IACR Transactions on Symmetric Cryptology
The IACR Transactions on Symmetric Cryptology is a scholarly journal for timely research papers on symmetric cryptology that seeks to combine the benefits of fast conference turnaround with consistent journal reviewing.
Chosen-IV Algebraic Attack on Randomized Ciphers FASTA and HERA
Fully homomorphic encryption (FHE) enables computation on encrypted data without decryption, providing strong guarantees for privacy-preserving applications. However, its practicality heavily depends on the efficiency of the underlying cryptographic primitives. To this end, FHE-friendly symmetric ciphers have been designed to achieve a balance between security and homomorphic efficiency. Among them, FASTA (a variant of Rasta) and HERA are two FHE-friendly symmetric-key primitives proposed at CT-RSA 2022 and ASIACRYPT 2021, respectively. Previous cryptanalytic results of FASTA and HERA were achieved by peeling off the last nonlinear layer. In this paper, we present an improved algebraic cryptanalysis of FASTA by exploiting structural properties of its affine layers through chosen-IV algebraic attacks. We demonstrate that both the first and last nonlinear layers of FASTA can be removed, which significantly reduces the algebraic degree of the resulting system. As a result, we achieve the first key-recovery attack on 4-round FASTA, with time complexity about 2118.8, memory complexity 294.2, and data complexity 234.1, improving the best attack by 1 round. Overall, our findings reveal exploitable algebraic weaknesses in the affine layer of FASTA. For HERA, our refined chosen-IV algebraic attack based on the eXtended Linearization (XL) algorithm significantly enlarges the feasible parameter range, enabling attacks on prime moduli that were previously considered out of reach. This is mainly because the integration of the XL algorithm further decreases the number of keystream words required during the online phase of the chosen-IV algebraic attack, thus reducing the cost of its offline phase, i.e., a better tradeoff between the offline and online complexity can be achieved in our improved attack. This highlights the central role of the XL algorithm in enabling efficient algebraic attacks on FHE-friendly symmetric ciphers.
Copyright (c) 2025 Fukang Liu, Tianning Wang, Jianqiang Ni, Daisuke Yamamoto, Guilherme T. S. Sato, Haoyang Wang, Willi Meier http://creativecommons.org/licenses/by/4.0
Cube Attacks with Elimination Strategy: Key Recovery Attacks on Trivium
In this paper, we present a novel framework for cube attacks named cube attacks with elimination strategy. The core idea is to find specific key conditions and cubes such that their superpolies under these key conditions can be efficiently computed. By recovering these conditional superpolies, we can solve the corresponding equation system and thereby retrieve key information. If a sufficient number of such key conditions can be found, the attack can be extended to a larger key space. To apply this framework in practical attacks, we propose the following techniques. First, we propose a nested coefficient solver that combines variable substitution and symbolic computation to efficiently recover superpolies, and present the conditional monomial prediction technique to rapidly recover conditional superpolies. Second, by combining numeric mapping with monomial prediction techniques, we propose an automated cube search algorithm that is capable of generating a large number of good cubes for attacks. Finally, we develop two kinds of testing methods, which are used to efficiently extract substantial key information from large-scale equation systems. To illustrate the power of our techniques, we apply them to Trivium. As a result, for 840 rounds of Trivium, a practical key recovery attack is mounted with complexity below 255 and a success rate 77.8%. For 845 rounds, we present a practical key recovery attack with complexity below 256 and a success rate 98.1% for 280 x 59.1% keys. For 855 rounds, we present a theoretical weak-key recovery attack for 274 keys. To the best of our knowledge, these are the best practical and theoretical attacks on Trivium. The improvements in the number of rounds reached are 13 for practical attacks and 4 for theoretical attacks, respectively.
Copyright (c) 2025 Haoran Li, Shichang Wang, Meicheng Liu, Willi Meier, Dongdai Lin http://creativecommons.org/licenses/by/4.0
In this paper, we propose new differential attacks against the block cipher GIFT-64. First we demonstrate how the parallel matching algorithm proposed by Naya-Plasencia at CRYPTO’11 as an advanced list-merging algorithm can be leveraged to enhance differential attacks, overcoming a previously assumed bottleneck. By reducing the complexity of the pairs generation process whenever a non-linear filter is available, this approach enabled us to mount a new differential attack against 25-round GIFT-64 in the related-key setting. Then we use the differential Meet-in-the-Middle cryptanalysis technique introduced by Boura et al. at CRYPTO’23 to improve the differential attacks recently proposed by Chang et al. at CT-RSA’25, leading to the best known attacks against GIFT-64 in the single-key setting, both in term of number of rounds and of complexity.
Copyright (c) 2025 Patrick Derbez, Baptiste Germon, Bastien Michel, María Naya-Plasencia http://creativecommons.org/licenses/by/4.0
Generic Attacks on Double Block Length Sponge Hashing
The sponge construction is one of the main modes of operation for hash functions. Using a permutation of width b = r + c, the sponge construction with rate r and capacity c is indifferentiable up to Ω(2c/2) permutation calls. In this paper we study variants of the sponge construction that use two permutations in parallel in order to increase the state size: the XOR combiner, and the double sponge construction of Lefevre and Mennink. We focus on the indifferentiability security, and we obtain new distinguishers on these constructions based on a variant of the 4-sum problem that we denote the multiple 4-sum problem. First, we show that the XOR combiner does not increase the indifferentiability bound when applied to sponge hash functions, with a tight generic attack with complexity ˜Õ(2c/2). This improves over folklore results that require ˜Õ(2b/2) operations to find internal state collisions, and justifies the more involved double sponge construction. Indeed, by mixing the two internal states after every permutation call, the double sponge achieves security beyond the birthday bound, with a security proof up to Ω(22c/3) permutation calls. However, the proof is not tight: the best generic attack has complexity O(2c+r/2), and Lefevre and Mennink show a simulator-specific attack with complexity O(22c/3+r/3). We reduce this gap by showing a dedicated attack against the double sponge, with complexity O(2c) in general, and O(max(23c/4, 2c−r/3)) with the specific mixing matrix used by Lefevre and Mennink. In particular, we observe that the complexity of our attack decreases with r (for a fixed c), while previous attacks have a complexity that increases with r.
