Boomerang cryptanalysis of SAND

This paper investigates the security of a lightweight block cipher SAND that has an AND-RX construction. We evaluate its security against boomerang (and rectangle) attacks. First, we analyse SAND ’s boomerang switching properties from the perspective of the AND operation and when SAND ’s nonlinear operations are represented by synthetic S-boxes. We then develop an automated search for boomerang trails that uses the boomerang connectivity table. From the initial boomerang trail, we construct a rectangle distinguisher by enumerating other boomerang trails with the same input and output differences. We found 13-round and 17-round rectangle distinguishers for SAND -64 and SAND -128 with distinguishing probabilities 2 − 43 . 23 and 2 − 95 . 54 respectively. These rectangle distinguishers were used in key recovery attacks on 15 and 19 rounds of SAND -64 and SAND -128 with (time/data/memory) complexities of ( 2 63 . 09 , 2 56 , 2 59 ) and ( 2 123 . 75 , 2 114 , 2 122 ) respectively. In these attacks, we leverage the fact that input differences propagate deterministically over SAND ’s first round. To the best of our knowledge, these are the first boomerang attacks on SAND . • First boomerang/rectangle distinguishers for the lightweight block cipher SAND. • First key-recovery attacks based on boomerang/rectangle distinguishers for SAND. • Automated boomerang search model for SAND. • Analysis of SAND’s boomerang connectivity properties.