# Partly-Pseudo-Linear Cryptanalysis of Reduced-Round Speck

^{*}

## Abstract

**:**

## 1. Introduction

## 2. Preliminaries

#### 2.1. Notation

- ${\u229e}_{n}$: Addition modulo ${2}^{n}$
- ${\boxminus}_{n}$: Subtraction modulo ${2}^{n}$
- ⊕: The bitwise exclusive-or
- ${\u22d9}_{r}$: r-bit right rotation on an n-bit word
- ${\u22d8}_{r}$: r-bit left rotation on an n-bit word
- $PL\left(CL\right)$: Left word of the Plaintext (Ciphertext)
- $PR\left(CR\right)$: Right word of the Plaintext (Ciphertext)
- $x{l}^{j}\left(x{r}^{j}\right)$: Left (right) word at round j
- $x{l}_{t}^{j}\left(x{r}_{t}^{j}\right)$: $t\mathrm{th}$ window of state $xl$ ($xr$) at round j
- $x{l}_{t}^{j}(i,i+w)$ ($x{r}_{t}^{j}(i,i+w)$): window t with size w of the left (right) word x, where the msb is at i and the lsb is at $i+w-1$, for $0\le i<\frac{n}{2}$ and $1\le w\le \frac{n}{2}$.
- $x{l}_{t}^{j}\left(i\right)$ ($x{r}_{t}^{j}\left(i\right)$): Bit at index i of the window where $0\le i<w$ the left (right) word x.

#### 2.2. The Speck Cipher

- Addition modulo ${2}^{n}$, denoted ${\u229e}_{n}$
- Rotation: right rotation by $\alpha $, denoted $\u22d9\alpha $ and left rotation by $\beta $, denoted $\u22d8\beta $
- bitwise XOR, denoted ⊕

## 3. Related Works

#### 3.1. Linear Cryptanalysis

#### Linear Cryptanalysis of Modular Addition

**Lemma**

**1.**

- Bitwise rotation breaks the two consecutive bits. After the rotation, one of these two bits will be in the most significant bit position (msb) and the other will be in the least significant bit position (lsb).Example: $00011000\u22d94=10000001$
- Bitwise exclusive-or breaks the two consecutive bits. These two bits will be not consecutive any more.Example: $00011000\oplus 00110000=00101000$

#### 3.2. Pseudo-Linear Cryptanalysis

- Suppose $x=001001000100$ and $y=100010101010$. In this case the approximation is correct because the carry into the window is correctly assumed to be zero (See Figure 3).
- Suppose $x=00100100110$ and $y=100010101010$. In this case the approximation is incorrect because the carry into the window is incorrectly assumed to be zero (See Figure 4).

#### 3.2.1. Some Observations Regarding the Addition Window

- ⊕ Bitwise exclusive-or
- ⊞ Addition modulo ${2}^{n}$
- ${\u229e}_{w}$ Addition modulo ${2}^{w}$
- ⊟ Subtraction modulo ${2}^{n}$
- ${\boxminus}_{w}$ Subtraction modulo ${2}^{w}$

**Lemma**

**2.**

**Lemma**

**3.**

**Lemma**

**4.**

**Corollary**

**1.**

**Corollary**

**2.**

#### 3.2.2. Pseudo-Linear Approximations of ARX Round Functions

- Base ApproximationThe base approximation is a simple approximation that follows the windows until the target window. All exclusive-or operations and addition modulo ${2}^{n}$ operations are preserved, assuming that the carry into all windows is 0 [3].
- Carry PatternsA carry pattern is a series of carry values, ${c}_{i}$∈$\{0,1\}$ where i denotes to the approximated addition window that may have a carry into it.Multiple carry patterns, indexed by j, ${C}^{j}$ = $({c}_{0},\dots ,{c}_{i},\dots ,{c}_{m-1})$ can be constructed for each base approximation; here j denotes a specific carry pattern for the approximation, i the approximated window, and m the total number of windows approximated. If ${c}_{i}$ = 1, then the carry going into the $ith$ approximated addition window is 1. Thus, the base approximation is overlaid by the m carry patterns, ${C}^{j}+base$ to result in m estimates of the target window. [5].
- Computing BiasIf $cp$ carry patterns are used, the bias may be experimentally computed to be the difference between the probability of the approximation being correct and the probability of correctly guessing a carry pattern at random, with $cp$ tries. The carry patterns will be correct with probability $\frac{cp}{{2}^{w}}$ instead of $\frac{1}{{2}^{w}}$ since each pattern represents a different approximation. According to McKay [3] the bias is computed using Equation (10)$$bias=\frac{times\phantom{\rule{0.277778em}{0ex}}correct\phantom{\rule{0.277778em}{0ex}}-\frac{\#patterns}{{2}^{w}}\phantom{\rule{0.277778em}{0ex}}\times pairs}{pairs}.$$

#### 3.3. Comparison between Pseudo-Linear Cryptanalysis and Linear Cryptanalysis

#### 3.4. Cryptanalysis of Speck

#### 3.4.1. Different Methods of Cryptanalysis on Speck

#### 3.4.2. Linear Cryptanalysis of Speck

## 4. Pseudo-Linear Cryptanalysis Attacks on Reduced-Round Speck 32/64

#### 4.1. Four-Round Attack

- $Pr[{e}_{1}{e}_{0}=00]$ = $Pr[carr{y}_{s}=0]$ = $\frac{1}{2}+{2}^{-\left(3\right)}$ = $0.625$
- $Pr[{e}_{1}{e}_{0}=01]$ = $Pr[carr{y}_{s}=1]Pr[carry+s+1=0\mid carr{y}_{s}=1]$ = $\frac{1}{2}(1-Pr[carr{y}_{s}=0])$ = $\frac{1}{2}(1-{2}^{-\left(3\right)})$ = $0.1875$
- $Pr[{e}_{1}{e}_{0}=10]$ = 0
- $Pr[{e}_{1}{e}_{0}=11]$ = $\frac{1}{2}(1-{2}^{-\left(3\right)})$ = $0.1875$

- $Pr[{e}_{1}{e}_{0}=00]$ = $Pr[carr{y}_{s}=0]$ = $\frac{1}{2}+{2}^{-\left(5\right)}$ = $0.53125$
- $Pr[{e}_{1}{e}_{0}=01]$ = $Pr[carr{y}_{s}=1]Pr[carry+s+1=0\mid carr{y}_{s}=1]$ = $\frac{1}{2}(1-Pr[carr{y}_{s}=0])$ = $\frac{1}{2}(1-{2}^{-\left(5\right)})$ = $0.2343$
- $Pr[{e}_{1}{e}_{0}=10]$ = 0
- $Pr[{e}_{1}{e}_{0}=11]$ = $\frac{1}{2}(1-{2}^{-\left(5\right)})$ = $0.2343$

- $x{r}_{1}^{3}(9,10)\approx x{l}_{2}^{4}(11,12)\oplus x{r}_{3}^{4}(11,12)$; the error probabilities are those of $x{l}_{2}^{4}$, as $x{r}_{3}^{4}$ is approximated with zero error.

