IACR Transactions on Symmetric Cryptology
type: channel
description: The IACR Transactions on Symmetric Cryptology is a scholarly journal for timely research papers on symmetric cryptology that seeks to combine the benefits of fast conference turnaround with consistent journal reviewing.
publisher: Ruhr-Universität Bochum
language: en
publication name: IACR Transactions on Symmetric Cryptology
issn: 2519-173X
items: Chosen-IV Algebraic Attack on Randomized Ciphers FASTA and HERA
items: Cube Attacks with Elimination Strategy: Key Recovery Attacks on Trivium
items: Improved Cryptanalysis of GIFT-64
items: Generic Attacks on Double Block Length Sponge Hashing
items: On the Plaintext Awareness of AEAD Schemes
items: On Constructing AEs with Leakage and Faults
items: How to Implement Authenticated Encryption on XTS-Enabled Devices
items: THF: Designing Low-Latency Tweakable Block Ciphers
items: Dialga: A Family of Low-Latency Tweakable Block Ciphers Using Multiple Linear Layers
items: BEANIE – A 32-bit Cipher for Cryptographic Mitigations Against Software Attacks
items: Nostalgia Cipher: Can Filtered LFSRs Be Secure Again? An Application to Hybrid Homomorphic Encryption with Sub-50 ms Latency
items: Trail-Estimator: An Automated Verifier for Differential Trails in Block Ciphers
items: Divide-and-Conquer SAT for Exploring Optimal Differential and Linear Characteristics and Its Applications
items: SAT-Based Space Partitioning and Applications to Ascon-Hash256 Cryptanalysis
items: Linear Cancellations in the MitM Attacks on Sponge Functions
items: Mix-Basis Geometric Approach to Boomerang Distinguishers
items: Cryptanalysis: Theory Versus Practice
items: Observations on the BayesianKeySearch with Applications to Simon and Simeck
items: Generalizations of ChiChi: Families of Low-Latency Permutations in Any Even Dimension
items: MDS Diffusion Layers for Arithmetization-Oriented Symmetric Ciphers: The Rotational-Add Construction
items: New General MDS Matrix Construction Method Towards Low Area
items: The Large Block Cipher Vistrutah
items: LEAP: High-Performance Lattice-Based Pseudorandom Number Generator
items: HCTR+: An Optimally Secure TBC-Based Accordion Mode
items: Minimized PRFs from Public Permutations
items: Revisiting Vector-Input MACs
items: SoK: On Shallow Weak PRFs
items: Attacking Split-and-Lookup-Based Primitives Using Probabilistic Polynomial System Solving
items: Multidimensional Linear Cryptanalysis of AEGIS
items: Chosen-Key Distinguishing Attacks on Full AES-192, AES-256, Kiasu-BC, and More

Chosen-IV Algebraic Attack on Randomized Ciphers FASTA and HERA
type: item
description: Fully homomorphic encryption (FHE) enables computation on encrypted data without decryption, providing strong guarantees for privacy-preserving applications. However, its practicality heavily depends on the efficiency of the underlying cryptographic primitives. To this end, FHE-friendly symmetric ciphers have been designed to achieve a balance between security and homomorphic efficiency. Among them, FASTA (a variant of Rasta) and HERA are two FHE-friendly symmetric-key primitives proposed at CT-RSA 2022 and ASIACRYPT 2021, respectively. Previous cryptanalytic results of FASTA and HERA were achieved by peeling off the last nonlinear layer. In this paper, we present an improved algebraic cryptanalysis of FASTA by exploiting structural properties of its affine layers through chosen-IV algebraic attacks. We demonstrate that both the first and last nonlinear layers of FASTA can be removed, which significantly reduces the algebraic degree of the resulting system. As a result, we achieve the first key-recovery attack on 4-round FASTA, with time complexity about 2118.8, memory complexity 294.2, and data complexity 234.1, improving the best attack by 1 round. Overall, our findings reveal exploitable algebraic weaknesses in the affine layer of FASTA. For HERA, our refined chosen-IV algebraic attack based on the eXtended Linearization (XL) algorithm significantly enlarges the feasible parameter range, enabling attacks on prime moduli that were previously considered out of reach. This is mainly because the integration of the XL algorithm further decreases the number of keystream words required during the online phase of the chosen-IV algebraic attack, thus reducing the cost of its offline phase, i.e., a better tradeoff between the offline and online complexity can be achieved in our improved attack. This highlights the central role of the XL algorithm in enabling efficient algebraic attacks on FHE-friendly symmetric ciphers.
subject: Articles
  topic: section
subject: FASTA
  topic: keywords
subject: HERA
  topic: keywords
subject: XL
  topic: keywords
subject: chosen-IV attack
  topic: keywords
subject: algebraic attack
  topic: keywords
creator: Fukang Liu
creator: Tianning Wang
creator: Jianqiang Ni
creator: Daisuke Yamamoto
creator: Guilherme T. S. Sato
creator: Haoyang Wang
creator: Willi Meier
rights: Copyright (c) 2025 Fukang Liu, Tianning Wang, Jianqiang Ni, Daisuke Yamamoto, Guilherme T. S. Sato, Haoyang Wang, Willi Meier http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 357
ending page: 380
doi: 10.46586/tosc.v2025.i4.357-380

Cube Attacks with Elimination Strategy: Key Recovery Attacks on Trivium
type: item
description: In this paper, we present a novel framework for cube attacks named cube attacks with elimination strategy. The core idea is to find specific key conditions and cubes such that their superpolies under these key conditions can be efficiently computed. By recovering these conditional superpolies, we can solve the corresponding equation system and thereby retrieve key information. If a sufficient number of such key conditions can be found, the attack can be extended to a larger key space. To apply this framework in practical attacks, we propose the following techniques. First, we propose a nested coefficient solver that combines variable substitution and symbolic computation to efficiently recover superpolies, and present the conditional monomial prediction technique to rapidly recover conditional superpolies. Second, by combining numeric mapping with monomial prediction techniques, we propose an automated cube search algorithm that is capable of generating a large number of good cubes for attacks. Finally, we develop two kinds of testing methods, which are used to efficiently extract substantial key information from large-scale equation systems. To illustrate the power of our techniques, we apply them to Trivium. As a result, for 840 rounds of Trivium, a practical key recovery attack is mounted with complexity below 255 and a success rate 77.8%. For 845 rounds, we present a practical key recovery attack with complexity below 256 and a success rate 98.1% for 280 x 59.1% keys. For 855 rounds, we present a theoretical weak-key recovery attack for 274 keys. To the best of our knowledge, these are the best practical and theoretical attacks on Trivium. The improvements in the number of rounds reached are 13 for practical attacks and 4 for theoretical attacks, respectively.
subject: Articles
  topic: section
subject: Cube Attack
  topic: keywords
subject: Superpoly
  topic: keywords
subject: Monomial Prediction
  topic: keywords
subject: Numeric Mapping
  topic: keywords
subject: Cube Search
  topic: keywords
subject: Trivium
  topic: keywords
creator: Haoran Li
creator: Shichang Wang
creator: Meicheng Liu
creator: Willi Meier
creator: Dongdai Lin
rights: Copyright (c) 2025 Haoran Li, Shichang Wang, Meicheng Liu, Willi Meier, Dongdai Lin http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 308
ending page: 356
doi: 10.46586/tosc.v2025.i4.308-356

