At EUROCRYPT 2017, Grassi et al. proposed the multiple-of-8 property for 5-round AES, which states that the number of pairs in a certain input-output subspace, referred to as right pairs, is always a multiple of 8. However, no key-recovery attack has been proposed that utilizes this property until now. In this paper, we identify a new aspect of the multiple-of-8 property: when the number of right pairs is exactly eight, these eight pairs all have the same difference from after the 1st round SubBytes to before the 4th round SubBytes. Based on this observation, we propose a new key-recovery attack on 5-round AES. Our attack requires data and time complexities of 232.6 chosen plaintexts and 5-round AES encryptions, and a memory complexity of 231 128-bit blocks to recover a 32-bit subkey with a success probability of 50.5%. Although it is not the best attack on 5-round AES, it is notable as the first key-recovery attack that utilizes the multiple-of-8 property. We validate our observation through experiments and demonstrate its applicability to other ciphers with SPN structures, beyond AES.

At ASIACRYPT'19, Bonnetain et al. demonstrated that an S-box can be distinguished from a permutation chosen uniformly at random by quantifying the distances between their behaviors. In this study, we extend this approach by proposing a deep learning-based method to quantify distances between two different S-boxes and evaluate similarities in their design structures. First, we introduce a deep learning-based framework that trains a neural network model to recover the design structure of a given S-box based on its cryptographic table. We then interpret the decision-making process of our trained model to analyze which coefficients in the table play significant roles in identifying S-box structures. Additionally, we investigate the inference results of our model across various scenarios to evaluate its generalization capabilities. Building upon these insights, we propose a novel approach to quantify distances between structurally different S-boxes. Our method effectively assesses structural similarities by embedding S-boxes using the deep learning model and measuring the distances between their embedding vectors. Furthermore, experimental results confirm that this approach is also applicable to structures that the model has never seen during training. Our findings demonstrate that deep learning can reveal the underlying structural similarities between S-boxes, highlighting its potential as a powerful tool for S-box reverse-engineering.

Shadow is a block cipher for Internet of Things (IoT) Nodes proposed in the IEEE IoT Journal in 2021. The primary design principle of shadow is the adoption of a variant 4-branch Feistel structure to ensure a fast diffusion. We refer to this structure as the shadow structure and prove that it is almost identical to the Feistel structure, which invalidates the design principle. We also present a new structural distinguisher that can distinguish the shadow structure from a random permutation with only two plaintext/ciphertext pairs. Additionally, we demonstrate that the key-recovery attacks utilizing the impossible differential proposed by Liu et al. in the Cybersecurity Journal in 2023 and the integral characteristic proposed by Mirzaie et al. in the IEEE IoT Journal are infeasible. Instead, we extend our distinguisher to a key-recovery attack using only one plaintext/ciphertext pair by exploiting the key schedule. Moreover, upon investigating shadow's round function, we observe that only specific forms of monomials can appear in the ciphertext, leading to an integral distinguisher involving four plaintext/ciphertext pairs. Notably, the algebraic degree does not exceed 12 for shadow-32 and 20 for shadow-64, regardless of the number of rounds used. Our results show that shadow is highly vulnerable to algebraic attacks, emphasizing the need for careful consideration of algebraic attacks when incorporating AND, rotation, and xor operations in cipher design.

At ASIACRYPT 2021, Baksi et al. introduced DEFAULT, a block cipher designed to algorithmically resist Differential Fault Attack (DFA), claiming 64-bit DFA security regardless of the number of injected faults. At EUROCRYPT 2022, Nageler et al. demonstrated that DEFAULT’s claimed DFA resistance can be broken by applying an information-combining technique. More recently, at ASIACRYPT 2024, Jana et al. improved DFA by searching for differential trails with a single solution. They showed that, for DEFAULT with a simple key schedule, injecting five faults at the fifth-to-last round reduces the key space to one, and for BAKSHEESH, injecting twelve faults at the third-to-last round achieves the same result. In this paper, we propose a new DFA framework that utilizes a Mixed-Integer Linear Programming (MILP) solver. This framework makes it possible to attack deeper rounds than previously achieved, reducing the number of fault injections required for key recovery. Furthermore, we present a method to determine the most efficient fault injection bit positions by systematically analyzing the input differences from all possible single bit-flip faults, thereby further reducing the required number of faults. This systematic analysis has the significant advantage of allowing us to theoretically calculate the required number of faults. Applying our framework, for DEFAULT, injecting three faults at the sixth-to-last round and two faults at the seventh- and eighth-to-last rounds reduces the key space to one.

