Time-memory-data tradeoff attacks, as described by Babbage (1995), Golić (1997), and Biryukov and Shamir (2001), require the internal state of a stream cipher to be at least twice the desired security level n, or equivalently twice the key length. In conventional stream ciphers, the secret key and the IV are loaded into the cipher prior to keystream generation, after which the cipher operates exclusively on a volatile internal state stored in the hardware module. So-called small-state stream ciphers reduce the size of this volatile state below 2n by reusing, during keystream generation, the wires employed for loading the secret key and IV. In this setting, the key and IV are non-volatile and not part of the hardware module's modifiable state. Although the entire state still meets the 2n requirement, the hardware footprint can be significantly reduced. DRACO is a small-state stream cipher published in IACR ToSC 2022 and presented at FSE 2023. It features a 128-bit volatile state and a 128-bit non-volatile state, the latter consisting of a 96-bit public initial value and a 32-bit key prefix. Reusing the secret key and IV during keystream generation requires the stream cipher to employ a key-IV schedule; a task that historically has not been a concern in stream cipher design. At the same conference, an attack was presented that exploits a weakness in DRACO's key-IV schedule, reducing its security to approximately 108 bits. Fixing this issue turns out to be highly nontrivial. In this update, we introduce DRACO V1 an improved version of DRACO that is resistant to the style of attack presented in the aforementioned FSE 2023 paper. The new design employs an IV extension technique that is hardware-efficient and requires only a minimal increase in gate count. We refined the design through multiple iterations, carefully analyzing its security at each stage. Our evaluation includes an extensive analysis of all known attacks against such structures. Additionally, we synthesized the circuit using two standard cell libraries and found that DRACO V1 is approximately 10-15% smaller than all other stream ciphers offering 128-bit security.
We describe key-recovery attacks on the authenticated stream cipher HiAE, which was recently proposed by Huawei for future high-throughput communication networks such as 6G, setting a new throughput performance record. HiAE uses a 2048-bit state, a 256-bit key and produces 128-bit tags, targeting 256-bit security against key and state recovery. As a nonce-based scheme for authenticated encryption with associated data (AEAD), it relies on the uniqueness of the nonce per key for these security claims. Our analysis indicates that a complete recovery of the 256-bit key of HiAE is possible with a complexity of 2128 data and at most 2129 time. This key-recovery attack goes beyond the known distinguishability results for online AEAD with longer keys than tags (Khairallah, CiC 2024). Our attack model is nonce-respecting and uses decryption queries, similar to the previous cryptanalysis of the AEAD schemes COFB (Khairallah, ToSC 2022) and particularly Rocca (Hosoyamada et al., ToSC 2022). Note that the designers' security claims for HiAE exclude repeated tag guessing for key recovery. Our results also imply that the key-dependent initialization countermeasure proposed for Rocca and employed in HiAE to achieve 256-bit security against key-recovery attacks is not sufficient by itself for this design strategy. We describe further complete key-recovery attacks in the nonce-misuse and release of unverified plaintext (RUP) settings which require only a small constant number of repeated nonces or unverified decryption queries, respectively. We furthermore discuss the applicability of our attack to other NFSR-based AEAD schemes using the AES round function and suggest possible countermeasures.
Automated cryptanalysis has seen a lot of attraction and success in the past decade, leading to new distinguishers or key-recovery attacks against various ciphers. We argue that the improved efficiency and usability of these new tools have been undervalued, especially for design processes. In this article, we break the classical iterative design paradigm for symmetric-key primitives, where constructions are built around the repetition of a round function. We propose instead a new design framework, so-called uKNIT, that allows a round-by-round optimization-led automated construction of the primitives where each round can be entirely different from the others (the security/performance trade-off actually benefiting from this non-alignment). This new design framework being non-trivial to instantiate, we further propose a method for SPN ciphers using a genetic algorithm and leveraging advances in automated cryptanalysis: given a pool of good cipher candidates on x rounds, our algorithm automatically generates and selects (x+1)-round candidates by evaluating their security and performance. We finally exemplify our new design strategy on the important use-case of low-latency cryptography, by proposing the uKNIT-BC block cipher, together with a complete security analysis and benchmarks. Compared to the state-of-the-art in low-latency ciphers (PRINCEv2), uKNIT-BC has an improvement in latency (10% better), while increasing resistance against classical differential/linear cryptanalysis. It also reduces the area by 17% and energy consumption by 44% when fixing the latency of both ciphers. As a contribution of independent interest, we describe a generalization of the Superposition-Tweakey (STK) construction for key schedules, unlocking its application to bit-oriented ciphers. We also discuss the benefits of uKNIT to many other possible use-cases.
