Quantum Attackers Edge Closer to Breaking the Lightweight Cipher Simeck

…

…

The publication of these new quantum security results for Simeck arrives at a moment when the gap between theoretical quantum cryptanalysis and practical deployment is narrowing in ways that standards bodies can no longer ignore. Simeck, first presented at CHES 2015, was designed specifically to occupy a sweet spot between the bit-sliced simplicity of SIMON and the arithmetic efficiency of SPECK, and it has since been evaluated by several standards efforts, including the ISO/IEC 29192 lightweight cryptography project and the NIST lightweight cryptography standardization process, where its relatives were extensively benchmarked. The cipher’s compact key schedule, which reuses the same round function as the encryption routine, was celebrated as a hardware optimization, but the new analysis shows that this same structural regularity is precisely what allows probability-1 truncated differentials to propagate through many rounds and give rise to the periodic relations that Simon-type algorithms exploit. This is a recurring lesson in lightweight cryptography: features that minimize gate count and power consumption often create algebraic regularities that become liabilities once an adversary gains quantum query access.

The distinction between the Q1 and Q2 attack models deserves careful attention, because it determines how seriously these results should be weighed by practitioners. In the Q1 model, the adversary may run a quantum computer offline but can only make classical queries to the encryption oracle, which means Grover’s key search is essentially the best available generic attack and the security level is roughly halved relative to classical expectations. In the Q2 model, by contrast, the adversary can query the oracle in quantum superposition, which unlocks the full power of Simon’s algorithm and the Grover-meets-Simon framework. The distinction matters enormously for real systems: most current network protocols expose only classical interfaces, so Q2 attacks require an adversary who can submit superpositions of plaintexts to a cryptographic module. However, several practical scenarios make Q2 increasingly plausible, including cryptographic co-processors that accept quantum state inputs in emerging quantum network architectures, white-box implementations where the adversary controls the execution environment, and future protocols designed for quantum-native infrastructure. The authors’ decision to quantify both qCPA and qCCA variants is therefore not merely academic completeness; the qCCA setting, where decryption queries can also be made in superposition, models adversaries with even broader access to the cipher’s internals.

The methodological lineage of the new distinguishers is worth tracing because it illustrates how quantum cryptanalysis has matured from isolated observations into a systematic toolkit. Kuwakado and Morii’s original 2010 observation that Simon’s algorithm breaks three-round Feistel constructions seemed at first like a curiosity limited to toy constructions, since the hidden period only survived a handful of rounds. The subsequent decade transformed this observation into a research program: Kaplan and colleagues generalized the algorithm to functions with multiple colliding pairs, Leander and May invented the Grover-meets-Simon hybrid that converts distinguishers into key recovery, and Ito and colleagues developed the dimension-based testing method that extends periodic distinguishers into the chosen-ciphertext setting without needing to recover the period explicitly. The truncated-differential connection established by Xiang and colleagues in 2024 represents the most recent and arguably most consequential step, because it provides a bridge between the enormous classical literature on differential cryptanalysis and the quantum periodicity toolkit. Any cipher for which cryptanalysts have already computed high-probability truncated differentials now has a ready-made pathway to quantum distinguishers, which means the quantum security of a cipher can be partially inferred from its classical differential profile.

Applying this machinery to Simeck yields a coherent picture of where the cipher’s quantum weaknesses lie. The active-set propagation procedure that the authors apply produces probability-1 truncated differentials spanning 7, 8, and 10 rounds for the three Simeck variants, and these differentials in turn yield Simon-type distinguishers covering 8, 9, and 11 rounds in the qCPA model. The two-round extension technique then pushes the qCCA distinguishers to 10, 11, and 13 rounds. The fact that the qCPA round counts exactly match those found by Lu and colleagues through an automated symbolic search is itself informative: it suggests that the truncated-differential route and the symbolic-search route are converging on the same structural limit of the cipher, namely the maximum depth at which the round function’s linear structure preserves a usable period relation. When two independent methodologies agree on the boundary, confidence grows that the result reflects a genuine property of the cipher rather than an artifact of a particular search strategy.