Copyright (c) 2025 Gaëtan Leurent, César Mathéus http://creativecommons.org/licenses/by/4.0
On the Plaintext Awareness of AEAD Schemes
Plaintext-awareness of AEAD schemes is one of the more obscure and easily misunderstood notions. Originally proposed by Andreeva et al., Mennink and Talnikar showed in 2025 that the original definitions are vague and leave too much room for interpretation. They presented new definitions and analyzed the three main AEAD compositions relative to the new definitions. In particular, they showed that MAC-then-Encrypt (MtE) is not plaintext-aware. However, they showed that an SIV-style variant is indeed plaintext-aware. In this work, we first show that their analysis contains a gap, voiding their proof. We show this by showing several attacks; against their choice of extractor, with trivial complexity, and against any extractor, with birthday-bound complexity. Next, we re-establish their results by designing a new extractor that captures their intended goal and prove a tight PA1 security bound. We also show that the result is not dependent on the encryption scheme used, by showing that an extractor can also be designed for sMtE[ΘCB3], a variant where the encryption step is done by an ΘCB3-like scheme. Afterwards, we strengthen their results, by revisiting other compositions. In particular, we show that Encrypt-then-MAC (EtM) is in fact PA2-secure. Furthermore, we show that SIV-style MtE cannot be PA2-secure. Additionally, we show that Encode-then-Encipher is also PA2-secure, but not beyond the first successful forgery. More importantly, we show that up to some necessary assumptions, PA2 and RAE are equivalent. This result, while positive, holds only up to the first successful forgery. This indicates that the PA2 formalization maybe too strong for practical schemes, since we believe RAE sufficient for intuitive security. Last but not least, we investigate the value of the notion of plaintext awareness. We look deeper into the relation between plaintext awareness and confidentiality. We show that the problem of confidentiality in the presence of release of unverified plaintext can be seen as a confidentiality-with-leakage problem in the simulatable leakage framework. In this regard, we start, by showing that PA1 security cannot imply confidentiality with leakage. Similarly, we compare our results to the AERUP notion of TOSC 2019. We show that a scheme can be AERUP secure but not secure against a somewhat straightforward left-or-right attack in the same model. This puts into question the meaning and relevance of the PA1 and AERUP security notions. Results based on these notions can be seen as providing security in a two-phase game, where the adversary does not observe any leakage after the first challenge query, as we argue in the paper. On the positive side, we show that if a scheme achieves IND-CPA, INT-RUP and PA2, then it achieves confidentiality with leakage for the appropriate leakage function. This closes a gap in the literature on the relation between confidentiality with leakage and RUP notions.
Copyright (c) 2025 Mario Marhuenda Beltrán, Mustafa Khairallah http://creativecommons.org/licenses/by/4.0
On Constructing AEs with Leakage and Faults
Physical attacks are one of the potent threats to modern cryptography. Symmetric-key primitives are well-explored with respect to passive, active, and more recently combined (i.e., simultaneously leaking and faulting) adversaries. For symmetric key operating modes, there are many proposals for encryption (ENC), Message Authentication Codes (MAC), and Authenticated Encryption (AE) covering passive attacks. However, research on active or combined adversaries is more succinct and, to the best of our knowledge, boils down to combined secure MAC due to Berti et al. (ToSC 2023, issue 1), combined secure ENC due to Dobraunig et al. (CCS’22), and active secure AE named MEM due to Saha et al. (ToSC 2022, issue 4). Our first contribution is a security model to formally reason about the combined security of AE. The model extends the fault-then-leak security of MAC introduced by Berti et al. to AE and can also be seen as a natural extension of state-of-the-art leakage resistant notions in their so-called faulty matrix framework. Armed with this model, we show as a second contribution that all the leakage-resilient, including leakage-resistant, AE constructions and the fault-resilient MEM construction are vulnerable to a single fault injection within the composition of their building blocks. These decoupling attacks remain successful even for combined-secure building blocks. As a result, we finally present LEAF, the first AE construction secure against faultthen- leak adversaries with a single fault injection. In encryption, LEAF makes only one call to a MAC and two calls to an ENC that are combined secure.
Copyright (c) 2025 Thomas Peters, Sayandeep Saha, Yaobin Shen, François-Xavier Standaert http://creativecommons.org/licenses/by/4.0
How to Implement Authenticated Encryption on XTS-Enabled Devices
XTS is a block cipher mode for storage encryption. IEEE and NIST have standardized it, and it is widely deployed in real-world applications, including FileVault2, Bitlocker, and dm-crypt. However, it is well-known that XTS provides limited confidentiality and no integrity. XTS prevents simple attacks, e.g., information extraction from a stolen device. However, applications of XTS are expanding, such as cloud storage and CPU memory, where this issue implies a significant security threat. To address this issue, we propose iXTS, a family of black-box conversion methods of XTS into an authenticated encryption (AE). To make our proposal usable in practice, we need to assume that the only controllable part of the XTS engine is the plaintext input, because XTS engine’s ciphertext output is typically directly connected to the storage device and we assume the adversary is able to access the device directly, in addition to the black-box access to the engine. It is also desirable that the conversion could be done without the knowledge of the internal XTS key and without touching it. These constraints pose non-trivial technical challenges, and iXTS is the first effective solution meeting these constraints. We prove that each member of iXTS achieves n/2-bit security as a randomized AE using an n-bit block cipher. This security level is equivalent to popular AE modes such as GCM. iXTS is efficient as it requires no additional cryptographic computation beyond the original XTS. Plaintexts are expanded by a small amount, which is necessary for achieving AE. Our benchmarks on Intel platforms with AES-NI demonstrated that iXTS incurs only minor computation overhead from the underlying XTS.