- is obtained by adding $x{r}_{1}^{3}(9,10)$ and $x{l}_{1}^{4}(9,10)$. This is the target window and we are trying to compute the entire window correctly, so we compute $Pr[{e}_{1}{e}_{0}=00]$. If the incoming carry is $carr{y}_{s}=0$, we have 16 possibilities for two bit errors in each summand window, 6 of these, with an incoming carry of zero (the possibilities are: both summands have error 00 or 10; with probability half, when both have error patterns 01 or 11; with probability half when the summands are 01 and 11 (two possibilities).), and 8 with an incoming carry of one (with probability half, each of the following pairs of summand errors will result in an error of 00 in the approximated window when the true value of the incoming carry is one; each pair occurs twice: 00 and 01, 00 and 11, 01 and 10, 10 and 11) ,give ${e}_{1}{e}_{0}=00$. The total probability is obtained using the probabilities of errors in windows $x{l}_{1}^{4}(9,10)$ and $x{l}_{2}^{4}(11,12)$ computed above to obtain:
- $Pr[{e}_{1}{e}_{0}=00]$ = $0.4198\left(Pr[carr{y}_{s}=0]\right)+0.1992\left(Pr[carr{y}_{s}=1]\right)$ = $0.3097$.

#### 4.2. Six-Round Attack

## 5. Partly-Pseudo-Linear Cryptanalysis with Illustration on Speck

- The first part is the bias of xor of the bits of the window when the window is computed using the pseudo-linear approximation.
- The second part is the bias for the linear approximation, computed using traditional linear approaches. The combination of these two biases using the piling up lemma allows us to determine the number of plaintext and ciphertext pairs that we should use in our experiments.

#### 5.1. Implementation of the Partly-Pseudo-Linear Attack on Speck 32/64

#### 5.1.1. Six-Round Partly-Pseudo-Linear Attack

- (a)
- Both bits are zero (and the intermediate carry is zero, its value does not depend on the value of the incoming carry).
- (b)
- Both bits are one (the intermediate carry is one, independent of the incoming carry).

- Bias: The bias for this approximation is a combination of the experimentally-verified bias of the pseudo-linear approximation of the exclusive-or of the two-bit window (${2}^{-1.415}$)and the bias of the linear approximation (${2}^{-10}$) using the piling-up lemma: $2\times {2}^{-1.415}\times {2}^{-10}$ = ${2}^{-10.415}$
- Data complexity: We use the square of the inverse of the bias of the linear approximation: ${2}^{20.83}$
- Time complexity: Data complexity multiplied by the complexity of trying all possibilities for the number of key bits in the pseudo-linear approximation: ${2}^{20.83}\times {2}^{6}={2}^{26.83}$

#### 5.1.2. Nine-Round Partly-Pseudo-Linear Attack

#### 5.2. The Partly-Pseudo-Linear Attack on the Large Variants of Speck

## 6. Conclusions

## Author Contributions

## Funding

## Data Availability Statement

## Acknowledgments

## Conflicts of Interest

## Appendix A. Four-Rounds Attack of Pseudo-Linear Cryptanalysis

- Window size $w=3$. The following Table A1 shows the approximation for four rounds meeting at $x{l}_{1}^{2}(0,2)$.

**Table A1.**The pseudo-linear attack approximation for 4 rounds meeting at $x{l}_{1}^{2}(0,2)$, $w=3$.

Round | Encryption | Decryption |
---|---|---|

1 | $NewPL=(PL\u22d97){\u229e}_{16}PR$ | |

$x{l}_{1}^{1}=NewPL(0,2)\oplus {k}_{1}^{1}(0,2)$ | ||

$x{l}_{2}^{1}=NewPL(7,9)\oplus {k}_{2}^{1}(7,9)$ | ||

$x{r}_{1}^{1}=(PR(14,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})\u22d82)\oplus x{l}_{1}^{1}$ | ||

2 | $x{l}_{1}^{2}=\left((x{l}_{2}^{1}\u22d97){\u229e}_{3}x{r}_{1}^{1}\right)\oplus {k}_{1}^{2}(0,2)$ | |

$x{l}_{1}^{2}$ ≡ $x{l}_{1}^{3}$ | ||

3 | $x{l}_{1}^{3}\approx \left((x{l}_{1}^{4}\oplus {k}_{1}^{3}(9,11)){\boxminus}_{3}x{r}_{1}^{3}\right))\u22d87$ | |

$x{r}_{1}^{3}\approx \left((x{l}_{2}^{4}\oplus x{r}_{3}^{4})\right)\u22d92$ | ||

4 | $x{l}_{2}^{4}\approx \left((CL(4,6)\oplus {k}_{1}^{4}(4,6)){\boxminus}_{3}x{r}_{2}^{4}\right)\u22d87$ | |

$x{l}_{1}^{4}\approx \left((CL(2,4)\oplus {k}_{1}^{4}(2,4)){\boxminus}_{3}x{r}_{1}^{4}\right)\u22d87$ | ||

$x{r}_{1}^{4}=(CR(4,6)\oplus CL(4,6))\u22d92$ | ||

$x{r}_{2}^{4}=(CR(6,8)\oplus CL(6,8))\u22d92$ | ||

$x{r}_{3}^{4}=(CR(13,15)\oplus CL(13,15))\u22d92$ |

- 2.
- Window size $w=4$. The following Table A2 shows the approximation for four rounds meeting $x{l}_{1}^{2}(0,3)$.

Round | Encryption | Decryption |
---|---|---|

1 | $NewPL=(PL\u22d97){\u229e}_{16}PR$ | |

$x{l}_{1}^{1}=NewPL(0,3)\oplus {k}_{1}^{1}(0,3)$ | ||

$x{l}_{2}^{1}=NewPL(7,10)\oplus {k}_{2}^{1}(7,10)$ | ||

$x{r}_{1}^{1}=\left(PR(14,17\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})\right)\u22d82)\oplus x{l}_{1}^{1}$ | ||

2 | $x{l}_{1}^{2}=\left((x{l}_{2}^{1}\u22d97){\u229e}_{2}x{r}_{1}^{1}\right)\oplus {k}_{1}^{2}(0,3)$ | |

$x{l}_{1}^{2}$ ≡ $x{l}_{1}^{3}$ | ||

3 | $x{l}_{1}^{3}\approx \left((x{l}_{1}^{4}\oplus {k}_{1}^{3}(9,12)){\boxminus}_{2}x{r}_{1}^{3}\right))\u22d87$ | |

$x{r}_{1}^{3}\approx \left((x{l}_{2}^{4}\oplus x{r}_{3}^{4})\right)\u22d92$ | ||

4 | $x{l}_{2}^{4}\approx \left((CL(4,7)\oplus {k}_{2}^{4}(4,7)){\boxminus}_{2}x{r}_{2}^{4}\right)\u22d87$ | |

$x{l}_{1}^{4}\approx \left((CL(2,5)\oplus {k}_{1}^{4}(2,5)){\boxminus}_{2}x{r}_{1}^{4}\right)\u22d87$ | ||

$x{r}_{1}^{4}=\left(NewCR(4,7)\right)\u22d92$ | ||

$x{r}_{2}^{4}=\left(NewCR(6,9)\right)\u22d92$ | ||

$x{r}_{3}^{4}=\left(NewCR(13,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})\right)\u22d92$ | ||

$NewCR=CL\oplus CR$ |

## Appendix B. The Partly-Pseudo-Linear Attack on Speck 48

**Table A3.**Linear trail of Speck 48 for six rounds. (Starting with $\mathtt{0}\mathtt{x}\mathtt{000003000000}$ backward).