The addition, rotation, XOR (ARX) structure, which comprises three fundamental operations-Addition, Rotation, and XOR-makes it well-suited for lightweight cryptography. To design a secure and efficient ARX cipher, it is necessary to find the optimal structure by properly combining the order, number of operations, and rotation amounts. CHAM64 is an ARX block cipher with a 64-bit block size, which is proposed as an attempt to enhance the lightweight characteristics of LEA . In this article, we present secure and efficient CHAM ( SAECHAM ), a variant of CHAM64 with a rearranged order of operations and adjusted rotation amounts. By changing the order of the operations in CHAM64 , six different CHAM -like structures can be created. We propose the properties that can be eliminated in the implementation process depending on the rotation amount in each structure. To improve suitability for constrained environments, such as 8-bit and 16-bit microcontrollers, we reduce the search space for rotation amounts and analyze the number of instructions. Using an SMT solver-based automatic search method, we analyze the security of 62CHAM64 variants through differential and linear analysis. Among them, we find four variants with equal or better resistance to differential and linear cryptanalysis compared to CHAM64 . As a result, we propose the variant with the fewest instructions among them as SAECHAM . Through software implementations on 8-bit AVR, 16-bit MSP430, 32-bit ARM Cortex-M3 and Cortex-M4 platforms, we demonstrate that SAECHAM is efficient in terms of encryption speed and also performs efficiently when implemented using SIMD operations in high-performance CPUs.

At EUROCRYPT 2017, Grassi et al. proposed the multiple-of-8 property for 5-round AES, where the number n of right pairs is a multiple of 8. At ToSC 2019, Boura et al. generalized the multiple-of property for a general SPN block cipher and applied it to block cipher SKINNY. In this paper, we present that n is not only a multiple but also a fixed value for SKINNY. Unlike the previous proof of generalization of multiple-of property using equivalence class, we investigate the propagation of the set to compute the exact number n . We experimentally verified that presented property holds. We extend this property one round more using the lack of the whitening key on the SKINNY and use this property to construct 6-round distinguisher on SKINNY-64 and SKINNY-128. The probability of success of both distinguisher is almost 1 and the total complexities are 2 16 and 2 32 respectively. We verified that this property only holds for SKINNY, not for AES and MIDORI, and provide the conditions under which it exists for AES-like ciphers.

Differential factors, introduced by Tezcan and & Ouml;zbudak at LightSec 2014, are properties of the S-boxes that equalize the counters of some guessed keys, thereby reducing the key space for the key guess process. Differential factors have been used to reduce the key space for the attacks on SERPENT, PRESENT, PRIDE, and RECTANGLE. In this paper, we demonstrate that some differential factors do not actually reduce the key space for the differential-linear attack on SERPENT and the related- key differential attack on RECTANGLE. Moreover, by comparing these instances with the differential attack on PRESENT, where differential factors do have an effect, we identify a sufficient condition for the practical use of differential factors. This condition enables preemptive identification of differential factors that could impact the key space for attacks on other ciphers.

In this study, we focus on evaluating the false-positive probability of the Demirci-Sel & ccedil;uk meet-in-the-middle attack, particularly within the context of configuring precomputed tables with multisets. During the attack, the adversary effectively reduces the size of the key space by filtering out the wrong keys, subsequently recovering the master key from the reduced key space. The false-positive probability is defined as the probability that a wrong key will pass through the filtering process. Due to its direct impact on the post-filtering key space size, the false-positive probability is an important factor that influences the complexity and feasibility of the attack. However, despite its significance, the false-positive probability of the multiset-based Demirci-Sel & ccedil;uk meet-in-the-middle attack has not been thoroughly discussed, to the best of our knowledge. We generalize the Demirci-Sel & ccedil;uk meet-in-the-middle attack and present a sophisticated method for accurately calculating the false-positive probability. We validate our methodology through toy experiments, demonstrating its high precision. Additionally, we propose a method to optimize an attack by determining the optimal format of precomputed data, which requires the precise false-positive probability. Applying our approach to previous attacks on AES and ARIA, we have achieved modest improvements. Specifically, we enhance the memory complexity and time complexity of the offline phase of previous attacks on 7-round AES-128/192/256, 7-round ARIA-192/256, and 8-round ARIA-256 by factors ranging from 2(0.56) to 2(3). Additionally, we have improved the overall time complexity of attacks on 7-round ARIA-192/256 by factors of 2(0.13) and 2(0.42), respectively.

