This paper presents a unified framework for generic attacks on Generalized Feistel Ciphers, with a primary focus on Type 1, Type 2, and unbalanced contracting (U-Type 1) Feistel constructions with non-invertible round functions. In [OBR23], authors reveal a class of vulnerabilities exploitable via key independent multidimensional linear trails for Feistel Ciphers, yielding efficient generic distinguishing and key-recovery attacks. We extend the work of [OBR23] by formalizing the application of generic multidimensional linear cryptanalysis to Generalized Feistel Ciphers. In this way, we improve upon existing results by extending the maximum number of rounds for the generic distinguishing attack to t2 + 2t − 1 for Type 1 and U-Type 1, and to 2t + 3 for Type 2. Moreover, we have the maximum number of rounds for generic key recovery attacks on (U)-Type 1 as t2 + 3t − 2 and Type 2 as 4t. To the best of our knowledge, these findings yield the best results for the maximum number of rounds in key recovery attacks on the corresponding GFC. We further demonstrate the branch-permutation-independence of these attacks, showing that changing internal permutations does not affect the applicability, complexity, or maximum number of rounds of generic attacks. The effectiveness of our attacks is validated through experiments on the first-round AES candidate CAST-256 and the MPC-friendly block cipher GMiMC. Both theoretical and experimental results confirm that our proposed branch-permutation-independent generic attacks enhance the maximum number of rounds for generic attacks for GFC and reduce complexity across various interesting cases.

Applications of cryptography are plenty in everyday life. This guidebook is about the security analysis or 'cryptanalysis' of the basic building blocks on which these applications rely. Rather than covering a variety of techniques at an introductory level, this book provides a comprehensive and in-depth treatment of linear cryptanalysis. The subject is introduced from a mathematical point of view, providing an overview of the most influential papers on linear cryptanalysis and placing them in a consistent framework based on linear algebra. A large number of examples and exercises are included, drawing upon practice as well as theory. The book is accessible to students with no prior knowledge of cryptography. It covers linear cryptanalysis starting from the basics, including linear approximations and trails, correlation matrices, automatic search, key-recovery techniques, up to advanced topics, such as multiple and multidimensional linear cryptanalysis, zero-correlation approximations, and the geometric approach.

This paper analyzes candidate schemes for PPP/PPP-RTK data authentication. Data authentication asymmetric schemes are proposed based on existing standards and compatible with GNSS messages. Postquantum cryptographic signatures are also reviewed and discussed. Two schemes are selected for analysis: DS (digital signature), based on ECDSA, and DD (delayed-disclosure), based on a hybrid scheme using the TESLA protocol. An implementation of each of them is described in detail for both Galileo HAS (High Accuracy Service), and QZSS (Quasi-Zenith Satellite System) CLAS (Centimeter-Level Accuracy Service). The performance of the schemes in terms of time to receive the corrections message, and increase in the age of data (AOD) due to authentication, is analyzed. The analysis is complemented by a review of the CPU consumption at receiver level.

We provide three first-order hardware maskings of the AES, each allowing for a different trade-off between the number of shares and the number of register stages. All maskings use a generalization of the changing of the guards method enabling the re-use of randomness between masked S-boxes. As a result, the maskings do not require fresh randomness while still allowing for a minimal number of shares and providing provable security in the glitch-extended probing model. The low-area variant has five cycles of latency and a serialized area cost of 8.13 kGE. The low-latency variant reduces the latency to three cycles while increasing the serialized area by $$67.89\%$$ compared to the low-area variant. The maskings of the AES encryption are implemented on FPGA and evaluated with Test Vector Leakage Assessment (TVLA).

Threshold implementation is a method based on secret sharing to secure cryptographic ciphers (and in particular S-boxes) against differential power analysis side-channel attacks which was proposed by Nikova, Rechberger, and Rijmen in 2006. Until now, threshold implementations were only constructed for specific types of functions and some small S-boxes, but no generic construction was ever presented. In this paper, we present the first universal threshold implementation with $t+2$ shares that is applicable to any bijective S-box, where $t$ is its algebraic degree (or is larger than the algebraic degree). While being universal, our construction is also optimal with respect to the number of shares, since the theoretically smallest possible number, $t+1$ , is not attainable for some bijective S-boxes. Our results enable low latency secure hardware implementations without the need for additional randomness. In particular, we apply this result to find two uniform sharings of the AES S-box. The first sharing is obtained by using the threshold implementation of the inversion in $\mathbb {F}_{2^{8}}$ and the second by using two threshold implementations of two cubic power permutations that decompose the inversion. Area and performance figures for hardware implementations are provided.