Improved Cryptanalysis of GIFT-64
type: item
description: In this paper, we propose new differential attacks against the block cipher GIFT-64. First we demonstrate how the parallel matching algorithm proposed by Naya-Plasencia at CRYPTO’11 as an advanced list-merging algorithm can be leveraged to enhance differential attacks, overcoming a previously assumed bottleneck. By reducing the complexity of the pairs generation process whenever a non-linear filter is available, this approach enabled us to mount a new differential attack against 25-round GIFT-64 in the related-key setting. Then we use the differential Meet-in-the-Middle cryptanalysis technique introduced by Boura et al. at CRYPTO’23 to improve the differential attacks recently proposed by Chang et al. at CT-RSA’25, leading to the best known attacks against GIFT-64 in the single-key setting, both in term of number of rounds and of complexity.
subject: Articles
  topic: section
subject: symmetric cryptanalysis
  topic: keywords
subject: GIFT
  topic: keywords
subject: differential attacks
  topic: keywords
subject: key-recovery
  topic: keywords
subject: list merging algorithms
  topic: keywords
subject: differential meet-in-the-middle attacks
  topic: keywords
creator: Patrick Derbez
creator: Baptiste Germon
creator: Bastien Michel
creator: María Naya-Plasencia
rights: Copyright (c) 2025 Patrick Derbez, Baptiste Germon, Bastien Michel, María Naya-Plasencia http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 284
ending page: 307
doi: 10.46586/tosc.v2025.i4.284-307

Generic Attacks on Double Block Length Sponge Hashing
type: item
description: The sponge construction is one of the main modes of operation for hash functions. Using a permutation of width b = r + c, the sponge construction with rate r and capacity c is indifferentiable up to Ω(2c/2) permutation calls. In this paper we study variants of the sponge construction that use two permutations in parallel in order to increase the state size: the XOR combiner, and the double sponge construction of Lefevre and Mennink. We focus on the indifferentiability security, and we obtain new distinguishers on these constructions based on a variant of the 4-sum problem that we denote the multiple 4-sum problem. First, we show that the XOR combiner does not increase the indifferentiability bound when applied to sponge hash functions, with a tight generic attack with complexity ˜Õ(2c/2). This improves over folklore results that require ˜Õ(2b/2) operations to find internal state collisions, and justifies the more involved double sponge construction. Indeed, by mixing the two internal states after every permutation call, the double sponge achieves security beyond the birthday bound, with a security proof up to Ω(22c/3) permutation calls. However, the proof is not tight: the best generic attack has complexity O(2c+r/2), and Lefevre and Mennink show a simulator-specific attack with complexity O(22c/3+r/3). We reduce this gap by showing a dedicated attack against the double sponge, with complexity O(2c) in general, and O(max(23c/4, 2c−r/3)) with the specific mixing matrix used by Lefevre and Mennink. In particular, we observe that the complexity of our attack decreases with r (for a fixed c), while previous attacks have a complexity that increases with r.
subject: Articles
  topic: section
subject: Generic attacks
  topic: keywords
subject: Distinguisher
  topic: keywords
subject: Hash function
  topic: keywords
subject: Combiners
  topic: keywords
subject: Sponge
  topic: keywords
creator: Gaëtan Leurent
creator: César Mathéus
rights: Copyright (c) 2025 Gaëtan Leurent, César Mathéus http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 262
ending page: 283
doi: 10.46586/tosc.v2025.i4.262-283

On the Plaintext Awareness of AEAD Schemes
type: item
description: Plaintext-awareness of AEAD schemes is one of the more obscure and easily misunderstood notions. Originally proposed by Andreeva et al., Mennink and Talnikar showed in 2025 that the original definitions are vague and leave too much room for interpretation. They presented new definitions and analyzed the three main AEAD compositions relative to the new definitions. In particular, they showed that MAC-then-Encrypt (MtE) is not plaintext-aware. However, they showed that an SIV-style variant is indeed plaintext-aware. In this work, we first show that their analysis contains a gap, voiding their proof. We show this by showing several attacks; against their choice of extractor, with trivial complexity, and against any extractor, with birthday-bound complexity. Next, we re-establish their results by designing a new extractor that captures their intended goal and prove a tight PA1 security bound. We also show that the result is not dependent on the encryption scheme used, by showing that an extractor can also be designed for sMtE[ΘCB3], a variant where the encryption step is done by an ΘCB3-like scheme. Afterwards, we strengthen their results, by revisiting other compositions. In particular, we show that Encrypt-then-MAC (EtM) is in fact PA2-secure. Furthermore, we show that SIV-style MtE cannot be PA2-secure. Additionally, we show that Encode-then-Encipher is also PA2-secure, but not beyond the first successful forgery. More importantly, we show that up to some necessary assumptions, PA2 and RAE are equivalent. This result, while positive, holds only up to the first successful forgery. This indicates that the PA2 formalization maybe too strong for practical schemes, since we believe RAE sufficient for intuitive security. Last but not least, we investigate the value of the notion of plaintext awareness. We look deeper into the relation between plaintext awareness and confidentiality. We show that the problem of confidentiality in the presence of release of unverified plaint…
subject: Articles
  topic: section
subject: Plaintext awareness
  topic: keywords
subject: AEAD
  topic: keywords
subject: Leakage
  topic: keywords
subject: Release of unverified plaintext
  topic: keywords
subject: Confidentiality
  topic: keywords
creator: Mario Marhuenda Beltrán
creator: Mustafa Khairallah
rights: Copyright (c) 2025 Mario Marhuenda Beltrán, Mustafa Khairallah http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 231
ending page: 261
doi: 10.46586/tosc.v2025.i4.231-261

On Constructing AEs with Leakage and Faults
type: item
description: Physical attacks are one of the potent threats to modern cryptography. Symmetric-key primitives are well-explored with respect to passive, active, and more recently combined (i.e., simultaneously leaking and faulting) adversaries. For symmetric key operating modes, there are many proposals for encryption (ENC), Message Authentication Codes (MAC), and Authenticated Encryption (AE) covering passive attacks. However, research on active or combined adversaries is more succinct and, to the best of our knowledge, boils down to combined secure MAC due to Berti et al. (ToSC 2023, issue 1), combined secure ENC due to Dobraunig et al. (CCS’22), and active secure AE named MEM due to Saha et al. (ToSC 2022, issue 4). Our first contribution is a security model to formally reason about the combined security of AE. The model extends the fault-then-leak security of MAC introduced by Berti et al. to AE and can also be seen as a natural extension of state-of-the-art leakage resistant notions in their so-called faulty matrix framework. Armed with this model, we show as a second contribution that all the leakage-resilient, including leakage-resistant, AE constructions and the fault-resilient MEM construction are vulnerable to a single fault injection within the composition of their building blocks. These decoupling attacks remain successful even for combined-secure building blocks. As a result, we finally present LEAF, the first AE construction secure against faultthen- leak adversaries with a single fault injection. In encryption, LEAF makes only one call to a MAC and two calls to an ENC that are combined secure.
subject: Articles
  topic: section
subject: Faults
  topic: keywords
subject: Side-Channels
  topic: keywords
subject: Combined Security
  topic: keywords
subject: Authenticated Encryption
  topic: keywords
creator: Thomas Peters
creator: Sayandeep Saha
creator: Yaobin Shen
creator: François-Xavier Standaert
rights: Copyright (c) 2025 Thomas Peters, Sayandeep Saha, Yaobin Shen, François-Xavier Standaert http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 199
ending page: 230
doi: 10.46586/tosc.v2025.i4.199-230

