In this paper, we propose an automatic tool to search for optimal differential and linear trails in ARX ciphers. It’s shown that a modulo addition can be divided into sequential small modulo additions with carry bit, which turns an ARX cipher into an S-box-like cipher. From this insight, we introduce the concepts of carry-bit-dependent difference distribution table (CDDT) and carry-bit-dependent linear approximation table (CLAT). Based on them, we give efficient methods to trace all possible output differences and linear masks of a big modulo addition, with returning their differential probabilities and linear correlations simultaneously. Then an adapted Matsui’s algorithm is introduced, which can find the optimal differential and linear trails in ARX ciphers. Besides, the superiority of our tool’s potency is also confirmed by experimental results for round-reduced versions of HIGHT and SPECK. More specifically, we find the optimal differential trails for up to 10 rounds of HIGHT, reported for the first time. We also find the optimal differential trails for 10, 12, 16, 8 and 8 rounds of SPECK32/48/64/96/128, and report the provably optimal differential trails for SPECK48 and SPECK64 for the first time. The optimal linear trails for up to 9 rounds of HIGHT are reported for the first time, and the optimal linear trails for 22, 13, 15, 9 and 9 rounds of SPECK32/48/64/96/128 are also found respectively. These results evaluate the security of HIGHT and SPECK against differential and linear cryptanalysis. Also, our tool is useful to estimate the security in the design of ARX ciphers.

中文翻译：

---

一种在ARX密码中搜索最优差分和线性路径的新方法

在本文中，我们提出了一种自动工具来搜索 ARX 密码中的最佳差分和线性路径。结果表明，模加法可以分解为带有进位的连续小模加法，从而将 ARX 密码变成类 S-box 密码。基于此，我们引入了进位相关差分分布表 (CDDT) 和进位相关线性近似表 (CLAT) 的概念。基于它们，我们提供了有效的方法来跟踪所有可能的输出差异和大模加法的线性掩码，同时返回它们的微分概率和线性相关性。然后介绍了一种适应的Matsui 算法，它可以在ARX 密码中找到最优的差分和线性路径。除了，HIGHT 和 SPECK 的圆形简化版本的实验结果也证实了我们工具效力的优越性。更具体地说，我们找到了第一次报告的最多 10 轮 HIGHT 的最佳差异轨迹。我们还找到了 10、12、16、8 和 8 轮 SPECK32/48/64/96/128 的最佳差分路径，并首次报告了 SPECK48 和 SPECK64 可证明的最佳差分路径。首次报道了高达 9 轮 HIGHT 的最佳线性轨迹，并分别找到了 22、13、15、9 和 9 轮 SPECK32/48/64/96/128 的最佳线性轨迹。这些结果评估了 HIGHT 和 SPECK 针对差分和线性密码分析的安全性。此外，我们的工具可用于评估 ARX 密码设计中的安全性。