Fully Homomorphic Encryption offers an effective solution for privacy-preserving computation, but its adoption is hindered by substantial computational and communication overheads. To address these, the Hybrid Homomorphic Encryption (HHE) protocol was developed, where the client encrypts data using a symmetric encryption scheme (SE), and the server homomorphically evaluates its decryption. Previous studies have demonstrated that the HHE protocol has no impact on the correctness of applications; however, in this work, we shift the focus to its security resilience when subjected to Differential Fault Analysis (DFA). While DFA has proven effective against standalone symmetric-key primitives, no DFA study has been proposed that exploits the HHE protocol as a whole. Furthermore, previous DFA approaches on SE rely on strong assumptions such as nonce reuse, which limits their applicability in real-world protocols or practical applications.

Automated cryptanalysis has taken center stage in the arena of cryptanalysis since the pioneering work by Mouhaet al. which showcased the power of Mixed Integer Linear Programming (MILP) in solving cryptanalysis problems that otherwise, required significant effort. Since the inception, research in this area has moved in primarily two directions. One is to model more and more classical cryptanalysis tools as optimization problems to leverage the ease provided by state-of-the-art solvers. The other direction is to improve existing models to make them more efficient and/or accurate. The current work is an attempt to contribute to the latter. In this work, a general model referred to as DEEPAND has been devised to capture the correlation between AND gates in NLFSR-based lightweight block ciphers. DEEPAND builds upon and generalizes the idea of joint propagation of differences through AND gates captured using refined MILP modeling of TinyJAMBU by Sahaet al. in FSE 2020. The proposed model has been applied to TinyJAMBU, KATAN, KTANTAN and can detect correlations that were missed by earlier models. This leads to more accurate differential bounds for both the ciphers. In particular, a 384-round (full-roundas per earlier specification) Type-IV trail is found for TinyJAMBU with 14-active AND gates using the new model, while the refined model reported this figure to be 19. This also reaffirms the decision of the designers to increase the number of rounds from 384 to 640. Moreover, the model succeeds in searching afull roundType-IV trail of TinyJAMBU keyed permutationP1024with probability 2−105(≫ 2−128). This reveals the non-random properties ofP1024thereby showing it to benon-ideal. Hence it cannot be expected to provide the same security levels as robust block ciphers. Further, the provable security of TinyJAMBU AEAD scheme should be carefully revisited. Similarly, for the variants of KATAN, several previously reported trails are improved upon by employing the DEEPAND model. Moreover, in the related-key setting, the DEEPAND model is able to make a better 140-round boomerang distinguisher (for both the data and time complexity) in comparison to the previous boomerang attack by Isobeet al. in ACISP 2013. Furthermore, for enhanced applicability, we employ the DEEPAND model on another multiple AND-based cipher, KTANTAN , in the related-key setting. Our analysis reveals practical differential distinguishers with low data and time complexities for all full-round KTANTAN variants. In summary, DEEPAND seems to capture the underlying correlation better when multiple AND gates are at play and can be adapted to other classes of ciphers as well.

The authors explore a cryptanalysis strategy which seems to be particularly applicable to parallelisable ciphers where the key forms a part of the internal state. The proposed technique combines internal differentials with guess and determine analysis to come up with what is referred to as the match‐in‐the‐end attack. The notion of difference here deviates from the classical differential where the difference is controllable via the plaintext/ciphertext. Here, they exploit the Hamming distance between parallel branches to devise the differential trail. They apply the strategy on full eight (out of 20) rounds of parallelisable authenticated cipher [parallelisable AE based on quadrupled AES ( PAEQ )] to devise key recovery attacks with practical time complexities. They first show an initial attack on paeq‐64/80/128 and then devise improvements which give us the best key‐recovery attacks with time complexities of , and , respectively. While the best reported attacks on eight‐round paeq‐64/80/128 have a data complexity of blocks, the result improves their time complexities by factors of , and , while preserving the data complexity. Finally, they present a nonce‐based differential attack which works on paeq‐128‐t with time complexity but uses just two single block known plaintexts making it the most practical attack on any round‐reduced PAEQ variant reported so far.