Related-key differential cryptanalysis of GIFT-64 has thus far been driven largely by a single 18-round related-key differential trail of probability 2-58. Recent results, however, suggest that this trail is strongly key-dependent: it holds for only a 2-8 fraction of keys, while its probability conditioned on this right-key subset is about 2-50. Motivated by the fact that differential attacks are governed by the right-key space and the aggregate probability of the underlying differential, rather than by the probability of an individual trail, we re-examine the related-key differential behavior of GIFT-64 from a differential-level perspective. Our study focuses on the 8.25-round self-canceling core that determines the practical validity of the known 18-round trail. Using SAT-based search, we prove that the previously identified core achieves the optimal trail probability 2-50 and uncover 31 additional optimal self-canceling trails. These 32 trails naturally fall into eight classes, each consisting of four distinct trails that realize the same 8.25-round differential. We then assess their dependencies via value restrictions using a three-stage pipeline. We show that, within each class, the right-key spaces of the four dominant trails are pairwise disjoint, so aggregating dominant trails does not increase the differential probability. We further enumerate and analyze minor trails, cast their coexistence as a Max-PoSSo instance, and demonstrate that cumulative gains beyond the dominant key set are negligible. Finally, leveraging this differential-level understanding of the middle 8.25 rounds, we systematically construct 128 distinct 18-round related-key differentials and 128 candidate 19-round related-key differentials for GIFT-64. For 18 rounds, each differential holds for about a 2-6 fraction of the key space with remaining probability approximately 2-50; for 19 rounds, the remaining probability is approximately 2-56.83 on essentially the same key fraction. To the best of our knowledge, this work provides the first differential-level characterization of the longest known related-key differentials for GIFT-64 and the first reported 19-round related-key differentials.
Common authenticated encryption schemes are generally believed to remain secure in the post-quantum setting where adversaries with local quantum power interact classically with the users. This is apart from a square root loss in the security bound due to Grover's algorithm. This changes dramatically when one switches to a fully quantum setting where the adversary is allowed to interact with the users in superposition, called IND-qCCA security. Here, many well-known schemes become completely insecure, including the widely deplyoed Galois/Counter mode (GCM). Here we propose a modification to GCM and to its counterpart GCM-SIV that resurrects IND-qCCA security in the quantum setting for nonce-respecting adversaries. The key observation is to replace the universal hash functions GHASH and PolyVal in GCM and GCM-SIV by pairwise-independent versions.
In this paper, we prove the security of symmetric-key constructions in an adversary model called the Q1MK model, which combines the Q1 model, where the adversary makes classical online queries and quantum offline queries, and the multi-key (multi-user) setting. Specifically, under this model, we prove the security of two symmetric-key constructions: the tweakable Even-Mansour cipher (TEM) and the FX construction (FX), as starting points for understanding the post-quantum security of symmetric-key constructions in this adversary model. Our security proofs are based on the hybrid argument technique introduced by Alagic et al. at EUROCRYPT 2022. First, we prove that in order to break TEM in the Q1MK model, Ω(2Κ/3) classical and quantum queries are needed, regardless of the number of target Κ-bit keys. Then, before turning to the Q1MK security analysis of FX, we revisit the security proof of FX in the standard Q1 model proposed in version 20230317:200508 of ePrint 2022/1097 and tighten it. By the modified proof, we show that in order to break FX with (Κ + n)-bit secret key in the Q1 model, Ω(2(Κ+n)/3) classical and quantum queries are needed. We then apply this proof to the Q1MK setting, and we show that in order to break FX in the Q1MK model, Ω(2(Κ + n - u)/3) classical and quantum queries are needed, when 2u ( 2Κ) independent keys are in use.
