Ring confidential transaction (RingCT) protocol is widely used in cryptocurrency to protect the privacy of both users’ identities and transaction amounts. Most recently, a new RingCT protocol (called RingCT 2.0) was proposed by leveraging cryptographic accumulators, which can achieve a constant-size output theoretically but still far from being practical due to the heavy zero-knowledge associated with the accumulator. In this article, we revisit the design of ring confidential transaction protocol and put forward a more efficient privacy-preserving payment protocol, which is built upon an extended version of one-out-of-many proof and a special multi-signature. Compared with previous works, the new protocol is not only more practical, but also does not suffer from a trusted setup. Besides, we show that the protocol satisfies the security requirements provided that the underlying cryptographic primitives are secure in the random oracle model. We implement our new payment protocol in Java, and the experimental results show that it is efficient enough to be used in practice.

The immutability of blockchain is crucial to the security of many blockchain applications, while it is still desired or even legally obliged to allow for redacting the contents of blockchain for some scenarios. In this work, we revisit the conflict between the immutability and redaction of blockchain, and put forward a new fine-grained redactable blockchain with a semi-trusted regulator, who follows our protocol but has a tendency to abuse his power. To the best of our knowledge, it is the first blockchain that not only supports the supervision of blockchain content, but also allows users themselves to manage their own data. To this end, we introduce a new variant of chameleon-hash function, named stateful Chameleon Hash with Revocable Subkey, which is important for building our redactable blockchain and may be of independent interest. We also propose a black-box construction from standard chameleon-hash functions, and prove its security properties under our proposed security notions. At last, we provide a proof-of-concept implementation. The evaluation results demonstrate that our redactable blockchain is practical and can be adopted with small additional overhead compared to the immutable blockchain.

Abstract In ASIACRYPT 2014, Jean et al. proposed the authentication encryption scheme Deoxys, which is one of the third-round candidates in CAESAR competition. Its internal block cipher is called Deoxys-BC that adopts the tweakey frame. Deoxys-BC has two versions of the tweakey size that are 256 bits and 384 bits, denoted by Deoxys-BC-256 and Deoxys-BC-384, respectively. In this paper, we revaluate the security of Deoxys-BC-256 against the meet-in-the-middle attack to obtain some new results. First, we append one round at the top and two rounds at the bottom of a 6-round distinguisher to form a 9-round truncated differential path with the probability of $2^{-144}$. Based on it, the adversary can attack 9-round Deoxys-BC-256 with $2^{108}$ chosen plaintext-tweaks, $2^{113.6}$ encryptions and $2^{102}$ blocks. Second, we construct a new 6.5-round distinguisher to form 10-round attacking path with the probability of $2^{-152}$. On the basis of it, the adversary could attack 10-round Deoxys-BC-256 with $2^{115}$ chosen plaintext-tweaks, $2^{171}$ encryptions and $2^{152}$ blocks. These two attacks improve the previous cryptanalytic results on reduced-round Deoxys-BC-256 against the meet-in-the-middle attack.

Abstract Kiasu-BC and Joltik-BC are internal tweakable block ciphers of authenticated encryption algorithms Kiasu and Joltik submitted to the CAESAR competition. Kiasu-BC is a 128-bit block cipher, of which tweak and key sizes are 64 and 128 bits, respectively. Joltik-BC-128 is a 64-bit lightweight block cipher supporting 128 bits tweakey. Its designers recommended the key and tweak sizes are both 64 bits. In this paper, we propose improved meet-in-the-middle attacks on 8-round Kiasu-BC, 9-round and 10-round Joltik-BC-128 by exploiting properties of their structures and using precomputation tables and the differential enumeration. For Kiasu-BC, we build a 5-round distinguisher to attack 8-round Kiasu-BC with $2^{109}$ plaintext–tweaks, $2^{112.8}$ encrytions and $2^{92.91}$ blocks. Compared with previously best known cryptanalytic results on 8-round Kiasu-BC under chosen plaintext attacks, the data and time complexities are reduced by $2^{7}$ and $2^{3.2}$ times, respectively. For the recommended version of Joltik-BC-128, we construct a 6-round distinguisher to attack 9-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{56.6}$ encryptions and $2^{52.91}$ blocks, respectively. Compared with previously best known results, the data and time complexities are reduced by $2^7$ and $2^{5.1}$ times, respectively. In addition, we present a 6.5-round distinguisher to attack 10-round Joltik-BC-128 with $2^{53}$ plaintext–tweaks, $2^{101.4}$ encryptions and $2^{76.91}$ blocks.

