Hindawi Security and Communication Networks Volume 2020, Article ID 3701067, 11 pages https://doi.org/10.1155/2020/3701067 Research Article Deep Learning-Based Cryptanalysis of Lightweight Block Ciphers Jaewoo So Department of Electronic Engineering, Sogang University, Seoul 04107, Republic of Korea Correspondence should be addressed to Jaewoo So; [email protected] Received 5 February 2020; Revised 21 June 2020; Accepted 26 June 2020; Published 13 July 2020 Academic Editor: Umar M. Khokhar Copyright © 2020 Jaewoo So. +is is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Most of the traditional cryptanalytic technologies often require a great amount of time, known plaintexts, and memory. +is paper proposes a generic cryptanalysis model based on deep learning (DL), where the model tries to find the key of block ciphers from known plaintext-ciphertext pairs. We show the feasibility of the DL-based cryptanalysis by attacking on lightweight block ciphers such as simplified DES, Simon, and Speck. +e results show that the DL-based cryptanalysis can successfully recover the key bits when the keyspace is restricted to 64 ASCII characters. +e traditional cryptanalysis is generally performed without the keyspace restriction, but only reduced-round variants of Simon and Speck are successfully attacked. Although a text-based key is applied, the proposed DL-based cryptanalysis can successfully break the full rounds of Simon32/64 and Speck32/64. +e results indicate that the DL technology can be a useful tool for the cryptanalysis of block ciphers when the keyspace is restricted. 1. Introduction space-time tradeoff, is a generic attack which weakens the security benefits of using multiple encryptions [6]. +e Cryptanalysis of block ciphers has persistently received great biclique attack, which is a variant of the MITM attack, attention. In particular, recently, many cryptanalytic tech- utilizes a biclique structure to extend the number of possibly niques have emerged. +e cryptanalysis based on the al- attacked rounds by the MITM attack [6]. In a related-key gorithm of algebraic structures can be categorized as follows: attack, an attacker can observe the operation of a cipher a differential cryptanalysis, a linear cryptanalysis, a differ- under several different keys whose values are initially un- ential-linear cryptanalysis, a meet-in-the-middle (MITM) known, but where some mathematical relationship con- attack, and a related-key attack [1, 2]. Differential crypt- necting the keys is known to the attacker [7]. analysis, which is the first general cryptanalytic technique, However, the conventional cryptanalysis might be im- analyses how differences evolve during encryption and how practical or have limitations to be generalized. First, most of differences of plaintext pairs evolve to differences of the conventional cryptanalytic technologies often require a great resultant ciphertext pairs [3]. +e differential cryptanalysis amount of time, known plaintexts, and memory. Second, has evolved to various types of differential cryptanalysis such although the traditional cryptanalysis is generally performed as an integral cryptanalysis, which is sometimes known as a without the keyspace restriction, only reduced-round vari- multiset attack, a boomerang attack, an impossible differ- ants are successfully attacked on recent block ciphers. For ential cryptanalysis, and an improbable differential crypt- example, no successful attack on the full-round Simon or the analysis [1, 2]. Linear cryptanalysis is also a general full-round Speck, which is a family of lightweight block cryptanalytic technique, where it analyses linear approxi- ciphers, is known [8–10]. +ird, we need an automated and mations between plaintexts bits, ciphertexts bits, and key generalized test tool for checking the safety of various bits. It is a known plaintext attack. +e work in [4] showed lightweight block ciphers for Internet of +ings [11]. +ere that the efficiency of the linear cryptanalysis can be im- are various automated techniques that can be used to build proved by use of chosen plaintexts. +e authors in [5] distinguishers against block ciphers [12–14]. Because re- proposed a zero-correlation linear cryptanalysis, which is a sistance against differential cryptanalysis is an important key recovery technique. +e MITM attack, which employs a design criterion for modern block ciphers, most designs rely 2 Security and Communication Networks on finding some upper bound on probability of differential +e studies on the ML-based cryptanalysis can be characteristics [12]. +e authors in [13] proposed a truncated classified as follows: first, some studies focused on finding searching algorithm which identifies differential character- the characteristics of block ciphers by using ML technolo- istics as well as high probability differential paths. +e au- gies. +e authors in [18] used a recurrent neural network to thors in [14] applied a mixed integer linear programming find the differential characteristics of block