We present the first known-plaintext attack on up to25rounds of thetweakable block cipherCraft. These attacks require only two known plaintext-ciphertext pairs to recover the full key, and work independent of the used tweaks.Given the state and key size of64and128bits, respectively, this is the minimal datacomplexity an attack recovering the full key can have.At the basis of this attack is the observation thatCraftcan be decomposed intotwo loosely dependent functions: the state can be split in half such that the roundfunction mixes only4bits of each half into the other. Since the key schedule doesnot provide mixing between these parts either, we can guess these4bits per roundto mount a meet-in-the-middle attack on up to25rounds.While the best attacks onCraftby M'Foukhet al.cover up to26rounds, theyare in the chosen-ciphertext setting and require (up to) the full code book. In fact,we show that their attacks (implicitly) use a similar decomposition, and thereforepresent the other end of a time-data trade-off for the same family of attacks
Internal differential cryptanalysis has recently yielded a series of new results in the preimage cryptanalysis of round-reduced Keccak. While these existing attacks share a similar high-level framework, they differ in their technical details. This paper provides a comparative analysis of these prior approaches and introduces a variant framework specifically suitable for 5-round Keccak[ r = 640 c = 160 ]. This technique integrates certain advantages from prior works, so that the complexity of matching the all-zero initial value and the digest can be separated while the period still remains only one-quarter of the lane size, which avoids the need for a complex Forward-TIDA. Although this technique only provides a constrained application scope, we successfully give the practical preimage attack on 5-round Keccakr r = 640 c = 160 ] with the complexity of around 259.7, which firstly solve a 5-round pre-image challenge of the Crunchy Contest.
(Multi-branch) Generalized Feistel Network (GFN) enables the construction of block ciphers from non-linear components with small domains, and has been adopted in various block ciphers. Berger et al. (SAC 2013) introduced the Extended Generalized Feistel Network (EGFN), which unified and extended existing Feistel-like structures by using a matrix representation. Given an arbitrary matrix, it is typically difficult to determine how many EGFN rounds are sufficient for pseudorandom permutation (PRP) and strong PRP (SPRP) security. Remarkably, security proofs for structures with a larger number of branches have to analyze a huge amount of collision events, which is overly complicated and prone to errors. To remedy this situation, we present AutoEGFN, a computer-aided proof tool that determines the number of rounds sufficient for PRP and SPRP security for various variants of EGFN. The tool operates by calculating three parameters: r1, r2, and r3. The validity and soundness of AutoEGFN are formally established by a detailed security proof. To demonstrate the effectiveness of AutoEGFN, we have applied it to multiple structures such as Type-1/2 GFN (Zheng et al., CRYPTO 1989), YI11’s Type-1 GFN (Yanagihara and Iwata, CANS 2011), DFLM19’s GFN (Derbez et al., FSE 2019), DDGP22’s GFN (Delaune et al., INDOCRYPT 2022), Type-1.x GFN (Yanagihara and Iwata, IEICE 2014), SH/TH GFN (Yanagihara and Iwata, CANS 2011), Nyberg’s GFN (Nyberg, ASIACRYPT 1996), SM’s GFN (Suzaki and Minematsu, FSE 2010), and BMT’s EGFN (Berger et al., SAC 2013). As a result, we provide a systematic analysis of the (S)PRP security for Type-1 and Type-2 structures for different numbers of branches. Our tool efficiently determines the concrete number of rounds required to ensure PRP and SPRP security for EGFNs with different branch numbers. For comparison, previous work only proved the (S)PRP security for 8- and 16-branch BMT’s EGFN. Our tool completes the proof within several minutes, even for variants with 32 branches. Meanwhile, for the other structures, we provide the first concrete (S)PRP security proofs without any restrictions on their permutation layers. Furthermore, AutoEGFN will significantly contribute to the enhancement of EGFN designs and implementations in various cryptographic applications.
This paper focuses on quantum key-recovery attacks on block ciphers. Previous works on quantum differential and truncated differential attacks like [Kaplan et al., ToSC 2016] have shown that classical algorithms for key-recovery, typically based on generating differential pairs and sieving them, can be accelerated by up to a quadratic speedup using variants of quantum search, quantum amplitude amplification, and quantum collision-finding.>br/> In this paper, we introduce a new quantum truncated differential key-recovery attack, which leverages the quantum convolution algorithm introduced in [Schrottenloher, CRYPTO 2022] and previously used in linear cryptanalysis. We adapt this algorithm to the case of differential cryptanalysis, by rewriting the probability of a differential of an n-bit cipher as a convolution of functions with 2n-bit input. We then construct a quantum state whose amplitudes encode the probability of the differential for different key guesses, and use this as the starting point of a quantum search. In some cases (although not on practical ciphers so far), the speedup is better than quadratic compared to classical attacks. We also extend the framework to related-key differential attacks. We give applications to a 9-round attack on QARMAv2-64 adapted from [Ahmadian et al., DCC 2024] and a 12-round related-key attack on AES-256 from [Boura et al., CRYPTO 2023], which show improvement over classical attacks and over Kaplan et al.’s strategy when taking into account the amount of memory and the type of quantum memory used (as our attack requires only quantum-accessible classical memory).