How to Implement Authenticated Encryption on XTS-Enabled Devices
type: item
description: XTS is a block cipher mode for storage encryption. IEEE and NIST have standardized it, and it is widely deployed in real-world applications, including FileVault2, Bitlocker, and dm-crypt. However, it is well-known that XTS provides limited confidentiality and no integrity. XTS prevents simple attacks, e.g., information extraction from a stolen device. However, applications of XTS are expanding, such as cloud storage and CPU memory, where this issue implies a significant security threat. To address this issue, we propose iXTS, a family of black-box conversion methods of XTS into an authenticated encryption (AE). To make our proposal usable in practice, we need to assume that the only controllable part of the XTS engine is the plaintext input, because XTS engine’s ciphertext output is typically directly connected to the storage device and we assume the adversary is able to access the device directly, in addition to the black-box access to the engine. It is also desirable that the conversion could be done without the knowledge of the internal XTS key and without touching it. These constraints pose non-trivial technical challenges, and iXTS is the first effective solution meeting these constraints. We prove that each member of iXTS achieves n/2-bit security as a randomized AE using an n-bit block cipher. This security level is equivalent to popular AE modes such as GCM. iXTS is efficient as it requires no additional cryptographic computation beyond the original XTS. Plaintexts are expanded by a small amount, which is necessary for achieving AE. Our benchmarks on Intel platforms with AES-NI demonstrated that iXTS incurs only minor computation overhead from the underlying XTS.
subject: Articles
  topic: section
subject: XTS
  topic: keywords
subject: Authenticated encryption
  topic: keywords
subject: Storage encryption
  topic: keywords
creator: Akiko Inoue
creator: Kazuhiko Minematsu
creator: Rei Ueno
creator: Naofumi Homma
rights: Copyright (c) 2025 Akiko Inoue, Kazuhiko Minematsu, Rei Ueno, Naofumi Homma http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 167
ending page: 198
doi: 10.46586/tosc.v2025.i4.167-198

THF: Designing Low-Latency Tweakable Block Ciphers
type: item
description: We introduce the Three-Hash Framework (THF), a new instantiation of the LRW+ paradigm that employs three hash functions to process tweak inputs. We prove that THF achieves beyond-birthday-bound security under standard assumptions. By extending the general practical cryptanalysis framework to the multiple-tweak setting, we further demonstrate that THF offers balanced resistance to both singleand multiple-tweak attacks, thereby enabling the potential for lower latency compared to existing constructions. Building on this framework, we design Blink, a family of tweakable block ciphers optimized for ultra-low latency. Blink features logarithmic-depth Toeplitz-based hashing, which ensures efficient diffusion and scalability with varying tweak lengths. Our cryptanalysis shows that Blink achieves strong security with fewer rounds, while hardware evaluations confirm its superior latency performance. Notably, Blink maintains comparable latency even when the tweak length is doubled, underscoring the scalability advantage of THF.
subject: Articles
  topic: section
subject: Low latency
  topic: keywords
subject: THF
  topic: keywords
subject: Hash function
  topic: keywords
subject: Blink
  topic: keywords
creator: Jianhua Wang
creator: Tao Huang
creator: Guang Zeng
creator: Tianyou Ding
creator: Shuang Wu
creator: Siwei Sun
rights: Copyright (c) 2025 Jianhua Wang, Tao Huang, Guang Zeng, Tianyou Ding, Shuang Wu, Siwei Sun http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 125
ending page: 166
doi: 10.46586/tosc.v2025.i4.125-166

Dialga: A Family of Low-Latency Tweakable Block Ciphers Using Multiple Linear Layers
type: item
description: In this paper, we propose Dialga, a family of low-latency tweakable block ciphers designed to support 128/256-bit tweaks and 256-bit keys. Dialga achieves significantly small latency by leveraging multiple novel strategies. These include the use of multiple linear layers with efficient cell permutations, which enhance security against differential and linear attacks with negligible hardware overhead. We also identify the optimal choice of S-boxes for these permutations using state-ofthe- art evaluation methods by SAT, enabling us to further reduce the delay of the round function. Besides, we design a reflection tweakey schedule that ensures strong security in the related-tweak setting and allows for encryption and decryption without delay overhead, reducing the circuit area. We conducted comprehensive hardware benchmarks involving Dialga and other primitives. As a result, Dialga achieves nearly half the delay of QARMAv2, while achieving approximately a 40% reduction in area, with the same claimed security.
subject: Articles
  topic: section
subject: Ultra-low latency
  topic: keywords
subject: Tweakable block cipher
  topic: keywords
subject: Multiple linear layers
  topic: keywords
subject: Memory encryption
  topic: keywords
subject: Beyond 5G (B5G)
  topic: keywords
creator: Subhadeep Banik
creator: Tatsuya Ishikawa
creator: Takanori Isobe
creator: Ryoma Ito
creator: Kazuhiko Minematsu
creator: Kazuma Nakata
creator: Mostafizar Rahman
creator: Kosei Sakamoto
rights: Copyright (c) 2025 Subhadeep Banik, Tatsuya Ishikawa, Takanori Isobe, Ryoma Ito, Kazuhiko Minematsu, Kazuma Nakata, Mostafizar Rahman, Kosei Sakamoto http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 70
ending page: 124
doi: 10.46586/tosc.v2025.i4.70-124

BEANIE – A 32-bit Cipher for Cryptographic Mitigations Against Software Attacks
type: item
description: In modern CPU architectures, various security features to mitigate software attacks can be found. Examples of such features are logical isolation, memory tagging or shadow stacks. Basing such features on cryptographic isolation instead of logical checks can have many advantages such as lower memory overhead and more robustness against misconfiguration or low-cost physical attacks. The disadvantage of such an approach is however that the cipher that has to be introduced has a severe impact on the system performance, either in terms of additional cycles or a decrease of the maximum achievable frequency. Finally, as of today, there is no suitable low-latency cipher design available for encrypting 32-bit words as is common in microcontrollers. In this paper, we propose a 32-bit tweakable block cipher tailored to memory encryption for microcontroller units. We optimize this cipher for low latency, which we achieve by a careful selection of components for the round function and leveraging an attack scenario similar to the one used to analyze the cipher SCARF. To mitigate some attack vectors introduced by this attack scenario, we deploy a complex tweak-key schedule. Due to the shortage of suitable 32-bit designs, we compare our design to various low-latency ciphers with different block sizes. Our hardware implementation shows competitive latency numbers.
subject: Articles
  topic: section
subject: Low-latency block cipher
  topic: keywords
subject: Memory encryption
  topic: keywords
creator: Simon Gerhalter
creator: Samir Hodžić
creator: Marcel Medwed
creator: Marcel Nageler
creator: Artur Folwarczny
creator: Ventzi Nikov
creator: Jan Hoogerbrugge
creator: Tobias Schneider
creator: Gary McConville
creator: Maria Eichlseder
rights: Copyright (c) 2025 Simon Gerhalter, Samir Hodžić, Marcel Medwed, Marcel Nageler, Artur Folwarczny, Ventzi Nikov, Jan Hoogerbrugge, Tobias Schneider, Gary McConville, Maria Eichlseder http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 31
ending page: 69
doi: 10.46586/tosc.v2025.i4.31-69

Nostalgia Cipher: Can Filtered LFSRs Be Secure Again? An Application to Hybrid Homomorphic Encryption with Sub-50 ms Latency
type: item
description: Linear Feedback Shift Registers (LFSRs) combined with non linear filtering functions have long been a fundamental design for stream ciphers, offering a wellunderstood structure that remains easy to analyze. However, the introduction of algebraic attacks in 2003 shifted the focus toward more complex designs, as filtered LFSRs required larger registers to maintain security. While this was seen as a drawback at the time, it is no longer a limiting factor, and emerging cryptographic applications benefit from specialized designs—challenges that filtered LFSRs can effectively address. In this work, we propose a new filtered LFSR design, called Nostalgia, tailored for Hybrid Homomorphic Encryption (HHE). We use a weightwise quadratic function as filtering function, leveraging its efficiency in the HHE setting while ensuring security against classical attacks. We also discuss the parameter selection of our design and demonstrate its efficiency in this setting by providing a proof-of-concept implementation. In terms of latency, our HHE solution outperforms current state-of-the-art for TFHE-based HHE (Baudrin et al., Crypto 2025) by a factor of 6.1 times. By revisiting filtered LFSRs in light of modern security requirements, we aim to renew interest in their potential applications and stimulate further cryptanalysis efforts.
subject: Articles
  topic: section
subject: LFSR
  topic: keywords
subject: Stream Cipher
  topic: keywords
subject: Weightwise quadratic functions
  topic: keywords
subject: Hybrid Homomorphic Encryption
  topic: keywords
creator: Nabil Chacal
creator: Antonio Guimarães
creator: Ange Martinelli
creator: Pierrick Méaux
creator: Romain Poussier
rights: Copyright (c) 2025 Nabil Chacal, Antonio Guimarães, Ange Martinelli, Pierrick Méaux, Romain Poussier http://creativecommons.org/licenses/by/4.0
date: 2025-12-17
publication date: 2025-12-17
starting page: 1
ending page: 30
doi: 10.46586/tosc.v2025.i4.1-30

