The SNOW 5G stream cipher has been recommended by the international standardization group as one standard algorithm for 5 G confidentiality and integrity protection over the wireless channel. This paper presents the first differential fault attack on SNOW 5G under the random fault model. We propose a joint differential analysis technique for state byte recovery, which constructs and solves a system of difference equations by leveraging the modulo 2^16 addition output difference and the S-box output difference induced by a single fault to recover the state bytes. Based on this, we recover the 896-bit internal state of SNOW 5G using 32 faults, with the memory complexity of the attack being 2^19 and the time complexity being 2^23 . We further utilize the public information in the modular addition difference equations caused by the linear property of the AES MixColumns operation to improve the fault utilization efficiency. Finally, under the condition that the internal state is known, we recover the 256-bit key of SNOW 5G using 32 faults, with the memory complexity of the attack being 2^6.83 bytes and the time complexity being 2^19.85 inverse AES round functions and 2^7.46 encryption verifications.
Constacyclic codes over finite fields are of theoretical importance as they are closely related to a number of areas of mathematics such as algebra, algebraic geometry, graph theory, combinatorial designs and number theory. However, the known results of constacyclic codes in the literature remain limited compared to classical cyclic codes. This paper provides two infinite families of constacyclic codes over 𝔽_q^2 that support infinite families of 3-designs, which generalize the results in Wang et al. [33]. The parameters and weight distributions are determined completely. Besides, we study their subfield subcodes and obtain a class of ovoid codes, whose minimum weight codewords support classical ovoid 3 -designs arising from ovoids in PG(3,𝔽_q) . As byproducts, two classes of maximal entanglement-assisted quantum error-correcting codes and two classes of distance-optimal and dimension-optimal locally recoverable codes are derived.
The recent introduction of Picnic3 has led to several new LowMC parameter sets, motivating a renewed security evaluation of LowMC. In particular, these parameter choices pose new challenges for cryptanalysis in extremely low-data settings. In this paper, we focus on the cryptanalysis of LowMC instances with full S-box layers under extremely low-data complexity, i.e., using only 1 or 2 chosen plaintext-ciphertext pairs. First, we revisit the difference enumeration attack framework proposed by Liu et al. at CRYPTO 2021 and present an enhanced attack framework for the 4-round LowMC instances with a data complexity of 2 chosen plaintexts. As a result, our attacks have both a lower total time complexity and a higher success probability compared to previous work, while keeping the memory negligible. Especially for high-probability attacks, our attacks achieve an acceleration factor of 2^8.9/2^19.9/2^24.8 compared to the CRYPTO 2021 paper and 2^3.3/2^11.3/2^14.2 compared to the DCC 2023 paper for the 129-/192-/255-bit key. Next, we propose improved low-memory attacks on the 5-/6-/7-round instances with a data complexity of a single chosen plaintext, which further reduce the memory requirements. The maximum reduction factor is 2^90.16 for the 7-round instance.
Ciphers built on bitwise AND, XOR, and rotation are highly competitive for resource‑constrained Internet of Things devices. A representative example is the SIMON family of lightweight block ciphers, introduced by the U.S. National Security Agency in 2013. Differential‑linear (DL) cryptanalysis of such ciphers comprises two central tasks: identifying promising DL distinguishers and evaluating their correlations. Recent notable works, including the Differential‑Linear Connectivity Table (DLCT), the Differential Algebraic Transitional Form (DATF), and new evaluation methods from boomerang and truncated differential perspectives, have made significant progress in correlation evaluation. Beyond correlation evaluation, efficiently finding long DL distinguishers with high correlation remains a crucial challenge, particularly for AndRX ciphers. To address this, we propose a two‑step solver‑aided strategy. The first step employs an automated solver to generate a large pool of DL distinguisher candidates by concatenating truncated differentials with linear approximations. In this step, we derive a rigorous probability formula for SIMON‑like round functions to enable fast correlation estimation. To the best of our knowledge, this is the first formula for computing truncated differential probabilities of such round functions. The second step re‑evaluates the DL correlations using the DLCT technique to ensure accuracy and mitigate clustering effects. Applied to all variants of SIMON and SIMECK, our method yields the longest DL distinguishers reported to date: 14, 17, 21, 29, and 37 rounds for SIMON‑32/48/64/96/128, respectively, and 14, 21, and 26 rounds for SIMECK‑32/48/64, respectively.
