is returned. Algorithm 5 describes the process of testing neural network distinguisher model. The process of training and testing of the distinguisher NDrm is similar to the above NDam model, which will not be repeated here.Algorithm 5: Testing NDam model.
Input: model Fsample number MOutput: acc(1)
TD’← (X (C0…Cm − 1), Y)/∗generate test data set∗/(2)
sum = 0(3)
fori = 0 to M − 1 do(4)
ifF(Ci) = 1(5)
sum++(6)
end if(7)
end for(8)
return acc = sum/m


## 4.3.1. Data Generation

The data set generation of the distinguisherNDrm is shown in Algorithm 3. The initial plaintext of the distinguisher NDrm is obtained by the random generator. They are expressed as Pi0,Pi2,…,Pi(2k), where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. For the given t different differences Δi, i∈0,1,…,t, the bitwise XOR is performed between the initial plaintexts and the given differences. The corresponding other half of plaintexts are Pi1,Pi3,…,Pi2k+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1 are obtained. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Ci2k+1, i∈0,1,2,…,N−1, and k∈0,1,2,…,t−1. The bitwise AND operation is performed between the sample data and 1 to ensure that the encrypted data and random data in the sample space account for half respectively.The data set generation of the distinguisherNDam is shown in Algorithm 4 from line 1 to line 18. The initial plaintext P0 of the distinguisher NDam is obtained by the random generator. Given a difference sequence Δ0,Δ1,…,Δt−1, next plaintext Pi is obtained by the bitwise XOR between the previous plaintext Pi−1 and the corresponding given difference Δi−1, namely, Pi=Pi−1⊕Δi−1. t plaintexts are generated. Finally, the plaintexts are encrypted to generate a sample data Ci=Ci0,Ci1,…,Cik+1, where i∈0,1,2,…,N−1 and k∈0,1,2,…,t−1. The construction of the sample space adopts the method similar to that in NDrm.


## 4.3.2. Training

Algorithm 4 is the training ofNDam model. The set used for training is composed of ciphertexts and random data. First, t associated plaintext pairs are generated by the given P0 and the multiple input differences Δ0,Δ1,…,Δt−1. Then, the ciphertext pairs are obtained. In order to make the encrypted data and random data account for half of the sample, half of the data is replaced with random data. Finally, the trained neural network model is saved and returned.Algorithm 3: Data generation for NDrm.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: TD’’(1)
TD″ ← (⋅)/∗initial data set∗/(2)
K ← Random()(3)
fori = 0 to t − 1 do(4)
P2i = Random()(5)
end for(6)
fori = 0 to t − 1 do(7)
P2i + 1 = P2i ⊕ Δi(8)
end for(9)
forj = 0 to N − 1 do(10)
Cj ← encrypt (Pj, Kj)(11)
end for(12)
fori = 0 to N − 1 do/∗set label∗/(13)
ifi&1 = 0 then(14)
Ci ← Random()(15)
Yi ← 0(16)
else(17)
Yi ← 1(18)
end if(19)
end for(20)
return TD’’ ← (X(C0…CN − 1), Y)Algorithm 4: Training NDam model.
Input:multiple differences (Δ0, Δ1, …, Δt − 1)sample numberNOutput: model(1)
TD ← (⋅); /∗initial training set∗/(2)
K ← Random()(3)
P0 = Random()(4)
fori = 1 to tdo(5)
Pi = Pt − 1 ⊕ Δi − 1(6)
end for(7)
forj = 0 to N − 1 do(8)
Cj ← encrypt (Pj, Kj)(9)
end for(10)
fori = 0 to N − 1 do/∗set training label∗/(11)
ifi&1 = 0 then(12)
Ci ← Random()(13)
Yi ← 0(14)
else(15)
Yi ← 1(16)
end if(17)
end for(18)
TD ← (X(C0…CN − 1), Y)(19)
model ← Training with TD(20)
return model


