Impossible differential cryptanalysis and impossible polytopic cryptanalysis are among the most effective techniques for evaluating the security of block ciphers. However, previous automatic search methods for their distinguishers—dimpossible differentials and impossible polytopic transitions—neither account for the influence of the key schedule in single-key settings nor are applicable to block ciphers featuring large S-boxes, variable rotations, or key-dependent permutations. Furthermore, existing approaches fail to search for clusters of impossible differentials when all details of a block cipher are considered. In contrast to previous methods that focus solely on the propagation of differences or s-difference, we redefine impossible differentials and impossible (s+ 1)-polytopic transitions based on state propagation. This redefinition enables us to overcome the limitations inherent in earlier methodologies. Theoretically, we demonstrate that traditional definitions of impossible differentials and impossible (s+ 1)-polytopic transitions correspond to subsets of our redefined concepts, which offer broader analytical perspectives. Technically, we reformulate the automatic search model and develop an SAT-based tool to efficiently evaluate our redefined impossible differentials and impossible (s+ 1)-polytopic transitions. Building upon this foundational search method, we construct a comprehensive framework for detecting clusters of impossible differentials and impossible (s+1)-polytopic transitions. This framework not only fully incorporates the details and differential properties of block ciphers but is also applicable to those employing large S-boxes while considering the full linear layer. As a result, we derive new impossible differentials for GIFT64, PRINTcipher48/96, MISTY1, RC5-32/64/128 and SPECK, as well as new clusters of impossible differentials for SPECK, DES and ARIA. In assessing resistance against impossible differentials, we apply our method to evaluate the security of GIFT64, PRINTcipher48/96, MISTY1, SPECK, SIMON, and DES while accounting for all details of the block ciphers. Moreover, we propose acceleration strategies and apply them to evaluate the security of MISTY1 and AES-128. Notably, we prove that no 5-round impossible differentials with one active input byte and one active output byte exist for AES-128, even when considering the dependencies among three consecutive round keys. Finally, in exploring new impossible (s+1)-polytopic transition, we apply our approach to PRINTcipher48, GIFT64, RC5-32/64 and SIMON32-64, successfully yielding the corresponding distinguishers for the first time.

Large Language Models (LLMs) generate realistic and coherent text, boosting efficiency and decision-making in various fields. However, their generative capabilities pose risks of intellectual property abuse. Watermarking technology offers a solution for information hiding in LLMs, with large model watermarking gaining attention for its unique methods. A critical challenge is embedding watermarks with minimal impact on text quality while ensuring rapid detection, making it an urgent issue to address. In this paper, to address these challenge, we propose a universal and robust tagged watermark technology for LLMs (TWT-LLM). Firstly, the method of TWT embeds a certain amount of watermark information in the sampling process while generating subsequent word text based on the prompt. Then, to enhance the quality of the generated text, we have proposed a group-based local watermark embedding method, which significantly reduces the impact on text quality. The method involves tagging tokens within each group, only the tokens that have been tagged will embed the watermark information. Moreover, to detect the watermark information in the generated text, we have designed a detection method specifically for this watermark embedding technique. Finally, we conducted experiments using the C4 and HC3 datasets, demonstrating that TWT-LLM achieves a lower False Negative Rate and is lighter compared to state-of-the-art methods.

Abstract The cipher is a lightweight tweakable block cipher introduced at FSE 2019. Its design aims to incorporate countermeasures against Differential Fault Attacks at the algorithmic level. The cipher employs a lightweight and involutory S-box along with a simple linear layer, enabling efficient encryption and decryption operations. In particular, utilizes a straightforward tweakey schedule that generates four 64-bit round tweakeys, which are reused throughout the encryption process. Despite its lightweight design, the resistance of against impossible differential analysis has not been thoroughly evaluated, with limited attention from cryptanalysts in this regard. Hence, this paper presents a comprehensive analysis of specifically targeting its resistance to impossible differential cryptanalysis. By employing an Satisfiability Modulo Theory (SMT) based automatic search tool, we successfully identify both 12-round related-tweak impossible differential distinguishers and 15-round related-tweakey impossible differential distinguishers for , marking the first discovery of such distinguishers for this cipher. Our results indicate that the tweak in enhances the cipher’s flexibility, provided it receives appropriate attention. In addition, we conduct key-recovery attacks on reduced-round , successfully recovering the 128-bit keys for 20-round, 21-round, and 23-round variants. Based on our comprehensive analysis and experimental results, we conclude that demonstrates effective resistance against impossible differential cryptanalysis.

Abstract SIMON is one of the lightweight block ciphers designed by the National Security Agency in 2013, and a technical report including security analysis was published by the design team nearly 4 years later. As for the linear attack, it is claimed that ‘the single‐path probabilities (and linear correlations) dip below 2 −block size for 12, 16, 20, 29, and 38 rounds for SIMON32, 48, 64, 96, and 128, respectively’. However, the design team does not show details on how to get the result and there are also no published papers verified the result yet. In the present paper, an upper bound of squared correlation of SIMON‐like functions is given. As an important application of this bound, how to find optimal linear characteristics of SIMON and SIMECK under the Markov assumption with Matsui's branch‐and‐bound algorithm is shown. The authors’ results confirm the claim of the design team. Furthermore, the best‐known linear‐hull distinguishers for SIMON and SIMECK is also given.

In this paper, we propose an automatic tool to search for optimal differential and linear trails in ARX ciphers. It’s shown that a modulo addition can be divided into sequential small modulo additions with carry bit, which turns an ARX cipher into an S-box-like cipher. From this insight, we introduce the concepts of carry-bit-dependent difference distribution table (CDDT) and carry-bit-dependent linear approximation table (CLAT). Based on them, we give efficient methods to trace all possible output differences and linear masks of a big modulo addition, with returning their differential probabilities and linear correlations simultaneously. Then an adapted Matsui’s algorithm is introduced, which can find the optimal differential and linear trails in ARX ciphers. Besides, the superiority of our tool’s potency is also confirmed by experimental results for round-reduced versions of HIGHT and SPECK. More specifically, we find the optimal differential trails for up to 10 rounds of HIGHT, reported for the first time. We also find the optimal differential trails for 10, 12, 16, 8 and 8 rounds of SPECK32/48/64/96/128, and report the provably optimal differential trails for SPECK48 and SPECK64 for the first time. The optimal linear trails for up to 9 rounds of HIGHT are reported for the first time, and the optimal linear trails for 22, 13, 15, 9 and 9 rounds of SPECK32/48/64/96/128 are also found respectively. These results evaluate the security of HIGHT and SPECK against differential and linear cryptanalysis. Also, our tool is useful to estimate the security in the design of ARX ciphers.