Cryptanalysis - the task of finding attacks against cryptographic schemes - sits at the intersection of mathematical reasoning and cybersecurity, two areas where LLMs have advanced fastest. Cryptanalysis represents both a clean testbed for frontier reasoning (as practical attacks can be automatically verified) and a domain with unusually high stakes, since the primitives under study underpin our digital security. In this paper we ask whether LLMs can do cryptanalysis, and find that the answer is increasingly yes. We introduce CryptanalysisBench, 191 tasks across six families of cryptographic primitives (block ciphers, hash functions, etc.) drawn primarily from four NIST standardization competitions. Our benchmark consists of three tiers: (i) primitives with known practical breaks; (ii) primitives with no known practical break, evaluated both at full strength and as scaled-down variants; and (iii) a challenge set of production primitives at the frontier of cryptanalysis. Five frontier models (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and the open-weights GLM 5.2) break 65 We release CryptanalysisBench as a tool to help track if (or when) AI cryptanalysis becomes a serious factor and as a scaffold for stress-testing candidate schemes before deployment. The attacks that the benchmark already surfaces are an early snapshot of a fast-moving frontier that may soon match, and in places exceed, the published state of the art.

Privacy is a fundamental human right, but it is also one of the more complicated rights. Not only privacy is very context-oriented and society-oriented, it is hard to define privacy without involving adversaries trying to break it. The conceived tension between "national security" or "public order" and the basic human right of privacy, impacts the adoption of Privacy Enhancing Technologies (PETs), and at times, hinders the ability to offer privacy to users. In this talk, we will discuss a few topics where such a conflict exists, such as biometric data, contact tracing, and COVID certificates. We will discuss the importance of incorporating privacy into our technical work, thus making a real-life impact by offering solutions that offer better privacy. We will discuss the problems in disseminating state-of-the-art scientific knowledge to the public. We will then consider the problem of discussing these issues with policy makers, as they are the ones making the call, while not necessarily understanding the impact of complicated technologies for (and on) privacy.

Pelican, suggested by Daemen and Rijmen, is a Message Authentication Code (MAC) with a structure that resembles a CBC-MAC. A constant IV is first encrypted under the unknown key, and then a CBC “encryption” takes place with a fixed random permutation (of 4 keyless AES rounds). The finalization is composed of applying another full keyed AES encryption. Previous works relied on internal collisions, and resulted in an almost universal forgery, in which it is easy to generate the correct tag of any given message if the attacker is allowed to change a single block in it. However, no key-recovery attacks or forgery attacks invalidating the security claims of the Pelican were published. In this paper we show a simple forgery attack against Pelican. We show that adding a block of 0 to the message (at any location) does not change the tag with probability 18 · 2^-128 (i.e., 18 times higher than expected), which contradicts the security claims of Pelican. We also show that one can increase the success rate of the attack up to 3,810 · 2^-128≈ 2^-116.1 by adding 951 blocks of 0 to the message. We argue that the fixed-point based attacks contradict the security claims of Pelican.

Biometric data is considered to be very private and highly sensitive. As such, many methods for biometric template protection were considered over the years -- from biohashing and specially crafted feature extraction procedures, to the use of cryptographic solutions such as Fuzzy Commitments or the use of Fully Homomorphic Encryption (FHE). A key question that arises is how much protection these solutions can offer when the adversary can inject samples, and observe the outputs of the system. While for systems that return the similarity score, one can use attacks such as hill-climbing, for systems where the adversary can only learn whether the authentication attempt was successful, this question remained open. In this paper, we show that it is indeed possible to reconstruct the biometric template by just observing the success/failure of the authentication attempt (given the ability to inject a sufficient amount of templates). Our attack achieves negligible template reconstruction loss and enables full recovery of facial images through a generative inversion method, forming a pipeline from binary scores to high-resolution facial images that successfully pass the system more than 98\% of the time. Our results, of course, are applicable for any protection mechanism that maintains the accuracy of the recognition.

