Recently (Crypto’24), Das and Ren proposed an adaptively secure variant of threshold BLS signatures. Unlike the initial threshold BLS signature described by Boldyreva (PKC’03), their variant can be proven secure in the adaptive corruption setting while preserving the useful features of the scheme (i.e., non-interactivity, uniqueness of signatures, and optimal signature size). In this work, we present a simplification of their scheme where the sizes of partial signatures and secret key shares are decreased by ≈ 20 % and 33 % , respectively. In addition, we reduce the communication cost of the distributed key generation phase by a factor 2. We can still prove the security of our simplified variant under adaptive corruptions in the random oracle model and under the same assumptions (namely, the co-CDH assumption and the DDH assumption in the first source group of the pairing) as Das and Ren.
Ascon, a family of algorithms that support hashing and Authenticated Encryption with Associated Data (AEAD), is the final winner of the NIST Lightweight Cryptography Project. As a research hotspot, Ascon has received substantial third-party security evaluation. Among all the results of Ascon-128 (the primary recommendation of AEAD), the key recovery attack can only be achieved by reducing the initialization phase to 7 rounds or fewer, regardless of whether it violates the security claims made by the designers (i.e., misuse of the nonce or exceeding data limits 2^64 ). In this paper, we, from two aspects (misuse-free setting and misused setting), improve the key recovery attack on Ascon-128 using the cube attack method. In one part, we present a faster method to recover the superpolies for a 64-dimensional cube in the output bits of the 7-round initialization, enabling us to recover the secret key with a time complexity of 2^95.96 and a data complexity of 2^64 . Our 7-round key recovery attack, based on the full key space, greatly improves the time complexity, making it the best result to date. Additionally, we utilize several techniques to extend state recovery to key recovery, answering the open problem of transitioning from full state recovery in the encryption phase to key recovery for Ascon-128 (ToSc Vol 4, 2022). By combining encryption phase state recovery with initialization phase key recovery, we can achieve 8-round and 9-round initialization phase key recovery in the nonce misuse scenario, with time complexities of 2^101 and 2^123.92 , respectively. This represents an improvement of two rounds over previous results in the misused setting. Our first key recovery attack is also applicable to Ascon-128a, achieving the same result. In cases where the full state, prior to the encryption phase, can be recovered in other Ascon AEAD modes, our second key recovery attack will also be useful. It is worth noting that this work does not threaten the security of the full 12 rounds Ascon, but we expect that our results provide new insights into the security of Ascon.
The SM4 block cipher has a generalised Feistel structure with four 32-bit branches and a 128-bit user key, which is a Chinese national standard and an ISO international standard. Following Chow et al.’s seminal work of white-box cryptography in 2002, a few white-box SM4 implementations with external encodings have been proposed since 2009, among which, except the one using linear internal encodings, all the others (i.e. the ones using affine internal encodings) are regarded as (practically) secure against key-recovery attack so far, partially because secret constant parts from affine encodings hinder some attack methods under Feistel structure, like algebraic and affine equivalence attacks, though several published attacks recovered a masked key with such constants, while by contrast all published white-box AES implementations have been practically broken mainly with such attack methods. As a consequence, one may think that Feistel structure is better than SPN structure in terms of their security on white-box cryptography. In this paper, we apply Derbez et al.’s affine equivalence algorithm to the generalised Feistel cipher SM4, and give an affine equivalence-based attack framework to recover the original user key of these white-box SM4 implementations with a very practical complexity of about t^2· 2^32 for affine encodings or t · 2^27 for linear encodings (with t being a small integer 1 or 2), by exploring implementation particulars and exploiting a differential meet-in-the-middle approach and the SM4 key expansion formula to filter out a few secret parameters. Finally, as examples, we apply this framework to recover the original user key of Xiao and Lai’s and Bai and Wu’s white-box SM4 implementations for the first time, with a time complexity of 2^32 and 2^34 respectively, and to recover the original user key of Shi et al.’s white-box SM4 implementation with a time complexity of 2^27 , significantly lower than the previous attack complexity of 2^49 . Our work shows how to apply Derbez et al.’s affine equivalence algorithm to a Feistel cipher and all such white-box SM4 implementations are not practically secure like white-box AES, and designers of white-box implementations of Feistel ciphers should pay attention to this framework.
Simon’s algorithm, which constructs periodic functions from encryption and decryption oracles of a cipher, has shown great power in breaking symmetric ciphers. This paper studies the quantum chosen-ciphertext attacks (qCCA) distinguishers based on Simon’s algorithm and the general technique to build such distinguishers. The qCCA distinguishers can be divided into distinguishers that use only the decryption oracle and those that use the encryption oracle. We refer to these two types of distinguishers as the ^d distinguishers and the ^e distinguishers, respectively. Firstly, we show the general methods of constructing ^d distinguishers exploiting truncated differential, which can explain the previous work, that is, constructing Simon-based ^d distinguishers of primitives case by case. Secondly, we explored the relations between periodic functions used by ^e distinguishers and boomerang distinguishing attacks. Specifically, we deeply observed truncated boomerang attacks and introduced the definition of truncated boomerang differential to find the relations. The basic observation is that an improved truncated boomerang differential with probability 1 can be used to construct periodic functions, and two such constructions are presented. With these new construction techniques, we present new qCCA distinguishers of unified structures that unify the Feistel, Lai-Massey, MARS-like, and SM4-like structures. In particular, for the d-branch MARS-like and SM4-like structures, we prove the existence of 2d-round qCCA distinguishers that are the best results so far as we know.
