Improved Differential Cryptanalysis of the Ultra-Lightweight Block Cipher PICO

Abstract

PICO is an ultra-lightweight substitution–permutation network block cipher designed for resource-constrained devices such as Internet of Things terminals and edge agents. For fixed endpoints, summing the characteristic probabilities over an enumerated finite weight window gives a verifiable lower bound on the differential probability. We use a PICO-specific workflow that combines mixed-integer linear programming bounds on active substitution boxes, exact-weight Boolean satisfiability search, optional Matsui pruning, and fixed-endpoint enumeration. For the selected endpoints, enumeration over W=63,…,76 and W=66,…,79 gives finite-window lower bounds of 2−59.95 and 2−61.95 for 21 and 22 rounds, respectively. We prepend two rounds and append three rounds to the 21-round differential distinguisher. The resulting 26-round analysis is an analytical equivalent-round-key filtering-and-ranking procedure for a 108-bit tuple. The verified 21-round finite-window probability input is a factor of 20.8032≈1.745 larger than the previously reported input, increasing the expected right-tuple support at fixed S under the analytical accounting. For the illustrative choice S=242, the analytical resources are D=262 chosen plaintexts, a normalized substitution-box filtering workload of T=2100.11 equivalent 26-round encryptions, and M=262 stored plaintext–ciphertext records. This setting is not tied to a demonstrated success probability and does not establish an equal-success complexity advantage over prior work.