Differential Cryptanalysis of Lightweight Block Ciphers SLIM and LCB

Abstract

In this paper, we analyze the security of two recently proposed ultra-lightweight block ciphers, SLIM and LCB. SLIM is designed based on the Feistel paradigm, operating on 32-bit blocks and has an 80-bit key. The designers claim that SLIM is immune to differential cryptanalysis after they were only able to find a trail of up to 7 rounds by using a heuristic method. LCB is another ultra-lightweight block cipher with a 32-bit block and instead uses a 64-bit secret key. It was designed based on a hybrid of Feistel and substitution-permutation network structures. Although no concrete security analyses were performed, the designers claim that 10 rounds of the cipher is secure enough against various attacks including differential cryptanalysis. We verify these claims by proposing differential attacks on both ciphers. For SLIM, we first report optimal (i.e., having the best differential probability) trails for up to 32 rounds found using an SMT solver. We then propose practical key recovery attacks on up to 14 rounds that recover the final round key with time complexity $2^{32}$. Next, a close inspection of LCB’s design revealed a lack of nonlinearity, whereby its S-box could be modelled as a permutation. As such, differential trails that hold with probability 1 can be trivially derived for any number of rounds of the cipher. A trivial distinguishing attack can be performed with just one known-ciphertext. We fix this flaw and go on to show that LCB is actually more secure (against differential cryptanalysis) than SLIM given the same number of rounds. To the best of our knowledge, these are the first third-party cryptanalysis attacks against both ciphers.