With the enlargement of wireless technology, Internet of Things (IoT) is emerging as a promising approach to realize smart cities and address lots of serious problems such as safety, convenience and efficiency. In order to avoid any possible rancorous attacks, employing lightweight cryptosystems is most effective to implement encryption/decryption, message authentication and digital signature for security of the IoT. LED is such a lightweight cipher with two flexible keysize variants in the IoT. Since its designing, a multitude of fault analysis techniques in chosen plaintext attacks focus on provoking faults on LED to derive the 64-bit and 128-bit secret keys. It is vital to investigate whether injecting faults allows breaking LED while the attackers have the weakest ciphertext-only attacking ability. This study presents ciphertext-only fault analysis with six different distinguishers on LED. The simulating experiments show that our analysis can recover its 64-bit and 128-bit secret keys with over 99 percent probability using the SEI, GF, GF-SEI, ML, HW and MAP distinguishers. The attack can not only improve the attacking efficiency, but also decrease the number of faults. The fault locations can be injected into the deeper round. It provides vital reference for security analysis of other lightweight ciphers in the IoT.

TWINE is a lightweight block cipher, which was proposed by NEC corporation in 2012. It is both a good example of common trade-offs in lightweight cryptography and one of the only instances of a GFN with improved diffusion layer. Therefore, its security has attracted amount of attention in recent years. In this paper, we present a meet-in-the-middle attack on 26-round TWINE-128 by exploiting the slow diffusion of key schedule. Specifically, we first construct a new 11-round distinguisher of TWINE. Based on it, we mount a meet-in-the-middle attack on 26-round TWINE-128. The data, time and memory complexities are 260 chosen plaintexts, 2126.18 26-round encryptions and 2109 64-bit blocks, respectively. Our results are better than all previous ones on TWINE-128 in the single-key scenario if not considering biclique cryptanalysis of TWINE-128.

Camellia is one of the widely used block ciphers, which has been included in the NESSIE block cipher portfolio and selected as a standard by ISO/IEC. In this study, the authors observe that there exist some interesting properties of the FL / FL −1 functions in Camellia. With this observation they derive some weak keys for the cipher, based on which they present the first known 8‐round zero‐correlation linear distinguisher of Camellia with FL / FL −1 layers. This result shows that the FL / FL −1 layers inserted in Camellia cannot resist zero‐correlation linear cryptanalysis effectively for some weak keys since the currently best zero‐correlation linear distinguisher for Camellia without FL / FL −1 layers also covers eight rounds. Moreover, by using the novel distinguisher, they launch key recovery attacks on 13‐round Camellia‐192 and 14‐round Camellia‐256. To their knowledge, these results are the best for Camellia‐192 and Camellia‐256 with FL / FL −1 and whitening layers.

