Automated differential–linear cryptanalysis of SIMON-like ciphers via truncated differential

Abstract

Ciphers built on bitwise AND, XOR, and rotation are highly competitive for resource‑constrained Internet of Things devices. A representative example is the SIMON family of lightweight block ciphers, introduced by the U.S. National Security Agency in 2013. Differential‑linear (DL) cryptanalysis of such ciphers comprises two central tasks: identifying promising DL distinguishers and evaluating their correlations. Recent notable works, including the Differential‑Linear Connectivity Table (DLCT), the Differential Algebraic Transitional Form (DATF), and new evaluation methods from boomerang and truncated differential perspectives, have made significant progress in correlation evaluation. Beyond correlation evaluation, efficiently finding long DL distinguishers with high correlation remains a crucial challenge, particularly for AndRX ciphers. To address this, we propose a two‑step solver‑aided strategy. The first step employs an automated solver to generate a large pool of DL distinguisher candidates by concatenating truncated differentials with linear approximations. In this step, we derive a rigorous probability formula for SIMON‑like round functions to enable fast correlation estimation. To the best of our knowledge, this is the first formula for computing truncated differential probabilities of such round functions. The second step re‑evaluates the DL correlations using the DLCT technique to ensure accuracy and mitigate clustering effects. Applied to all variants of SIMON and SIMECK, our method yields the longest DL distinguishers reported to date: 14, 17, 21, 29, and 37 rounds for SIMON‑32/48/64/96/128, respectively, and 14, 21, and 26 rounds for SIMECK‑32/48/64, respectively.