We present a ciphertext-only attack on the GEO-Mobile Radio Interface-2 (GMR-2) system for the first time. The GMR-2 is a satellite communication standard adopted by Inmarsat, a British satellite telecommunications company that offers global mobile services. The best publicly known attack on GMR-2 is a known plaintext attack called the inversion attack, proposed by Hu et al. in 2018. It recovers the 64-bit session key in 20 milliseconds when one keystream frame (15-byte) is available. Our contributions are twofold. First, we improve the previous inversion attack using a novel approach, pre-filtration. With our improvement, we can recover the session key in 4.5 milliseconds and 0.62 milliseconds using one and two keystream frames, respectively. Second, we propose a practical ciphertext-only attack on the GMR-2 by exploiting a vulnerability in the CIPHERING MODE COMMAND message type. We find that this message type only has $2^{11}$ degrees of freedom despite being transmitted in a 184-bit format. Additionally, we find that two or more keystream frames can be derived from a single message in four of the six channels through which this message type may be transmitted. Assuming the CIPHERING MODE COMMAND message type is transmitted using one of these four channels, we can iteratively guess the message and conduct a known plaintext attack to recover the session key. Thanks to the speed improvement achieved by our pre-filtration method, our ciphertext-only attack can recover the session key in 1.3 seconds.

PIPO is a lightweight block cipher proposed at ICISC 2020, which has a byte-oriented structure suitable for bit-sliced implementation and allows for efficient higher-order masking implementations. In this study, we use bit-based division property techniques to construct 6-round integral distinguishers, and propose key-recovery attacks on 8 rounds of PIPO-64/128 and 10 rounds of PIPO-64/256. The data complexity of both attacks is 263 chosen plaintexts and the time complexities are 2125 and $2^{253.8}$ respectively. Our results complement the security analysis of PIPO, and show that the PIPO structure is resistant to recently researched cryptanalysis methods. Because only differential and linear attacks were carefully considered to determine the number of rounds of PIPO, our work, based on division property, is important for verifying the security margin.

In this study, we accelerate Matsui’s search algorithm to search for the best differential and linear trails of AES-like ciphers. Our acceleration points are twofold. The first exploits the structure and branch number of an AES-like round function to apply strict pruning conditions to Matsui’s search algorithm. The second employs permutation characteristics in trail search to reduce the inputs that need to be analyzed. We demonstrate the optimization of the search algorithm by obtaining the best differential and linear trails of existing block ciphers: AES, LED, MIDORI-64, CRAFT, SKINNY, PRESENT, and GIFT. In particular, our search program finds the fullround best differential and linear trails of GIFT-64 (in approx. 1 s and 10 s) and GIFT-128 (in approx. 89 h and 452 h), respectively.For a more in-depth application, we leverage the acceleration to investigate the optimal DC/LC resistance that GIFT-variants, called BOGI-based ciphers, can achieve. To this end, we identify all the BOGI-based ciphers and reduce them into 41,472 representatives. Deriving 16-, 32-, 64-, and 128-bit BOGI-based ciphers from the representatives, we obtain their best trails until 15, 15, 13, and 11 rounds, respectively. The investigation shows that 12 rounds are the minimum threshold for a 64-bit BOGIbased cipher to prevent efficient trails for DC/LC, whereas GIFT-64 requires 14 rounds. Moreover, it is shown that GIFT can provide better resistance by only replacing the existing bit permutation. Specifically, the bit permutation variants of GIFT-64 and GIFT-128 require fewer rounds, one and two, respectively, to prevent efficient differential and linear trails.