Round | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | Cost |
---|---|---|---|---|---|

1 | $\mathtt{0}\mathtt{xe}\mathtt{3036}\mathtt{d}$ | $\mathtt{0}\mathtt{xe}\mathtt{03}\mathtt{f}\mathtt{62}$ | $\mathtt{0}\mathtt{x}\mathtt{3}\mathtt{c}\mathtt{0}\mathtt{f}\mathtt{03}$ | $\mathtt{0}\mathtt{x}\mathtt{5}\mathtt{f}\mathtt{3}\mathtt{be}\mathtt{3}$ | 5 |

2 | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{f}\mathtt{0063}$ | $\mathtt{0}\mathtt{x}\mathtt{03000}\mathtt{f}$ | $\mathtt{0}\mathtt{xe}\mathtt{3036}\mathtt{d}$ | $\mathtt{0}\mathtt{xe}\mathtt{03}\mathtt{f}\mathtt{62}$ | 6 |

3 | $\mathtt{0}\mathtt{x}\mathtt{000363}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{f}\mathtt{0063}$ | $\mathtt{0}\mathtt{x}\mathtt{03000}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{ee}\mathtt{30}\mathtt{c}$ | 3 |

4 | $\mathtt{0}\mathtt{x}\mathtt{030300}$ | $\mathtt{0}\mathtt{x}\mathtt{600303}$ | $\mathtt{0}\mathtt{x}\mathtt{000363}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{f}\mathtt{0063}$ | 3 |

5 | $\mathtt{0}\mathtt{x}\mathtt{000300}$ | $\mathtt{0}\mathtt{x}\mathtt{000003}$ | $\mathtt{0}\mathtt{x}\mathtt{030300}$ | $\mathtt{0}\mathtt{x}\mathtt{600303}$ | 2 |

6 | $\mathtt{0}\mathtt{x}\mathtt{000003}$ | $\mathtt{0}\mathtt{x}\mathtt{000000}$ | $\mathtt{0}\mathtt{x}\mathtt{000300}$ | $\mathtt{0}\mathtt{x}\mathtt{000003}$ | 1 |

## Appendix C. The Partly-Pseudo-Linear Attack on Speck 64

**Table A4.**Linear trail of Speck 64 for 9 rounds. (Starting with $\mathtt{0}\mathtt{x}\mathtt{0000000300000000}$ backward).

Round | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | Cost |
---|---|---|---|---|---|

1 | $\mathtt{0}\mathtt{x}\mathtt{30}\mathtt{c}\mathtt{03030}$ | $\mathtt{0}\mathtt{x}\mathtt{30}\mathtt{f}\mathtt{6}\mathtt{e}\mathtt{836}$ | $\mathtt{0}\mathtt{x}\mathtt{36}\mathtt{d}\mathtt{80600}$ | $\mathtt{0}\mathtt{xc}\mathtt{6280500}$ | 5 |

2 | $\mathtt{0}\mathtt{x}\mathtt{36018000}$ | $\mathtt{0}\mathtt{x}\mathtt{06314030}$ | $\mathtt{0}\mathtt{x}\mathtt{30}\mathtt{c}\mathtt{03030}$ | $\mathtt{0}\mathtt{x}\mathtt{30}\mathtt{f}\mathtt{6}\mathtt{e}\mathtt{836}$ | 4 |

3 | $\mathtt{0}\mathtt{x}\mathtt{300}\mathtt{c}\mathtt{0}\mathtt{c}\mathtt{00}$ | $\mathtt{0}\mathtt{x}\mathtt{303}\mathtt{a}\mathtt{0}\mathtt{d}\mathtt{80}$ | $\mathtt{0}\mathtt{x}\mathtt{36018000}$ | $\mathtt{0}\mathtt{x}\mathtt{06314030}$ | 3 |

4 | $\mathtt{0}\mathtt{x}\mathtt{8060006}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{80500}\mathtt{c}\mathtt{61}$ | $\mathtt{0}\mathtt{x}\mathtt{300}\mathtt{c}\mathtt{0}\mathtt{c}\mathtt{00}$ | $\mathtt{0}\mathtt{x}\mathtt{303}\mathtt{a}\mathtt{0}\mathtt{d}\mathtt{80}$ | 3 |

5 | $\mathtt{0}\mathtt{x}\mathtt{0303030}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{e}\mathtt{83630}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{8060006}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{80500}\mathtt{c}\mathtt{61}$ | 4 |

6 | $\mathtt{0}\mathtt{x}\mathtt{03000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{030063}$ | $\mathtt{0}\mathtt{x}\mathtt{0303030}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{e}\mathtt{83630}\mathtt{f}$ | 5 |

7 | $\mathtt{0}\mathtt{x}\mathtt{00030300}$ | $\mathtt{0}\mathtt{x}\mathtt{60000303}$ | $\mathtt{0}\mathtt{x}\mathtt{03000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{030063}$ | 3 |

8 | $\mathtt{0}\mathtt{x}\mathtt{00000300}$ | $\mathtt{0}\mathtt{x}\mathtt{00000003}$ | $\mathtt{0}\mathtt{x}\mathtt{00030300}$ | $\mathtt{0}\mathtt{x}\mathtt{60000303}$ | 2 |

9 | $\mathtt{0}\mathtt{x}\mathtt{00000003}$ | $\mathtt{0}\mathtt{x}\mathtt{00000000}$ | $\mathtt{0}\mathtt{x}\mathtt{00000300}$ | $\mathtt{0}\mathtt{x}\mathtt{00000003}$ | 1 |

## Appendix D. The Partly-Pseudo-Linear Attack on Speck 96

**Table A5.**Linear trail of Speck 96 for six rounds. (Starting with $\mathtt{0}\mathtt{x}\mathtt{000000000003000000000000}$ backward).

Round | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | Cost |
---|---|---|---|---|---|

1 | $\mathtt{0}\mathtt{x}\mathtt{83000060036}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{803300600}\mathtt{c}\mathtt{62}$ | $\mathtt{0}\mathtt{x}\mathtt{3300000}\mathtt{f}\mathtt{0}\mathtt{f}\mathtt{03}$ | $\mathtt{0}\mathtt{x}\mathtt{5335600}\mathtt{c}\mathtt{0}\mathtt{e}\mathtt{83}$ | 7 |

2 | $\mathtt{0}\mathtt{x}\mathtt{00030303030}\mathtt{c}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{d}\mathtt{800303630}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{83000060036}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{803300600}\mathtt{c}\mathtt{62}$ | 6 |

3 | $\mathtt{0}\mathtt{x}\mathtt{000003000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{0000030063}$ | $\mathtt{0}\mathtt{x}\mathtt{00030303030}\mathtt{c}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{d}\mathtt{800303630}\mathtt{f}$ | 5 |

4 | $\mathtt{0}\mathtt{x}\mathtt{000000030300}$ | $\mathtt{0}\mathtt{x}\mathtt{600000000303}$ | $\mathtt{0}\mathtt{x}\mathtt{000003000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{0000030063}$ | 3 |

5 | $\mathtt{0}\mathtt{x}\mathtt{000000000300}$ | $\mathtt{0}\mathtt{x}\mathtt{000000000003}$ | $\mathtt{0}\mathtt{x}\mathtt{000000030300}$ | $\mathtt{0}\mathtt{x}\mathtt{600000000303}$ | 2 |

6 | $\mathtt{0}\mathtt{x}\mathtt{000000000003}$ | $\mathtt{0}\mathtt{x}\mathtt{000000000000}$ | $\mathtt{0}\mathtt{x}\mathtt{000000000300}$ | $\mathtt{0}\mathtt{x}\mathtt{000000000003}$ | 1 |

## Appendix E. The Partly-Pseudo-Linear Attack on Speck 128

**Table A6.**Linear trail of Speck 128 for six rounds. (Starting with $\mathtt{0}\mathtt{x}\mathtt{000000000000000}$$\mathtt{30000000000000000}$ backward).

R | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | Cost |
---|---|---|---|---|---|

1 | $\mathtt{0}\mathtt{x}\mathtt{800003000060036}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{8030000300600}\mathtt{c}\mathtt{62}$ | $\mathtt{0}\mathtt{x}\mathtt{30030300000}\mathtt{f}\mathtt{0}\mathtt{f}\mathtt{00}$ | $\mathtt{0}\mathtt{x}\mathtt{50360303600}\mathtt{c}\mathtt{0}\mathtt{e}\mathtt{83}$ | 7 |

2 | $\mathtt{0}\mathtt{x}\mathtt{000000030303030}\mathtt{c}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{d}\mathtt{8000000303630}\mathtt{f}$ | $\mathtt{0}\mathtt{x}\mathtt{800003000060036}\mathtt{d}$ | $\mathtt{0}\mathtt{x}\mathtt{8030000300600}\mathtt{c}\mathtt{62}$ | 6 |

3 | $\mathtt{0}\mathtt{x}\mathtt{0000000003000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{00000000030063}$ | $\mathtt{0}\mathtt{x}\mathtt{000000030303030}\mathtt{c}$ | $\mathtt{0}\mathtt{x}\mathtt{6}\mathtt{d}\mathtt{8000000303630}\mathtt{f}$ | 5 |

4 | $\mathtt{0}\mathtt{x}\mathtt{0000000000030300}$ | $\mathtt{0}\mathtt{x}\mathtt{6000000000000303}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000003000360}$ | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{00000000030063}$ | 3 |

5 | $\mathtt{0}\mathtt{x}\mathtt{0000000000000300}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000000000003}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000000030300}$ | $\mathtt{0}\mathtt{x}\mathtt{6000000000000303}$ | 2 |

6 | $\mathtt{0}\mathtt{x}\mathtt{0000000000000003}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000000000000}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000000000300}$ | $\mathtt{0}\mathtt{x}\mathtt{0000000000000003}$ | 1 |

## References

- Beaulieu, R.; Shors, D.; Smith, J.; Treatman-Clark, S.; Weeks, B.; Wingers, L. The SIMON and SPECK Families of Lightweight Block Ciphers. IACR Cryptol. EPrint Arch.
**2013**, 2013, 404. [Google Scholar] - Beaulieu, R.; Shors, D.; Smith, J.; Treatman-Clark, S.; Weeks, B.; Wingers, L. The SIMON and SPECK lightweight block ciphers. In Proceedings of the 52nd Annual Design Automation Conference, San Francisco, CA, USA, 7–11 June 2015; pp. 175:1–175:6. [Google Scholar] [CrossRef]
- McKay, K.A.; Vora, P.L. Analysis of ARX Functions: Pseudo-linear Methods for Approximation, Differentials, and Evaluating Diffusion. IACR Cryptol. EPrint Arch.
**2014**, 2014, 895. [Google Scholar] - McKay, K.A. Analysis of ARX Round Functions in Secure Hash Functions. Ph.D. Thesis, The George Washington University, Washington, DC, USA, 2014. [Google Scholar]
- McKay, K.A.; Vora, P.L. Pseudo-Linear Approximations for ARX Ciphers: With Application to Threefish. In Proceedings of the Second SHA-3 Candidate Conference, Santa Barbara, CA, USA, 23–24 August 2010; p. 282. [Google Scholar]
- Cho, J.Y.; Pieprzyk, J. Multiple Modular Additions and Crossword Puzzle Attack on NLSv2. In Proceedings of the 10th International Conference on Information Security (ISC 2007), Valparaiso, Chile, 9–12 October 2007; Lecture Notes in Computer Science. Garay, J.A., Lenstra, A.K., Mambo, M., Peralta, R., Eds.; Springer: Berlin/Heidelberg, Germany, 2007; Volume 4779, pp. 230–248. [Google Scholar] [CrossRef]
- Cho, J.Y.; Pieprzyk, J. Algebraic Attacks on SOBER-t32 and SOBER-t16 without Stuttering. In Fast Software Encryption, Proceedings of the 11th International Workshop, (FSE 2004), Delhi, India, 5–7 February 2004; Revised Papers; Lecture Notes in Computer Science; Roy, B.K., Meier, W., Eds.; Springer: Berlin/Heidelberg, Germany, 2004; Volume 3017, pp. 49–64. [Google Scholar] [CrossRef] [Green Version]
- Alzakari, S.; Vora, P. Linear and Partly-Pseudo-Linear Cryptanalysis of Reduced-Round SPARX Cipher. IACR Cryptol. EPrint Arch.
**2020**, 2020, 978. [Google Scholar] - Bodden, D. Linear Cryptanalysis of Reduced-Round Speck with a Heuristic Approach: Automatic Search for Linear Trails. In Proceedings of the Information Security–21st International Conference (ISC 2018), Guildford, UK, 9–12 September 2018; Lecture Notes in Computer Science. Chen, L., Manulis, M., Schneider, S., Eds.; Springer: Berlin/Heidelberg, Germany, 2018; Volume 11060, pp. 132–150. [Google Scholar] [CrossRef]
- Ashur, T.; Bodden, D. Linear Cryptanalysis of Reduced-Round Speck. In Proceedings of the 37th Symposium on Information Theory in the Benelux 2016, Louvain-la-Neuve, Belgium, 19–20 May 2016. [Google Scholar]
- Yao, Y.; Zhang, B.; Wu, W. Automatic Search for Linear Trails of the SPECK Family. In Proceedings of the Information Security—18th International Conference (ISC 2015), Trondheim, Norway, 9–11 September 2015; Lecture Notes in Computer Science. Lopez, J., Mitchell, C.J., Eds.; Springer: Berlin/Heidelberg, Germany, 2015; Volume 9290, pp. 158–176. [Google Scholar] [CrossRef]
- Fu, K.; Wang, M.; Guo, Y.; Sun, S.; Hu, L. MILP-Based Automatic Search Algorithms for Differential and Linear Trails for Speck. In Proceedings of the Fast Software Encryption—23rd International Conference (FSE 2016), Bochum, Germany, 20–23 March 2016; Revised Selected Papers; Lecture Notes in Computer Science. Peyrin, T., Ed.; Springer: Berlin/Heidelberg, Germany, 2016; Volume 9783, pp. 268–288. [Google Scholar] [CrossRef]
- Liu, Y.; Fu, K.; Wang, W.; Sun, L.; Wang, M. Linear cryptanalysis of reduced-round SPECK. Inf. Process. Lett.
**2016**, 116, 259–266. [Google Scholar] [CrossRef] - Matsui, M. Linear Cryptanalysis Method for DES Cipher. In Advances in Cryptology—EUROCRYPT ’93, Proceedings of the Workshop on the Theory and Application of of Cryptographic Techniques, Lofthus, Norway, 23–27 May 1993; Lecture Notes in Computer Science; Helleseth, T., Ed.; Springer: Berlin/Heidelberg, Germany, 1993; Volume 765, pp. 386–397. [Google Scholar] [CrossRef] [Green Version]
- Heys, H.M. A Tutorial on Linear and Differential Cryptanalysis. Cryptologia
**2002**, 26, 189–221. [Google Scholar] [CrossRef] - Beaulieu, R.; Shors, D.; Smith, J.; Treatman-Clark, S.; Weeks, B.; Wingers, L. SIMON and SPECK: Block Ciphers for the Internet of Things. IACR Cryptol. EPrint Arch.
**2015**, 2015, 585. [Google Scholar] - Song, L.; Huang, Z.; Yang, Q. Automatic Differential Analysis of ARX Block Ciphers with Application to SPECK and LEA. In Proceedings of the Information Security and Privacy—21st Australasian Conference (ACISP 2016), Melbourne, VIC, Australia, 4–6 July 2016; Part II; Lecture Notes in Computer Science. Liu, J.K., Steinfeld, R., Eds.; Springer: Berlin/Heidelberg, Germany, 2016; Volume 9723, pp. 379–394. [Google Scholar] [CrossRef]
- HoChang, L.; Seojin, K.; HyungChul, K.; Deukjo, H.; Jaechul, S.; Hong, S. Calculating the Approximate Probability of Differentials for ARX-Based Cipher Using SAT Solver. J. Korea Inst. Inf. Secur. Cryptol.
**2018**, 28, 15–24. [Google Scholar] [CrossRef] - Liu, Y.; Witte, G.D.; Ranea, A.; Ashur, T. Rotational-XOR Cryptanalysis of Reduced-round SPECK. IACR Trans. Symmetric Cryptol.
**2017**, 2017, 24–36. [Google Scholar] [CrossRef] - Dwivedi, A.D.; Morawiecki, P.; Srivastava, G. Differential Cryptanalysis of Round-Reduced SPECK Suitable for Internet of Things Devices. IEEE Access
**2019**, 7, 16476–16486. [Google Scholar] [CrossRef]