The Pointer Authentication Code (PAC) feature in the Arm architecture is used to enforce the Code Flow Integrity (CFI) of running programs. It does so by generating a short MAC — called the PAC — of the return address and some additional context information upon function entry, and checking it upon exit. An attacker that wants to overwrite the stack with manipulated addresses now faces an additional hurdle, as they now have to guess, forge, or reuse PAC values. PAC is deployed on billions of devices as a first line of defense to harden system software and complex programs against software exploitation. The original version of the feature uses a 12-round version the QARMA-64 block cipher. The output is then truncated to between 3 and 32 bits, in order to be inserted into unused bits of 64-bit pointers. A later revision of the specification allows the use of an 8-round version of QARMA-64. This reduction may introduce vulnerabilities such as high-probability distinguishers, potentially enabling key recovery attacks. The present paper explores this avenue. A cryptanalysis of the PAC computation function entails restricting the inputs to valid virtual addresses, meaning that certain most significant bits are fixed to zero, and considering only the truncated output. Within these constraints, we present practical attacks on various PAC configurations. These attacks, while not presenting immediate threat to the PAC mechanism, show that some versions of the feature do miss the security targets made for the original function. This offers new insights into the practical security of constructing MAC from truncated block ciphers, expanding on the mostly theoretical understanding of creating PRFs from truncated PRPs. We note that the results do not affect the security of QARMA-64 when used with the recommended number of rounds for general purpose applications.

A major research area in discrete geometry is to consider the best way to partition the d -dimensional Euclidean space $$\mathbb {R}^d$$ R d under various quality criteria. In this paper we introduce a new type of space partitioning that is motivated by the problem of rounding noisy measurements from the continuous space $$\mathbb {R}^d$$ R d to a discrete subset of representative values. Specifically, we study partitions of $$\mathbb {R}^d$$ R d into bounded-size tiles colored by one of k colors, such that tiles of the same color have a distance of at least t from each other. Such tilings allow for error-resilient rounding, as two points of the same color and distance less than t from each other are guaranteed to belong to the same tile, and thus, to be rounded to the same point. The main problem we study in this paper is characterizing the achievable tradeoffs between the number of colors k and the distance t , for various dimensions d . On the qualitative side, we show that in $$\mathbb {R}^d$$ R d , using $$k=d+1$$ k = d + 1 colors is both sufficient and necessary to achieve $$t>0$$ t > 0 . On the quantitative side, we achieve numerous upper and lower bounds on t as a function of k . In particular, for $$d=3,4,8,24$$ d = 3 , 4 , 8 , 24 , we obtain sharp asymptotic bounds on t , as $$k \rightarrow \infty $$ k → ∞ . We obtain our results with a variety of techniques including isoperimetric inequalities, the Brunn-Minkowski theorem, sphere packing bounds, Bapat’s connector-free lemma, and Čech cohomology.

One of the most celebrated and useful cryptanalytic algorithms is Hellman’s time/memory tradeoff (and its Rainbow Table variant), which can be used to invert random-looking functions with domains of size N with time and space complexities satisfying TM^2=N^2 . In this paper we develop new upper bounds on their performance in the quantum setting. As a search problem, one can always apply to it the standard Grover’s algorithm, but this algorithm does not benefit from the possible availability of a large memory in which one can store auxiliary advice obtained during a free preprocessing stage. In fact, at FOCS’20 it was rigorously shown that for memory size bounded by M ≤ O(√(N)) , even quantum advice cannot yield an attack which is better than Grover’s algorithm.Our main result complements this lower bound by showing that in the standard Quantum Accessible Classical Memory (QACM) model of computation, we can improve Hellman’s tradeoff curve to T^4/3M^2=N^2 . When we generalize the cryptanalytic problem to a time/memory/data tradeoff attack (in which one has to invert f for at least one of D given values), we get the generalized curve T^4/3M^2D^2=N^2 . A typical point on this curve is D=N^0.2 , M=N^0.6 , and T=N^0.3 , whose time is strictly lower than both Grover’s algorithm (which requires T=N^0.4 in this generalized search variant) and the classical Hellman algorithm (which requires T=N^0.4 for these D and M ).

Boomerang attacks are extensions of differential attacks that make it possible to combine two unrelated differential properties of the first and second part of a cryptosystem with probabilities p and q into a new differential-like property of the whole cryptosystem with probability p^2q^2 (since each one of the properties has to be satisfied twice). In this paper, we describe a new version of boomerang attacks which uses the counterintuitive idea of throwing out most of the data in order to force equalities between certain values on the ciphertext side. In certain cases, this creates a correlation between the four probabilistic events, which increases the probability of the combined property to p^2q and increases the signal-to-noise ratio of the resultant distinguisher. We call this variant a retracing boomerang attack since we make sure that the boomerang we throw follows the same path on its forward and backward directions. To demonstrate the power of the new technique, we apply it to the case of 5-round AES. This version of AES was repeatedly attacked by a large variety of techniques, but for twenty years its complexity had remained stuck at 2^32 . At Crypto’18, it was finally reduced to 2^24 (for full key recovery), and with our new technique, we can further reduce the complexity of full key recovery to the surprisingly low value of 2^16.5 (i.e., only 90, 000 encryption/decryption operations are required for a full key recovery). In addition to improving previous attacks, our new technique unveils a hidden relationship between boomerang attacks and two other cryptanalytic techniques, the yoyo game and the recently introduced mixture differentials.