Copyright (c) 2025 Akiko Inoue, Kazuhiko Minematsu, Rei Ueno, Naofumi Homma http://creativecommons.org/licenses/by/4.0
THF: Designing Low-Latency Tweakable Block Ciphers
We introduce the Three-Hash Framework (THF), a new instantiation of the LRW+ paradigm that employs three hash functions to process tweak inputs. We prove that THF achieves beyond-birthday-bound security under standard assumptions. By extending the general practical cryptanalysis framework to the multiple-tweak setting, we further demonstrate that THF offers balanced resistance to both singleand multiple-tweak attacks, thereby enabling the potential for lower latency compared to existing constructions. Building on this framework, we design Blink, a family of tweakable block ciphers optimized for ultra-low latency. Blink features logarithmic-depth Toeplitz-based hashing, which ensures efficient diffusion and scalability with varying tweak lengths. Our cryptanalysis shows that Blink achieves strong security with fewer rounds, while hardware evaluations confirm its superior latency performance. Notably, Blink maintains comparable latency even when the tweak length is doubled, underscoring the scalability advantage of THF.
Copyright (c) 2025 Jianhua Wang, Tao Huang, Guang Zeng, Tianyou Ding, Shuang Wu, Siwei Sun http://creativecommons.org/licenses/by/4.0
Dialga: A Family of Low-Latency Tweakable Block Ciphers Using Multiple Linear Layers
In this paper, we propose Dialga, a family of low-latency tweakable block ciphers designed to support 128/256-bit tweaks and 256-bit keys. Dialga achieves significantly small latency by leveraging multiple novel strategies. These include the use of multiple linear layers with efficient cell permutations, which enhance security against differential and linear attacks with negligible hardware overhead. We also identify the optimal choice of S-boxes for these permutations using state-ofthe- art evaluation methods by SAT, enabling us to further reduce the delay of the round function. Besides, we design a reflection tweakey schedule that ensures strong security in the related-tweak setting and allows for encryption and decryption without delay overhead, reducing the circuit area. We conducted comprehensive hardware benchmarks involving Dialga and other primitives. As a result, Dialga achieves nearly half the delay of QARMAv2, while achieving approximately a 40% reduction in area, with the same claimed security.
Copyright (c) 2025 Subhadeep Banik, Tatsuya Ishikawa, Takanori Isobe, Ryoma Ito, Kazuhiko Minematsu, Kazuma Nakata, Mostafizar Rahman, Kosei Sakamoto http://creativecommons.org/licenses/by/4.0
BEANIE – A 32-bit Cipher for Cryptographic Mitigations Against Software Attacks
In modern CPU architectures, various security features to mitigate software attacks can be found. Examples of such features are logical isolation, memory tagging or shadow stacks. Basing such features on cryptographic isolation instead of logical checks can have many advantages such as lower memory overhead and more robustness against misconfiguration or low-cost physical attacks. The disadvantage of such an approach is however that the cipher that has to be introduced has a severe impact on the system performance, either in terms of additional cycles or a decrease of the maximum achievable frequency. Finally, as of today, there is no suitable low-latency cipher design available for encrypting 32-bit words as is common in microcontrollers. In this paper, we propose a 32-bit tweakable block cipher tailored to memory encryption for microcontroller units. We optimize this cipher for low latency, which we achieve by a careful selection of components for the round function and leveraging an attack scenario similar to the one used to analyze the cipher SCARF. To mitigate some attack vectors introduced by this attack scenario, we deploy a complex tweak-key schedule. Due to the shortage of suitable 32-bit designs, we compare our design to various low-latency ciphers with different block sizes. Our hardware implementation shows competitive latency numbers.
Copyright (c) 2025 Simon Gerhalter, Samir Hodžić, Marcel Medwed, Marcel Nageler, Artur Folwarczny, Ventzi Nikov, Jan Hoogerbrugge, Tobias Schneider, Gary McConville, Maria Eichlseder http://creativecommons.org/licenses/by/4.0
Nostalgia Cipher: Can Filtered LFSRs Be Secure Again? An Application to Hybrid Homomorphic Encryption with Sub-50 ms Latency
Linear Feedback Shift Registers (LFSRs) combined with non linear filtering functions have long been a fundamental design for stream ciphers, offering a wellunderstood structure that remains easy to analyze. However, the introduction of algebraic attacks in 2003 shifted the focus toward more complex designs, as filtered LFSRs required larger registers to maintain security. While this was seen as a drawback at the time, it is no longer a limiting factor, and emerging cryptographic applications benefit from specialized designs—challenges that filtered LFSRs can effectively address. In this work, we propose a new filtered LFSR design, called Nostalgia, tailored for Hybrid Homomorphic Encryption (HHE). We use a weightwise quadratic function as filtering function, leveraging its efficiency in the HHE setting while ensuring security against classical attacks. We also discuss the parameter selection of our design and demonstrate its efficiency in this setting by providing a proof-of-concept implementation. In terms of latency, our HHE solution outperforms current state-of-the-art for TFHE-based HHE (Baudrin et al., Crypto 2025) by a factor of 6.1 times. By revisiting filtered LFSRs in light of modern security requirements, we aim to renew interest in their potential applications and stimulate further cryptanalysis efforts.