We present the first known-plaintext attack on up to 25 rounds of the tweakable block cipher Craft. These attacks require only two known plaintextciphertext pairs to recover the full key, and work independent of the used tweaks. Given the state and key size of 64 and 128 bits, respectively, this is the minimal data complexity an attack recovering the full key can have. At the basis of this attack is the observation that Craft can be decomposed into two loosely dependent functions: the state can be split in half such that the round function mixes only 4 bits of each half into the other. Since the key schedule does not provide mixing between these parts either, we can guess these 4 bits per round to mount a meet-in-the-middle attack on up to 25 rounds. While the best attacks on Craft by M’Foukh et al. cover up to 26 rounds, they are in the chosen-ciphertext setting and require (up to) the full code book. In fact, we show that their attacks (implicitly) use a similar decomposition, and therefore present the other end of a time-data trade-off for the same family of attacks.
The protection of executable code in embedded systems requires efficient mechanisms that ensure confidentiality and integrity. Belkheyar et al. recently proposed the Authenticated Code Encryption (ACE) framework, with ChiLow as the first ACE-2 instantiation at EUROCRYPT 2025. ChiLow-(32 + τ ) is a 32-bit tweakable block cipher combined with a pseudorandom function, featuring quadratic nonlinear layers called ChiChi (χχ) and a nested tweak/key schedule optimized for low-latency decryptions in secure code execution under strict query limits. In this paper, we exploit the algebraic structure of χχ and study the resistance of ChiLow-(32 + τ ) to cube-like and integral cryptanalysis in single- and multiple-tweak settings. In the multiple-tweak setting, we present conditional attacks that can recover the full key for 5-round ChiLow-(32 + τ ) with practical complexity, and extend the analysis to 6 rounds at a still non-trivial but purely theoretical cost below brute force. We additionally construct borderline cube attacks on 5- and 6-round ChiLow-(32 + τ ), each capable of recovering the full key with practical complexity. Specifically, we recover the full key for 5-round ChiLow-(32 + τ ) using 232 decryptions, 218.58 chosen ciphertext data, and 233.56 bits of memory, and for 6-round ChiLow-(32 + τ ) using 234 decryptions, 233.58 chosen ciphertext data, and 254.28 bits of memory. We then focus on integral cryptanalysis and the challenge of extending the analysis to 7 rounds. We identify integral distinguishers in the single- and multiple-tweak models and extend suitable 2-round and 3-round integral distinguishers to build a 7-round attack. We present a nested strategy to recover all round tweaks and tackle the problem of deriving the master key from round-tweak and key information. Our key-recovery method exploits high-degree monomials that arise in the integral key-recovery phase to reduce the average number of guessed key bits and hence reduce the time complexity. As a result, we mount a 7-round key-recovery attack on ChiLow-(32 + τ ) that requires 26.32 chosen ciphertext data, has a time complexity of about 2108.55 encryptions, and needs negligible memory. Notably, all our attacks remain consistent with the security claims of the design.
In this work, we present new cryptanalytic attacks on recently proposed, theory-inspired constructions of weak pseudorandom functions (weak-PRFs). We demonstrate attacks on several such designs, showing that the initial security arguments require significant refinement. Methodologically, our approach relies on novel observations about the structure of cyclic matrices, applications of Wagner’s generalized birthday technique, and conversion into polynomial systems over F3. These findings highlight the need for a more careful analysis of those weak-PRF candidates.