## 4.3.3. Testing

The data sets of testing and training are generated in the same way. The model can be regarded as a functionF, which accepts inputs, judges, and outputs. If the label is 0 and it is judged that the data belong to random data, the output is 0. Similarly, if the label is 1 and the model judged that the data belong to cipher, the output is 1. Finally, the test accuracy of neural network model is returned. Algorithm 5 describes the process of testing neural network distinguisher model. The process of training and testing of the distinguisher NDrm is similar to the above NDam model, which will not be repeated here.Algorithm 5: Testing NDam model.
Input: model Fsample number MOutput: acc(1)
TD’← (X (C0…Cm − 1), Y)/∗generate test data set∗/(2)
sum = 0(3)
fori = 0 to M − 1 do(4)
ifF(Ci) = 1(5)
sum++(6)
end if(7)
end for(8)
return acc = sum/m


## 5. Experiment and Performance Evaluation

The performance of some distinguishers and the comparisons among these distinguishers are presented in this section. The proposed distinguishers in this study areNDrm and NDam. The distinguisher NDS is realized by using the ideas of reference [13], and the distinguisher NDM is realized by using the ideas of multiple ciphertext and single difference [30]. All experiments were conducted on a computer with a GTX 1650 graphics card, 16 GB memory. Tensorflow is used at the back end and Keras is used at the front end.


### 5.1. Results of the Proposed Distinguishers

Figure3 shows the accuracy of distinguisher NDam and NDrm of round-reduced SIMECK 32/64 (6–11 rounds). The network of the distinguisher shown in Figure 3 adopted CNN. In our experiments, the two distinguishers have the same parameters. The number of differences is set as t = 3, and the threshold is set as δ > 0.5. The training sample size is 224, and the testing sample size is 218. The positive and negative samples in training set and testing set account for 1/2 of them, respectively. The input plaintext differences Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x4 were selected.Figure 3
Accuracy of distinguishers for round-reduced SIMECK32/64 (6–11 rounds). (a) Round 6. (b) Round 7. (c) Round 8. (d) Round 9. (e) Round 10. (f) Round 11.
(a)(b)(c)(d)(e)(f)The experimental results show that the deep learning distinguisher can easily learn the distinguishing characteristics of encrypted data and random data for the low rounds, but as the number of iteration rounds increases, the accuracy will continue to decrease. According to the confusion and diffusion of the block cipher, the higher iteration rounds is, the weaker the statistical information between plaintexts and ciphertexts become. And the corresponding positive and negative samples have the high similarity. It becomes difficult for deep learning to select the feature effectively. In order to make the neural network distinguisher have a strong generalization ability, the neural network model can be improved to a certain extent by increasing the size of sample in training and testing or prolonging the training epoch.It can also be seen from Figure3 that distinguisher NDrm and NDam have similar trends, but the accuracy of NDam is slightly higher than that of NDrm. The convergence speed of NDam is faster than that of NDrm when the number of rounds is high. It