Impossible Differential Cryptanalysis of Reduced Round SIMON

SIMON is a lightweight block cipher introduced by NSA and has attracted lots of attention ever since its publication in 2013. There have been numerous attacks on SIMON such as linear, differential, impossible differential, and zero correlation linear hull cryptanalysis. The SIMON family has 10 versions depending on different block sizes and key sizes to satisfy various security requirements. In this paper, we use automatic-search technique to obtain the longest impossible differential paths of SIMON, and then we propose impossible differential attacks. We give detailed process of attacks on SIMON32/64. In the process of structure construction, we exploit the connection of plaintext and round one output difference of the first round, which is independent of key bits. By building and solving equations of the second round we get plaintext pairs that satisfy the bit conditions of the first round thus reduce the complexity of data collecting phase greatly. In the key recovery phase, we use the dynamic key guessing technique proposed by Wang combined with bit property to exactly the exact bit difference condition, and the time complexity can be reduced and previous results of impossible differential attacks on SIOMN are imoroved.