ARX algorithms are a class of symmetric-key algorithms constructed by Addition, Rotation, and XOR. To evaluate the resistance of an ARX cipher against differential and impossible-differential cryptanalysis, the recent automated methods employ constraint satisfaction solvers to search for optimal characteristics or impossible differentials. The main difficulty in formulating this search is finding the differential models of the non-linear operations. While an efficient bit-vector differential model was obtained for the modular addition with two variable inputs, no differential model for the modular addition by a constant has been proposed so far, preventing ARX ciphers including this operation from being evaluated with automated methods. In this paper, we present the first bit-vector differential model for the n-bit modular addition by a constant input. Our model contains O(log2(n)) basic bit-vector constraints and describes the binary logarithm of the differential probability. We describe an SMT-based automated method that includes our model to search for differential characteristics of ARX ciphers including constant additions. We also introduce a new automated method for obtaining impossible differentials where we do not search over a small pre-defined set of differences, such as low-weight differences, but let the SMT solver search through the space of differences. Moreover, we implement both methods in our open-source tool ArxPy to find characteristics and impossible differentials of ARX ciphers with constant additions in a fully automated way. As some examples, we provide related-key impossible differentials and differential characteristics of TEA, XTEA, HIGHT, LEA, SHACAL-1, and SHACAL-2, which achieve better results compared to previous works.

A GNSS signal authentication concept named semi-assisted authentication is proposed. It is based on the re-encryption and publication of keystream sequences of some milliseconds from an already existing encrypted signal. Some seconds after the keystreams are transmitted in the signal-in-space, the signal broadcasts the key allowing to decrypt the sequences and the a-posteriori correlation at the receiver. The concept is particularized as Galileo Assisted Commercial Authentication Service, or ACAS, for Galileo E1-B, with OSNMA used for the decryption keys, and E6C, assumed to be encrypted in the near future. This work proposes the ACAS cryptographic operations and a model for signal processing and authentication verification. Semi-assisted authentication can be provided without any modification to the signal plan of an existing GNSS, without the disclosure of signal encryption keys, and for several days of receiver autonomy, depending on its storage capabilities.

A systematic approach to the fixed-key analysis of differential probabilities is proposed. It is based on the propagation of 'quasidifferential trails', which keep track of probabilistic linear relations on the values satisfying a differential characteristic in a theoretically sound way. It is shown that the fixed-key probability of a differential can be expressed as the sum of the correlations of its quasidifferential trails. The theoretical foundations of the method are based on an extension of the difference-distribution table, which we call the quasidifferential transition matrix. The role of these matrices is analogous to that of correlation matrices in linear cryptanalysis. This puts the theory of differential and linear cryptanalysis on an equal footing. The practical applicability of the proposed methodology is demonstrated by analyzing several differentials for RECTANGLE, KNOT, Speck and Simon. The analysis is automated and applicable to other SPN and ARX designs. Several attacks are shown to be invalid, most others turn out to work only for some keys but can be improved for weak-keys.

A new fundamental 4-round property of AES, called the zero-difference property, was introduced by Rønjom, Bardeh and Helleseth at Asiacrypt 2017. Our work characterizes it in a simple way by exploiting the notion of related differences which was introduced and well analyzed by the AES designers. We extend the 4-round property by considering some further properties of related differences over the AES linear layer, generalizing the zero-difference property. This results in a new key-recovery attack on 7-round AES which is the first attack on 7-round AES by exploiting the zero-difference property.