**Figure 8.**The pseudo-linear approximation of the first 5 rounds of Speck 32/64 for a nine-round Partly-Pseudo-Linear attack.

Block Size, 2n | Key Size, mn | Word Size, n | $\mathit{\alpha}$ | $\mathit{\beta}$ | Rounds |
---|---|---|---|---|---|

32 | 64 | 16 | 7 | 2 | 22 |

48 | 72 | 24 | 8 | 3 | 22 |

96 | 23 | ||||

64 | 96 | 32 | 8 | 3 | 26 |

128 | 27 | ||||

96 | 96 | 48 | 8 | 3 | 28 |

144 | 29 | ||||

128 | 128 | 64 | 8 | 3 | 32 |

192 | 33 | ||||

256 | 34 |

Pairs | $2\times {\mathit{\u03f5}}^{-2}$ | ${2}^{2}\times {\mathit{\u03f5}}^{-2}$ | ${2}^{3}\times {\mathit{\u03f5}}^{-2}$ | ${2}^{4}\times {\mathit{\u03f5}}^{-2}$ |
---|---|---|---|---|

Rate | $48.6\%$ | $78.5\%$ | $96.7\%$ | $99.9\%$ |

Linear Cryptanalysis | Pseudo-Linear Cryptanalysis |
---|---|

The effect of several approximations can be easily concatenated and simplified because there is only one operation (exclusive-or). | The effect of several approximations cannot be concatenated and simplified because the two operations (exclusive-or and addition modulo ${2}^{w}$) do not commute. |

Combining key bits across rounds into a single function of the key, independent of plaintext bits, is possible. | Cannot combine key bits across rounds into a single function of the key independent of plaintext. |

The approximation may be used for a distinguisher as well as for key recovery. | The approximation includes a non-linear function of key and plaintext bits, and cannot be used as a distinguisher but can be used for key recovery. |

Approximation of a single modular addition for large window sizes has low bias. | Approximation of a single modular addition can result in high accuracy prediction of large windows. |

N/K | Ref. | Type of Attack | Number of Rounds | Data Complexity | Time Complexity |
---|---|---|---|---|---|

32/64 | [19] | Rotational | 12 | NA | NA |

[20] | Differential | 12 | ${2}^{31}$ | ${2}^{63}$ | |

[17] | Differential | 14 | ${2}^{30.47}$ | ${2}^{62.47}$ | |

[18] | Differential | 15 | ${2}^{31.39}$ | ${2}^{63.39}$ | |

48/72 | [17] | Differential | 15 | ${2}^{45.31}$ | ${2}^{69.31}$ |

[18] | Differential | 16 | ${2}^{47.8}$ | ${2}^{95.8}$ | |

48/96 | [20] | Differential | 13 | ${2}^{48}$ | ${2}^{96}$ |

[19] | Rotational | 15 | NA | NA | |

[17] | Differential | 16 | ${2}^{45.31}$ | ${2}^{93.31}$ | |

[18] | Differential | 17 | ${2}^{47.8}$ | ${2}^{71.8}$ | |

64/96 | [17] | Differential | 19 | ${2}^{61.56}$ | ${2}^{93.56}$ |

64/128 | [19] | Rotational | 13 | NA | NA |

[20] | Differential | 15 | ${2}^{64}$ | ${2}^{128}$ | |

[17] | Differential | 20 | ${2}^{61.56}$ | ${2}^{125.56}$ | |

96/96 | [17] | Differential | 20 | ${2}^{95.94}$ | ${2}^{95.94}$ |

96/144 | [19] | Rotational | 13 | NA | NA |

[20] | Differential | 13 | ${2}^{93}$ | ${2}^{141}$ | |

[17] | Differential | 21 | ${2}^{95.94}$ | ${2}^{143.94}$ | |

128/128 | [17] | Differential | 23 | ${2}^{125.35}$ | ${2}^{125.35}$ |

128/128 | [17] | Differential | 24 | ${2}^{125.35}$ | ${2}^{189.35}$ |

128/128 | [19] | Rotational | 13 | NA | NA |

[20] | Differential | 15 | ${2}^{126}$ | ${2}^{254}$ | |

[17] | Differential | 25 | ${2}^{125.35}$ | ${2}^{253.35}$ |

N | Ref. | Number of Rounds | Guessed Key Bit/K | Bias | Data Complexity | Time Complexity |
---|---|---|---|---|---|---|

