Abstract Whether a block cipher can resist impossible differential attack is an important basis to evaluate the security of a block cipher. However, the length of impossible differentials is important for the security evaluation of block ciphers. Most of the previous studies are based on structural cryptanalysis to find the impossible differential, and the structural cryptanalysis covers a lot of specific cryptanalytic vectors which are independent of the nonlinear S-boxes. In this paper, we study the maximum length of the impossible differential of an Advanced Encryption Standard-like cipher in the setting with the details of S-boxes. Inspired by the ‘Divide-and-Conquer’ technique, we propose a new technique called Reduced Block, which combines the details of the S-box. With this tool, the maximum length of impossible differentials can be proven under reasonable assumptions. As applications, we use this tool on uBlock and Midori. Consequently, we prove that for uBlock-128, uBlock-256 and Midori-64, there are no impossible five-round, six-round and seven-round differentials with one active input nibble and one active output nibble, even when considering the details of S-boxes. Furthermore, we reveal some properties of the uBlock S-box and linear layer and demonstrate theoretically that there are no impossible differentials longer than four rounds for uBlock-128 under the assumption that the round keys are independent and uniformly random. This study might provide some insight into the bounds of the length of impossible differentials.

With the rapid advancement of the Internet of Things (IoT), many innovative lightweight block ciphers have been introduced to meet the stringent security demands of IoT devices. Among these, the Shadow cipher stands out for its compactness, making it particularly well-suited for deployment in resource-constrained IoT nodes (IEEE Internet of Things Journal, 2021). This paper demonstrates two real-time attacks on Shadow for the first time: real-time plaintext recovery and key recovery. Firstly, numerous properties of Shadow are discussed, illustrating an equivalent representation of the two-round Shadow and the relationship between the round keys. Secondly, we introduce multiple two-round iterative linear approximations. Employing these approximations enables the derivation of full-round linear distinguishers. Moreover, we have uncovered numerous linear relationships between plaintext and ciphertext. Real-time plaintext recovery is achievable based on these established relationships. On average, it takes 5 seconds to recover the plaintext for a fixed ciphertext of Shadow-32. Thirdly, many properties of the propagation of difference through SIMON-like function are illustrated. According to these properties, various differential distinguishers up to full rounds are presented, allowing real-time key recovery. Specifically, the 64-bit master key of Shadow-32 can be retrieved in around two days on average. Experiments verify all our results.

Abstract 3D is an Advanced Encryption Standard (AES)-like cipher employed 3D structure proposed in 2008. The main innovation of 3D is the multi-dimensional state, generalizing the design of Rijndael and allowing block sizes beyond the 256-bit boundary. Saturnin, a lightweight block cipher has been selected as a second-round candidate in the National Institute of Standards and Technology standardization for lightweight cryptography. It also employs a 3D structure and provides high security against quantum and classic attacks. The exchange-equivalence attacks proposed by Bardeh and Rønjom consider how quadruples of plaintexts confirm distinguishable properties for AES. It is similar to the principle of yoyo attack, but it can find a longer number of rounds of distinguisher. In this paper, we investigate the exchange-equivalence attack on 3D and yoyo attack on Saturnin. Our new results turn out to be the first secret-key chosen plaintext distinguisher for 10-round 3D. The complexity of the distinguisher is about $2^{364.2}$ in terms of data, memory and computational complexity. For Saturnin, we propose the first six-super-round impossible differential yoyo attack, which is suitable for the two-S-layer version. Compared with the previous impossible differential attacks in the design report of Saturnin, the attacks presented here are the best in terms of the complexity under the chosen-plaintext scenario.

This paper focuses on similarity properties and extension of the classical slide property of block ciphers. Taking FESH, an award‐winning block cipher of the National Cryptographic Algorithm Design Competition 2019, as an example, similarity properties of the encryption and key transformation are found, owing to the similar structures that the encryption and key transformation adopted, and the constants generation. Based on the similarity properties, extended slide properties can be constructed for FESH. Slide attacks of FESH are then proposed. The similarity properties and extended slide property are immune to the increasing of iterated rounds, i.e., it cannot be avoided by increasing the round number of FESH. Furthermore, extended slide property helps relaxing the strict requirements of the subkeys in slide attacks. Taking Feistel and SPN structures as examples, frameworks of slide attacks based on the extended slide properties are presented. Slide attack of FESH is exactly a concrete example of SPN structure.

Based on the method of the H‐representation of the convex hull, the linear inequalities of all possible differential patterns of 4‐bit S‐boxes in the mix integer linear programming (MILP) model can be generated easily by the SAGE software. Whereas this method cannot be apply to 8‐bit S‐boxes. In this study, the authors propose a new method to obtain the inequalities for large S‐boxes with the coefficients belonging to integer. The relationship between the coefficients of the inequalities and the corresponding excluded impossible differential patterns is obtained. As a result, the number of inequalities can be lower than 4000 for the AES S‐box. Then, the new method for finding the best probability of the differential characteristics of 4–15 rounds SM4 in the single‐key setting is presented. Especially, the authors found that the 15‐round SM4 exists four differential characteristics with 12 active S‐boxes. The exact lower bound of the number of differentially active S‐boxes of the 16‐round SM4 is 15. The authors also found eight differential characteristics of the 19‐round SM4 with the probability .

A type of simple key schedule especially suitable for lightweight block ciphers is defined as straightforward key schedule in this study. As a typical example, GOST‐type key schedule, which is an extension of the key schedules of Russian Standard GOST and its newly modified version GOST2, is introduced and classified. GOST2 is designed based on the GOST encryption structure with different but the same type of key schedule to overcome the weakness of GOST against self‐similarity properties‐based attacks. However, it has been shown in Fast Software Encryption 2017, the simple change in the key schedule is insufficient to offer 256‐bit security. By constructing an evaluation framework combining self‐similarity properties and meet‐in‐the‐middle attack, properties of GOST‐type key schedules are evaluated, and candidate key schedules are provided in this work. These candidate key schedules are able to provide much better security for GOST and GOST2 ciphers than their original key schedules, and the pre‐existing self‐similarity properties‐based attacks of full round GOST and GOST2 can be avoided. The designers of GOST and GOST2 should have been more cautious choosing the parameters of key schedules. The evaluation framework proposed can be used for reference in the design of other Feistel ciphers with straightforward key schedules.

The scale-invariant feature transform algorithm and its many variants are widely used in feature-based remote sensing image registration. However, it may be difficult to find enough correct correspondences for remote image pairs in some cases that exhibit a significant difference in intensity mapping. In this letter, a new gradient definition is introduced to overcome the difference of image intensity between the remote image pairs. Then, an enhanced feature matching method by combining the position, scale, and orientation of each keypoint is introduced to increase the number of correct correspondences. The proposed algorithm is tested on multispectral and multisensor remote sensing images. The experimental results show that the proposed method improves the matching performance compared with several state-of-the-art methods in terms of the number of correct correspondences and aligning accuracy.

Although many feature-based registration methods have been proposed, automatic image registration is still a challenging task due to the influence of various conditions and uncertain difficulties for remote sensing images. In this letter, a novel image registration method, including two types of feature detectors and a region boundary constraint strategy for matching, is proposed. Two types of features detected by scale-invariant feature transform and Harris operators have advantages of keeping different structural information in the image and increasing the number of keypoints for later matching. Afterward, a region boundary constraint strategy based on the image sketch map is utilized in matching step. This strategy restricts the detected two types of features in their respective structural region and nonstructural region to reduce the incorrect correspondences. Experimental results demonstrate the superiority of our proposed registration algorithm compared with other research works in terms of correct matching number and aligning accuracy.