proves that NDam has learned more features from the associated ciphertext pairs. Compared with the ciphertext pairs generated by random multiple differences, there are hidden features in the associated ciphertext pairs. Therefore, the performance of the distinguisher is improved. However, NDam distinguisher also has restrictions on data requirements in training and testing. Data generation of the distinguisher NDrm is easier than that of distinguisher NDam.In training and testing of the distinguisher model, the sample data required for the distinguisher of lower rounds can be reduced. TakingNDam (r = 6, t = 3) as an example, the samples of the training set only need 28. Using the settings in this study, the accuracy about 0.99 can be achieved in 25 s. For the NDam (r = 7, t = 3), the samples of the training set need 216, which takes about 1 minute to achieve the accuracy about 0.98.Using the same training parameters as CNN, this study also constructed the corresponding distinguisher using MLP. The MLP network consists four hidden layers, whose neurons for each hidden layer are set as2n,2n,n,n. Each hidden layer abstracts the features of the input ciphertext pair to another dimension space to extract more abstract features. L2 kernel regularizer and nonlinear activation function ReLU are used in each layer. Since the number of layers of MLP network is not very deep, the batch normalization module is not used. The training of MLP adopts the circular learning rate scheme in reference [13], which is different from the decreasing learning rate scheme adopted in CNN. Table 2 lists the results of the distinguisher based on MLP. It can be seen from the results that the accuracy of MLP is equal to or less thanthat of CNN in each round. But it is up to only 10 rounds at most. In the case of rounds 8 and 9, the accuracy of NDam is significantly higher than that of NDrm. This also shows that the associated difference has certain advantages.Table 2
Accuracy of SIMECK’s distinguisher training by MLP.
r (round)NDamNDrm60.99990.967070.94410.939180.87850.784690.61240.5011100.5017-Table3 lists the number of learning parameters, training time, and accuracy of 6–10 rounds of distinguisher NDam (t = 3) when using MLP and CNN. Due to the simple structure of MLP, the training time and the number of parameters will be greatly reduced. It can be seen that CNN can better converge to a local minimum and is easier to be optimized, and the accuracy of CNN is slightly higher than that of MLP.Table 3
SIMECK32/64 distinguisher of 6–10 rounds MLP compared to CNN.
r (round)Number of parametersTime of trainingAccuracyMLPCNNMLP (s)CNN (s)MLPCNN61558544001336257230.99990.999971558544001348157270.94320.999881558544001340157200.88010.964891558544001340857430.61280.7248101558544001336157610.50160.5501Figures4 and 5 show the prediction distribution of distinguisher NDam and NDrm (r = 8, t = 3) based on CNN with 512 random positive samples, respectively. It can be seen that our 8-round CNN distinguishers have high reliability in the distribution of predicted values. It is basically consistent with the accuracy of training. Ciphertexts with high probability difference can be easily found.Figure 4
Prediction distribution of 8-round distinguisherNDam.Figure 5
Prediction distribution of 8-round distinguisherNDrm.