Trail-Estimator: An Automated Verifier for Differential Trails in Block Ciphers
type: item
description: Differential cryptanalysis is a powerful technique for attacking block ciphers, wherein the Markov cipher assumption and stochastic hypothesis are commonly employed to simplify the search and probability estimation of differential trails. However, these assumptions often neglect inherent algebraic constraints, potentially resulting in invalid trails and inaccurate probability estimates. Some studies identified violations of these assumptions and explored how they impose constraints on key material, but they have not yet fully captured all relevant ones. This study proposes Trail-Estimator, an automated verifier for differential trails on block ciphers, consisting of two parts: a constraint detector Cons-Collector and a solving tool Cons-Solver. We first establish the fundamental principles that will allow us to systematically identify all constraint subsets within a differential trail, upon which Cons-Collector is built. Then, Cons-Solver utilizes specialized preprocessing techniques to efficiently solve the detected constraint subsets, thereby determining the key space and providing a comprehensive probability distribution of differential trails. To validate its effectiveness, Trail-Estimator is applied to verify 17 differential trails for the SKINNY, LBLOCK, TWINE, and AES block ciphers. Experimental results show that Trail-Estimator consistently identifies previously undetected constraints for SKINNY and AES, and discovers constraints for the first time for LBLOCK and TWINE. Notably, it is the first tool to discover long nonlinear constraints extending beyond five rounds in these ciphers. Furthermore, Trail-Estimator’s accuracy is validated by experiments showing its predictions closely match the real probability distribution of short-round differential trails.
subject: Articles
  topic: section
subject: Block ciphers
  topic: keywords
subject: Differential cryptanalysis
  topic: keywords
subject: Constraint detection
  topic: keywords
subject: Probability estimation
  topic: keywords
creator: Thomas Peyrin
creator: Quan Quan Tan
creator: Hongyi Zhang
creator: Chunning Zhou
rights: Copyright (c) 2025 Thomas Peyrin, Quan Quan Tan, Hongyi Zhang, Chunning Zhou http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 475
ending page: 515
doi: 10.46586/tosc.v2025.i3.475-515

Divide-and-Conquer SAT for Exploring Optimal Differential and Linear Characteristics and Its Applications
type: item
description: Developing automatic search tools to derive optimal characteristics is crucial for both the design and cryptanalysis of symmetric-key primitives. However, evaluating primitives that employ large S-boxes and complex linear layers remains a computationally demanding task. In this paper, we introduce a novel solver-aided automatic search tool based on the divide-and-conquer strategy that leverages the advantages of both MILP and SAT methods. Our method divides a given SAT model into multiple smaller SAT models, allowing to pre-eliminate as much of the space of Boolean variable assignments that make a given SAT model always “UNSAT”. In addition, we propose a new method for large S-boxes that involves the decimal parts of values, enabling us to efficiently derive optimal linear characteristics for a large S-box-based primitive, all within a practical time for the first time. The new tool is able to obtain optimal differential and linear characteristics in the significant number of rounds of AES, Camellia without FL function, ARIA, LED, Midori-128, SKINNY- 128, and Rijndael-256-256. Our results improve the required number of rounds for differential and linear attacks, based on a single characteristic, for Camellia, LED, and Midori-128. Besides, our tool identifies the longest distinguisher for extensivelyanalyzed ciphers of Camellia/ARIA/Midori-128 and SKINNY-128 by optimal linear and differential ones, respectively.
subject: Articles
  topic: section
subject: SAT
  topic: keywords
subject: divide-and-conquer approach
  topic: keywords
subject: differential and linear characteristics
  topic: keywords
subject: AES
  topic: keywords
subject: Camellia
  topic: keywords
subject: ARIA
  topic: keywords
subject: LED
  topic: keywords
subject: Midori-128
  topic: keywords
subject: SKINNY-128
  topic: keywords
subject: Rijndael-256-256
  topic: keywords
creator: Kazuma Taka
creator: Kosei Sakamoto
creator: Ryoma Ito
creator: Rentaro Shiba
creator: Shion Utsumi
creator: Takanori Isobe
rights: Copyright (c) 2025 Kazuma Taka, Kosei Sakamoto, Ryoma Ito, Rentaro Shiba, Shion Utsumi, Takanori Isobe http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 516
ending page: 576
doi: 10.46586/tosc.v2025.i3.516-576

SAT-Based Space Partitioning and Applications to Ascon-Hash256 Cryptanalysis
type: item
description: We introduce an efficient SAT-based space partitioning technique that enables systematic exploration of large search spaces in cryptanalysis. The approach divides complex search spaces into manageable subsets through combinatorial necklace generation, allowing precise tracking of explored regions while maintaining search completeness. We demonstrate the technique’s effectiveness through extensive cryptanalysis of Ascon-Hash256. For differential-based collision attacks, we conduct an exhaustive search of 2-round collision trails, proving that no collision trail with weight less than 156 exists. Through detailed complexity analysis and parameter optimization, we present an improved 2-round collision attack with complexity 261.79. We also discover new Semi-Free-Start (SFS) collision trails that enable practical attacks on both 3-round and 4-round Ascon-Hash256, especially improving the best known 4-round SFS trail from weight 295 to 250. Furthermore, applying the technique to Meet-in-the-Middle structure search yields improved attacks on 3-round Ascon-Hash256. We reduce the collision attack complexity from 2116.74 to 2114.13 with memory complexity 2112 (improved from 2116), and the preimage attack complexity from 2162.80 to 2160.75 with memory complexity 2160 (improved from 2162).
subject: Articles
  topic: section
subject: SAT
  topic: keywords
subject: Space Partitioning
  topic: keywords
subject: Ascon-Hash256
  topic: keywords
subject: Collision Attack
  topic: keywords
subject: Preimage Attack
  topic: keywords
subject: Meet-in-the-Middle
  topic: keywords
creator: Guozhen Liu
creator: Shun Li
creator: Huina Li
creator: Weidong Qiu
creator: Siwei Sun
rights: Copyright (c) 2025 Guozhen Liu, Shun Li, Huina Li, Weidong Qiu, Siwei Sun http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 577
ending page: 632
doi: 10.46586/tosc.v2025.i3.577-632