Copyright (c) 2025 Nabil Chacal, Antonio Guimarães, Ange Martinelli, Pierrick Méaux, Romain Poussier http://creativecommons.org/licenses/by/4.0
Trail-Estimator: An Automated Verifier for Differential Trails in Block Ciphers
Differential cryptanalysis is a powerful technique for attacking block ciphers, wherein the Markov cipher assumption and stochastic hypothesis are commonly employed to simplify the search and probability estimation of differential trails. However, these assumptions often neglect inherent algebraic constraints, potentially resulting in invalid trails and inaccurate probability estimates. Some studies identified violations of these assumptions and explored how they impose constraints on key material, but they have not yet fully captured all relevant ones. This study proposes Trail-Estimator, an automated verifier for differential trails on block ciphers, consisting of two parts: a constraint detector Cons-Collector and a solving tool Cons-Solver. We first establish the fundamental principles that will allow us to systematically identify all constraint subsets within a differential trail, upon which Cons-Collector is built. Then, Cons-Solver utilizes specialized preprocessing techniques to efficiently solve the detected constraint subsets, thereby determining the key space and providing a comprehensive probability distribution of differential trails. To validate its effectiveness, Trail-Estimator is applied to verify 17 differential trails for the SKINNY, LBLOCK, TWINE, and AES block ciphers. Experimental results show that Trail-Estimator consistently identifies previously undetected constraints for SKINNY and AES, and discovers constraints for the first time for LBLOCK and TWINE. Notably, it is the first tool to discover long nonlinear constraints extending beyond five rounds in these ciphers. Furthermore, Trail-Estimator’s accuracy is validated by experiments showing its predictions closely match the real probability distribution of short-round differential trails.
Copyright (c) 2025 Thomas Peyrin, Quan Quan Tan, Hongyi Zhang, Chunning Zhou http://creativecommons.org/licenses/by/4.0
Divide-and-Conquer SAT for Exploring Optimal Differential and Linear Characteristics and Its Applications
Developing automatic search tools to derive optimal characteristics is crucial for both the design and cryptanalysis of symmetric-key primitives. However, evaluating primitives that employ large S-boxes and complex linear layers remains a computationally demanding task. In this paper, we introduce a novel solver-aided automatic search tool based on the divide-and-conquer strategy that leverages the advantages of both MILP and SAT methods. Our method divides a given SAT model into multiple smaller SAT models, allowing to pre-eliminate as much of the space of Boolean variable assignments that make a given SAT model always “UNSAT”. In addition, we propose a new method for large S-boxes that involves the decimal parts of values, enabling us to efficiently derive optimal linear characteristics for a large S-box-based primitive, all within a practical time for the first time. The new tool is able to obtain optimal differential and linear characteristics in the significant number of rounds of AES, Camellia without FL function, ARIA, LED, Midori-128, SKINNY- 128, and Rijndael-256-256. Our results improve the required number of rounds for differential and linear attacks, based on a single characteristic, for Camellia, LED, and Midori-128. Besides, our tool identifies the longest distinguisher for extensivelyanalyzed ciphers of Camellia/ARIA/Midori-128 and SKINNY-128 by optimal linear and differential ones, respectively.
Copyright (c) 2025 Kazuma Taka, Kosei Sakamoto, Ryoma Ito, Rentaro Shiba, Shion Utsumi, Takanori Isobe http://creativecommons.org/licenses/by/4.0
SAT-Based Space Partitioning and Applications to Ascon-Hash256 Cryptanalysis
We introduce an efficient SAT-based space partitioning technique that enables systematic exploration of large search spaces in cryptanalysis. The approach divides complex search spaces into manageable subsets through combinatorial necklace generation, allowing precise tracking of explored regions while maintaining search completeness. We demonstrate the technique’s effectiveness through extensive cryptanalysis of Ascon-Hash256. For differential-based collision attacks, we conduct an exhaustive search of 2-round collision trails, proving that no collision trail with weight less than 156 exists. Through detailed complexity analysis and parameter optimization, we present an improved 2-round collision attack with complexity 261.79. We also discover new Semi-Free-Start (SFS) collision trails that enable practical attacks on both 3-round and 4-round Ascon-Hash256, especially improving the best known 4-round SFS trail from weight 295 to 250. Furthermore, applying the technique to Meet-in-the-Middle structure search yields improved attacks on 3-round Ascon-Hash256. We reduce the collision attack complexity from 2116.74 to 2114.13 with memory complexity 2112 (improved from 2116), and the preimage attack complexity from 2162.80 to 2160.75 with memory complexity 2160 (improved from 2162).
Copyright (c) 2025 Guozhen Liu, Shun Li, Huina Li, Weidong Qiu, Siwei Sun http://creativecommons.org/licenses/by/4.0
Linear Cancellations in the MitM Attacks on Sponge Functions
At EUROCRYPT 2023, Qin et al. proposed the MitM attack framework on sponge functions by separating the message bits into two sets of neutral bits. By assigning bit cancellations on one of the two sets, the states of the two sets can be computed independently and then filtered by some matching equations. To solve the bit cancellations, Qin et al. exhaustively compute the cancellations of all message bits, and store them in a huge hash table, which leads to attacks with huge memory. In this paper, we separate the bit cancellations into linear and nonlinear cancellations for the MitM attacks, where the linear cancellations are solved by Gaussian elimination, and only the nonlinear cancellations are dealt with the hash table. Hence, the memory cost is significantly reduced. In order to search new attacks with efficient memory (fewer nonlinear cancellations and more linear cancellations), we propose a new MILP model whose encoding scheme can distinguish linear and nonlinear cancellations. Besides, dedicated tricks such as the so-called weak-diffusion structure and two-stage search are proposed to further accelerate solving the MILP models. Finally, the memory complexities of MitM attacks on 4-round Keccak[1024], 3-round Xoodyak-Xof, 4-round Ascon-Xof, and full Subterranean 2.0 are reduced by 249, 259, 216, and 236, respectively. Besides, our memory-efficient approach can turn invalid MitM attacks (where memory complexity is the dominant factor in old framework) into valid MitM attacks. For example, we propose the first MitM preimage attack on 4-round Keccak[768] and the first 3-round collision attack on Xoodyak-Xof with 128-bit tag.
