Many cryptographers have focused on lightweight cryptography, and a huge number of lightweight block ciphers have been proposed. On the other hand, designing lightweight stream ciphers is a challenging task due to the well-known security criteria, i.e., the state size of stream ciphers must be at least twice the key size. The designers of Sprout addressed this issue by involving the secret key not only in the initialization but also in the keystream generation, and the state size of such stream ciphers can be smaller than twice the key size. After the seminal work, some small-state stream ciphers have been proposed such as Fruit, Plantlet, and LIZARD. Unlike conventional stream ciphers, these small-state stream ciphers have the limitation of keystream bits that can be generated from the same key and IV pair. In this paper, our motivation is to show whether the data limitation claimed by the designers is proper or not. The correlation attack is one of the attack methods exploiting many keystream bits generated from the same key and IV pair, and we apply it to Fruit-80 and Plantlet. As a result, we can break the full Fruit-80, i.e., the designers' data limitation is not sufficient. We can also recover the secret key of Plantlet if it allows about 253 keystream bits from the same key and IV pair.

A fast correlation attack (FCA) is a well-known cryptanalysis technique for LFSR-based stream ciphers. The correlation between the initial state of an LFSR and corresponding key stream is exploited, and the goal is to recover the initial state of the LFSR. In this paper, we revisit the FCA from a new point of view based on a finite field, and it brings a new property for the FCA when there are multiple linear approximations. Moreover, we propose a novel algorithm based on the new property, which enables us to reduce both time and data complexities. We finally apply this technique to the Grain family, which is a well-analyzed class of stream ciphers. There are three stream ciphers, Grain-128a, Grain-128, and Grain-v1 in the Grain family, and Grain-v1 is in the eSTREAM portfolio and Grain-128a is standardized by ISO/IEC. As a result, we break them all, and especially for Grain-128a, the cryptanalysis on its full version is reported for the first time.

This paper analyzes two factoring algorithms, NFS (Number Field Sieve) and ECM (Elliptic Curve Method). The previous results only minimize their running times, however, we may need to minimize the storage size or running time with smaller success probability. We provide these trade-offs, L[s] ( s≤ 1/3 ) memory requires L[1-2s] running time for NFS, for example. This can be interpreted that NFS requires much more running time when reducing memory complexity.

ICT development progresses, and many cryptographic algorithms are used. The most of cryptographic algorithms require assumptions to guarantee their security, but it is sometimes not clearly written. This causes many problems. This paper shows previous cases, and suggests to concede cryptographers and system developer each other from an industrial cryptographers viewpoint.

A fast correlation attack (FCA) is a well-known cryptanalysis technique for LFSR-based stream ciphers. The correlation between the initial state of an LFSR and corresponding key stream is exploited, and the goal is to recover the initial state of the LFSR. In this paper, we revisit the FCA from a new point of view based on a finite field, and it brings a new property for the FCA when there are multiple linear approximations. Moreover, we propose a novel algorithm based on the new property, which enables us to reduce both time and data complexities. We finally apply this technique to the Grain family, which is a well-analyzed class of stream ciphers. There are three stream ciphers, Grain-128a, Grain-128, and Grain-v1 in the Grain family, and Grain-v1 is in the eSTREAM portfolio and Grain-128a is standardized by ISO/IEC. As a result, we break them all, and especially for Grain-128a, the cryptanalysis on its full version is reported for the first time.

The impacts that quantum computers will have on cryptography have become more and more important to study for not only public key cryptography but also symmetric key cryptography. For example, at ISITA 2012, Kuwakado and Morii showed that an adversary with a quantum computer can recover keys of the Even-Mansour construction in polynomial time by applying Simon's algorithm. In addition, at CRYPTO 2016, Kaplan et al. showed that Simon's algorithm can also be used to perform forgery attacks against MACs and exponentially speed-up a slide attack. This paper introduces a tool for finding the period of a function that is periodic up to constant addition and shows that a quantum adversary can use the tool to perform a related-key attack in polynomial time. Our quantum related-key attack is an extension of the quantum slide attack by Kaplan et al. against iterated Even-Mansour ciphers that are implemented on quantum circuits. Although the relationships among keys are strong, our algorithm can recover all the keys of a two-round iterated Even-Mansour cipher in polynomial time.

AES is one of the most common block ciphers and many AES-like primitives have been proposed. Recently, many lightweight symmetric-key cryptographic primitives have also been proposed. Some such primitives require the diffusion using element-wise XORs, which are called binary matrices in this paper, rather than that using MDS matrices because the element-wise XOR is efficiently implemented in a lightweight environment. However, since the branch number of binary matrices is generally lower than that of MDS matrices, such primitives require more rounds to guarantee security against several cryptanalyses. In this paper, we focus on binary matrices and discuss useful cryptographic properties of binary matrices. Specifically, we focus on AES-like primitives with binary MixColumns, whose output is computed using a binary matrix. One of the benefit of AES-like primitives is that four rounds guarantee ℬ^2 differentially and linearly active S-boxes, where ℬ denotes the branch number of the matrix. We argue that there is a binary MixColumns in which the lower bound of the number of active S-boxes is more than ℬ^2 in the 4-round characteristic. For some binary matrices, the lower bound is improved from ℬ^2 to ℬ(ℬ+2) .

