Raviyoyla v1 is an authenticated encryption algorithm submitted to the first round of the CAESAR competition which is a grand occasion launched recently to identify efficient, flexible and secure authenticated encryption primitives. Raviyoyla v1 is composed by an additive stream cipher motivated by the eSTREAM candidate MAG v2 and a keyed hash function. The designer declares $128$ bit security for authentication. In this paper, we propose a method to construct forgeries using a single query and the complexity is negligible. Indeed, we introduce differential of specific form to the public message and try to canceling it before outputting any authenticated tags. Specially, the differential is not restricted to any particular value and thus multiple forgeries may be made through a single query. Our theoretical analysis shows that the probability for a randomly selected differential of our form to be canceled out is at least $0.307143$. Therefore, it is sufficient to have three trials to obtain a forgery. Moreover, the probability can approaches one for some specialized values. Furthermore, the revised Raviyoyla v1 is vulnerable from our attack as well.

Hummingbird‐2, designed by Engels et al ., is a lightweight cipher with built‐in MAC functionality. In this study, the authors examine the security of Hummingbird‐2 in the related‐key model. First, the authors define a new cryptographic notion of an S ‐box, called combination points, based on its differential equation, and demonstrate some properties of combination points. A potential application of the new notion is to recover some partial input of an S ‐box, and the authors show this on Hummingbird‐2 by recovering some internal state bits. Then, by carefully studying the differential distributions of the S ‐boxes, a set of key dependent S ‐boxes can be derived and be used to recover the subkey word of Hummingbird‐2. At last, by the divide and conquer strategy, all the 128 key bits can be recovered with a complexity of 2 40 , which is much lower than that (2 64 ) of the attack at FSE 2013. The attack has been fully implemented on a PC and the secret key has been recovered in a few hours. The results provide some new insights into the design of cryptographic S‐boxes.

In this paper, we present a new variant of the self-shrinking generator (SSG). The new construction inherits the conceptual simplicity and indispensable security properties of the SSG and all the known attacks on the SSG can be frustrated by the new model. Besides, its keystream has ideal run distribution and the flexibility of the new construction allows for efficient practical implementations at a large scale