### 5.2. Comparisons of Distinguishers

In our experiment, the distinguishers (t = 2, 3, and 4) were given. The sample sizes of training and testing are 224 and 218, respectively. The specific input differences used are listed in Table 4.Table 4
Quantity of differences and selected differences.
tSelected differences2Δ0=0x0/0x1,Δ1=0x0/0x23Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x44Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x4,Δ3=0x0/0x8Table5 lists the accuracy of t-differences neural distinguisher Drm, Dam of SIMECK’s 6–11 rounds. In the case of the same round, the same input difference, and the same size of training sets and testing sets, the accuracy of Dam is slightly higher than that of Drm regardless of the quantity of plaintext differences. It is indicated that Dam has stronger feature selection ability and generalization ability. It also shows that when t increases, the accuracies of Drm and Dam increase. But it does not always increase with the increment of t. Table 5 also lists that the accuracies of Drm and Dam are all the highest when t = 3. It can be inferred from algorithm 4 and algorithm 5 that in the case of the same size of training sets and testing sets, the more the number of input differences is, the more complex the data become. The distinguishers are difficult to extract the features among ciphertexts, which will not increase the accuracy of the distinguishers.Table 5
Comparison oft-differences distinguishers’ accuracy.
r (round)t = 2t = 3t = 4NDrmNDamNDrmNDamNDrmNDam60.99990.99990.99990.99990.99990.999970.99800.99830.99800.99980.99900.999280.92450.94490.93820.96450.93360.942290.68750.69170.70600.71510.68490.7051100.52050.53880.53190.55050.53250.5415110.50240.50150.50390.50290.50190.5022The input difference selected byDrm and Dam is the same as that used in the previous experiment when t = 3. The input difference used in NDM and NDS is Δ0=0x0/0x1. The size of samples is the same as above. Table 6 lists the accuracy of distinguishers of SIMECK32/64’s 6–11 rounds.Table 6
Comparison of distinguishers’ accuracy of SIMECK32/64.
r (round)DamDrmNDS ([13])NDM ([30])60.99990.99990.99990.995270.99900.99800.98460.971880.96450.93820.93890.850590.71510.70600.70230.5898100.55050.53190.50180.5403110.50420.5038—0.5014Dam and Drm can reach higher rounds than NDS obviously. They can be applied to the SIMECK 32/64 algorithm with higher rounds; that is, the number of the round is expanded to round 11. And the accuracy is equivalent to the accuracy of round 10 in NDS. The Dam and Drm have achieved higher accuracy than NDM under the same number of rounds and still maintain a high accuracy in round 9 without a precipitous decline. It fully proves that our Dam and Drm have learned some additional features from multiple ciphertext pairs. At the same time, it also proves that when multiple differences are introduced, the accuracy of the distinguisher can be appropriately improved under the same round or a higher round of the distinguisher can be obtained. It also proves that it is feasible to train distinguishers by using multiple differences.In reference [18], the authors presented the optimized differential trails. The deep learning multiple differential distinguishers proposed in this study have better performance compared with reference [18]. Table 7 lists the detailed comparison of the complexity.Table 7
Complexity of SIMECK32/64.
r (round)Data complexityTime complexityMemory complexityDam (our)[18]Dam (our)[18]Dam (our)[18]62821325.42210.4228213721121528.19212.1921121582132192102162132199214221210.83217.8321422110216225212.68221.6821622511224227220.54223.54224227To further verify our neural distinguisher as a cryptographic tool, 512 random samples are used to test the ability of filtering error ciphertext of the multiple differential distinguishers. Using 3 input differences and 7–9 rounds of encryption,NDam is tested. Among 512 chosen-plaintext sets, half are positive samples and half are negative samples. Table 8 lists the probabilities of true positive (TP), true negative (TN), false positive (FP), and false negative (FN) of our Dam. It can be seen that the accuracy of filtering error ciphertext (i.e., FN) of our neural distinguisher is 99.61%, 96.10%, and 77.34%, respectively, and our distinguisher has high reliability.Table 8
Accuracy statistical results ofNDam.
r (round)TP (%)FP (%)TN (%)FN (%)7100.000.390.0099.61899.613.910.3996.10981.2522.6618.7577.34


