Simon (cipher)

Simon is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013¹. Simon has been optimized for performance in hardware implementations, while its sister algorithm, Speck, has been optimized for software implementations. The NSA began working on the Simon and Speck ciphers in 2011. The agency anticipated some agencies in the US federal government would need a cipher that would operate well on a diverse collection of Internet of Things devices while maintaining an acceptable level of security.

Simon is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. Simon has been optimized for performance in hardware implementations, while its sister algorithm, Speck, has been optimized for software implementations. The NSA began working on the Simon and Speck ciphers in 2011. The agency anticipated some agencies in the US federal government would need a cipher that would operate well on a diverse collection of Internet of Things devices while maintaining an acceptable level of security. The Simon block cipher is a balanced Feistel cipher with an n-bit word, and therefore the block length is 2n. The key length is a multiple of n by 2, 3, or 4, which is the value m. Therefore, a Simon cipher implementation is denoted as Simon2n/nm. For example, Simon64/128 refers to the cipher operating on a 64-bit plaintext block (n = 32) that uses a 128-bit key. The block component of the cipher is uniform between the Simon implementations; however, the key generation logic is dependent on the implementation of 2, 3 or 4 keys. Simon supports the following combinations of block sizes, key sizes and number of rounds: k_{i+m} = \left\{ \begin{array}{ll} c\oplus\left(z_j\right)_i\oplus k_i \oplus\left(I\oplus S^{-1}\right)\left(S^{-3}k_{i+1}\right),&m=2\\ c\oplus\left(z_j\right)_i\oplus k_i \oplus\left(I\oplus S^{-1}\right)\left(S^{-3}k_{i+2}\right),&m=3\\ c\oplus\left(z_j\right)_i\oplus k_i \oplus\left(I\oplus S^{-1}\right)\left(S^{-3}k_{i+3}\oplus k_{i+1}\right),&m=4\\ \end{array}\right. The key schedule structure may or may not be balanced. The key word count of m is used to determine the structure of the key expansion, resulting in a total bit width of m*n . The key word expansion consists of a right shift, XOR and a constant sequence, z_x . The z_x bit operates on the lowest bit of the key word once per round.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1364003813 under CC BY-SA 4.0; modifications have been made.