Copyright (c) 2025 Lingyue Qin, Boxin Zhao, Qingliang Hou, Keting Jia, Gaoli Wang, Xiaoyang Dong http://creativecommons.org/licenses/by/4.0
Mix-Basis Geometric Approach to Boomerang Distinguishers
Differential cryptanalysis relies on assumptions like Markov ciphers and hypothesis of stochastic equivalence. The probability of a differential characteristic estimated by classical methods is the key-averaged probability under the two assumptions. However, the real probability can vary significantly between keys. Hence, tools for differential cryptanalysis in the fixed-key model are desirable. Recently, Beyne and Rijmen applied the geometric approach to differential cryptanalysis and proposed a systematic framework called quasi-differential (CRYPTO 2022). As a variant of differential cryptanalysis, boomerang attacks rely on similar assumptions, so it is important to study their probability in the fixed-key model as well. A direct extension of the quasi-differential for boomerang attacks leads to the quasi-3- differential framework (IEEE-IT 2024). However, such a straightforward approach is difficult in practical applications as there are too many quasi-3-differential trails. We tackle this problem by applying the mix-basis style geometric approach (CRYPTO 2025) to the boomerang attacks and construct the quasi-boomerang framework. By choosing a suitable pair of bases, the boomerang probability can be computed by summing correlations of quasi-boomerang characteristics. The transition matrix of the key-XOR operation is also a diagonal matrix; thus, the influence of keys can be analyzed in a similar way to the quasi-differential framework. We apply the quasi-boomerang framework to SKINNY-64 and GIFT-64. For SKINNY- 64, we check and confirm 4 boomerang distinguishers with high probability (2 with probability 1 and 2 with probability 2−4) generated from Hadipour, Bagheri, and Song’s tool (ToSC 2021/1), through the analysis of key dependencies and the probability calculation from quasi-boomerang characteristics. We also propose a divide-and-conquer approach following the sandwich framework for boomerangs with small probability or long rounds to apply the quasi-boomerang framework. After checking 2/1 boomerang distinguisher(s) of SKINNY-64/GIFT-64, we find that the previously considered invalid 19-round distinguisher of GIFT-64 is valid. In addition, as a contribution of independent interest, we revisit Boura, Derbez, and Germon’s work by extending the quasi-differential framework to the related-key scenario (ToSC 2025/1), and show an alternative way to derive the same formulas in their paper by regarding the key-XOR as a normal cipher component.
Copyright (c) 2025 Chengcheng Chang, Hosein Hadipour, Kai Hu, Muzhou Li, Meiqin Wang http://creativecommons.org/licenses/by/4.0
Most modern cryptanalysis results are obtained through theoretical analysis, often relying on simplifications and idealized assumptions. In this work, we use the parallel computational power of GPUs to experimentally verify a small portion of the cryptanalysis results that have been published in recent years. Our focus is on the ciphers Ascon, ChaCha, and Serpent. In none of the attacks we considered did the theoretical estimates fully match the actual practical values. More precisely, we show that the 4.5-round truncated differential with probability one, the 6-round differential-linear (DL), and the 6-round impossible differential distinguishers on Ascon, as well as the best known 7- and 7.5-round DL distinguisher on ChaCha, do not actually work in practice. Moreover, we demonstrate that the best known 10, 11, and 12-round DL attacks on Serpent perform better in practice than previously estimated. Additionally, we provide a new experimentally obtained 9-round DL distinguisher on Serpent, which can be used in 10 and 11-round attacks with reduced data complexity. In a broader sense, we recommend that cryptanalysts experimentally verify reduced versions of their theoretically obtained analysis results whenever possible. In order to simplify this process, we make our optimized code for the ciphers treated here available for future use.
Copyright (c) 2025 Cihangir Tezcan, Gregor Leander, Hosein Hadipour http://creativecommons.org/licenses/by/4.0
Observations on the BayesianKeySearch with Applications to Simon and Simeck
In CRYPTO 2019, Gohr pioneered the integration of machine learning with differential cryptanalysis, demonstrating that differential-neural distinguishers can outperform classical techniques in distinguishing attacks. He also introduced a novel key-recovery strategy based on Bayesian optimization, termed BayesianKey- Search, enhancing key recovery for Speck32/64. However, the impact of parameter selection on the complexity and success probability of key-recovery attack using BayesianKeySearch remains underexplored. This paper investigates the impact of parameter selections on key-recovery effectiveness. Gohr’s key-recovery attack involves two stages, each using a cutoff value to filter candidate guesses for the last subkey and second-to-last subkey. Previous works selected these cutoffs independently. We propose connecting these cutoff selections, enhancing coordination between stages and improving the attack’s complexity and success probability. Applying our parameter optimization, we enhance the single-key recovery attacks on 16-round Simon32/64, 16-round and 17-round Simeck32/64, achieving higher success rates and lower time complexities compared to previous works. Additionally, for related-key differential-neural attacks on Simon32/64, we exploit both single-key and related-key features from cross-paired ciphertexts, developing advanced neuraldistinguishers for up to 13 rounds. Using these neural-distinguishers combined with carefully selected classical differentials, we devise an 18-round related-key recovery attack on Simon32/64. Our results validate the practical effectiveness of the proposed strategies and are expected to contribute to the advancement of machine learningaided cryptanalysis.
Copyright (c) 2025 Zezhou Hou, Zhenzhen Bao, Jinyu Lu, Shaozhen Chen http://creativecommons.org/licenses/by/4.0
Generalizations of ChiChi: Families of Low-Latency Permutations in Any Even Dimension
At Eurocrypt’25, Belkheyar et al. introduced a new non-linear layer called ChiChi or χχ. ChiChi is built based on Daemen’s χ function, but crucially gives a permutation in even dimension divisible by four. In this work, we generalize their construction in multiple ways, prove their open conjecture regarding the algebraic degree of the inverse of ChiChi, and investigate the properties of it against key recovery attacks.