## 5.1. Results of the Proposed Distinguishers

Figure3 shows the accuracy of distinguisher NDam and NDrm of round-reduced SIMECK 32/64 (6–11 rounds). The network of the distinguisher shown in Figure 3 adopted CNN. In our experiments, the two distinguishers have the same parameters. The number of differences is set as t = 3, and the threshold is set as δ > 0.5. The training sample size is 224, and the testing sample size is 218. The positive and negative samples in training set and testing set account for 1/2 of them, respectively. The input plaintext differences Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x4 were selected.Figure 3
Accuracy of distinguishers for round-reduced SIMECK32/64 (6–11 rounds). (a) Round 6. (b) Round 7. (c) Round 8. (d) Round 9. (e) Round 10. (f) Round 11.
(a)(b)(c)(d)(e)(f)The experimental results show that the deep learning distinguisher can easily learn the distinguishing characteristics of encrypted data and random data for the low rounds, but as the number of iteration rounds increases, the accuracy will continue to decrease. According to the confusion and diffusion of the block cipher, the higher iteration rounds is, the weaker the statistical information between plaintexts and ciphertexts become. And the corresponding positive and negative samples have the high similarity. It becomes difficult for deep learning to select the feature effectively. In order to make the neural network distinguisher have a strong generalization ability, the neural network model can be improved to a certain extent by increasing the size of sample in training and testing or prolonging the training epoch.It can also be seen from Figure3 that distinguisher NDrm and NDam have similar trends, but the accuracy of NDam is slightly higher than that of NDrm. The convergence speed of NDam is faster than that of NDrm when the number of rounds is high. It proves that NDam has learned more features from the associated ciphertext pairs. Compared with the ciphertext pairs generated by random multiple differences, there are hidden features in the associated ciphertext pairs. Therefore, the performance of the distinguisher is improved. However, NDam distinguisher also has restrictions on data requirements in training and testing. Data generation of the distinguisher NDrm is easier than that of distinguisher NDam.In training and testing of the distinguisher model, the sample data required for the distinguisher of lower rounds can be reduced. TakingNDam (r = 6, t = 3) as an example, the samples of the training set only need 28. Using the settings in this study, the accuracy about 0.99 can be achieved in 25 s. For the NDam (r = 7, t = 3), the samples of the training set need 216, which takes about 1 minute to achieve the accuracy about 0.98.Using the same training parameters as CNN, this study also constructed the corresponding distinguisher using MLP. The MLP network consists four hidden layers, whose neurons for each hidden layer are set as2n,2n,n,n. Each hidden layer abstracts the features of the input ciphertext pair to another dimension space to extract more abstract features. L2 kernel regularizer and nonlinear activation function ReLU are used in each layer. Since the number of layers of MLP network is not very deep, the batch normalization module is not used. The training of MLP adopts the circular learning rate scheme in reference [13], which is different from the decreasing learning rate scheme adopted in CNN. Table 2 lists the results of the distinguisher based on MLP. It can be seen from the results that the accuracy of MLP is equal to or less thanthat of CNN in each round. But it is up to only 10 rounds at most. In the case of rounds 8 and 9, the accuracy of NDam is significantly higher than that of NDrm. This also shows that the associated difference has certain advantages.Table 2
Accuracy of SIMECK’s distinguisher training by MLP.
r (round)NDamNDrm60.99990.967070.94410.939180.87850.784690.61240.5011100.5017-Table3 lists the number of learning parameters, training time, and accuracy of 6–10 rounds of distinguisher NDam (t = 3) when using MLP and CNN. Due to the simple structure of MLP, the training time and the number of parameters will be greatly reduced. It can be seen that CNN can better converge to a local minimum and is easier to be optimized, and the accuracy of CNN is slightly higher than that of MLP.Table 3
SIMECK32/64 distinguisher of 6–10 rounds MLP compared to CNN.
r (round)Number of parametersTime of trainingAccuracyMLPCNNMLP (s)CNN (s)MLPCNN61558544001336257230.99990.999971558544001348157270.94320.999881558544001340157200.88010.964891558544001340857430.61280.7248101558544001336157610.50160.5501Figures4 and 5 show the prediction distribution of distinguisher NDam and NDrm (r = 8, t = 3) based on CNN with 512 random positive samples, respectively. It can be seen that our 8-round CNN distinguishers have high reliability in the distribution of predicted values. It is basically consistent with the accuracy of training. Ciphertexts with high probability difference can be easily found.Figure 4
Prediction distribution of 8-round distinguisherNDam.Figure 5
Prediction distribution of 8-round distinguisherNDrm.