Linear Cancellations in the MitM Attacks on Sponge Functions
type: item
description: At EUROCRYPT 2023, Qin et al. proposed the MitM attack framework on sponge functions by separating the message bits into two sets of neutral bits. By assigning bit cancellations on one of the two sets, the states of the two sets can be computed independently and then filtered by some matching equations. To solve the bit cancellations, Qin et al. exhaustively compute the cancellations of all message bits, and store them in a huge hash table, which leads to attacks with huge memory. In this paper, we separate the bit cancellations into linear and nonlinear cancellations for the MitM attacks, where the linear cancellations are solved by Gaussian elimination, and only the nonlinear cancellations are dealt with the hash table. Hence, the memory cost is significantly reduced. In order to search new attacks with efficient memory (fewer nonlinear cancellations and more linear cancellations), we propose a new MILP model whose encoding scheme can distinguish linear and nonlinear cancellations. Besides, dedicated tricks such as the so-called weak-diffusion structure and two-stage search are proposed to further accelerate solving the MILP models. Finally, the memory complexities of MitM attacks on 4-round Keccak[1024], 3-round Xoodyak-Xof, 4-round Ascon-Xof, and full Subterranean 2.0 are reduced by 249, 259, 216, and 236, respectively. Besides, our memory-efficient approach can turn invalid MitM attacks (where memory complexity is the dominant factor in old framework) into valid MitM attacks. For example, we propose the first MitM preimage attack on 4-round Keccak[768] and the first 3-round collision attack on Xoodyak-Xof with 128-bit tag.
subject: Articles
  topic: section
subject: MitM
  topic: keywords
subject: Sponge Functions
  topic: keywords
subject: MILP
  topic: keywords
subject: Keccak
  topic: keywords
subject: Xoodyak
  topic: keywords
subject: Ascon
  topic: keywords
creator: Lingyue Qin
creator: Boxin Zhao
creator: Qingliang Hou
creator: Keting Jia
creator: Gaoli Wang
creator: Xiaoyang Dong
rights: Copyright (c) 2025 Lingyue Qin, Boxin Zhao, Qingliang Hou, Keting Jia, Gaoli Wang, Xiaoyang Dong http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 633
ending page: 692
doi: 10.46586/tosc.v2025.i3.633-692

Mix-Basis Geometric Approach to Boomerang Distinguishers
type: item
description: Differential cryptanalysis relies on assumptions like Markov ciphers and hypothesis of stochastic equivalence. The probability of a differential characteristic estimated by classical methods is the key-averaged probability under the two assumptions. However, the real probability can vary significantly between keys. Hence, tools for differential cryptanalysis in the fixed-key model are desirable. Recently, Beyne and Rijmen applied the geometric approach to differential cryptanalysis and proposed a systematic framework called quasi-differential (CRYPTO 2022). As a variant of differential cryptanalysis, boomerang attacks rely on similar assumptions, so it is important to study their probability in the fixed-key model as well. A direct extension of the quasi-differential for boomerang attacks leads to the quasi-3- differential framework (IEEE-IT 2024). However, such a straightforward approach is difficult in practical applications as there are too many quasi-3-differential trails. We tackle this problem by applying the mix-basis style geometric approach (CRYPTO 2025) to the boomerang attacks and construct the quasi-boomerang framework. By choosing a suitable pair of bases, the boomerang probability can be computed by summing correlations of quasi-boomerang characteristics. The transition matrix of the key-XOR operation is also a diagonal matrix; thus, the influence of keys can be analyzed in a similar way to the quasi-differential framework. We apply the quasi-boomerang framework to SKINNY-64 and GIFT-64. For SKINNY- 64, we check and confirm 4 boomerang distinguishers with high probability (2 with probability 1 and 2 with probability 2−4) generated from Hadipour, Bagheri, and Song’s tool (ToSC 2021/1), through the analysis of key dependencies and the probability calculation from quasi-boomerang characteristics. We also propose a divide-and-conquer approach following the sandwich framework for boomerangs with small probability or long rounds to apply the quasi-boomerang …
subject: Articles
  topic: section
subject: Boomerang
  topic: keywords
subject: Fixed-Key
  topic: keywords
subject: Mix-Basis
  topic: keywords
subject: Geometric Approach
  topic: keywords
creator: Chengcheng Chang
creator: Hosein Hadipour
creator: Kai Hu
creator: Muzhou Li
creator: Meiqin Wang
rights: Copyright (c) 2025 Chengcheng Chang, Hosein Hadipour, Kai Hu, Muzhou Li, Meiqin Wang http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 693
ending page: 728
doi: 10.46586/tosc.v2025.i3.693-728

Cryptanalysis: Theory Versus Practice
type: item
description: Most modern cryptanalysis results are obtained through theoretical analysis, often relying on simplifications and idealized assumptions. In this work, we use the parallel computational power of GPUs to experimentally verify a small portion of the cryptanalysis results that have been published in recent years. Our focus is on the ciphers Ascon, ChaCha, and Serpent. In none of the attacks we considered did the theoretical estimates fully match the actual practical values. More precisely, we show that the 4.5-round truncated differential with probability one, the 6-round differential-linear (DL), and the 6-round impossible differential distinguishers on Ascon, as well as the best known 7- and 7.5-round DL distinguisher on ChaCha, do not actually work in practice. Moreover, we demonstrate that the best known 10, 11, and 12-round DL attacks on Serpent perform better in practice than previously estimated. Additionally, we provide a new experimentally obtained 9-round DL distinguisher on Serpent, which can be used in 10 and 11-round attacks with reduced data complexity. In a broader sense, we recommend that cryptanalysts experimentally verify reduced versions of their theoretically obtained analysis results whenever possible. In order to simplify this process, we make our optimized code for the ciphers treated here available for future use.
subject: Articles
  topic: section
subject: cryptanalysis
  topic: keywords
subject: GPU
  topic: keywords
subject: ASCON
  topic: keywords
subject: ChaCha
  topic: keywords
subject: SERPENT
  topic: keywords
creator: Cihangir Tezcan
creator: Gregor Leander
creator: Hosein Hadipour
rights: Copyright (c) 2025 Cihangir Tezcan, Gregor Leander, Hosein Hadipour http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 729
ending page: 754
doi: 10.46586/tosc.v2025.i3.729-754

Observations on the BayesianKeySearch with Applications to Simon and Simeck
type: item
description: In CRYPTO 2019, Gohr pioneered the integration of machine learning with differential cryptanalysis, demonstrating that differential-neural distinguishers can outperform classical techniques in distinguishing attacks. He also introduced a novel key-recovery strategy based on Bayesian optimization, termed BayesianKey- Search, enhancing key recovery for Speck32/64. However, the impact of parameter selection on the complexity and success probability of key-recovery attack using BayesianKeySearch remains underexplored. This paper investigates the impact of parameter selections on key-recovery effectiveness. Gohr’s key-recovery attack involves two stages, each using a cutoff value to filter candidate guesses for the last subkey and second-to-last subkey. Previous works selected these cutoffs independently. We propose connecting these cutoff selections, enhancing coordination between stages and improving the attack’s complexity and success probability. Applying our parameter optimization, we enhance the single-key recovery attacks on 16-round Simon32/64, 16-round and 17-round Simeck32/64, achieving higher success rates and lower time complexities compared to previous works. Additionally, for related-key differential-neural attacks on Simon32/64, we exploit both single-key and related-key features from cross-paired ciphertexts, developing advanced neuraldistinguishers for up to 13 rounds. Using these neural-distinguishers combined with carefully selected classical differentials, we devise an 18-round related-key recovery attack on Simon32/64. Our results validate the practical effectiveness of the proposed strategies and are expected to contribute to the advancement of machine learningaided cryptanalysis.
subject: Articles
  topic: section
subject: Neural Network
  topic: keywords
subject: BayesianKeySearch
  topic: keywords
subject: Parameter Optimization
  topic: keywords
subject: Key-recovery
  topic: keywords
subject: Simon32/64
  topic: keywords
subject: Simeck32/64
  topic: keywords
creator: Zezhou Hou
creator: Zhenzhen Bao
creator: Jinyu Lu
creator: Shaozhen Chen
rights: Copyright (c) 2025 Zezhou Hou, Zhenzhen Bao, Jinyu Lu, Shaozhen Chen http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 755
ending page: 799
doi: 10.46586/tosc.v2025.i3.755-799