32 | [10] | 7 | LT | ${2}^{-14}$ | ${2}^{28}$ | ${2}^{28}$ |

[9] | 8 | LT | ${2}^{-15}$ | ${2}^{30}$ | ${2}^{30}$ | |

This work | 9 | 36/64 | ${2}^{-13.348}$ | ${2}^{26.68}$ | ${2}^{62.68}$ | |

[12] | 9 | LT | ${2}^{-14}$ | NA | NA | |

[13] | 9 | LT | ${2}^{-14}$ | NA | NA | |

[11] | 12 | 29/64 | ${2}^{-14}$ | ${2}^{30.87}$ | ${2}^{60.21}$ | |

48 | [10] | 8 | LT | ${2}^{-22}$ | ${2}^{44}$ | ${2}^{44}$ |

[9] | 9 | LT | ${2}^{-23}$ | ${2}^{46}$ | ${2}^{46}$ | |

This work | 10 | 27/72 | ${2}^{-22.436}$ | ${2}^{44.872}$ | ${2}^{71.872}$ | |

[12] | 10 | LT | ${2}^{-22}$ | NA | NA | |

[13] | 10 | LT | ${2}^{-22}$ | NA | NA | |

[11] | 11 | 24/72 | ${2}^{-20}$ | ${2}^{43.72}$ | ${2}^{67.93}$ | |

This work | 11 | 45/96 | ${2}^{-24}$ | ${2}^{48}$ | ${2}^{93}$ | |

[11] | 12 | 48/96 | ${2}^{-20}$ | ${2}^{43.72}$ | ${2}^{91.93}$ | |

64 | [9] | 11 | LT | ${2}^{-31}$ | ${2}^{62}$ | ${2}^{62}$ |

[10] | 11 | LT | ${2}^{-32}$ | ${2}^{64}$ | ${2}^{64}$ | |

[13] | 12 | LT | ${2}^{-30}$ | NA | NA | |

This work | 13 | 28/96 | ${2}^{-29.88}$ | ${2}^{59.76}$ | ${2}^{87.76}$ | |

[11] | 13 | 31/96 | ${2}^{-25}$ | ${2}^{54.63}$ | ${2}^{85.74}$ | |

[12] | 13 | LT | ${2}^{-30}$ | NA | NA | |

[11] | 14 | 31/96 | ${2}^{-31}$ | ${2}^{62.73}$ | ${2}^{94.87}$ | |

[11] | 14 | 63/128 | ${2}^{-25}$ | ${2}^{54.80}$ | ${2}^{117.7}$ | |

This work | 14 | 49/128 | ${2}^{-31.58}$ | ${2}^{63.16}$ | ${2}^{112.16}$ | |

[11] | 15 | 63/128 | ${2}^{-31}$ | ${2}^{62.73}$ | ${2}^{126.9}$ | |

96 | [11] | 8 | 47/96 | ${2}^{-11}$ | ${2}^{27.65}$ | ${2}^{74.7}$ |

[11] | 9 | 95/144 | ${2}^{-11}$ | ${2}^{27.65}$ | ${2}^{122.7}$ | |

[10] | 10 | LT | ${2}^{-47}$ | ${2}^{92}$ | ${2}^{92}$ | |

This work | 10 | 46/96 | ${2}^{-21.86}$ | ${2}^{43.72}$ | ${2}^{89.72}$ | |

[9] | 12 | LT | ${2}^{-48}$ | ${2}^{96}$ | ${2}^{96}$ | |

This work | 12 | 76/144 | ${2}^{-29.238}$ | ${2}^{58.476}$ | ${2}^{134.476}$ | |

[12] | 15 | LT | ${2}^{-45}$ | NA | NA | |

[13] | 17 | NA/144 | ${2}^{-45}$ | ${2}^{92}$ | ${2}^{96}$ | |

128 | [11] | 7 | 191/256 | ${2}^{-11}$ | ${2}^{28.30}$ | ${2}^{220.7}$ |

[11] | 8 | 63/128 | ${2}^{-11}$ | ${2}^{28.30}$ | ${2}^{92.69}$ | |

[11] | 9 | 127/192 | ${2}^{-11}$ | ${2}^{28.30}$ | ${2}^{156.7}$ | |

[10] | 11 | LT | ${2}^{-63}$ | ${2}^{144}$ | ${2}^{144}$ | |

This work | 11 | 50/128 | ${2}^{-28.179}$ | ${2}^{56.358}$ | ${2}^{106.358}$ | |

[9] | 13 | LT | ${2}^{-58}$ | ${2}^{116}$ | ${2}^{116}$ | |

This work | 13 | 122/192 | ${2}^{-31.299}$ | ${2}^{62.598}$ | ${2}^{184.598}$ | |

This work | 14 | 173/256 | ${2}^{-33.415}$ | ${2}^{66.83}$ | ${2}^{239.83}$ | |

[12] | 16 | LT | ${2}^{-58}$ | NA | NA | |

[13] | 18 | NA/192 | ${2}^{-61}$ | ${2}^{124}$ | ${2}^{128}$ | |

[13] | 19 | NA/256 | ${2}^{-61}$ | ${2}^{124}$ | ${2}^{192}$ |

Round | Encryption | Decryption |
---|---|---|

1 | $NewPL=(PL\u22d97){\u229e}_{16}PR$ | |

$x{l}_{1}^{1}=NewPL(0,1)\oplus {k}_{1}^{1}(0,1)$ | ||

$x{l}_{2}^{1}=NewPL(7,8)\oplus {k}_{2}^{1}(7,8)$ | ||

$x{r}_{1}^{1}=\left(PR(14,15)\right)\u22d82)\oplus x{l}_{1}^{1}$ | ||

2 | $x{l}_{1}^{2}(0,1)=\left((x{l}_{2}^{1}\u22d97){\u229e}_{2}x{r}_{1}^{1}\right)\oplus {k}_{1}^{2}(0,1)$ | |

$x{l}_{1}^{2}(0,1)$ ≡ $x{l}_{1}^{3}(0,1)$ | ||

3 | $x{l}_{1}^{3}(0,1)\approx \left((x{l}_{1}^{4}(9,10)\oplus {k}_{1}^{3}(9,10)){\boxminus}_{2}x{r}_{1}^{3}(9,10)\right))\u22d87$ | |

$x{r}_{1}^{3}(9,10)\approx \left((x{l}_{2}^{4}(11,12)\oplus x{r}_{3}^{4}(11,12))\right)\u22d92$ | ||

4 | $x{l}_{2}^{4}(11,12)\approx \left((CL(4,5)\oplus {k}_{1}^{4}(4,5)){\boxminus}_{2}x{r}_{2}^{4}(4,5)\right)\u22d87$ | |

$x{l}_{1}^{4}(9,10)\approx \left((CL(2,3)\oplus {k}_{1}^{4}(2,3)){\boxminus}_{2}x{r}_{1}^{4}(2,3)\right)\u22d87$ | ||

$x{r}_{1}^{4}(2,3)=(CR(4,5)\oplus CL(4,5))\u22d92$ | ||

$x{r}_{2}^{4}(4,5)=(CR(6,7)\oplus CL(6,7))\u22d92$ | ||

$x{r}_{3}^{4}(11,12)=(CR(13,14)\oplus CL(13,14))\u22d92$ |

Approximation | Window Size | Guessed Key Bits | Bias | Data Complexity | Time Complexity |
---|---|---|---|---|---|

Table 6 | 2 bits | 12 | ${2}^{-3.35}$ | ${2}^{10}$ | ${2}^{22}$ |

Appendix A | 3 bits | 17 | ${2}^{-2.01}$ | ${2}^{10}$ | ${2}^{27}$ |

Appendix A | 4 bits | 22 | ${2}^{-1.65}$ | ${2}^{10}$ | ${2}^{32}$ |

**Table 8.**Linear trail of Speck 32/64 for four rounds—six-rounds Partly-Pseudo-Linear attack (Starting with $\mathtt{0}\mathtt{x}\mathtt{30000000}$ forward).