The partial sums cryptanalytic technique was introduced in 2000 by Ferguson et al., who used it to break 6-round AES with time complexity of 2 52 S-box computations – a record that has not been beaten ever since. In 2014, Todo and Aoki showed that for 6-round AES, partial sums can be replaced by a technique based on the Fast Fourier Transform (FFT), leading to an attack with a comparable complexity. In this paper we show that the partial sums technique can be combined with an FFT-based technique, to get the best of the two worlds. Using our combined technique, we obtain an attack on 6-round AES with complexity of about 2 46.4 additions. We fully implemented the attack experimentally, along with the partial sums attack and the Todo-Aoki attack, and confirmed that our attack improves the best known attack on 6-round AES by a factor of more than 32. We expect that our technique can be used to significantly enhance numerous attacks that exploit the partial sums technique. To demonstrate this, we use our technique to improve the best known attack on 7-round Kuznyechik by a factor of more than 80.

Differential-Linear (DL) cryptanalysis is a well known cryptanalytic technique that combines differential and linear cryptanalysis. Over the years, multiple techniques were proposed to increase its strength. Two recent ones are: The partitioning technique by Leurent and the use of neutral bits adapted by Beierle et al. to DL cryptanalysis. In this paper we compare these techniques and discuss the possibility of using them together to achieve the best possible DL attacks. We study the combination of these two techniques and show that in many cases they are indeed compatible. We demonstrate the strength of the combination in two ways. First, we present the first DL attack on 4-round Xoodyak and an extension to 5-round in the related key model. We show that the attacks are possible only by using these two techniques simultaneously. In addition, using the combination of the two techniques we improve a DL attack on 9-round DES. We show that the partitioning technique mainly reduces the time complexity, and the use of neutral bits mainly reduces the data complexity, while the combination of them reduces both the time and data complexities.

TinyJAMBU is one of the finalists in the NIST lightweight standardization competition. This paper presents full round practical zero-sum distinguishers on the keyed permutation used in TinyJAMBU. We propose a full round zero-sum distinguisher on the 128- and 192-bit key variants and a reduced round zero-sum distinguisher for the 256-bit key variant in the known-key settings. Our best known-key distinguisher works with $$2^{16}$$ data/time complexity on the full 128-bit version and with $$2^{23}$$ data/time complexity on the full 192-bit version. For the 256-bit version, we can distinguish 1152 rounds (out of 1280 rounds) in the known-key settings. In addition, we present the best zero-sum distinguishers in the secret-key settings: with complexity $$2^{23}$$ we can distinguish 544 rounds in the forward direction or 576 rounds in the backward direction. For finding the zero-sum distinguisher, we bound the algebraic degree of the TinyJAMBU permutation using the monomial prediction technique proposed by Hu et al. at ASIACRYPT 2020. We model the monomial prediction rule on TinyJAMBU in MILP and find upper bounds on the degree by computing the parity of the number of solutions.

Encrypting too much data using the same key is a bad practice from a security perspective. Hence, it is customary to perform re-keying after a given amount of data is transmitted. While in many cases, the re-keying is done using a fresh execution of some key exchange protocol (e.g., in IKE or TLS), there are scenarios where internal re-keying, i.e., without exchange of information, is performed, mostly due to performance reasons.Originally suggested by Abdalla and Bellare, there are several proposals on how to perform this internal re-keying mechanism. For example, Liliya et al. offered the CryptoPro Key Meshing (CPKM) to be used together with GOST 28147-89 (known as the GOST block cipher). Later, ISO and the IETF adopted the Advanced CryptoPro Key Meshing (ACKPM) in ISO 10116 and RFC 8645, respectively.In this paper, we study the security of ACPKM and CPKM. We show that the internal re-keying suffers from an entropy loss in successive repetitions of the rekeying mechanism. We show some attacks based on this issue. The most prominent one has time and data complexities of O(2κ/2) and success rate of O(2−κ/4) for a κ-bit key.Furthermore, we show that a malicious block cipher designer or a faulty implementation can exploit the ACPKM (or the original CPKM) mechanism to significantly hinder the security of a protocol employing ACPKM (or CPKM). Namely, we show that in such cases, the entropy of the re-keyed key can be greatly reduced.