As an ISO/IEC international standard, Camellia has been used in various cryptographic applications. In this study, the authors present the best currently known attacks on Camellia‐192/256 with key‐dependent layers FL / FL −1 (without the whitening layers) by taking advantage of the intrinsic weakness of keyed functions, the redundancy of key schedule and the early abort technique. Specifically, the authors mount the first impossible differential attack on 13‐round Camellia‐192 with 2 124.79 chosen plaintexts, 2 186.09 13‐round encryptions and 2 129.79 bytes, while the analysis for the biggest number of rounds in previous results on Camellia‐192 worked on 12 rounds. Furthermore, the authors successfully attack on 14‐round Camellia‐256 with 2 122.14 chosen plaintexts, 2 228.33 14‐round encryptions and 2 134.14 bytes. Compared with the previously best known attack on 14‐round Camellia‐256, the time and memory complexities are reduced by 2 9.87 times and 2 46.06 times, and the data complexity is comparable.

With the advancement and deployment of leading-edge telecommunication technologies for sensing and collecting traffic related information, the vehicular ad-hoc networks (VANETs) have emerged as a new application scenario that is envisioned to revolutionize the human driving experiences and traffic flow control systems. To avoid any possible malicious attack and resource abuse, employing lightweight cryptosystems is widely recognized as one of the most effective approaches for the VANETs to achieve confidentiality, integrity and authentication. As a typical substitution-permutation network lightweight cryptosystem, LED supports 64-bit and 128-bit secret keys, which are flexible to provide security for the RFID and other highly-constrained devices in the VANETs. Since its introduction, some research of fault analysis has been devoted to attacking the last three rounds of LED. It is an open problem to know whether provoking faults at a former round of LED allows recovering the secret key. In this paper, we give an answer to this problem by showing a novel impossible differential fault analysis on one round earlier of all LED keysize variants. Mathematical analysis and simulating experiments show that the attack could recover the 64-bit and 128-bit secret keys of LED by introducing 48 faults and 96 faults in average, respectively. The result in this study describes that LED is vulnerable to a half byte impossible differential fault analysis. It will be beneficial to the analysis of the same type of other iterated lightweight cryptosystems in the VANETs.

In this study, the authors present the first related‐key rectangle cryptanalysis of Rijndael‐160/160 and Rijndael‐192/192. The author's attack on Rijndael‐160/160 covers eight rounds. The attack complexities are 2 126.5 chosen plaintexts, 2 129.28 8‐round Rijndael‐160/160 encryptions and 2 132.82 bytes. Their attack on Rijndael‐192/192 covers ten rounds. It requires 2 179 chosen plaintexts, 2 181.09 10‐round Rijndael‐192/192 encryptions and 2 185.59 bytes memory. These are the currently best cryptanalytic results on Rijndael‐160/160 and Rijndael‐192/192 in terms of the number of attacked rounds. Furthermore, their results show that the slow diffusion in the key schedule of Rijndael makes it a target for this type of analysis.

© 2014 John Wiley & Sons, Ltd. Meet-in-the-Middle (MitM) fault analysis is a kind of powerful cryptanalytic approach suitable for various block ciphers. When applying the method to analyze the security of block ciphers, it is very crucial to find effective MitM characteristics based on some fault models. In this paper, we investigate the security of word-oriented substitution-permutation network (SPN) block ciphers by means of MitM fault analysis and observe that if the diffusion layers of the ciphers have some special properties, it is easy to derive effective MitM characteristics under the condition of single-word fault model, which can lead to efficient fault attacks on the ciphers. In order to demonstrate the effectiveness of our observation, we apply it to ARIA and AES and obtain some effective MitM characteristics, respectively; then, we present efficient MitM fault attacks on the ciphers in terms of these characteristics. It is expected that our work could be helpful in evaluating the security of word-oriented SPN block ciphers against fault attack. We also hope that this work could be beneficial to the design strategy of diffusion layers of block ciphers.

In CHES 2006, M. Amir et al. introduced a generalized method of differential fault attack (DFA) against AES-128. Their fault models cover all locations before the 9th round in AES-128. However, their method cannot be applied to AES with other key sizes, such as AES-192 and AES-256. On the differential analysis, we propose a new method to extend DFA on AES with all key sizes. Our results in this study will also be beneficial to the analysis of the same type of other iterated block ciphers.