Round | Cost | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | Reason to Stop |
---|---|---|---|---|---|---|

1 | 1 | $\mathtt{0}\mathtt{x}\mathtt{0006}$ | $\mathtt{0}\mathtt{x}\mathtt{0000}$ | $\mathtt{0}\mathtt{x}\mathtt{7800}$ | $\mathtt{0}\mathtt{x}\mathtt{6000}$ | |

2 | 2 | $\mathtt{0}\mathtt{x}\mathtt{7800}$ | $\mathtt{0}\mathtt{x}\mathtt{6000}$ | $\mathtt{0}\mathtt{x}\mathtt{8331}$ | $\mathtt{0}\mathtt{x}\mathtt{83}\mathtt{c}\mathtt{1}$ | |

3 | 3 | $\mathtt{0}\mathtt{x}\mathtt{8331}$ | $\mathtt{0}\mathtt{x}\mathtt{83}\mathtt{c}\mathtt{1}$ | $\mathtt{0}\mathtt{xe}\mathtt{019}$ | $\mathtt{0}\mathtt{x}\mathtt{831}\mathtt{f}$ | |

4 | 3 | $\mathtt{0}\mathtt{xe}\mathtt{019}$ | $\mathtt{0}\mathtt{x}\mathtt{831}\mathtt{f}$ | $\mathtt{0}\mathtt{xf}\mathtt{0}\mathtt{be}$ | $\mathtt{0}\mathtt{xc}\mathtt{37}\mathtt{e}$ | |

5 | $\mathtt{0}\mathtt{xf}\mathtt{0}\mathtt{be}$ | $\mathtt{0}\mathtt{xc}\mathtt{37}\mathtt{e}$ | Broke requirement of consecutive ones for | |||

$\mathtt{0}\mathtt{xf}\mathtt{0}\mathtt{be}\u22d97$. |

**Table 9.**The approximation for the Partly-Pseudo-Linear attack: six rounds, meeting at $x{l}_{1}^{2}(1,2)$.

Round | Encryption | Decryption |
---|---|---|

1 | $NewPL=(PL\u22d97){\u229e}_{16}PR$ | |

$x{l}_{1}^{1}=NewPL(1,2)\oplus {k}_{1}^{1}(1,2)$ | ||

$x{l}_{2}^{1}=NewPL(8,9)\oplus {k}_{2}^{1}(8,9)$ | ||

$x{r}_{1}^{1}=(PR(15,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}16)\u22d82)\oplus x{l}_{1}^{1}$ | ||

2 | $x{l}_{1}^{2}(1,2)\approx \left((x{l}_{2}^{1}\u22d97){\u229e}_{2}x{r}_{1}^{1}\right)\oplus {k}_{1}^{2}(1,2)$ | |

$x{l}_{1}^{2}\left(1\right)\oplus x{l}_{1}^{2}\left(2\right)$ ≡ $linearT$ | ||

3 to 6 | $linearT\approx {\lambda}_{{x}^{4}}$$.CL\oplus {\lambda}_{{y}^{4}}.CR$ |

Approximation | Window | No. of Key Bits Correctly Determined | Bias | Data Complexity | Time Complexity |
---|---|---|---|---|---|

Table 9 | 2 bits | 6 | ${2}^{-10.415}$ | ${2}^{20.83}$ | ${2}^{26.83}$ |

**Table 11.**Linear trail of Speck 32/64 for four rounds—nine rounds Partly-Pseudo-Linear attack (Starting with $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{000000}$ forward).

Round | Cost | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}}}$ | ${\mathit{\lambda}}_{{\mathit{x}}^{\mathit{i}+1}}$ | ${\mathit{\lambda}}_{{\mathit{y}}^{\mathit{i}+1}}$ | Reason to Stop |
---|---|---|---|---|---|---|

1 | 1 | $\mathtt{0}\mathtt{x}\mathtt{0}\mathtt{c}\mathtt{00}$ | $\mathtt{0}\mathtt{x}\mathtt{0000}$ | $\mathtt{0}\mathtt{x}\mathtt{0078}$ | $\mathtt{0}\mathtt{x}\mathtt{0060}$ | |

2 | 2 | $\mathtt{0}\mathtt{x}\mathtt{0078}$ | $\mathtt{0}\mathtt{x}\mathtt{0060}$ | $\mathtt{0}\mathtt{x}\mathtt{3183}$ | $\mathtt{0}\mathtt{xc}\mathtt{183}$ | |

3 | 3 | $\mathtt{0}\mathtt{x}\mathtt{3183}$ | $\mathtt{0}\mathtt{xc}\mathtt{183}$ | $\mathtt{0}\mathtt{x}\mathtt{19}\mathtt{e}\mathtt{0}$ | $\mathtt{0}\mathtt{x}\mathtt{1}\mathtt{f}\mathtt{83}$ | |

4 | 3 | $\mathtt{0}\mathtt{x}\mathtt{19}\mathtt{e}\mathtt{0}$ | $\mathtt{0}\mathtt{x}\mathtt{1}\mathtt{f}\mathtt{83}$ | $\mathtt{0}\mathtt{xbef}\mathtt{0}$ | $\mathtt{0}\mathtt{x}\mathtt{7}\mathtt{ec}\mathtt{3}$ | |

5 | $\mathtt{0}\mathtt{xbef}\mathtt{0}$ | $\mathtt{0}\mathtt{x}\mathtt{7}\mathtt{ec}\mathtt{3}$ | Broke requirement for consecutive ones for | |||

$\mathtt{0}\mathtt{xfbc}\mathtt{2}\u22d97$. |

Round | Encryption | Decryption |
---|---|---|

1 | $NewPL=(PL\u22d97){\u229e}_{16}PR$ | |

$x{l}_{1}^{1}=NewPL(15,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})\oplus {k}_{1}^{1}(15,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})$ | ||

$x{l}_{2}^{1}=NewPL(1,2)\oplus {k}_{2}^{1}(1,2)$ | ||

$x{l}_{3}^{1}=NewPL(4,5)\oplus {k}_{3}^{1}(4,5)$ | ||

$x{l}_{4}^{1}=NewPL(6,7)\oplus {k}_{4}^{1}(6,7)$ | ||

$x{l}_{5}^{1}=NewPL(8,9)\oplus {k}_{5}^{1}(8,9)$ | ||

$x{l}_{6}^{1}=NewPL(10,11)\oplus {k}_{6}^{1}(10,11)$ | ||

$x{l}_{7}^{1}=NewPL(13,14)\oplus {k}_{7}^{1}(13,14)$ | ||

$x{r}_{1}^{1}=(PR(13,14)\u22d82)\oplus x{l}_{1}^{1}$ | ||

$x{r}_{2}^{1}=(PR(15,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})\u22d82)\oplus x{l}_{2}^{1}$ | ||