Copyright (c) 2025 Samuele Andreoli, Gregor Leander, Enrico Piccione, Lukas Stennes http://creativecommons.org/licenses/by/4.0
MDS Diffusion Layers for Arithmetization-Oriented Symmetric Ciphers: The Rotational-Add Construction
We introduce the rotational-add diffusion layers aimed for applications in the design of arithmetization-oriented (AO) symmetric ciphers, such as fully homomorphic encryption (FHE)-friendly symmetric ciphers. This generalizes the rotational-XOR diffusion layers which have been utilized in the design of many important conventional symmetric ciphers like SHA-256, SM4, ZUC and Ascon. A rotational-add diffusion layer is defined over the finite field Fp for arbitrary prime p, enabling implementations using only rotations and modular additions/subtractions. The advantage of using such diffusion layers in AO ciphers is that, the costs of scalar multiplications can be reduced since the appearing scalars include only ±1, thus the total costs depend on sizes of the rotation offsets. In this paper, we investigate characterizations and constructions of lightest rotational-add diffusion layers over (Fmp)n that are maximum distance separable (MDS) with a focus on the case n = 4. It turns out that the minimum achievable size of the rotation offsets is 5 subject to the MDS property constraint. We specify a large class of rotational-add diffusion layers with 5 rotations and traverse all possible patterns of appearance of the scalars ±1. In four cases we can derive computationally tractable necessary and sufficient conditions for the rotational-add diffusion layers to attain the MDS property. These conditions enable explicit characterization of suitable primes p for given parameters. Leveraging these results, we construct three distinct families of rotational-add MDS diffusion layers applicable to AO ciphers. Although a rotational-add diffusion layer with 7 rotations and only additions has already been used in the design of the FHEfriendly block cipher YuX recently, to our knowledge, our work presents the first systematic theoretical characterization of rotational-add MDS diffusion layers and provides explicit constructions of them.
Arithmetization-oriented symmetric cipher
Copyright (c) 2025 Baofeng Wu, Wen Kong, Dewei Kong, Hailun Yan http://creativecommons.org/licenses/by/4.0
New General MDS Matrix Construction Method Towards Low Area
Maximum Distance Separable (MDS) matrices have been widely used in symmetric cryptographic primitives because of their excellent cryptographic properties. However, due to the heavy area cost, larger-scale MDS matrices than 4 x 4 ones are limited in ciphers, although they have a larger branch number. In this paper, we propose a general method for constructing MDS matrices with low implementation area cost, using matrix decomposition, automatic search, and symbolic computation techniques. According to matrix decomposition theory, every invertible matrix can be decomposed into a sequence of elementary matrices, including Type-1 (row switching), Type-2 (row multiplication) and Type-3 (row addition) elementary matrices. So, we first propose a greedy algorithm to construct MDS matrix patterns with as few Type-3 elementary matrices as possible. Then, we build an automatic search model to minimize the implementation area of multiplication coefficients used in Type-3 elementary matrices. Lastly, another greedy strategy is raised to further reduce the implementation area of MDS matrix patterns by introducing a few Type-2 elementary matrices. In comparison to previous methods, our approach is more general and effective for constructing lower-area MDS matrices. To demonstrate the efficiency of our method, we apply the framework on constructing m x m MDS matrices over F2n or GL(n, F2), where m ∈ {4, 5, 6, 7, 8} and n ∈ {4, 8, 16, 32, 64}. The 4 x 4 MDS matrices constructed by our method can also reach the minimum area. The 5 x 5, 6 x 6 and 7 x 7 MDS matrices constructed by our method have lower area compared to previous ones. While the 8 x 8 MDS matrices with n ∈ {16, 32, 64} constructed by our method also have lower area compared to previous ones.
Copyright (c) 2025 Yan He, Tingting Cui, Qing Ling, Xi Han http://creativecommons.org/licenses/by/4.0
Vistrutah is a block cipher with block sizes of 256 and 512 bits. It iterates a step function consisting of two AES rounds applied to each 128-bit block of the state, followed by a state-wide cell permutation. Building upon established design principles from Simpira, Haraka, Pholkos, and ASURA, Vistrutah leverages AES instructions to achieve high performance. For each component of Vistrutah, we conduct a systematic evaluation of functions that can be efficiently implemented on both Intel and Arm architectures. We therefore expect them to perform efficiently on any recent vector instruction set architecture (ISA) with AES support. Our evaluation methodology combines, for each combination of the various choices of the cipher’s components, a security analysis with a latency estimation on an abstracted ISA. The goal is to maximize the ratio of “bits of security per unit of time,” i.e., to achieve the highest security for a given performance target, or equivalently, the best performance for a given security level within this class of designs. Implementations confirm the accuracy of our latency model. Vistrutah even performs significantly better than Rijndael-256-256. Our security claims are backed by a comprehensive ad-hoc cryptanalysis. An isomorphism between Vistrutah-512, the 512-bit wide variant, and the AES, allows us to also leverage the extensive cryptanalysis of AES and apply it to Vistrutah-512. A core design principle is the use of an inline key schedule, computed during each encryption or decryption operation without requiring storage in any external memory. In fact, rekeying Vistrutah has no associated overheads. Key schedules like the AES’s must precompute and store round keys in memory for acceptable performance. However, in 2010 Kamal and Youssef showed that this makes cold boot attacks significantly more effective. Vistrutah’s approach minimizes leakage to at most two byte-permutations of the original key during context switches. Furthermore, expensive key schedules reduce key agility, limiting the design of modes of operation. Vistrutah is particularly well-suited for Birthday-Bound modes of operation, including Synthetic IV modes and Accordion modes for 256-bit block ciphers. It can serve as a building block for compression functions (such as Matyas-Meyer-Oseas) in wide Merkle–Damgård hash functions. Additionally, it can implement “ZIP” wide pseudo-random functions as recently proposed by Flórez-Gutiérrez et al. in 2024. Finally, we present short, i.e., reduced-round versions of Vistrutah which are analyzed taking into account the restrictions posed on attackers by specific modes of operation. In particular, we model the use of the block ciphers in Hash-Encrypt-Hash (HEH) constructions such as HCTR2 as well as in ForkCiphers. These short versions of Vistrutah can be used to accelerate modes of operation without sacrificing security.