Linear cryptanalysis proposed by Matsui is one of the most effective attacks on block ciphers. Some attempts to improve linear cryptanalysis have been made since Matsui introduced. We focus on how to optimize linear cryptanalysis with such techniques, and we apply the optimized linear cryptanalysis on FEAL-8X. First, we evaluate two existing implementation methods so as to optimize the computation time of linear cryptanalysis. Method 1 removes redundant round function computations and optimizes the other computation of linear cryptanalysis by transforming it into bitwise operations. Method 2 transforms the computation of linear cryptanalysis into a matrix multiplication and reduces the time complexity of the multiplication using the fast Fourier transform (FFT). We implement both methods optimized for modern microprocessors and compare their computation time to clarify the appropriate method for practical cryptanalysis. From the result, we show that the superior implementation depends on the number of given known plaintexts (KPs) and that of guessed key bits. Furthermore, we show that these results enable us to select the superior method to implement linear cryptanalysis without another comparative experiment. By using the superior method, we implement the multiple linear cryptanalysis (MLC) on FEAL-8X. Our implementation can recover the secret key of FEAL-8X with 210KPs in practical computation time with non-negligible probability, and it is the best attack on FEAL-8X in data complexity.

AES is one of the most common block ciphers and many AES-like primitives have been proposed. Recently, many lightweight symmetric-key cryptographic primitives have also been proposed. Some such primitives require the diffusion using element-wise XORs, which are called binary matrices in this paper, rather than that using MDS matrices because the element-wise XOR is efficiently implemented in a lightweight environment. However, since the branch number of binary matrices is generally lower than that of MDS matrices, such primitives require more rounds to guarantee security against several cryptanalyses. In this paper, we focus on binary matrices and discuss useful cryptographic properties of binary matrices. Specifically, we focus on AES-like primitives with binary MixColumns, whose output is computed using a binary matrix. One of the benefit of AES-like primitives is that four rounds guarantee B-2 differentially and linearly active S-boxes, where B denotes the branch number of the matrix. We argue that there is a binary MixColumns in which the lower bound of the number of active S-boxes is more than B-2 in the 4-round characteristic. For some binary matrices, the lower bound is improved from B-2 to B(B + 2).

In this paper, we present several cryptanalyses of Hierocrypt-Ll block cipher, which was selected as one of the CRYPTREC recommended ciphers in Japan in 2003. We present a differential attack and an impossible differential attack on 8 S-function layers in a related-key setting. We first show that there exist the key scheduling differential characteristics which always hold, then we search for differential paths for the data randomizing part with the minimum active S-boxes using the above key differentials. We also show that our impossible differential attack is a new type.

The linear cryptanalysis proposed by Matsui is one of the most effective attacks on block ciphers, and he demonstrated an experimental cryptanalysis against DES at CRYPTO 1994. In this paper, we show how to optimize the linear cryptanalysis on modern microprocessors. Nowadays, there are two methods of implementing the linear cryptanalysis. Method 1 reduces the time complexity by reducing the number of computations of round functions, and Method 2 applies the fast Fourier transform (FFT). We implement both methods optimized for modern microprocessors and compare them in terms of computation time so as to discover which method is more appropriate for practical cryptanalysis. From the results of comparative experiments, we show that the fastest implementation depends on the number of given known plaintexts (KPs) and that of guessed key bits. These results clarify the criteria for selecting the method to implement the linear cryptanalysis. Taking the experimental results into account, we implement the linear cryptanalysis on FEAL-8X. In 2014, Biham and Carmeli showed an implementation of linear cryptanalysis that was able to recover the secret key with 2^14 KPs. Our implementation breaks FEAL-8X with 2^12 KPs and is the best attack on FEAL-8X in terms of data complexity.

This paper proposes a new accurate evaluation method for examining the resistance of cryptographic implementations against access-driven cache attacks (CAs). We show that a mathematical correlation method between the sets of measured access time and the ideal data, which depend on the guessed key, can be utilized to evaluate quantitatively the correct key in access-driven CAs. We show the effectiveness of the proposed method using the access time measured in noisy environments. We also estimate the number of key candidates based on mathematical proof while considering memory allocation. Furthermore, based on the proposed method, we analyze quantitatively how the correlation values change with the number of plaintexts for a successful attack.

It is hypothesized that sperm whales employ active pursuit strategies for hunting prey, mainly deep-sea squid at great depths, but no visual evidence has been obtained to confirm this. We recorded the hunting behavior of sperm whales using animal-borne cameras and accelerometers simultaneously deployed on 17 whales, and obtained 42.8 h of diving data, includ- ing 17 715 images. A statistical comparison indicated no clear effect of light (with or without flash- ing white lights from cameras) on diving behavior of tagged whales. Although 98.5% of the still images were of empty water and uninformative, 5 classes of images with visible material were identified: (1) suspended material, possibly squid ink (n = 17), (2) unidentified particles (n = 4), (3) possible animal body parts (n = 2), (4) other sperm whales (n = 221), and (5) the seafloor (n = 8). All image classes were recorded at deeper depths (mean ± SD = 785 ± 140 m), except Class 4 images, which were recorded only at depths u003c339 m, suggesting that tagged whales swam alone while for- aging at great depths. Simultaneous use of speed and image sensors revealed that Class 1 images were associated with bursts of speed up to approximately twice (3.3 ± 1.0 m s �1 , max. 6 m s �1 ) the mean swim speed (1.8 ± 0.4 m s �1 ). These images, likely derived during chasing prey, support the hypothesis that sperm whales actively hunt to capture prey.

