This paper shows practical committing attacks against Rocca-S, an authenticated encryption with associated data scheme designed for 6G applications. Previously, the best complexity of the attack was 2 64 by Derbez et al. in ToSC 2024(1)/FSE 2024. We show that the committing attack against Rocca by Takeuchi et al. in ToSC 2024(2)/FSE 2025 can be applied to Rocca-S, where Rocca is an earlier version of Rocca-S. We show a concrete test vector of our attack. We also point out a committing attack that exploits equivalent keys.

In this study, we propose a quantum attack on the two-round iterated Even-Mansour cipher, which consists of two independent permutations and three independent subkeys. Our attack is in the Q1 model, where an adversary makes classical online queries and quantum offline queries. The complexity of our attack is O(2n/2), where n is the block size, while the best known attack for this variant is O(23n/5). Thus, our method significantly improves the computational complexity compared to existing quantum attacks.

Abstract MDPH is a double‐block‐length hash function proposed by Naito at Latincrypt 2019. This is a combination of Hirose's compression function and the domain extender called Merkle–Damgård with permutation. When instantiated with an n ‐bit block cipher, Naito proved that this achieves the (nearly) optimal indifferentiable security bound of O ( n − log n )‐bit security. In this paper, the authors first point out that the proof of the claim contains a gap, which is related to the definition of the simulator in simulating the decryption of the block cipher. The authors then show that the proof can be fixed. The authors introduce a new simulator that addresses the issue, showing that MDPH retains its (nearly) optimal indifferentiable security bound of O ( n − log n )‐bit security.

Abstract This paper considers a problem of identifying matching attacks against Romulus‐M, one of the 10 finalists of National Institute of Standards and Technology Lightweight Cryptography standardisation project. Romulus‐M is provably secure, that is, there is a theorem statement showing the upper bound on the success probability of attacking the scheme as a function of adversaries' resources. If there exists an attack that matches the provable security bound, then this implies that the attack is optimal and that the bound is tight in the sense that it cannot be improved. It is shown that the security bounds of Romulus‐M are tight for a large class of parameters by presenting concrete matching attacks.

Generalized Feistel structures (GFS) are widely employed as the underlying structure of primitives like block ciphers and hash functions. In order to improve its slow diffusion, several design ideas have been proposed. In this contribution, we explore the (im)possibility of further improving the round diffusion of GFS by modifying its round permutations. First, we generalize a technique called sub-block dividing, which further divides each sub-block into smaller blocks. We prove that the diffusion round of a round permutation with sub-block dividing is four, regardless of the number of sub-blocks. Moreover, we show that the round diffusion of GFS can be improved by alternately using two different round permutations instead of a single permutation. We present the first results that, by using two round permutations, 10- and 12-block GFS partially and fully reach the lower bounds on the diffusion round, respectively.

At CRYPTO 2019, constructions of a pseudorandom function from public random permutations were presented. We consider one of the constructions called Sum of Even-Mansour (SoEM), and present quantum attacks against the construction. Our attacks are based on two quantum algorithms, Simon's algorithm and Grover's algorithm, and derive the secret key. We also present quantum attacks against natural variants of SoEM.

In this paper, we introduce a new covering radius of RM(r,n) from cryptography viewpoint. It is defined as the maximum distance between t-resilient functions and the rth order Reed-Muller code RM(r,n). We next derive its lower and upper bounds. We further present a table of numerical data of our bounds.