Copyright (c) 2025 Roberto Avanzi, Avik Chakraborti, Bishwajit Chakraborty, Eik List http://creativecommons.org/licenses/by/4.0
LEAP: High-Performance Lattice-Based Pseudorandom Number Generator
At EUROCRYPT2012, Banerjee, Peikert, and Rosen introduced Ring Learning With Rounding (RLWR) problem and constructed lattice-based pseudorandom functions for the first time. Subsequently, Banerjee, Brenner, Leurent, Peikert, and Rosen named this family of lattice-based pseudorandom functions as SPRING, reanalyzed the security, and gave two practical instances. Building upon the SPRING family, Bouillaguet, Delaplace, Fouque, and Kirchner further extended it to a pseudorandom number generator called SPRING-RS. It is quite fast but still has a certain gap compared with the classical pseudorandom number generator based on symmetric cryptography, and the key size is large. In this work, we present LEAP, a lattice-based pseudorandom number generation scheme characterized by high performance, adaptable parameter selection, and extensive support for parallel processing. Unlike the RLWR problem used in public key cryptography, LEAP treats the public parameter in the RLWR problem as the key as well. Hiding the public parameters leads to larger lattice dimensions and higher standard deviations of error in the concrete security analysis compared to RLWR under identical parameters. These adjustments imply enhanced security, allowing smaller parameters while maintaining the same security level, thereby improving performance. Additionally, we introduce a novel framework that reuses multiple parameters, significantly enhancing overall performance. To mitigate the issue of increased key size caused by treating the public parameter as the key, we design a pseudorandom number generator leveraging the small key size characteristic of a variant of the NTRU assumption, which provides the key required for the high-performance pseudorandom number generator. Compared with the SPRING-RS, the LEAP can reduce the key size by 1.71X while improving performance by 3.30X at the same security level. Under the AVX2 and AVX512 implementations, the performance reaches 1.61 Cycles/byte and 1.14 Cycles/byte, and the throughput reaches 16.12 Gbps and 22.60 Gbps, respectively.
Copyright (c) 2025 Yu Zhang, Xianhui Lu, Yijian Liu, Yongjian Yin, Kunpeng Wang http://creativecommons.org/licenses/by/4.0
HCTR+: An Optimally Secure TBC-Based Accordion Mode
The design of tweakable wide-block ciphers has advanced significantly over the past two decades. This evolution began with the wide-block cipher by Naor and Reingold. Since then, numerous constructions have been proposed, many of which are built on existing block ciphers and are secure up to the birthday bound for the total number of blocks queried. Although there has been a recent slowdown in the development of such ciphers, the latest NIST proposal for Accordion modes has reignited the interest and momentum in the design and analysis of these ciphers. Although new designs have emerged, their security often falls short of optimal (i.e., n-bit) security, where n is the output size of the primitive. In this direction, designing an efficient tweakable wide-block cipher with n-bit security seems to be an interesting research problem to the symmetric key research community. An optimally secure tweakable wide-block cipher mode can easily be turned into a misuse-resistant RUP secure authenticated encryption scheme with optimal security. This paper proposes HCTR+, which turns an n-bit tweakable block cipher (TBC) with n-bit tweak into a variable input length tweakable wide block cipher. Unlike tweakable HCTR, HCTR+ ensures n-bit security regardless of tweak repetitions. We also propose two TBC-based almost-xor-universal hash functions, named PHASH+ and ZHASH+, and use them as the underlying hash functions in the HCTR+ construction to create two TBC-based n-bit secure tweakable wide block cipher modes, PHCTR+ and ZHCTR+. Experimental results show that both PHCTR+ and ZHCTR+ exhibit excellent software performance when their underlying TBC is instantiated with Deoxys-BC-256.
Copyright (c) 2025 Nilanjan Datta, Avijit Dutta, Shibam Ghosh, Eik List, Hrithik Nandi http://creativecommons.org/licenses/by/4.0
The sum of permutations is a popular way to turn a PRP (like a block cipher) into a PRF. However, with the rise of permutation based cryptography, it makes sense to investigate the possibility to design a PRF as the sum of externally keyed public permutations. This challenge was initiated by Chen et al. (CRYPTO 2019) who presented the Sum of Even-Mansours (SoEM) construction. Sibleyras and Todo (CT-RSA 2023) later minimized the amount of key maskings in this construction with their Keyed Sum of Permutations (KSoP). However, both constructions have in common that their security proofs require two independent keys and two independent public random permutations. In this work, we investigate the possibilities to reduce this amount of randomness, by introducing three constructions: sirP, that uses two independent permutations but one key, sirK, that uses two independent keys but one permutation, and sirX, that uses a single permutation and a single key. The constructions are further generalized by having a parameter prescribing the data input size compared to the permutation size. We present general security results for all three variants, and demonstrate that, for certain parameter choices, the security bounds match those of SoEM and KSoP, but with reduced randomness.
Copyright (c) 2025 Bart Mennink http://creativecommons.org/licenses/by/4.0
At Eurocrypt 2006, Rogaway and Shrimpton (RS06) presented the idea of vector-input MAC that accepts a vector consisting of variable-length bit strings. A vector-input MAC could be built on a conventional (bit) string-input MAC, e.g., CMAC, with an injective encoding. RS06 pointed out an efficiency loss in this method and presented a general construction S2V that is more efficient than the encodingbased method. RS06 made significant scientific and practical impacts on the field of mode constructions, in particular for the invention of deterministic authenticated encryption. However, despite its potential, their work on vector-input MAC has been largely overlooked for more than 18 years. We revisit RS06’s treatment of vector-input MAC and show that the topic is more subtle than initially considered. We first formally define the problem of vector-input MAC and propose a natural efficiency goal for vector-input MACs as a counterpart of what has been considered for string-input MACs. Since S2V with any string-input MAC mode never achieves this efficiency goal, we propose a family of new MAC modes, VecMAC, that achieves this goal. VecMAC has a similarity to the popular PMAC, in particular its idea of tweak. However, the purpose of introducing tweak is different from PMAC and tweak is tailored to handle vectors without redundant block cipher calls. We also provide implementation results that show an advantage over the conventional method.