Automated search methods based on Satisfiability Modulo Theory (SMT) problems are being widely used to evaluate the security of block ciphers against distinguishing attacks. While these methods provide a systematic and generic methodology, most of their software implementations are limited to a small set of ciphers and attacks, and extending these implementations requires significant effort and expertise. In this work, the authors present cryptographic algorithms for distinguishing attacks (CASCADA), an open-source Python library to evaluate the security of cryptographic primitives, specially block ciphers, against distinguishing attacks with bit-vector SMT solvers. The tool CASCADA implements the bit-vector property framework herein proposed and several SMT-based automated search methods to evaluate the security of ciphers against differential, related-key differential, rotational-XOR, impossible-differential, impossible-rotational-XOR, related-key impossible-differential, linear and zero-correlation cryptanalysis. The library CASCADA is the result of a huge engineering effort, and it provides many functionalities, a modular design, an extensive documentation and a complete suite of tests.

Over the past decades, there has been a dramatic increase of the attacks recovering the data from the RAM memory. These have heightened the need for new solutions and primitives suitable for the encryption of this information. In this paper we introduce RAMus, a new tweakable lightweight block cipher whose properties support its usage for securing the RAM memory. In this sense, RAMus attains all the requirements provided by the (German) Federal Office of Information Security (BSI) in the domain of encryption algorithms suitable for RAM and memory encryption. The design strategy of RAMus is inspired from the LS-approach. Compared to the literature, in our proposal the linear layer is replaced by a second Sbox layer. In RAMus, the diffusion is ensured by the Sbox layers, which use Sboxes with a non-trivial branch number.

NSUCRYPTO is the unique cryptographic Olympiad containing scientific mathematicalproblems for professionals, school and university students from any country. Its aim is to involveyoung researchers in solving curious and tough scientific problems of modern cryptography. Fromthe very beginning, the concept of the Olympiad was not to focus on solving olympic tasks but onincluding unsolved research problems at the intersection of mathematics and cryptography. TheOlympiad history starts in 2014. In 2019, it was held for the sixth time. We present the problemsand their solutions of the Sixth International Olympiad in cryptography NSUCRYPTO $$^{\prime}$$ 2019. Under consideration are the problems relatedto attacks on ciphers and hash functions, protocols, Boolean functions, Dickson polynomials, primenumbers, rotor machines, etc. We discuss several open problems on mathematical countermeasuresto side-channel attacks, APN involutions, S-boxes, etc. The problem of finding a collision for thehash function Curl27 was partiallysolved during the Olympiad.

We provide three first-order sharings of the AES each allowing for a different trade-off between the number of shares and the number of register stages. All sharings use a generalization of the changing of the guards method by allowing randomness to be used in the shared S-box. As a result, the sharings have minimal randomness requirements. The sharings are written out in detail to ease implementation efforts.

Data and signal authentication schemes are being proposed to address Global Navigation Satellite Systems' (GNSS) vulnerability to spoofing. Due to the low power of their signals, the bandwidth available for authentication in GNSS is scarce. Since delayed-disclosure protocols, e.g., TESLA (timed-efficient stream loss-tolerant authentication), are efficient in terms of bandwidth and robust to signal impairments, they have been proposed and implemented by GNSS. The length of message authentication codes (MACs) and cryptographic keys are two crucial aspects of the protocol design as they have an impact on the utilized bandwidth, and therefore on the protocol performance. We analyze both aspects in detail for GNSS-TESLA and present recommendations for efficient yet safe MAC and key lengths. We further complement this analysis by proposing possible authentication success and failure policies and quantify the reduction of the attack surface resulting from employing them. The analysis shows that in some cases it is safe to use MAC and key sizes that are smaller than those proposed in best-practice guidelines. While some of our considerations are general to delayed-disclosure lightweight protocols for data and signal authentication, we particularize them for GNSS-TESLA protocols.

This chapter is based on our work in [50] and [51]. It has been reported before that the fixed-key probability of trails depends on the value of the key [14, 38, 6]. We define plateau trails, where the dependency on the value of the key is very structured.

In this chapter we give a brief description of the block cipher DES [1]. Both differential cryptanalysis and linear cryptanalysis were successfully applied to the DES. Differential cryptanalysis was the first chosen-plaintext attack that was theoretically more efficient than an exhaustive key search for the DES.

Abstract In this paper we study two-round key-alternating block ciphers with round function f (x)= x (2 t +1)2 s , where t, s are positive integers. An algorithm to compute the distribution weight in respect to input and output masks is described. Also, in the case t = 1 the correlation distributions depending on input and output masks are completely determined for arbitrary pairs of masks.