Abstract Differential-linear (DL) cryptanalysis divides the target cipher $E$ into three part, i.e. $E = E_{2} \circ E_{m} \circ E_{1}$. Existing DL distinguishers search frameworks typically begin by estimating the theoretical correlation of $E_{m}$, followed by an experimental evaluation to determine its precise value. However, the deviation between the actual correlation and the theoretical correlation often renders the distinguishers identified by the models invalid. In this paper, we propose a pre-pruning technique to reduce the frequency of invalid distinguishers and improve the existing Mixed-Integer Linear Programming (MILP)-based DL distinguishers search frameworks. Specifically, we first filter the output differences of $E_{d}$ according to the probability of one-round differential characteristics. Subsequently, we identify the high-correlation bits of the output mask of the middle part and designate the low-correlation bits as inactive mask bits in our MILP models for each selected difference. Our pre-pruning technique significantly reduces the number of low-correlation distinguishers in the model’s solution pool, allowing our tool to identify more valid DL distinguishers from a larger pool of higher quality candidates under limited computing resources. As an application, we find $12$-round and nine-round DL distinguishers for GIFT-64 and LELBC, respectively, and improve the best-known $13$-round DL distinguisher of PRESENT by one round. To the best of our knowledge, our nine-round DL distinguisher is the best distinguisher for LELBC in the single-key scenario.

$\textsf {Simon}$and$\textsf {Simeck}$are two famous lightweight block cipher families, both of which have good implementation performance benefiting from their extremely simple round functions. So, they are suitable and friendly in use for the Internet of Things devices that require high security but low-latency and low-energy. In this article, we aim to improve the mixed-integer linear programming/mixed-integer quadratic constraint programming (MILP/MIQCP)-based method, to find better differential-linear (DL) distinguishers for the above ciphers, which can be exploited to mount distinguishing or key-recovery attacks. In particular, first, we give the completely precise mixed-integer linear programming (MILP) model to describe the linear part, and utilize the general expressions of$\textsf {Gurobi}$optimizer to model middle part in a quite easy way. Second, to explore DL trails in a reasonable time, we propose two heuristic strategies to speed up the searching process. Lastly, we introduce the transforming technique, which exploits the clustering effect on DL trails, to improve the estimated correlation of the DL approximation. By applying our enhanced method, we improve the DL distinguisher correlation from$2^{-59.75}$to$2^{-59.62}$for 32-round$\textsf {Simon128}$, and extend the number of longest rounds of valid DL distinguishers for$\textsf {Simon32/48/64/96}$from$11/16/16/25$to$14/17/21/26$. For$\textsf {Simeck}$, we do not outperform the currently best work, but refresh Zhou et al.’s results (the first work to automate finding DL distinguishers for$\textsf {Simon/Simeck}$using MILP/MIQCP). Our work not only provides a new insight on the automatic DL cryptanalysis, but also further confirms that$\textsf {Simon}$and$\textsf {Simeck}$are sufficiently strong to resist the DL attacks.

The SM4 block cipher is standardized in ISO/IEC, and it is also the national standard of commercial cryptography in China. In this paper, we propose two new techniques called “split‐and‐join” and “off‐peak and stagger” to make SM4 more applicable to resource‐constrained environments. The area optimization method uses a 1‐bit data path while reducing the number of registers from 64 to 8 and the number of XOR gates from 194 to 8. As a result, we report a 1‐bit‐serial SM4 encryption circuit that occupies 1771 GE with a latency of 2,336 cycles. Additionally, the “off‐peak and stagger” technique compresses all the operations within the state update and key schedule into 32 clock cycles to reduce the latency. In other words, it takes 32 clock cycles to complete one round encryption. The new circuit occupies 1861 GE with a latency of 1,344 cycles. Moreover, we also discuss how to further reduce the latency by increasing the data path with a small area overhead to provide wider area‐latency tradeoffs for SM4. Our designs make SM4 competitive with many ciphers specifically designed for lightweight cryptography.