Generalizations of ChiChi: Families of Low-Latency Permutations in Any Even Dimension
type: item
description: At Eurocrypt’25, Belkheyar et al. introduced a new non-linear layer called ChiChi or χχ. ChiChi is built based on Daemen’s χ function, but crucially gives a permutation in even dimension divisible by four. In this work, we generalize their construction in multiple ways, prove their open conjecture regarding the algebraic degree of the inverse of ChiChi, and investigate the properties of it against key recovery attacks.
subject: Articles
  topic: section
subject: Non-linear layer
  topic: keywords
subject: Boolean functions
  topic: keywords
subject: Chi
  topic: keywords
subject: ChiChi
  topic: keywords
creator: Samuele Andreoli
creator: Gregor Leander
creator: Enrico Piccione
creator: Lukas Stennes
rights: Copyright (c) 2025 Samuele Andreoli, Gregor Leander, Enrico Piccione, Lukas Stennes http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 800
ending page: 826
doi: 10.46586/tosc.v2025.i3.800-826

MDS Diffusion Layers for Arithmetization-Oriented Symmetric Ciphers: The Rotational-Add Construction
type: item
description: We introduce the rotational-add diffusion layers aimed for applications in the design of arithmetization-oriented (AO) symmetric ciphers, such as fully homomorphic encryption (FHE)-friendly symmetric ciphers. This generalizes the rotational-XOR diffusion layers which have been utilized in the design of many important conventional symmetric ciphers like SHA-256, SM4, ZUC and Ascon. A rotational-add diffusion layer is defined over the finite field Fp for arbitrary prime p, enabling implementations using only rotations and modular additions/subtractions. The advantage of using such diffusion layers in AO ciphers is that, the costs of scalar multiplications can be reduced since the appearing scalars include only ±1, thus the total costs depend on sizes of the rotation offsets. In this paper, we investigate characterizations and constructions of lightest rotational-add diffusion layers over (Fmp)n that are maximum distance separable (MDS) with a focus on the case n = 4. It turns out that the minimum achievable size of the rotation offsets is 5 subject to the MDS property constraint. We specify a large class of rotational-add diffusion layers with 5 rotations and traverse all possible patterns of appearance of the scalars ±1. In four cases we can derive computationally tractable necessary and sufficient conditions for the rotational-add diffusion layers to attain the MDS property. These conditions enable explicit characterization of suitable primes p for given parameters. Leveraging these results, we construct three distinct families of rotational-add MDS diffusion layers applicable to AO ciphers. Although a rotational-add diffusion layer with 7 rotations and only additions has already been used in the design of the FHEfriendly block cipher YuX recently, to our knowledge, our work presents the first systematic theoretical characterization of rotational-add MDS diffusion layers and provides explicit constructions of them.
subject: Articles
  topic: section
subject: Arithmetization-oriented symmetric cipher
  topic: keywords
subject: Rotational-add diffusion layer
  topic: keywords
subject: MDS matrix
  topic: keywords
subject: Circulant matrix
  topic: keywords
subject: Determinant
  topic: keywords
creator: Baofeng Wu
creator: Wen Kong
creator: Dewei Kong
creator: Hailun Yan
rights: Copyright (c) 2025 Baofeng Wu, Wen Kong, Dewei Kong, Hailun Yan http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 827
ending page: 867
doi: 10.46586/tosc.v2025.i3.827-867

New General MDS Matrix Construction Method Towards Low Area
type: item
description: Maximum Distance Separable (MDS) matrices have been widely used in symmetric cryptographic primitives because of their excellent cryptographic properties. However, due to the heavy area cost, larger-scale MDS matrices than 4 x 4 ones are limited in ciphers, although they have a larger branch number. In this paper, we propose a general method for constructing MDS matrices with low implementation area cost, using matrix decomposition, automatic search, and symbolic computation techniques. According to matrix decomposition theory, every invertible matrix can be decomposed into a sequence of elementary matrices, including Type-1 (row switching), Type-2 (row multiplication) and Type-3 (row addition) elementary matrices. So, we first propose a greedy algorithm to construct MDS matrix patterns with as few Type-3 elementary matrices as possible. Then, we build an automatic search model to minimize the implementation area of multiplication coefficients used in Type-3 elementary matrices. Lastly, another greedy strategy is raised to further reduce the implementation area of MDS matrix patterns by introducing a few Type-2 elementary matrices. In comparison to previous methods, our approach is more general and effective for constructing lower-area MDS matrices. To demonstrate the efficiency of our method, we apply the framework on constructing m x m MDS matrices over F2n or GL(n, F2), where m ∈ {4, 5, 6, 7, 8} and n ∈ {4, 8, 16, 32, 64}. The 4 x 4 MDS matrices constructed by our method can also reach the minimum area. The 5 x 5, 6 x 6 and 7 x 7 MDS matrices constructed by our method have lower area compared to previous ones. While the 8 x 8 MDS matrices with n ∈ {16, 32, 64} constructed by our method also have lower area compared to previous ones.
subject: Articles
  topic: section
subject: MDS matrix
  topic: keywords
subject: Matrix decomposition
  topic: keywords
subject: Symbolic computation
  topic: keywords
subject: Automatic optimization
  topic: keywords
subject: Low area
  topic: keywords
creator: Yan He
creator: Tingting Cui
creator: Qing Ling
creator: Xi Han
rights: Copyright (c) 2025 Yan He, Tingting Cui, Qing Ling, Xi Han http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 868
ending page: 890
doi: 10.46586/tosc.v2025.i3.868-890

The Large Block Cipher Vistrutah
type: item
description: Vistrutah is a block cipher with block sizes of 256 and 512 bits. It iterates a step function consisting of two AES rounds applied to each 128-bit block of the state, followed by a state-wide cell permutation. Building upon established design principles from Simpira, Haraka, Pholkos, and ASURA, Vistrutah leverages AES instructions to achieve high performance. For each component of Vistrutah, we conduct a systematic evaluation of functions that can be efficiently implemented on both Intel and Arm architectures. We therefore expect them to perform efficiently on any recent vector instruction set architecture (ISA) with AES support. Our evaluation methodology combines, for each combination of the various choices of the cipher’s components, a security analysis with a latency estimation on an abstracted ISA. The goal is to maximize the ratio of “bits of security per unit of time,” i.e., to achieve the highest security for a given performance target, or equivalently, the best performance for a given security level within this class of designs. Implementations confirm the accuracy of our latency model. Vistrutah even performs significantly better than Rijndael-256-256. Our security claims are backed by a comprehensive ad-hoc cryptanalysis. An isomorphism between Vistrutah-512, the 512-bit wide variant, and the AES, allows us to also leverage the extensive cryptanalysis of AES and apply it to Vistrutah-512. A core design principle is the use of an inline key schedule, computed during each encryption or decryption operation without requiring storage in any external memory. In fact, rekeying Vistrutah has no associated overheads. Key schedules like the AES’s must precompute and store round keys in memory for acceptable performance. However, in 2010 Kamal and Youssef showed that this makes cold boot attacks significantly more effective. Vistrutah’s approach minimizes leakage to at most two byte-permutations of the original key during context switches. Furthermore, expensive ke…
subject: Articles
  topic: section
subject: Block Cipher
  topic: keywords
subject: AES
  topic: keywords
subject: AES Instructions
  topic: keywords
subject: Cryptographic Implementations
  topic: keywords
subject: Cryptanalysis
  topic: keywords
creator: Roberto Avanzi
creator: Avik Chakraborti
creator: Bishwajit Chakraborty
creator: Eik List
rights: Copyright (c) 2025 Roberto Avanzi, Avik Chakraborti, Bishwajit Chakraborty, Eik List http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 1
ending page: 150
doi: 10.46586/tosc.v2025.i3.1-150