ciphers, where (MILP) to search for differential characteristics and linear the recurrent neural network represents the substitution approximations in ARX ciphers. However, most automated functions of a block cipher. +e author in [19] applied an techniques have endeavoured to search for differential artificial neural network to automate attacks on the classical characteristics and linear approximations. Hence, the ma- ciphers of a Caesar cipher, a Vigenere` cipher, and a sub- chine learning- (ML-) based cryptanalysis can be a candidate stitution cipher, by exploiting known statistical weakness. to solve the above problems. +ey trained a neural network to recover the key by pro- +is paper proposes a generic deep learning- (DL-) based viding the relative frequencies of ciphertext letters. Recent cryptanalysis model that finds the key from known plain- work [20] experimentally showed that a CipherGAN, which text-ciphertext pairs and shows the feasibility of the DL- is a tool based on a generative adversarial network (GAN), based cryptanalysis by applying it to lightweight block ci- can crack language data enciphered using shift and Vigenere` phers. Specifically, we try to utilize deep neural networks ciphers. (DNNs) to find the key from known plaintexts. +e con- Second, some studies used ML technologies to classify tribution of this paper is two-fold: first, we develop a generic encrypted traffic or to identify the cryptographic algorithm and automated cryptanalysis model based on the DL. +e from ciphertexts. In [21], an ML-based traffic classification proposed DL-based cryptanalysis is a promising step to- was introduced to identify SSH and Skype encrypted traffic. wards a more efficient and automated test for checking the +e authors in [22] constructed three ML-based classifica- safety of emerging lightweight block ciphers. Second, we tion protocols to classify encrypted data. +ey showed the perform the DL-based attacks on lightweight block ciphers, three protocols, hyperplane decision, Na¨ıve Bayes, and such as S-DES, Simon, and Speck. In our knowledge, this is decision trees, efficiently perform a classification when the first attempt to successfully break the full rounds of running on real medication data sets. +e authors in [23] Simon32/64 and Speck32/64 although we apply the text- used a support vector machine (SVM) technique to identify based key for the block ciphers. five block cryptographic algorithms, AES, Blowfish, 3DES, +e remainder of this paper is organized as follows: RC5, and DES, from ciphertexts. +e authors in [24] pro- Section 2 presents the related work; Section 3 describes the posed an unsupervised learning cost function for a sequence attack model for cryptanalysis; Section 4 introduces the DL- classifier without labelled data, and they showed how it can based approach for the cryptanalysis of lightweight block be applied in order to break the Caesar cipher. ciphers and presents the structure of the DNN model; +ird, other researchers have endeavoured to find out Section 5 describes how to learn and evaluate the model; in the mapping relationship between plaintexts, ciphertexts, Section 6, we apply the DL-based cryptanalysis to light- and the key, but there are few scientific publications. +e weight block ciphers and evaluate the performance of the work in [25] reported astonishing results for attacking the DL-based cryptanalysis; finally, Section 7 concludes this DES and the Triple DES, where a neural network was used to paper. find the plaintexts from the ciphertexts. +e authors in [26] Notations: we give some notations, which will be used in used a neural network to find out the mapping relationship the rest of this paper. A plaintext and ciphertext are, re- between plaintexts, ciphertexts, and the key in simplified spectively, denoted by p � (p0, p1, ..., pn−1) and c � (c0, c1, ..., DES (S-DES). +e author in [27] developed a feedforward cn−1), where n is the block size, pi is the ith bit of the neural network that discovers the plaintext from the ci- plaintext, ci is the ith bit of the ciphertext, and pi; ci ∈ f0; 1 g. phertext without the key in the AES cipher. +e authors in A key is denoted by k � (k0, k1, ..., km−1), where m is the key [28] attacked on the round-reduced Speck32/64 by using j length and ki is the ith bit of the key, ki ∈ f0; 1 g. Let kji deep residual neural networks, where they trained the neural denote the key bits from the ith bit to the jth bit of the key, networks to distinguish the output of Speck with a given j that is, kji ≜ (ki; ki+1; ... ; kj). A block cipher is specified by input difference based on the chosen plaintext attack. +e an encryption function, E(p, k), that is, c � E(p, k). attack in [28] is similar to the classical differential crypt- analysis. However, the previous work failed to attack the full 2. Related Work rounds of lightweight block ciphers, and moreover, they failed to develop a generic deep learning- (DL-) based ML has been successfully applied in a wide range of areas cryptanalysis model.