$x{r}_{3}^{1}=(PR(2,3)\u22d82)\oplus x{l}_{3}^{1}$ | ||

$x{r}_{4}^{1}=(PR(4,5)\u22d82)\oplus x{l}_{4}^{1}$ | ||

$x{r}_{5}^{1}=(PR(6,7)\u22d82)\oplus x{l}_{5}^{1}$ | ||

$x{r}_{6}^{1}=(PR(8,9)\u22d82)\oplus x{l}_{6}^{1}$ | ||

$x{r}_{7}^{1}=(PR(11,12)\u22d82)\oplus x{l}_{7}^{1}$ | ||

2 | $x{l}_{1}^{2}\approx \left((x{l}_{4}^{1}\u22d97){\u229e}_{2}x{r}_{1}^{1}\right)\oplus {k}_{1}^{2}(15,16\phantom{\rule{0.166667em}{0ex}}mod\phantom{\rule{0.166667em}{0ex}}{2}^{4})$ | |

$x{l}_{2}^{2}\approx \left((x{l}_{5}^{1}\u22d97){\u229e}_{2}x{r}_{2}^{1}\right)\oplus {k}_{2}^{2}(1,2)$ | ||

$x{l}_{3}^{2}\approx \left((x{l}_{7}^{1}\u22d97){\u229e}_{2}x{r}_{4}^{1}\right)\oplus {k}_{3}^{2}(6,7)$ | ||

$x{l}_{4}^{2}\approx \left((x{l}_{1}^{1}\u22d97){\u229e}_{2}x{r}_{5}^{1}\right)\oplus {k}_{4}^{2}(8,9)$ | ||

$x{l}_{5}^{2}\approx \left((x{l}_{2}^{1}\u22d97){\u229e}_{2}x{r}_{6}^{1}\right)\oplus {k}_{5}^{2}(10,11)$ | ||

$x{r}_{1}^{2}\approx (x{r}_{7}^{1}\u22d82)\oplus x{l}_{1}^{2}$ | ||

$x{r}_{2}^{2}\approx (x{r}_{1}^{1}\u22d82)\oplus x{l}_{2}^{2}$ | ||

$x{r}_{3}^{2}\approx (x{r}_{3}^{1}\u22d82)\oplus x{l}_{3}^{2}$ | ||

$x{r}_{4}^{2}\approx (x{r}_{4}^{1}\u22d82)\oplus x{l}_{4}^{2}$ | ||

$x{r}_{5}^{2}\approx (x{r}_{5}^{1}\u22d82)\oplus x{l}_{5}^{2}$ | ||

3 | $x{l}_{1}^{3}\approx \left((x{l}_{4}^{2}\u22d97){\u229e}_{2}x{r}_{2}^{2}\right)\oplus {k}_{1}^{3}(1,2)$ | |

$x{l}_{2}^{3}\approx \left((x{l}_{1}^{2}\u22d97){\u229e}_{2}x{r}_{4}^{2}\right)\oplus {k}_{2}^{3}(8,9)$ | ||

$x{l}_{3}^{3}\approx \left((x{l}_{2}^{2}\u22d97){\u229e}_{2}x{r}_{5}^{2}\right)\oplus {k}_{3}^{3}(10,11)$ | ||

$x{r}_{1}^{3}\approx (x{r}_{1}^{2}\u22d82)\oplus x{l}_{1}^{3}$ | ||

$x{r}_{2}^{3}\approx (x{r}_{3}^{2}\u22d82)\oplus x{l}_{2}^{3}$ | ||

$x{r}_{3}^{3}\approx (x{r}_{4}^{2}\u22d82)\oplus x{l}_{3}^{3}$ | ||

4 | $x{l}_{1}^{4}\approx \left((x{l}_{2}^{3}\u22d97){\u229e}_{2}x{r}_{1}^{3}\right)\oplus {k}_{1}^{4}(1,2)$ | |

$x{l}_{2}^{4}\approx \left((x{l}_{1}^{3}\u22d97){\u229e}_{2}x{r}_{3}^{3}\right)\oplus {k}_{2}^{4}(10,11)$ | ||

$x{r}_{1}^{4}\approx (x{r}_{2}^{3}\u22d82)\oplus x{l}_{2}^{4}$ | ||

5 | $x{l}_{1}^{5}(10,11)\approx \left((x{l}_{1}^{4}\u22d97){\u229e}_{2}x{r}_{1}^{4}\right)\oplus {k}_{1}^{5}(10,11)$ | |

$x{l}_{1}^{5}\left(10\right)\oplus x{l}_{1}^{5}\left(11\right)$ ≡ $linearT$ | ||

6 to 9 | $linearT\approx {\lambda}_{{x}^{4}}.CL\oplus {\lambda}_{{y}^{4}}.CR$ |

**Table 13.**Summary of the Partly-Pseudo-Linear approximation: nine rounds of Speck 32/64, with window size $w=2$.

Approximation | Window Size | Key | Bias | Data Complexity | Time Complexity |
---|---|---|---|---|---|

Table 12 | 2 bits | 36 | ${2}^{-13.348}$ | ${2}^{26.68}$ | ${2}^{62.68}$ |

Block Size | Key Size | Rounds | Guessed Key Bits | Bias | Data Complexity | Time Complexity | Approximation |
---|---|---|---|---|---|---|---|

32 | 64 | 9 | 36 | ${2}^{-13.348}$ | ${2}^{26.68}$ | ${2}^{62.68}$ | Table 12 |

48 | 72 | 10 | 27 | ${2}^{-22.436}$ | ${2}^{44.872}$ | ${2}^{71.872}$ | Appendix B |

96 | 11 | 45 | ${2}^{-24}$ | ${2}^{48}$ | ${2}^{93}$ | ||

64 | 96 | 13 | 28 | ${2}^{-29.88}$ | ${2}^{59.76}$ | ${2}^{87.76}$ | Appendix C |

128 | 14 | 49 | ${2}^{-31.58}$ | ${2}^{63.16}$ | ${2}^{112.16}$ | ||

96 | 96 | 10 | 46 | ${2}^{-21.86}$ | ${2}^{43.72}$ | ${2}^{89.72}$ | Appendix D |

144 | 12 | 76 | ${2}^{-29.238}$ | ${2}^{58.476}$ | ${2}^{134.476}$ | ||

128 | 128 | 11 | 50 | ${2}^{-28.179}$ | ${2}^{56.358}$ | ${2}^{106.358}$ | Appendix E |

192 | 13 | 122 | ${2}^{-31.299}$ | ${2}^{62.598}$ | ${2}^{184.598}$ | ||

256 | 14 | 173 | ${2}^{-33.415}$ | ${2}^{66.83}$ | ${2}^{239.83}$ |

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |

© 2020 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Alzakari, S.A.; Vora, P.L.
Partly-Pseudo-Linear Cryptanalysis of Reduced-Round Speck. *Cryptography* **2021**, *5*, 1.
https://doi.org/10.3390/cryptography5010001

**AMA Style**

Alzakari SA, Vora PL.
Partly-Pseudo-Linear Cryptanalysis of Reduced-Round Speck. *Cryptography*. 2021; 5(1):1.
https://doi.org/10.3390/cryptography5010001

**Chicago/Turabian Style**

Alzakari, Sarah A., and Poorvi L. Vora.
2021. "Partly-Pseudo-Linear Cryptanalysis of Reduced-Round Speck" *Cryptography* 5, no. 1: 1.
https://doi.org/10.3390/cryptography5010001