LEAP: High-Performance Lattice-Based Pseudorandom Number Generator
type: item
description: At EUROCRYPT2012, Banerjee, Peikert, and Rosen introduced Ring Learning With Rounding (RLWR) problem and constructed lattice-based pseudorandom functions for the first time. Subsequently, Banerjee, Brenner, Leurent, Peikert, and Rosen named this family of lattice-based pseudorandom functions as SPRING, reanalyzed the security, and gave two practical instances. Building upon the SPRING family, Bouillaguet, Delaplace, Fouque, and Kirchner further extended it to a pseudorandom number generator called SPRING-RS. It is quite fast but still has a certain gap compared with the classical pseudorandom number generator based on symmetric cryptography, and the key size is large. In this work, we present LEAP, a lattice-based pseudorandom number generation scheme characterized by high performance, adaptable parameter selection, and extensive support for parallel processing. Unlike the RLWR problem used in public key cryptography, LEAP treats the public parameter in the RLWR problem as the key as well. Hiding the public parameters leads to larger lattice dimensions and higher standard deviations of error in the concrete security analysis compared to RLWR under identical parameters. These adjustments imply enhanced security, allowing smaller parameters while maintaining the same security level, thereby improving performance. Additionally, we introduce a novel framework that reuses multiple parameters, significantly enhancing overall performance. To mitigate the issue of increased key size caused by treating the public parameter as the key, we design a pseudorandom number generator leveraging the small key size characteristic of a variant of the NTRU assumption, which provides the key required for the high-performance pseudorandom number generator. Compared with the SPRING-RS, the LEAP can reduce the key size by 1.71X while improving performance by 3.30X at the same security level. Under the AVX2 and AVX512 implementations, the performance reaches 1.61 Cycles/byte and 1.14 Cycles/…
subject: Articles
  topic: section
subject: Lattice-based cryptography
  topic: keywords
subject: PRNG
  topic: keywords
subject: NTRU
  topic: keywords
subject: RLWR
  topic: keywords
creator: Yu Zhang
creator: Xianhui Lu
creator: Yijian Liu
creator: Yongjian Yin
creator: Kunpeng Wang
rights: Copyright (c) 2025 Yu Zhang, Xianhui Lu, Yijian Liu, Yongjian Yin, Kunpeng Wang http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 151
ending page: 182
doi: 10.46586/tosc.v2025.i3.151-182

HCTR+: An Optimally Secure TBC-Based Accordion Mode
type: item
description: The design of tweakable wide-block ciphers has advanced significantly over the past two decades. This evolution began with the wide-block cipher by Naor and Reingold. Since then, numerous constructions have been proposed, many of which are built on existing block ciphers and are secure up to the birthday bound for the total number of blocks queried. Although there has been a recent slowdown in the development of such ciphers, the latest NIST proposal for Accordion modes has reignited the interest and momentum in the design and analysis of these ciphers. Although new designs have emerged, their security often falls short of optimal (i.e., n-bit) security, where n is the output size of the primitive. In this direction, designing an efficient tweakable wide-block cipher with n-bit security seems to be an interesting research problem to the symmetric key research community. An optimally secure tweakable wide-block cipher mode can easily be turned into a misuse-resistant RUP secure authenticated encryption scheme with optimal security. This paper proposes HCTR+, which turns an n-bit tweakable block cipher (TBC) with n-bit tweak into a variable input length tweakable wide block cipher. Unlike tweakable HCTR, HCTR+ ensures n-bit security regardless of tweak repetitions. We also propose two TBC-based almost-xor-universal hash functions, named PHASH+ and ZHASH+, and use them as the underlying hash functions in the HCTR+ construction to create two TBC-based n-bit secure tweakable wide block cipher modes, PHCTR+ and ZHCTR+. Experimental results show that both PHCTR+ and ZHCTR+ exhibit excellent software performance when their underlying TBC is instantiated with Deoxys-BC-256.
subject: Articles
  topic: section
subject: Tweakable wide block cipher
  topic: keywords
subject: Tweakable block cipher
  topic: keywords
subject: Accordion mode
  topic: keywords
subject: Provable security
  topic: keywords
subject: Optimal security
  topic: keywords
subject: AES
  topic: keywords
subject: HCTR
  topic: keywords
creator: Nilanjan Datta
creator: Avijit Dutta
creator: Shibam Ghosh
creator: Eik List
creator: Hrithik Nandi
rights: Copyright (c) 2025 Nilanjan Datta, Avijit Dutta, Shibam Ghosh, Eik List, Hrithik Nandi http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 183
ending page: 229
doi: 10.46586/tosc.v2025.i3.183-229

Minimized PRFs from Public Permutations
type: item
description: The sum of permutations is a popular way to turn a PRP (like a block cipher) into a PRF. However, with the rise of permutation based cryptography, it makes sense to investigate the possibility to design a PRF as the sum of externally keyed public permutations. This challenge was initiated by Chen et al. (CRYPTO 2019) who presented the Sum of Even-Mansours (SoEM) construction. Sibleyras and Todo (CT-RSA 2023) later minimized the amount of key maskings in this construction with their Keyed Sum of Permutations (KSoP). However, both constructions have in common that their security proofs require two independent keys and two independent public random permutations. In this work, we investigate the possibilities to reduce this amount of randomness, by introducing three constructions: sirP, that uses two independent permutations but one key, sirK, that uses two independent keys but one permutation, and sirX, that uses a single permutation and a single key. The constructions are further generalized by having a parameter prescribing the data input size compared to the permutation size. We present general security results for all three variants, and demonstrate that, for certain parameter choices, the security bounds match those of SoEM and KSoP, but with reduced randomness.
subject: Articles
  topic: section
subject: RP-to-PRF
  topic: keywords
subject: SoEM
  topic: keywords
subject: KSoP
  topic: keywords
subject: beyond birthday bound
  topic: keywords
subject: sirX
  topic: keywords
creator: Bart Mennink
rights: Copyright (c) 2025 Bart Mennink http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 230
ending page: 260
doi: 10.46586/tosc.v2025.i3.230-260

Revisiting Vector-Input MACs
type: item
description: At Eurocrypt 2006, Rogaway and Shrimpton (RS06) presented the idea of vector-input MAC that accepts a vector consisting of variable-length bit strings. A vector-input MAC could be built on a conventional (bit) string-input MAC, e.g., CMAC, with an injective encoding. RS06 pointed out an efficiency loss in this method and presented a general construction S2V that is more efficient than the encodingbased method. RS06 made significant scientific and practical impacts on the field of mode constructions, in particular for the invention of deterministic authenticated encryption. However, despite its potential, their work on vector-input MAC has been largely overlooked for more than 18 years. We revisit RS06’s treatment of vector-input MAC and show that the topic is more subtle than initially considered. We first formally define the problem of vector-input MAC and propose a natural efficiency goal for vector-input MACs as a counterpart of what has been considered for string-input MACs. Since S2V with any string-input MAC mode never achieves this efficiency goal, we propose a family of new MAC modes, VecMAC, that achieves this goal. VecMAC has a similarity to the popular PMAC, in particular its idea of tweak. However, the purpose of introducing tweak is different from PMAC and tweak is tailored to handle vectors without redundant block cipher calls. We also provide implementation results that show an advantage over the conventional method.
subject: Articles
  topic: section
subject: MAC
  topic: keywords
subject: Vector
  topic: keywords
subject: S2V
  topic: keywords
subject: Mode of operation
  topic: keywords
creator: Isamu Furuya
creator: Kazuhiko Minematsu
rights: Copyright (c) 2025 Isamu Furuya, Kazuhiko Minematsu http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 261
ending page: 288
doi: 10.46586/tosc.v2025.i3.261-288