## 5.2. Comparisons of Distinguishers

In our experiment, the distinguishers (t = 2, 3, and 4) were given. The sample sizes of training and testing are 224 and 218, respectively. The specific input differences used are listed in Table 4.Table 4
Quantity of differences and selected differences.
tSelected differences2Δ0=0x0/0x1,Δ1=0x0/0x23Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x44Δ0=0x0/0x1,Δ1=0x0/0x2,Δ2=0x0/0x4,Δ3=0x0/0x8Table5 lists the accuracy of t-differences neural distinguisher Drm, Dam of SIMECK’s 6–11 rounds. In the case of the same round, the same input difference, and the same size of training sets and testing sets, the accuracy of Dam is slightly higher than that of Drm regardless of the quantity of plaintext differences. It is indicated that Dam has stronger feature selection ability and generalization ability. It also shows that when t increases, the accuracies of Drm and Dam increase. But it does not always increase with the increment of t. Table 5 also lists that the accuracies of Drm and Dam are all the highest when t = 3. It can be inferred from algorithm 4 and algorithm 5 that in the case of the same size of training sets and testing sets, the more the number of input differences is, the more complex the data become. The distinguishers are difficult to extract the features among ciphertexts, which will not increase the accuracy of the distinguishers.Table 5
Comparison oft-differences distinguishers’ accuracy.
r (round)t = 2t = 3t = 4NDrmNDamNDrmNDamNDrmNDam60.99990.99990.99990.99990.99990.999970.99800.99830.99800.99980.99900.999280.92450.94490.93820.96450.93360.942290.68750.69170.70600.71510.68490.7051100.52050.53880.53190.55050.53250.5415110.50240.50150.50390.50290.50190.5022The input difference selected byDrm and Dam is the same as that used in the previous experiment when t = 3. The input difference used in NDM and NDS is Δ0=0x0/0x1. The size of samples is the same as above. Table 6 lists the accuracy of distinguishers of SIMECK32/64’s 6–11 rounds.Table 6
Comparison of distinguishers’ accuracy of SIMECK32/64.
r (round)DamDrmNDS ([13])NDM ([30])60.99990.99990.99990.995270.99900.99800.98460.971880.96450.93820.93890.850590.71510.70600.70230.5898100.55050.53190.50180.5403110.50420.5038—0.5014Dam and Drm can reach higher rounds than NDS obviously. They can be applied to the SIMECK 32/64 algorithm with higher rounds; that is, the number of the round is expanded to round 11. And the accuracy is equivalent to the accuracy of round 10 in NDS. The Dam and Drm have achieved higher accuracy than NDM under the same number of rounds and still maintain a high accuracy in round 9 without a precipitous decline. It fully proves that our Dam and Drm have learned some additional features from multiple ciphertext pairs. At the same time, it also proves that when multiple differences are introduced, the accuracy of the distinguisher can be appropriately improved under the same round or a higher round of the distinguisher can be obtained. It also proves that it is feasible to train distinguishers by using multiple differences.In reference [18], the authors presented the optimized differential trails. The deep learning multiple differential distinguishers proposed in this study have better performance compared with reference [18]. Table 7 lists the detailed comparison of the complexity.Table 7
Complexity of SIMECK32/64.
r (round)Data complexityTime complexityMemory complexityDam (our)[18]Dam (our)[18]Dam (our)[18]62821325.42210.4228213721121528.19212.1921121582132192102162132199214221210.83217.8321422110216225212.68221.6821622511224227220.54223.54224227To further verify our neural distinguisher as a cryptographic tool, 512 random samples are used to test the ability of filtering error ciphertext of the multiple differential distinguishers. Using 3 input differences and 7–9 rounds of encryption,NDam is tested. Among 512 chosen-plaintext sets, half are positive samples and half are negative samples. Table 8 lists the probabilities of true positive (TP), true negative (TN), false positive (FP), and false negative (FN) of our Dam. It can be seen that the accuracy of filtering error ciphertext (i.e., FN) of our neural distinguisher is 99.61%, 96.10%, and 77.34%, respectively, and our distinguisher has high reliability.Table 8
Accuracy statistical results ofNDam.
r (round)TP (%)FP (%)TN (%)FN (%)7100.000.390.0099.61899.613.910.3996.10981.2522.6618.7577.34


## 6. Conclusions

In this study, we proposed a new deep learning distinguisher based on multiple differences for SIMECK32/64’s 6–11 rounds. Two kinds of ciphertext pairs by using multiple differences are designed as the input of neural network. The distinguishers with good performance are verified. We also show some distinguishers and the accuracy of our distinguishers under different conditions. And the differential distinguishers based on deep learning consume less time and data than traditional distinguisher. The accuracy of filtering error ciphertext of our neural distinguisher is high. It is further proved that the deep learning method provides feasible means to simulate the case of the multiple input differences and multiple output differences. We are also trying to study deep learning distinguisher for other ciphers with different structure and block size. In the future, we will also adopt data preprocessing and other methods to study the deep learning distinguisher.



---

*Source: 7564678-2022-09-14.xml*