At Eurocrypt'16, Meaux et al. designed a construction for symmetric ciphers that can be efficiently evaluated with Fully Homomorphic Encryption, dubbed Filter Permutator. They also specify FLIP, a family of Filter Permutators. Creating FiLIP, they improved their first construction using whitening keys and reduction of the initial key register. Later, Cosseron et al. and Hoffmann et al. proposed successive generalisations of their work, creating the new families of Group Filter Permutators and then Mixed Filter Permutators. In this article, we prove the generic security of Mixed Filter Permutators in the Random Oracle Model. Moreover, we study a derived scheme that avoids using whitening keys. We show that the resulting construction is less secure by providing an attack for some parameter choices that would yield a Mixed Filter Permutator that is secure in the Random Oracle Model. Finally, we prove a security bound for this Mixed Filter Permutators construction without the whitening key.
ChiLow is a family of tweakable block ciphers specifically designed for embedded code encryption, proposed at EUROCRYPT 2025. Its novel nested tweakkey schedule and a variant of the χ function significantly enhance latency and energy efficiency. This paper presents a security analysis of ChiLow from the perspectives of differential-linear cryptanalysis and cube attacks, filling some gaps in the initial security analysis made by the designers. Our main contributions are threefold: (1) Distinguishing attacks based on differential-linear cryptanalysis that can distinguish full-round ChiLow from random permutations. For ChiLow-(32+τ ), both the time complexity and data complexity of the attack are 281.03; for ChiLow-40, both complexities are 288.91. We note that the data complexities of these distinguishing attacks are valid since an adversary could query multiple devices. (2) Key recovery attacks on full-round ChiLow based on differential-linear cryptanalysis with the time complexity better than the exhaustive key search. These attacks achieve a time complexity of 2121, with data complexities of 279.5 for ChiLow-(32+τ ) and 288.42 for ChiLow-40 exceeding the data limit for one key. (3) A key recovery attack on 6-round ChiLow based on cube attacks, with a time complexity of 268 and a data complexity of 233 respecting the limit of the total number of queries. These results shed some new light on the security boundaries of ChiLow and provide valuable insights for designing low-latency ciphers in embedded systems.
Neptune is a hash function proposed by Grassi et al. at ToSC 2022(3) for Zero-Knowledge (ZK) applications. In this note, we show that the linear layer of Neptune’s external rounds fails to guarantee the maximum growth of the degree, potentially affecting the security of Neptune against algebraic attacks. Here, we formally address this problem, by identifying sufficient conditions that ensure the expected degree growth is maintained.
Linear cryptanalysis has long served as a cornerstone in the securityanalysis of symmetric-key cryptanalytic primitives. Through more than 30 years ofcommunity efforts, it has become routine to use automated tools to search for theoptimal linear approximations. In stark contrast, the key recovery part is still farfrom automation and optimization. The situation became even more challenging afterthe work of Fl & oacute;rez-Guti & eacute;rrez and Todo [FT24], where the newly introduced WalshSpectrum Puncturing (WSP) technique brought a large number of candidate keyrecovery map approximations. In this paper, we formally prove that the approximatekey recovery map proposed by [FT24] is the optimal strategy for Bit Puncturing andLAT Subspace Puncturing. We then propose an MILP model to automatically searchfor the optimal approximate key recovery map for WSP. The automated model isused to improve the linear key recovery attack on the AES finalist Serpent and theISO standard PRESENT. We reduce the time complexity of the 12-round Serpent keyrecovery attack to2184.8(from2189.7) for Serpent-192 and to2200.4(from2210.4) forSerpent-256. For PRESENT-128, we update the key recovery attack on its 29-roundvariant, and extend the attack to 30 rounds for the first time.
This paper introduces a new cryptographic notion for diffusion matrices, termed the Differential Pattern Transition (DPT). Building on this notion, we develop a systematic framework for describing the differential behavior of diffusion layers over multiple rounds in AES-like block ciphers. Specifically, the DPT framework enables a finer-grained evaluation of diffusion strength against differential attacks, allowing distinctions even among matrices sharing the same branch number. Furthermore, the DPT framework facilitates the classification of shuffle layers and assists in identifying permutation layers that maximize differential resistance. As a case study, we apply the DPT framework to the diffusion matrices used in MIDORI, PRINCE, QARMA, and AES, as well as a lightweight MDS matrix proposed in [SS16]. The results show that DPT provides both theoretical insights and practical guidance for the selection and design of diffusion and shuffle layers in secure and efficient block cipher constructions.