An integral attack is one of the most powerful attacks against block ciphers. We propose a new technique for the integral attack called the Fast Fourier Transform (FFT) key recovery. When N chosen plaintexts are required for the integral characteristic and the guessed key is k bits, a straightforward key recovery requires the time complexity of O(N2(k)). However, the FFT key recovery only requires the time complexity of O(N + k2(k)). As a previous result using FFT, at ICISC 2007, Collard et al. proposed that FFT can reduce the time complexity of a linear attack. We show that FFT can also reduce the complexity of the integral attack. Moreover, the estimation of the complexity is very simple. We first show the complexity of the FFT key recovery against three structures, the Even-Mansour scheme, a key-alternating cipher, and the Feistel structure. As examples of these structures, we show integral attacks against PROST, AES, PRESENT, and CLEFIA. As a result, an 8-round PROST (P) over tilde (128, K) can be attacked with about an approximate time complexity of 2(79.6). For the key-alternating cipher, a 6-round AES and a 10-round PRESENT can be attacked with approximate time complexities of 2(51.7) and 2(97.4), respectively. For the Feistel structure, a 12-round CLEFIA can be attacked with approximate time complexities of 2(87.5).

Measurements of bottomonium production in heavy-ion and p + p collisions at the Relativistic Heavy Ion Collider (RHIC) are presented. The inclusive yield of the three states, (1S + 2S + 3S), was measured in the PHENIX experiment via electron-positron decay pairs at midrapidity for Au + Au and p + p collisions at root sNN = 200 GeV. The (1S + 2S + 3S) -> e(+)e(-) differential cross section at midrapidity was found to be B(ee)d sigma/dy = 108 +/- 38 (stat) +/- 15 (syst) +/- 11 (luminosity) pb in p + p collisions. The nuclear modification factor in the 30% most central Au + Au collisions indicates a suppression of the total. state yield relative to the extrapolation from p + p collision data. The suppression is consistent with measurements made by STAR at RHIC and at higher energies by the CMS experiment at the Large Hadron Collider.

The security of the optimal Ate pairing using the BN curves is based on the hardness of the DLP over $\text{GF}(p^{12})$. At CRYPTO 2006, Joux et al. proposed the number field sieve over $\text{GF}(p^n)$, but the number field sieve needs multi-dimensional sieving. In this paper, we deal with the multi-dimensional sieving, and discuss its parameter sizes such as the dimension of sieving and the size of the sieving region from some experiments of the multi-dimensional sieving. Using efficient parameters, we have solved the DLP over $\text{GF}(p^{12})$ of 203 bits in about 43 hours using a PC of 16 CPU cores.

Hierocrypt-L1 is one of the Japanese e-Government Recommended Ciphers listed by CRYPTREC in 2003, and its security was reconfirmed as secure by CRYPTREC in 2013. In this paper we first find differential characteristics with probability 1 in the key scheduling of Hierocrypt-L1. Then, using the above characteristics, we construct related-key differentials and related-key impossible differentials. The impossible differentials are in a new type of impossible differential characteristics in that the S-box impossible differentials are directly utilized. The above related-key differentials and impossible differentials are applied to key recovery attacks on 8 S-function layers of Hierocrypt-L1, which are the best attacks on Hierocrypt-L1 in terms of the number of attackable S-function layers.

CLEFIA is a 128-bit block cipher proposed by Shirai et al. at FSE 2007, and it was selected as several standards. CLEFIA adopts a generalized Feistel structure with the switching diffusion mechanism, which realizes a compact hardware implementation for CLEFIA, and it seems one of the promising candidates to be used for restricted environments, which require that a cryptographic primitive is versatile. It means that we need to evaluate the security of CLEFIA even for unusual scenario such as known-key scenario. As Knudsen and Rijmen did for 7-round AES at Asiacrypt 2007, we construct 17-round known-key distinguisher using two integral characteristics. To combine the 17-round known-key distinguisher with the standard subkey recovery technique for a secret-key scenario, we can construct a known-key distinguisher for full CLEFIA-128 from a random permutation under the framework of middletext distinguisher proposed by Minier et al. at Africacrypt 2009. The known-key distinguisher requires query of 2(112) texts, time complexity of 2(112), and memory complexity of 2(3) blocks, with the advantage of e(-1), where e is the base of the natural logarithm. Note that there is no practical impact on the security of CLEFIA-128 for the current usages, since the result can only work under the known-key setting and data used by the adversary are enormous and needs a special form.