Linear cryptanalysis of 30-round LBC-IoT algorithm

In order to evaluate the ability of LBC-IoT algorithm to resist linear cryptanalysis, the set of linear approximations with the longest number of rounds was solved based on the MILP automated search technique using both direct search and iterative linear approximation loop construction methods and obtained the initial key guessing basis for each linear approximation with the longest possible number of extended rounds. The initial key guessing basis was further compressed by combining the minimum guessing basis technique, which filtered out the optimal linear approximation for key recovery attack. The results show that the LBC-IoT algorithm had a total of 6 linear approximations of 23 rounds with linear bias of 2-15, among which there existed the only optimal linear approximation with a minimum guessing basis size of only 52 bit. The first key recovery attack of up to 30 rounds was launched against the LBC-IoT algorithm based on the upward and downward expansion of this distinguisher by 3 and 4 rounds, respectively. The data, time, and storage complexity of this attack was 230 KP, 277.9 30 rounds of encryption, and 252, respectively. Compared with the existing results, the number of rounds of the attack has been increased by 4 rounds as a whole, which leads to less than 7% of the security redundancy rounds of the LBC-IoT algorithm, which is not recommended to use in practical communication data encryption anymore.