SM4 is China's commercial block cipher standard and an ISO/IEC international standard. While SM4 withstood a great deal of analysis, its non-tweakable structure makes it inflexible. In this paper, we study three different methods to turn SM4 into a tweakable block cipher. Based on the Tweak-aNd-Tweak (TNT) introduced by Bao et al. at EUROCRYPT 2020, we propose the first scheme, called TNT-SM4, which can be treated as an instantiation of TNT. For comparative analysis, the 128 and 32 bits tweaks are both adopted, which is denoted as TNT-SM4-128 and TNT-SM4-32, respectively. By taking full advantage of the structural characteristics of SM4, we also propose the second method, which studies how to tweak SM4 into a tweakable block cipher in a direct way. With the design goal of reducing the design, security evaluation, and implementation costs, we use SM4 as is and attach a lightweight linear tweak schedule to it. The biggest challenge is to find the best insertion location for tweaks in both aspects of security and efficiency. We extensively utilize mixed integer linear programming (MILP) to perform a comprehensive search. The third method adopts the same tweak schedule as the key schedule of SM4, which is equivalent to one more key schedule for SM4. We analyze the security of the three schemes, focusing on related-key and related-tweak attacks, and provide a comparative analysis of the three schemes. The results show that our schemes are secure, and a better scheme that makes SM4 more flexible is obtained from the comparison of the three schemes.

The block cipher GOST 28147-89 was the Russian Federation encryption standard for over 20 years, and is still one of its two standard block ciphers. GOST is a 32-round Feistel construction, whose security benefits from the fact that the S-boxes used in the design are kept secret. In the last 10 years, several attacks on the full 32-round GOST were presented. However, they all assume that the S-boxes are known. When the S-boxes are secret, all published attacks either target a small number of rounds, or apply for small sets of weak keys. In this paper we present the first practical-time attack on GOST with secret S-boxes. The attack works in the related-key model and is faster than all previous attacks in this model which assume that the S-boxes are known. The complexity of the attack is less than 2 27 encryptions. It was fully verified, and runs in a few seconds on a PC. The attack is based on a novel type of related-key differentials of GOST, inspired by local collisions. Our new technique may be applicable to certain GOST-based hash functions as well. To demonstrate this, we show how to find a collision on a Davies-Meyer construction based on GOST with an arbitrary initial value, in less than 2 10 hash function evaluations.

A central problem in cryptanalysis is to find all the significant deviations from randomness in a given n -bit cryptographic primitive. When n is small (e.g., an 8-bit S-box), this is easy to do, but for large n , the only practical way to find such statistical properties was to exploit the internal structure of the primitive and to speed up the search with a variety of heuristic rules of thumb. However, such bottom-up techniques can miss many properties, especially in cryptosystems which are designed to have hidden trapdoors. In this paper we consider the top-down version of the problem in which the cryptographic primitive is given as a structureless black box, and reduce the complexity of the best known techniques for finding all its significant differential and linear properties by a large factor of 2 n / 2 . Our main new tool is the idea of using surrogate differentiation . In the context of finding differential properties, it enables us to simultaneously find information about all the differentials of the form f ( x ) ⊕ f ( x ⊕ α ) in all possible directions α by differentiating f in a single randomly chosen direction γ (which is unrelated to the α ’s). In the context of finding linear properties, surrogate differentiation can be combined in a highly effective way with the Fast Fourier Transform. For 64-bit cryptographic primitives, this technique makes it possible to automatically find in about 2 64 time all their differentials with probability p ≥ 2 - 32 and all their linear approximations with bias | p | ≥ 2 - 16 (using 2 64 memory); previous algorithms for these problems required at least 2 96 time. Similar techniques can be used to significantly improve the best known time complexities of finding related key differentials, second-order differentials, and boomerangs. In addition, we show how to run variants of these algorithms which require no memory, and how to detect such statistical properties even in trapdoored cryptosystems whose designers specifically try to evade our techniques.

Alibaba Cloud's preemptible instances are IaaS instances sold using an auction, similar to the spot instances offered by Amazon Web Services (AWS). Clients purchase them by bidding. The instances are terminated when supply is insufficient, or when the client's bid is lower than the "market price"--- which Alibaba Cloud publishes ever so often. We collected Alibaba Cloud's preemptible price traces from November 2018 to July 2021. This work analyzes the traces, and shows evidence that they experienced sharp lateral behavioral changes over time. We characterize the traces before and after these events. Our analysis highlights features in the traces that seem to be artificially engineered by an underlying pricing mechanism. Since engineered features may abruptly change, they are particularly interesting to clients planning their bidding strategy, or scholars who study them (e.g., to design new pricing mechanisms on the basis of real-life data).