This page uses content from Wikipedia and is licensed under CC BY-SA.

Speck (cipher)

Speck block cipher 0 indexing.svg
3 rounds of Speck with 2-word key schedule
Designers Ray Beaulieu, Douglas Shors, Jason Smith, Stefan Treatman-Clark, Bryan Weeks, Louis Wingers NSA
First published 2013
Related to Simon, Threefish
Cipher detail
Key sizes 64, 72, 96, 128, 144, 192 or 256 bits
Block sizes 32, 48, 64, 96 or 128 bits
Structure ARX
Rounds 22–34 (depending on block and key size)
Speed 2.6 cpb (5.7 without SSE) on Intel Xeon 5640 (Speck128/128)
Best public cryptanalysis
Differential cryptanalysis can break 17 rounds of Speck128/128 with 2113 data, 222 bytes memory and time complexity of 2113.[1] Rectangle attack can break 18 rounds of Speck128/192,256 with 2121.9 data, 2125.9 bytes memory and time complexity of 2182.7.[2]

Speck is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013.[3] Speck has been optimized for performance in software implementations, while its sister algorithm, Simon, has been optimized for hardware implementations. Speck is an add-rotate-xor (ARX) cipher.

The NSA began working on the Simon and Speck ciphers in 2012. The agency anticipated some agencies in the US federal government would need a cipher that would operate well on a diverse collection of Internet of Things devices while maintaining an acceptable level of security.[4]

Cipher description

Speck supports a variety of block and key sizes. A block is always two words, but the words may be 16, 24, 32, 48 or 64 bits in size. The corresponding key is 2, 3 or 4 words. The round function consists of two rotations, adding the right word to the left word, xoring the key into the left word, then and xoring the left word to the right word. The number of rounds depends on the parameters selected, as follows:[3]

Block size (bits) Key size (bits) Rounds
2×16 = 32 4×16 = 64 22
2×24 = 48 3×24 = 72 22
4×24 = 96 23
2×32 = 64 3×32 = 96 26
4×32 = 128 27
2×48 = 96 2×48 = 96 28
3×48 = 144 29
2×64 = 128 2×64 = 128 32
3×64 = 192 33
4×64 = 256 34

The key schedule uses the same round function as the main block cipher.

Reference code

The following is the designers' reference implementation, written in C, of the Speck variant with a 128-bit block size and key, where key = (K[1], K[0]). It is adapted from their IACR ePrint.[3]

#include <stdint.h>

#define ROR(x, r) ((x >> r) | (x << (64 - r)))
#define ROL(x, r) ((x << r) | (x >> (64 - r)))
#define R(x, y, k) (x = ROR(x, 8), x += y, x ^= k, y = ROL(y, 3), y ^= x)
#define ROUNDS 32

void encrypt(uint64_t ct[2],
             uint64_t const pt[2],            
             uint64_t const K[2])
   uint64_t y = pt[0], x = pt[1], b = K[0], a = K[1];

   R(x, y, b);
   for (int i = 0; i < ROUNDS - 1; i++) {
      R(a, b, i);
      R(x, y, b);

   ct[0] = y;
   ct[1] = x;

For 16-bit words, the rotates are 7 bits right and 2 bits left; for all other word sizes, they are 8 and 3 as shown here.

If the key is more than 2 words long, there are 2 or 3 a values, which are used in rotation.


The original Speck paper does not explicitly state the endianness of bytes when the plaintext block is interpreted as the two words used in the cipher algorithm. The test vectors given in the paper suggest big-endian order. However, the authors of the algorithm have advised some implementers[5] that little-endian byte order is to be used for keys, plaintext, and ciphertext, and the practice was accepted by others[6].


According to ECRYPT's stream cipher benchmarks (eBASC), Speck is one of the fastest ciphers available, both for long as well as short messages and is comparable in speed to the stream cipher Salsa20. Some median performances for long messages (128-bit, 128-block size version) are: 1.99 cycles per byte (cpb) on an AMD Ryzen 7 1700; 1.27 cpb on an Intel Core i5-6600; 15.96 cpb on a Broadcom BCM2836 Cortex A7.[7]

When implemented on 8-bit AVR microcontroller, Speck encryption with 64b blocks and 128b key consumes 192 bytes of Flash, temporary variables consume 112 bytes of RAM, and takes 164 cycles to encrypt each byte in the block.[8]

Opposition to ISO approval

German, Japanese and Israeli delegates to the International Organization for Standardization have opposed efforts by the NSA to standardise the Simon and Speck ciphers, citing concerns that the NSA is pushing for their standardisation with knowledge of exploitable weaknesses in the ciphers, based on partial evidence of weaknesses in the ciphers, lack of clear need for standardisation of the new ciphers, and the NSA's previous involvement in the creation and promotion of the backdoored Dual_EC_DRBG cryptographic algorithm.[9]


  1. ^ Dinur, Itai (2014-08-31). "Improved Differential Cryptanalysis of Round-Reduced Speck". Retrieved 2016-09-20. 
  2. ^ Abed, Farzaneh; List, Eik; Lucks, Stefan; Wenzel, Jakob (2013-10-09). "Cryptanalysis of the Speck Family of Block Ciphers". Retrieved 2016-09-20. 
  3. ^ a b c Beaulieu, Ray; Shors, Douglas; Smith, Jason; Treatman-Clark, Stefan; Weeks, Bryan; Wingers, Louis (2013-06-19). "The SIMON and SPECK Families of Lightweight Block Ciphers". Retrieved 2016-09-20. 
  4. ^ Beaulieu, Ray; Shors, Douglas; Smith, Jason; Treatman-Clark, Stefan; Weeks, Bryan; Winger, Louis (2015-07-09). "Simon and Speck: Block Ciphers for the Internet of Things" (PDF). Retrieved 2017-11-23. 
  5. ^ "Re: [PATCH 0/5] crypto: Speck support". Retrieved 2018-04-12. 
  6. ^ "SPECK - Crypto++ Wiki". Retrieved 2018-04-12. 
  7. ^ "ECRYPT Benchmarking of Stream Ciphers". Retrieved 22 June 2017. 
  8. ^ "The Simon and Speck Block Ciphers on AVR 8-bit Microcontrollers" (PDF). Retrieved 25 September 2017. 
  9. ^ "Distrustful U.S. allies force spy agency to back down in encryption fight".