The design of lightweight cryptographic schemes necessitates efficient circuit implementations of linear layers. A commonly used metric for evaluating circuit efficiency is the number of XOR gates required. For a given linear transformation over the binary field, finding its circuit implementation with the minimum number of XOR gates is referred to as the Shortest Linear Program (SLP) problem. As a prominent heuristic, the Boyar-Peralta (BP) algorithm provides competitive results, and numerous subsequent studies have introduced further optimizations. However, the inefficient implementations of the BP-like algorithms significantly limit their applicability to high-dimensional and dense matrices, and effective solutions to these performance bottlenecks remain scarce. In this paper, we address the performance bottlenecks of the BP algorithm and its variants (e.g., A1, A2 and BP-LSL) both theoretically and practically. We introduce the meet-in-the-middle (MITM) approach to reduce their theoretical time complexity. Practically, we re-design the implementation framework of these algorithms to fully leverage GPU parallelism, which significantly reduces the time spent on computing multiple XOR sums of bases, performing binary search, and updating distances. Meanwhile, we also propose a candidate pruning mechanism to reduce the computational burden on the GPU side and further improve the overall efficiency. Compared with the original implementations, we significantly accelerate the solving process for both normal and depth-constrained scenarios while maintaining the same solution quality. Our experimental results demonstrate that, for a 26-dimensional matrix with density 0.5, our implementation requires only 9.44 seconds on an entry-level GTX 1650 GPU, achieving a speedup of over 6,200x times compared with the current recursive, exhaustive, and one-threaded implementation. Using a high-performance RTX 4090 GPU, we extend the solvable boundary to 64-dimensional sparse matrices and 42-dimensional matrices with density 0.381. For 32-dimensional matrices, our accelerated A1 algorithm successfully establishes some new g-XOR records, including a 172-step g-XOR implementation for Whirlwind M0 and a 170-step implementation for Whirlwind M1. Besides, we also provide a 157-step g-XOR sequence for AES-InvMixColumn matrix with its theoretical depth 5 through our BP-LSL implementation. Based on our accelerated BP implementation, we construct some MDS matrices with dimension 40 or more. For four by four blockwise circulant matrices of dimensions 40, 48, and 64, the minimum g-XOR sequence lengths we found are 110, 132, and 184.
Demirci-Selçuk meet-in-the-middle (DS-MITM) attacks are effective against many primitives and are responsible for some state-of-the-art attacks on widespread standards, such as round-reduced AES. As with other types of attacks, the community has proposed automatic tools to help cryptographers find distinguishers and attacks. The tools developed by Shi et al. at ASIACRYPT 2018 and EUROCRYPT 2023 can already capture some of the improvements to the basic technique, such as differential enumeration and key dependencies. However, recent works have proposed further technical refinements to DS-MITM attacks, such as value constraints, which have led to improved attacks on round-reduced AES but still lack automation support. In this work, we extend the earlier modelling approaches of DS-MITM attacks by proposing a framework that integrates value constraints and table lookups. We apply our framework not only to SPNs, such as variants of Rijndael, SKINNY, and Vistrutah, but also to the Type-II Feistel design TWINE and the bit-oriented balanced Feistel cipher SIMON. We show improved DS-MITM attacks on these variants, including the first 10-round DS-MITM attack on Rijndael-256-256, demonstrating the effectiveness of the technique and our framework.
After winning NIST's Lightweight Cryptography (LwC) competition, AsconAEAD128 was standardized with a recommended 256-bit key variant for multi-user settings, we denote it as mu-Ascon. We show this instantiation has two critical weaknesses. First, mu-Ascon only partially blinds the expanded key during initialization and finalization, weakening its key-blinding guarantees. Building on this, we show that the recovery of the internal state enables partial key recovery. We further demonstrate a state-recovery attack on three-round-reduced mu-Ascon. Second, mu-Ascon remains vulnerable to committing attacks and hence cannot be used in cases where committing security is required. To remedy this, we propose two API-compatible alternatives for multi-user applications. Our first construction, Ascon-256.v2, achieves CMT-4 committing security up to 64 bits. Our second construction, Ascon-256.v3, leads to both CMT-4 committing security and full 256-bit key-blinding. Both variants require only one additional permutation call, incurring negligible performance overhead while substantially strengthening multi-user security guarantees.
We propose the arithmetization-oriented (AO) hash function Arion, following a permutation-based design approach. We first define the permutation Arion-π over the finite field F_p, where (p > 2) is prime. The design of Arion-π is based on the recently introduced generalized triangular polynomial system, a novel algebraic framework for constructing cryptographic permutations using polynomials over finite fields. Using this permutation, we define the hash function Arion in two modes: the well-established Sponge construction and a feed-forward truncation mode (Trunc). Secure parameter sets are specified for prime fields commonly used in zero-knowledge proof applications, including the scalar fields of the BLS12-381 and BN254 elliptic curves. We provide an extensive security analysis of Arion, with particular emphasis on algebraic techniques — including interpolation and polynomial system solving (PoSSo) based techniques, such as Gröbner basis computations, and resultants — which are especially relevant for cryptographic primitives defined over prime fields. To the best of our knowledge, Arion is the first hash function whose security analysis is explicitly based on the algebraic invariant of the underlying ideal - the quotient ring dimension. In particular, we explicitly determine the dimension of the quotient ring associated with the CICO problem induced by the hashing modes. Furthermore, our analysis of the CICO-t problem applies to any t ≥ 1 and covers both the Sponge and feed-forward constructions. We evaluate the efficiency of Arion across several arithmetization frameworks — R1CS, Plonk, and AIR — and compare it with prominent AO hash functions, including Poseidon, Poseidon2, Anemoi, Griffin, and Rescue. Our results show that Arion is frequently the best-performing design in the Plonk setting and remains highly competitive, often ranking second, in both RoneCS and AIR. In terms of native performance, Arion is the only construction based on high-degree power maps that achieves performance comparable to Poseidon/Poseidon2. This makes it an attractive choice for applications where both zero-knowledge proving efficiency and native evaluation costs are important considerations.
ARADI is a low-latency block cipher for memory encryption, proposed by researchers at the National Security Agency of the United States. We study its differential cryptanalysis using quasidifferential trails. Due to a large number of high-correlation quasidifferential trails per characteristic, we find a substantial difference between fixed-key probabilities and key-averaged probabilities. To efficiently compute the fixed-key probabilities, we propose a new method to estimate these probabilities that remains efficient even when the number of quasidifferential trails is too large for exhaustive enumeration. Moreover, we show how to correctly combine the fixed-key probabilities of differential characteristics to estimate the fixed-key probabilities of differentials. We further show that the number of key bits that must be guessed was underestimated in prior key-recovery attacks, and provide a method using quasidifferential trails over the key-recovery rounds to determine the correct number of bits. Finally, we propose two new high-probability differentials tailored for key recovery, and use them to mount key-recovery attacks on 12- and 14-round ARADI.
