Research Article

MILP/MIQCP-Based Fully Automatic Method of Searching for Differential-Linear Distinguishers for SIMON-Like Ciphers

Table 20

Twenty-five-round DL distinguisher for SIMECK64 with theoretical correlation and experimental correlation , where the theoretical probability of the differential part, the theoretical correlation of the DL part, and the theoretical correlation of the linear part are , and , respectively.

Differential part (optimal differential trail)

00000000000000000001000000000000000000000000000000101010000000000
70000000000000000000101000000000000000000000000000000100000000000

DL part

−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.01.0−1.01.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.01.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0

8−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−0.0−1.0
−0.0−1.01.0−0.0−1.0−0.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.01.0−1.01.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0

9−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−0.5−1.0−0.5−1.0−0.0−0.25−0.0
−0.251.0−0.00.5−0.00.5−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−0.0−1.0
−0.0−1.01.0−0.0−1.0−0.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0

10−1.0−1.0−1.0−1.0−0.75−1.0−0.75−1.0
−0.25−0.4688−0.25−0.4688−0.0−0.0625−0.0−0.0625
−0.0−0.0−0.25−0.00.25−0.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0
−1.0−0.5−1.0−0.5−1.0−0.0−0.25−0.0
−0.251.0−0.00.5−0.00.5−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0

11−1.0−0.875−1.0−0.4688−0.6426−0.4688−0.6426−0.125
−0.1556−0.0459−0.1556−0.0−0.0156−0.0−0.0039−0.0
−0.00.125−0.0−0.0625−0.00.25−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−0.875
−1.0−1.0−1.0−1.0−0.75−1.0−0.75−1.0
−0.25−0.4688−0.25−0.4688−0.0−0.0625−0.0−0.0625
−0.0−0.0−0.25−0.00.25−0.0−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−1.0

12−0.6426−0.77−0.2637−0.2727−0.1510−0.2727−0.0385−0.0445
−0.0033−0.0192−0.0−0.0018−0.0−0.00006−0.0−0.0
−0.0−0.0−0.0078−0.0−0.03125−0.0−1.0−1.0
−1.0−1.0−0.9375−1.0−0.9375−1.0−0.6426−0.77
−1.0−0.875−1.0−0.4688−0.6426−0.4688−0.6426−0.125
−0.1556−0.0459−0.1556−0.0−0.0156−0.0−0.0039−0.0
−0.00.125−0.0−0.0625−0.00.25−1.0−1.0
−1.0−1.0−1.0−1.0−1.0−1.0−1.0−0.875

13−0.4024−0.1060−0.09−0.0226−0.0514−0.0057−0.0074−0.0001
−0.0007−0.0−0.00007−0.0−0.0−0.0−0.0
−0.00.0004−0.0−0.00098−0.00.1211−1.0−0.9688
−1.0−0.77−0.8573−0.77−0.8573−0.4060−0.4024−0.2864
−0.6426−0.77−0.2637−0.2727−0.1510−0.2727−0.0385−0.0445
−0.0033−0.0192−0.0−0.0018−0.0−0.00006−0.0−0.0
−0.0−0.0−0.0078−0.0−0.03125−0.0−1.0−1.0
−1.0−1.0−0.9375−1.0−0.9375−1.0−0.6426−0.77

14−0.0240−0.0193−0.0016−0.0036−0.0002−0.0005−0.000001−0.000008
−0.0−0.0−0.0−0.0−0.0−0.0
−0.0−0.0−0.000003−0.00.0017−0.0−0.8573−0.9142
−0.5413−0.5320−0.4311−0.5320−0.1955−0.1542−0.0660−0.1048
−0.4024−0.1060−0.09−0.0226−0.0514−0.0057−0.0074−0.0001
−0.0007−0.0−0.00007−0.0−0.0−0.0−0.0
−0.00.0005−0.0−0.00098−0.00.1211−1.0−0.96875
−1.0−0.77−0.8573−0.77−0.8573−0.4060−0.4024−0.2864

Linear part

0000000000000000000000010001000000000000000000000000000000000000
150000000000000000000000000000000000000000000000000000000100010000
160000000000000000000000010001000000000000000000000000000010000000
170000000000000000000000001000000000000000000000000000000101010000
180000000000000000000000010101000000000000000000000000000000100000
190000000000000000000000000010000000000000000000000000000101000000
200000000000000000000000010100000000000000000000000000000010000000
210000000000000000000000001000000000000000000000000000000100000000
220000000000000000000000010000000000000000000000000000000000000000
230000000000000000000000000000000000000000000000000000000100000000
240000000000000000000000010000000000000000000000000000000010000000
250000000000000000000000001000000000000000000000000000000101000000

Note: The experimental correlation of the first 14 () rounds is under sample sizes and 100 random keys, and the experimental correlation of the 11 rounds at the bottom is under sample sizes and 100 random keys. According to piling-up lemma, the experimental correlation is .