MILP/MIQCP-Based Fully Automatic Method of Searching for Differential-Linear Distinguishers for SIMON-Like Ciphers
Table 10
Twenty-five-round DL distinguisher for SIMON96 with theoretical correlation and experimental correlation , where the theoretical probability of the differential part, the theoretical correlation of the DL part, and the theoretical correlation of the linear part are , and , respectively.
Differential part (optimal differential trail)
0
000000000000000000010001000100000000000000000000
000000000000000001000000010000000000000000000000
10
000000000000000000010001000100000000000000000000
000000000000000000000100000000000000000000000000
DL part
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
11
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.0
−1.0
−1.0
−1.0
−0.0
−1.0
1.0
−0.0
−0.0
−1.0
−1.0
−0.0
−1.0
−1.0
1.0
−0.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
12
−1.0
−1.0
−1.0
−0.5
−1.0
−1.0
−1.0
−0.5
−1.0
−0.0
−0.25
−0.5
−1.0
−0.0
−0.25
1.0
−0.0
−0.0
−0.25
1.0
−0.0
−0.5
−1.0
−1.0
−0.0
−0.5
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.0
−1.0
−1.0
−1.0
−0.0
−1.0
1.0
−0.0
−0.0
−1.0
−1.0
−0.0
−1.0
−1.0
1.0
−0.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
13
−1.0
−0.25
−0.4688
−0.75
−1.0
−0.25
−0.4688
−0.0
−0.0625
−0.156
−0.4688
−0.0
−0.0625
0.4688
−0.0
−0.0
−0.0625
−0.4688
−0.0
−0.0
−0.75
−1.0
−0.0
−0.25
−0.75
−1.0
−0.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.75
−1.0
−1.0
−1.0
−0.75
−1.0
−1.0
−1.0
−0.5
−1.0
−1.0
−1.0
−0.5
−1.0
−0.0
−0.25
−0.5
−1.0
−0.0
−0.25
1.0
−0.0
−0.0
−0.25
1.0
−0.0
−0.5
−1.0
−1.0
−0.0
−0.5
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
14
−0.1556
−0.3184
−0.6426
−0.0625
−0.1556
−0.0
−0.0156
−0.0208
−0.1440
−0.0
−0.0039
0.0623
−0.0
−0.0
−0.0039
0.1556
−0.0
−0.0
−0.0469
0.875
−0.0
−0.0625
−0.4688
−0.875
−0.0
−0.25
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.875
−1.0
−1.0
−1.0
−0.875
−1.0
−0.4688
−0.6426
−0.875
−1.0
−0.4688
−0.6426
−0.125
−1.0
−0.25
−0.4688
−0.75
−1.0
−0.25
−0.4688
−0.0
−0.0625
−0.1563
−0.4688
−0.0
−0.0625
0.4688
−0.0
−0.0
−0.0625
−0.4688
−0.0
−0.0
−0.75
−1.0
−0.0
−0.25
−0.75
−1.0
−0.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.75
−1.0
−1.0
−1.0
−0.75
15
−0.2423
−0.0064
−0.0195
−0.0
−0.0039
−0.0013
−0.0173
−0.0
−0.00006
0.0024
−0.0
−0.0
−0.00006
−0.0195
−0.0
−0.0
−0.0007
0.1342
−0.0
−0.0
−0.1868
−0.6426
−0.0
−0.0313
−0.46875
1.0
−0.0
−0.9375
−1.0
−1.0
−1.0
−0.9375
−1.0
−0.6426
−0.77
−0.9375
−1.0
−0.6426
−0.77
−0.2637
−0.2727
−0.4737
−0.77
−0.1868
−0.2727
−0.0513
−0.0445
−0.0704
−0.1556
−0.3184
−0.6426
−0.0625
−0.1556
−0.0
−0.0156
−0.0208
−0.1440
−0.0
−0.0039
0.0623
−0.0
−0.0
−0.0039
0.1556
−0.0
−0.0
−0.0469
0.875
−0.0
−0.0625
−0.4688
−0.875
−0.0
−0.25
−1.0
1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−1.0
−0.875
−1.0
−1.0
−1.0
−0.875
−1.0
−0.4688
−0.6426
−0.875
−1.0
−0.4688
−0.6426
−0.125
16
−0.0008
−0.0
−0.0006
−0.00002
−0.0007
−0.0
0.00001
−0.0
−0.0
0.0003
−0.0
−0.0
−0.0054
−0.0
−0.0
−0.0022
0.3232
−0.0
−0.00098
−0.1133
0.6225
−0.0
−0.0962
−0.8573
0.9688
−1.0
−0.77
−0.8573
−0.4060
−0.4024
−0.6114
−0.8573
−0.3336
−0.4024
−0.1227
−0.09
−0.1412
−0.3524
−0.0390
−0.0530
−0.0143
−0.0117
−0.0086
−0.0424
−0.0002
−0.2423
−0.0064
−0.0195
−0.0
−0.0039
−0.0013
−0.0173
−0.0
−0.00006
0.0024
−0.0
−0.0
−0.00006
−0.0195
−0.0
−0.0
−0.0007
0.1342
−0.0
−0.0
−0.1868
−0.6426
−0.0
−0.03125
−0.46875
1.0
−0.0
−0.9375
−1.0
−1.0
−1.0
−0.9375
−1.0
−0.6426
−0.77
−0.9375
−1.0
−0.6426
−0.77
−0.2637
−0.2727
−0.4737
−0.77
−0.1868
−0.2727
−0.0513
−0.0445
−0.0704
Linear part
000000000000000000000000001000100010000000000000
000000000000000000000000000000001000000000000000
17
000000000000000000000000000000001000000000000000
000000000000000000000000001000100000000000000000
18
000000000000000000000000001000100000000000000000
000000000000000000000000000010000000000000000000
19
000000000000000000000000000010000000000000000000
000000000000000000000000001000000000000000000000
20
000000000000000000000000001000000000000000000000
000000000000000000000000000000000000000000000000
21
000000000000000000000000000000000000000000000000
000000000000000000000000001000000000000000000000
22
000000000000000000000000001000000000000000000000
000000000000000000000000000100000000000000000000
23
000000000000000000000000000100000000000000000000
000000000000000000000000001000100000000000000000
24
000000000000000000000000001000100000000000000000
000000000000000000000000000000001000000000000000
25
000000000000000000000000000000001000000000000000
000000000000000000000000001000100010000000000000
Note: The experimental correlation of the first 10 rounds is under sample sizes and 100 random keys, the experimental correlation of the 6 rounds at the DL part is under sample sizes and 100 random keys, the experimental correlation of the 9 rounds at the bottom is under sample sizes and 100 random keys. According to piling-up lemma, the experimental correlation is .