The GEO-Mobile Radio Interface-1 (GMR-1) is a satellite communication standard used in Thuraya, a United Arab Emirates-based regional mobile satellite service provider. The specification of the encryption algorithm used in GMR-1 was not disclosed until it was uncovered by Driessen et al. in 2012 through reverse engineering. Given that A5-GMR-1, a stream cipher used in GMR-1, is primarily based on A5/2, Driessen et al. presented a ciphertext-only attack from the attacks on A5/2. Their ciphertext-only attack recovers the session key from multiple sets of 24 ciphertexts in an average of 32.1 min and requires 400 GB of pre-computed data. This study enhances Driessen et al.’s ciphertext-only attack on A5-GMR-1 in all aspects of time, memory, and data. Our contributions are fourfold. First, we optimize the inefficient part of the previous attack. As a result, our ciphertext-only attack recovers the session key from multiple sets of 13 ciphertexts in less than 1 second and requires 400 MB of pre-computed data. Second, we propose novel memory-saving techniques. These techniques reduce the memory complexity to 216 ~ 289 MB without increasing the time and data complexity. Third, we present several time-memory-data tradeoff techniques. Using these techniques, we can present an attack that meets the desired conditions, such as memory minimization or data minimization. Furthermore, while the complexity of the previous attack is presented vaguely as “multiple sets” of 24 ciphertexts, these techniques allow us to accurately calculate the time, memory, and data complexity of the attack. Finally, we demonstrate that A5-GMR-1 can be attacked without frame numbers. To find out the frame number of each ciphertext, it is necessary to analyze and synchronize multiple channels. We present a plaintext recovery attack that does not require these processes.

Bit permutations are efficient linear functions often used for lightweight cipher designs. However, they have low diffusion effects, compared to word-oriented binary and maximum distance separable (MDS) matrices. Thus, the security of bit permutation-based ciphers is significantly affected by differential and linear branch numbers (DBN and LBN) of nonlinear functions. In this paper, we introduce a widely applicable method for constructing S-boxes with high DBN and LBN. Our method exploits constructions of S-boxes from smaller S-boxes and it derives/proves the required conditions for smaller S-boxes so that the DBN and LBN of the constructed S-boxes are at least 3. These conditions enable us to significantly reduce the search space required to create such S-boxes. Using the unbalanced-Bridge and unbalanced-MISTY structures, we develop a variety of new lightweight S-boxes that provide not only both DBN and LBN of at least 3 but also efficient bitsliced implementations including at most 11 nonlinear bitwise operations. The new S-boxes are the first that exhibit these characteristics.

In this paper, we introduce a new lightweight 64-bit block cipher PIPO (PIPO stands for “Plug-In” and “Plug-Out”, representing its use in side-channel protected and unprotected environments, respectively.) supporting a 128 or 256-bit key. It is a byte-oriented and bitsliced cipher that offers excellent performance in 8-bit AVR software implementations. In particular, PIPO allows for efficient higher-order masking implementations, since it uses a minimal number of nonlinear operations. Our implementations demonstrate that PIPO outperforms existing block ciphers (for the same block and key lengths) in both side-channel protected and unprotected environments, on an 8-bit AVR. Furthermore, PIPO records competitive round-based hardware implementations. For the nonlinear layer of PIPO, we have developed a new lightweight 8-bit S-box that provides an efficient bitsliced implementation including only 11 nonlinear bitwise operations. Furthermore, its differential and linear branch numbers are both 3. This characteristic enables PIPO to thwart differential and linear attacks with fewer rounds. The security of PIPO has been scrutinized with regards to state-of-the-art cryptanalysis.

Nonlinear Invariant Attack is an attack that should be considered when constructing lightweight block ciphers with relatively simple key schedule. A shortcut to prove a block cipher’s resistance against nonlinear invariant attack is checking the smallest dimension of linear layer-invariant linear subspace which contains all known differences between round keys is equal to the block size. In this paper, we presents the following results. We identify the structure and number of optimal bit-permutations which require only one known difference between round keys for a designer to show that the corresponding block cipher is resistant against nonlinear invariant attack. Moreover, we show that PRESENT-like block ciphers need at least two known differences between round keys by checking all PRESENT-like bit-permutations. Additionally, we verify that