SoK: On Shallow Weak PRFs
type: item
description: A growing number of advanced cryptographic protocols and constructions rely on symmetric primitives known as weak pseudo-random functions (wPRFs). These functions differ significantly from traditional PRFs: they operate in constrained models where inputs are sampled uniformly at random and are not chosen by the adversary. In practice, many of these functions are implemented as shallow, non-iterated constructions with simple circuit representations. This Systematization of Knowledge (SoK) provides a unified view of shallow wPRFs (swPRFs), which we define as wPRFs computable by low-depth circuits and primarily used in different secure computation protocols. We identify and classify four main families of swPRFs—alternating moduli wPRFs, Goldreich’s PRG family, and the VDLPN and EALPN constructions—presenting formal definitions, algorithmic descriptions, known variants, cryptanalytic results, and concrete parameter sets for each. In addition to surveying the literature, our goal is to shift the focus from asymptotic analyses to concrete cryptanalysis. To this end, we provide a set of cryptanalytic challenges along with reference SAGE implementations for all the primitives discussed. We aim to encourage the symmetric cryptography community—particularly cryptanalysts— to rigorously evaluate the practical security levels offered by swPRFs, as concrete analyses are currently lacking. Given their growing use in high-level protocols and constructions, any cryptanalytic breakthrough on these primitives could directly affect the security of the broader cryptographic systems that rely on them.
subject: Articles
  topic: section
subject: shallow weak PRFs
  topic: keywords
subject: alternating moduli
  topic: keywords
subject: Goldreich’s PRG
  topic: keywords
subject: VDLPN
  topic: keywords
subject: EALPN
  topic: keywords
creator: Christina Boura
creator: Geoffroy Couteau
creator: Léo Perrin
creator: Yann Rotella
rights: Copyright (c) 2025 Christina Boura, Geoffroy Couteau, Léo Perrin, Yann Rotella http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 289
ending page: 336
doi: 10.46586/tosc.v2025.i3.289-336

Attacking Split-and-Lookup-Based Primitives Using Probabilistic Polynomial System Solving
type: item
description: In recent years, many hash functions have been introduced to satisfy the pressing need of some zero-knowledge protocols for such primitives allowing a low degree verification of their round function when arithmetized over a large field. While this can be achieved by restricting their sub-components to low-degree functions (and their inverse), the newest primitives in this category also leverage the intricacies of some proof systems to use “Split-and-Lookup” non-linear functions that essentially apply a small S-box in parallel over the binary representation of a field element. Such components excel at hindering attacks relying on polynomial system solving, but they offer poor security against statistical attacks. On the other hand, low degree monomials offer the opposite guarantees, being strong against statistical attacks. Several primitives have recently been proposed that combine such components in different ways in order to get the best from both. In this paper, we target such primitives by relying on the low degree components to allow a low-cost polynomial solving step. The weakness of Split-and-Lookups against linear attacks is used to simplify these systems, and their weakness against differential attacks is then used to propagate across many rounds the differential patterns obtained during polynomial solving. We instantiate this general approach by attacking round-reduced Monolith, and providing a distinguisher on full-round Skyscraper. These result then shed some light on how to best combine the different types of components to achieve the highest security.
subject: Articles
  topic: section
subject: Arithmetization-Oriented
  topic: keywords
subject: hash functions
  topic: keywords
subject: lookups
  topic: keywords
subject: Monolith
  topic: keywords
subject: Skyscraper
  topic: keywords
subject: rebound attack
  topic: keywords
subject: POlynomial System SOlving
  topic: keywords
creator: Antoine Bak
creator: Guilhem Jazeron
creator: Pierre Galissant
creator: Léo Perrin
rights: Copyright (c) 2025 Antoine Bak, Guilhem Jazeron, Pierre Galissant, Léo Perrin http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 337
ending page: 367
doi: 10.46586/tosc.v2025.i3.337-367

Multidimensional Linear Cryptanalysis of AEGIS
type: item
description: AEGIS is a family of authenticated encryption with associated data (AEAD) ciphers that target for highly efficient implementations in software. The main operation in AEGIS is the AES encryption round function such that it can make full use of the cryptographic properties and efficient implementation. AEGIS includes three variants AEGIS-128, AEGIS-128L, and AEGIS-256, which achieve 128, 128, and 256 bits of security, respectively. AEGIS-128 has been selected and included into the final portfolio of the CAESAR competition. In this paper, we perform multidimensional linear cryptanalysis of AEGIS. We first dig into the reason of the inconsistency between the byte and bit trails in AEGIS and propose an improved truncated model to efficiently derive the accurate minimum number of active Sboxes. Based on the derived byte trails, we perform deep theoretical analysis of the correlation propagation in AEGIS and derive linear approximations with high correlations. Moreover, we find interesting properties of AEGIS that enable us to derive a number of equivalent but independent linear approximations. By combining these linear approximations, we perform multidimensional linear distinguishing attacks on AEGIS-128, AEGIS-256, and AEGIS-128L with complexities 2126.46, 2154.11, and 2144.44, respectively. These results suggest that AEGIS-128 and AEGIS-256 do not meet their security claims. We also apply the improved truncated model to two AES-based stream cipher families LOL and Rocca for the linear cryptanalysis of them. Particularly, for LOL-MINI, we give a fast correlation attack with complexity 2250.5, thereby breaking its security claim if we ignore the restriction in the length of the keystream under a single pair of key and IV.
subject: Articles
  topic: section
subject: Multidimensional Linear Cryptanalysis
  topic: keywords
subject: AEGIS
  topic: keywords
subject: LOL
  topic: keywords
subject: Rocca
  topic: keywords
creator: Yinuo Liu
creator: Tian Tian
creator: Jing Yang
rights: Copyright (c) 2025 Yinuo Liu, Tian Tian, Jing Yang http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 368
ending page: 399
doi: 10.46586/tosc.v2025.i3.368-399

Chosen-Key Distinguishing Attacks on Full AES-192, AES-256, Kiasu-BC, and More
type: item
description: At CRYPTO 2020, Liu et al. demonstrated that many differentials on Gimli are, in fact, incompatible. Similar incompatibilities also arise in relatedkey differentials on AES, which are typically addressed in an ad-hoc manner by incorporating additional constraints into the searching models. However, such ad-hoc methods are insufficient to eliminate all incompatibilities and may still produce false positive related-key differentials. At CRYPTO 2022, a novel approach was introduced that combines a Constraint Programming (CP) tool with a triangulation algorithm to search for rebound attacks against AES-like hashings. In this paper, we extend and unify these techniques to develop a comprehensive related-key differential search model. Our model not only identifies valid related-key differentials for AES and similar ciphers, but also enables immediate verification of the existence of at least one key pair satisfying the differentials. Using this enhanced automatic tool, we discover new related-key differentials for full-round AES-192, AES-256, Kiasu-BC, and for roundreduced Deoxys-BC. Based on these findings, we present full-round limited-birthday chosen-key distinguishing attacks on AES-192, AES-256, and Kiasu-BC, as well as the first chosen-key distinguisher on reduced-round Deoxys-BC. Furthermore, we identify, for the first time, a limited-birthday distinguisher on 9-round Kiasu-BC with practical complexities.
subject: Articles
  topic: section
subject: Related-key
  topic: keywords
subject: Chosen-key
  topic: keywords
subject: Triangulation algorithm
  topic: keywords
subject: Constraint Programming
  topic: keywords
subject: Rebound techniques
  topic: keywords
creator: Xiaoyang Dong
creator: Jian Guo
creator: Shun Li
creator: Phuong Pham
rights: Copyright (c) 2025 Xiaoyang Dong, Jian Guo, Shun Li, Phuong Pham http://creativecommons.org/licenses/by/4.0
date: 2025-09-25
publication date: 2025-09-25
starting page: 400
ending page: 443
doi: 10.46586/tosc.v2025.i3.400-443