The key-recovery results deserve particular scrutiny because distinguishers alone do not break a cipher. The Grover-meets-Simon framework works by using the periodic distinguisher to filter candidate values of a partial subkey: only the correct guess preserves the hidden period through the distinguisher’s rounds, so a quantum period-finding procedure can verify guesses in superposition, and Grover amplification then searches the remaining key space. The authors report that their qCPA key-recovery attacks reach 11, 12, and 14 rounds of Simeck-32, Simeck-48, and Simeck-64 respectively, with the qCCA variants extending to 13, 14, and 16 rounds. The empirical query complexities of roughly 2 to the power 28.09, 40.32, and 52.59 in the qCPA setting, and 26.81, 39, and 51.17 in the qCCA setting, are notable for being derived from actual implementation experiments rather than purely asymptotic counting. This empirical grounding matters because Grover-meets-Simon attacks carry subtle correctness conditions: the decision test that separates correct from incorrect subkey guesses can produce false positives, and the authors’ explicit false-positive estimates represent a level of rigor that earlier papers in this line often lacked.

The qubit and depth accounting also deserves attention from an implementation standpoint. The authors treat one reversible Simeck round as a single round-function layer with order-n elementary gates per layer, and they parallelize the samples belonging to a single decision test in depth. For resource-constrained analysis, the relevant question is not merely the query count but whether the required quantum circuit fits within plausible fault-tolerant hardware budgets. A 64-bit cipher like Simeck-64 requires on the order of 2 to the power 52.59 quantum queries for the qCCA key-recovery attack, which is far beyond any foreseeable quantum machine, but the structure of the estimate is what matters for long-term planning: as quantum hardware scales, the security margin of each Simeck variant erodes in a predictable, quantifiable way rather than collapsing abruptly.

The relationship between these quantum results and the classical cryptanalytic record of Simeck is carefully handled in the paper and merits emphasis. Zhang and colleagues previously mounted impossible-differential attacks covering 20, 25, and 27 rounds of the three variants, which superficially looks like far better coverage than the 13 to 16 rounds achieved here. The authors correctly note that these figures are not directly comparable: impossible-differential attacks are classical differential eliminations that assume only classical oracle access, whereas the quantum attacks assume superposition queries and exploit period relations and amplitude amplification. A cipher can therefore be resistant to 27 rounds of classical impossible-differential analysis while remaining vulnerable in far fewer rounds to a quantum adversary with superposition access. This complementarity is a general feature of modern cryptanalysis: classical and quantum attack surfaces must be evaluated in parallel, and neither subsumes the other. Standards bodies drafting post-quantum guidance for symmetric primitives increasingly recognize that the relevant question is not whether a cipher is quantum-broken in the Shor sense, which no symmetric cipher is, but how its effective security level degrades across the Q1 and Q2 models.

For the broader lightweight cryptography ecosystem, the Simeck results carry implications beyond the cipher itself. SIMON and SPECK, Simeck’s direct ancestors, have already been subjected to similar Simon-type analyses, and the family resemblance means that lessons transfer in both directions. The rotation offsets that Simeck altered relative to SIMON were chosen to improve hardware efficiency, and the new analysis implicitly tests whether those altered offsets changed the differential-periodic structure in a security-relevant way. The fact that the distinguisher depths track the block size in the expected manner suggests that Simeck’s modifications did not introduce new quantum weaknesses beyond those inherited from its lineage, but they also did not strengthen the cipher against this particular attack class. Designers of future lightweight ciphers may want to treat resistance to probability-1 truncated differential propagation as an explicit design criterion, alongside the classical criteria of differential uniformity and linear branch number, since the quantum toolkit now converts such differentials into distinguishers with only a two-round extension penalty in the chosen-ciphertext model.

Looking forward, several open questions follow naturally from this work. The gap between the qCPA and qCCA distinguisher depths, consistently two rounds across all three variants, reflects the current limit of the two-round extension technique, and closing that gap with improved qCCA criteria would immediately deepen the key-recovery attacks correspondingly. Similarly, the interplay between the false-positive behavior of the decision test and the overall query complexity suggests room for optimization: a more selective test would reduce the number of Grover iterations needed, potentially improving the empirical constants. Finally, the empirical methodology itself, in which the authors validate period relations under the actual Simeck key schedule rather than assuming arbitrary round keys, sets a standard that future quantum cryptanalyses of lightweight ciphers should emulate, since key-schedule regularities can either invalidate or unexpectedly strengthen period relations in ways that idealized analyses miss.

Subject of Research: New results on the quantum security analysis of lightweight block cipher Simeck

Article Title: New results on the quantum security analysis of lightweight block cipher Simeck

Article References: Ding, Q., Ren, J., & Chen, S. (2026). New results on the quantum security analysis of lightweight block cipher Simeck. Cybersecurity, 9(1), Article 242. https://doi.org/10.1186/s42400-026-00666-4

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00666-4

Keywords: results, quantum, security, analysis, lightweight, block, cipher, Simeck, scientific research