Simon

Description of the cipher

The Simon block cipher is a balanced Feistel cipher with an n-bit word, and therefore the block length is 2n. The key length is a multiple of n by 2, 3, or 4, which is the value m. Therefore, a Simon cipher implementation is denoted as Simon2n/nm. For example, Simon64/128 refers to the cipher operating on a 64-bit plaintext block (n = 32) that uses a 128-bit key. The block component of the cipher is uniform between the Simon implementations; however, the key generation logic is dependent on the implementation of 2, 3 or 4 keys.

Simon supports the following combinations of block sizes, key sizes and number of rounds:

Description of the key schedule

Let

S

j

{\displaystyle S^{j}}

notate a left circular shift by

j

{\displaystyle j}

bits.

The key schedule is mathematically described as

k

i

+

m

=

{

c

⊕

(

z

j

)

i

⊕

k

i

⊕

(

I

⊕

S

−

1

)

(

S

−

Cryptanalysis

The designers claim that Simon, though a "lightweight" cipher, is designed to have the full security possible for each block and key size, against standard chosen-plaintext (CPA) and chosen-ciphertext (CCA) attacks. Resistance against related-key attacks was also stated as a goal, though a less crucial one as attacks in that model are not relevant for typical use cases. No effort was made to resist attacks in the known-key distinguishing attack model, nor did the designers evaluate Simon for use as a hash function.

As of 2018, no successful attack on full-round Simon of any variant is known. Due to interest in Simon and Speck, about 70 cryptanalysis papers have been published on them. As is typical for iterated ciphers, reduced-round variants have been successfully attacked. The best published attacks on Simon in the standard attack model (CPA/CCA with unknown key) are differential cryptanalysis attacks; these make it through about 70–75% of the rounds of most variants, though these best attacks are only marginally faster than brute-force.

The design team states that while designing Simon, they found differential attacks to be the limiting attacks, i.e. the type of attack that makes it through the most rounds; they then set the number of rounds to leave a security margin similar to AES-128's at approximately 30%.

Simon has been criticized for having too small a security margin, i.e. too few rounds between the best attacks and the full cipher, in comparison to more conservative ciphers such as ChaCha20.

Ciphers with small security margins are more likely to be broken by future advances in cryptanalysis. Simon's design team counters that there is a real-world cost to unnecessarily large security margins, especially on lightweight devices, that cryptanalysis during the design phase allowed the number of rounds to be set appropriately, and that they targeted AES's security margin.

Simon includes a round counter in the key schedule. The designers state this was included to block slide and rotational cryptanalysis attacks. Still, rotational-XOR cryptanalysis has been used to find distinguishers against reduced-round versions of related ciphers like Speck. Though the authors don't describe standard key-recovery attacks based on their distinguishers, their best distinguishers on Simon32 and Simon48 in the known-key distinguishing attack model for certain weak key classes make it through slightly more rounds than the best differential distinguishers. One of the authors has said that his research was resource-constrained and that rotational-XOR distinguishers on more rounds are probably possible. The designers also state that Simon was not designed to resist known-key distinguishing attacks (which do not directly compromise the confidentiality of ciphers).

Standardization efforts and controversies

Initial attempts to standardise Simon and Speck through the International Organization for Standardization (ISO) failed to meet the required super-majority vote, and the ciphers were not adopted. Expert delegates to the ISO from several countries including Germany, Japan and Israel opposed the NSA's efforts to standardise the ciphers, citing concerns that the NSA is pushing for their standardisation with knowledge of exploitable weaknesses in the ciphers. The position was based on partial evidence of weaknesses in the ciphers, lack of clear need for standardisation of the new ciphers, and the NSA's previous involvement in the creation and promotion of the backdoored Dual_EC_DRBG cryptographic algorithm.

In response to concerns, the NSA stated that more than 70 security analysis papers from some of the world's leading cryptographers support NSA's conclusion that the algorithms are secure and NSA affirmed that it is not aware of any cryptanalytic techniques that would allow them or anyone else to exploit Simon or Speck.

After initial attempts to standardise the ciphers failed, the ISO standardised Simon and Speck in other working groups. As of October 2018, the Simon and Speck ciphers have been standardized by ISO as a part of the RFID air interface standard, ISO standard 29167-21 (for Simon) and ISO standard 29167-22 (for Speck), making them available for use by commercial entities.