WARP is a lightweight 128-bit block cipher with generalized Feistel structure, which can be regarded as a low-area replacement of AES-128. In this paper, we present improved rectangle and linear attacks against WARP. To optimize the cost of the key-recovery process, we propose a flexible key-guessing method for rectangle attack on WARP. Utilizing this method, we present three rectangle attacks against 27-round WARP, which improve the previous rectangle attack by one round. Considering the linear hull effect, we automatically find a 20-round linear distinguisher, and present a linear attack against 25-round WARP with the FWT-based key-recovery algorithm, which improves the previous linear attack by two rounds.

Reflection structure has a significant advantage that realizing decryption and encryption results in minimum additional costs, and many block ciphers tend to adopt such structure to achieve the requirement of low overhead. PRINCE, MANTIS, QARMA, and PRINCEv2 are lightweight block ciphers with reflection feature proposed in recent years. In this paper, we consider the automatic differential cryptanalysis of reflection block ciphers based on Boolean satisfiability (SAT) method. Since reflection block ciphers have different round functions, we extend forward and backward from the middle structure and achieve to accelerate the search of the optimal differential characteristics for such block ciphers with the Matsui’s bounding conditions. As a result, we present the optimal differential characteristics for PRINCE up to 12 rounds (full round), and they are also the optimal characteristics for PRINCEv2. We also find the optimal differential characteristics for MANTIS, QARMA‐64, and QARMA‐128 up to 10, 12, and 8 rounds, respectively. To mount an efficient differential attack on such block ciphers, we present a uniform SAT model by combining the differential characteristic searching process and the key recovery process. With this model, we find two sets of 7‐round differential characteristics for PRINCE with less guessed key bits and use them to present a multiple differential attack against 11‐round PRINCE, which improves the known single‐key attack on PRINCE by one round to our knowledge.

Abstract Deoxys‐BC is the internal tweakable block cipher of the authenticated encryption (AE) Deoxys family, in which Deoxys‐II is the primary choice for the use case of ‘Defence in depth’ among the portfolio of CAESAR competition. Improvements of the related‐tweakey rectangle attacks on round‐reduced Deoxys‐BC using the known distinguishers is focussed in this study. Under the new related‐key rectangle attack framework proposed by Dong et al. in EUROCRYPT 2022, we present three kinds of precomputed tables to further reduce the time complexity in the key‐recovery phase. In the related‐tweakey rectangle attack, the invalid quartets are filtered or the subtweakey candidates are obtained by lookup the precomputed tables without more computation. Based on the precomputed table technique, we improved the related‐tweakey rectangle attacks on 11‐round Deoxys‐BC‐256, 13‐round and 14‐round Deoxys‐BC‐384. Furthermore, we reduce the time complexity of the 13‐round related‐tweakey rectangle attack on Deoxys AE scheme Deoxys‐I‐256‐128 by a factor of 2 24 compared with the best previous attack.

LBlock is a lightweight block cipher with Feistel‐SP structure proposed by Wu and Zhang in Applied Cryptography and Network Security 2011, and a modified version LBlock‐s is used later in the design of the lightweight authenticated encryption cipher LAC, one of the CAESAR candidates. The best known integral attack on LBlock is presented by Zhang and Wu which can attack 23‐round LBlock based on a 16‐round integral distinguisher found with division property. In Selected Areas in Cryptography 2018, Eskandari et al . further presented a 17‐round integral distinguisher of LBlock with bit‐based division property using SAT solver. Using their method, the authors further find some new 17‐round integral distinguishers of LBlock and use one of them to present a 24‐round integral attack on LBlock. Similarly, they also find some 17‐round integral distinguishers of LBlock‐s and select one to present a 24‐round integral attack on LBlock‐s. In this way, they have improved known single‐key attacks on LBlock and LBlock‐s by one round.

Let $\underline{a}$ be a maximum period feedback with carry shift register sequence (l‐sequence) with connection integer $q=p^e$ and period $T=p^{e-1}(p-1)$. It is shown that the expected value of its autocorrelations is 0, and its variance is $O(q\ln^{4}q)$. Thus when q is sufficiently large, with high probability, the autocorrelations are low. Furthermore, it is shown that when $e\geq2$, for any integer i, $1\leq i\leq e/2$, when the shift is a multiple of $T/2p^i$, the absolute value of the autocorrelations of $\underline{a}$ is $T/p^{2i-1}$, and the sign relies on the parity of the multiple.

Let$underlinea$be an l-sequence generated by a feedback-with-carry shift register with connection integer$p^e$, where$p$is an odd prime and$egeq 1$. Goresky and Klapper conjectured that when$p^enotin 5,9,11,13$, all decimations of$underlinea$are cyclically distinct. When$e=1$and$p ≫ 13$, they showed that the set of distinct decimations is large and, in some cases, all decimations are distinct. In this article, we further show that when$egeq 2$and$p^eneq 9$, all decimations of$underlinea$are also cyclically distinct.

Klapper and Goresky (1995) introduced feedback with carry shift register (FCSR) and presented a significant kind of FCSR sequences, that is, l-sequences. They showed that the number of 0s and 1s occurring in one of their periods are equal. We discuss the partial period distribution of l-sequences, and show that when the periods become large, the proportion of 1s (resp., 0s) occurring in any of their partial periods approximates 50%.