Copyright (c) 2025 Isamu Furuya, Kazuhiko Minematsu http://creativecommons.org/licenses/by/4.0
A growing number of advanced cryptographic protocols and constructions rely on symmetric primitives known as weak pseudo-random functions (wPRFs). These functions differ significantly from traditional PRFs: they operate in constrained models where inputs are sampled uniformly at random and are not chosen by the adversary. In practice, many of these functions are implemented as shallow, non-iterated constructions with simple circuit representations. This Systematization of Knowledge (SoK) provides a unified view of shallow wPRFs (swPRFs), which we define as wPRFs computable by low-depth circuits and primarily used in different secure computation protocols. We identify and classify four main families of swPRFs—alternating moduli wPRFs, Goldreich’s PRG family, and the VDLPN and EALPN constructions—presenting formal definitions, algorithmic descriptions, known variants, cryptanalytic results, and concrete parameter sets for each. In addition to surveying the literature, our goal is to shift the focus from asymptotic analyses to concrete cryptanalysis. To this end, we provide a set of cryptanalytic challenges along with reference SAGE implementations for all the primitives discussed. We aim to encourage the symmetric cryptography community—particularly cryptanalysts— to rigorously evaluate the practical security levels offered by swPRFs, as concrete analyses are currently lacking. Given their growing use in high-level protocols and constructions, any cryptanalytic breakthrough on these primitives could directly affect the security of the broader cryptographic systems that rely on them.
Copyright (c) 2025 Christina Boura, Geoffroy Couteau, Léo Perrin, Yann Rotella http://creativecommons.org/licenses/by/4.0
Attacking Split-and-Lookup-Based Primitives Using Probabilistic Polynomial System Solving
In recent years, many hash functions have been introduced to satisfy the pressing need of some zero-knowledge protocols for such primitives allowing a low degree verification of their round function when arithmetized over a large field. While this can be achieved by restricting their sub-components to low-degree functions (and their inverse), the newest primitives in this category also leverage the intricacies of some proof systems to use “Split-and-Lookup” non-linear functions that essentially apply a small S-box in parallel over the binary representation of a field element. Such components excel at hindering attacks relying on polynomial system solving, but they offer poor security against statistical attacks. On the other hand, low degree monomials offer the opposite guarantees, being strong against statistical attacks. Several primitives have recently been proposed that combine such components in different ways in order to get the best from both. In this paper, we target such primitives by relying on the low degree components to allow a low-cost polynomial solving step. The weakness of Split-and-Lookups against linear attacks is used to simplify these systems, and their weakness against differential attacks is then used to propagate across many rounds the differential patterns obtained during polynomial solving. We instantiate this general approach by attacking round-reduced Monolith, and providing a distinguisher on full-round Skyscraper. These result then shed some light on how to best combine the different types of components to achieve the highest security.
Copyright (c) 2025 Antoine Bak, Guilhem Jazeron, Pierre Galissant, Léo Perrin http://creativecommons.org/licenses/by/4.0
Multidimensional Linear Cryptanalysis of AEGIS
AEGIS is a family of authenticated encryption with associated data (AEAD) ciphers that target for highly efficient implementations in software. The main operation in AEGIS is the AES encryption round function such that it can make full use of the cryptographic properties and efficient implementation. AEGIS includes three variants AEGIS-128, AEGIS-128L, and AEGIS-256, which achieve 128, 128, and 256 bits of security, respectively. AEGIS-128 has been selected and included into the final portfolio of the CAESAR competition. In this paper, we perform multidimensional linear cryptanalysis of AEGIS. We first dig into the reason of the inconsistency between the byte and bit trails in AEGIS and propose an improved truncated model to efficiently derive the accurate minimum number of active Sboxes. Based on the derived byte trails, we perform deep theoretical analysis of the correlation propagation in AEGIS and derive linear approximations with high correlations. Moreover, we find interesting properties of AEGIS that enable us to derive a number of equivalent but independent linear approximations. By combining these linear approximations, we perform multidimensional linear distinguishing attacks on AEGIS-128, AEGIS-256, and AEGIS-128L with complexities 2126.46, 2154.11, and 2144.44, respectively. These results suggest that AEGIS-128 and AEGIS-256 do not meet their security claims. We also apply the improved truncated model to two AES-based stream cipher families LOL and Rocca for the linear cryptanalysis of them. Particularly, for LOL-MINI, we give a fast correlation attack with complexity 2250.5, thereby breaking its security claim if we ignore the restriction in the length of the keystream under a single pair of key and IV.
Copyright (c) 2025 Yinuo Liu, Tian Tian, Jing Yang http://creativecommons.org/licenses/by/4.0
Chosen-Key Distinguishing Attacks on Full AES-192, AES-256, Kiasu-BC, and More
At CRYPTO 2020, Liu et al. demonstrated that many differentials on Gimli are, in fact, incompatible. Similar incompatibilities also arise in relatedkey differentials on AES, which are typically addressed in an ad-hoc manner by incorporating additional constraints into the searching models. However, such ad-hoc methods are insufficient to eliminate all incompatibilities and may still produce false positive related-key differentials. At CRYPTO 2022, a novel approach was introduced that combines a Constraint Programming (CP) tool with a triangulation algorithm to search for rebound attacks against AES-like hashings. In this paper, we extend and unify these techniques to develop a comprehensive related-key differential search model. Our model not only identifies valid related-key differentials for AES and similar ciphers, but also enables immediate verification of the existence of at least one key pair satisfying the differentials. Using this enhanced automatic tool, we discover new related-key differentials for full-round AES-192, AES-256, Kiasu-BC, and for roundreduced Deoxys-BC. Based on these findings, we present full-round limited-birthday chosen-key distinguishing attacks on AES-192, AES-256, and Kiasu-BC, as well as the first chosen-key distinguisher on reduced-round Deoxys-BC. Furthermore, we identify, for the first time, a limited-birthday distinguisher on 9-round Kiasu-BC with practical complexities.
Copyright (c) 2025 Xiaoyang Dong, Jian Guo, Shun Li, Phuong Pham http://creativecommons.org/licenses/by/4.0