Recently, the cryptography community has witnessed growing interest in a novel attack called Differential Neural Cryptanalysis, which combines deep learning with differential cryptanalysis. This approach has demonstrated superior performance compared to classical techniques for certain ciphers. However, the differential-based neural distinguisher, as its core component, is highly specialized and presents challenges in adapting to other ciphers. The two major challenges limit its broader applicability: the lack of efficient methods for identifying high-quality input differences, which are critical for constructing datasets to train differential-based neural distinguishers; and the dependence on customized neural network structures tailored to specific ciphers. In this paper, we address the first challenge by introducing a new evaluation metric, the Differential Distribution Cluster (DDC) degree, inspired by information entropy. This metric provides a reliable measure for evaluating input differences and enables the construction of optimal datasets. Using the DDC degree, our proposed two-stage evaluation algorithm achieves significant time efficiency, evaluating each input difference in approximately 1.028 seconds. We apply the algorithm to several Feistel, SPN, and ARX-type block ciphers, successfully identifying their optimal input differences. Notably, we provide the first differential-based neural distinguishers for 7-round GIFT-64, 8-round GIFT-128, and 11-round SPECK128/256, and improve the state-of-the-art for LBLOCK, HIGHT, and SPECK64/128.

As the winner of the NIST lightweight cryptography project, Ascon has undergone extensive self‐evaluation and third‐party cryptanalysis. In this paper, we use constraint programming (CP) as a tool to analyze the Ascon permutation and propose several differential‐based distinguishers. We first propose a search methodology for finding truncated differentials for Ascon with CP, the core of which is modeling with the undisturbed bits of the S‐box. By using this method, we find the five‐ and six‐round truncated differentials with a probability of 2 −44 and 2 −162 , respectively. Considering the application of permutation in the context, we also provide the five‐ and six‐round truncated differential distinguishers under the weak‐key setting. Then, inspired by our five‐round truncated differentials, we propose a six‐round boomerang characteristic, and based on this, we obtain the five‐ and six‐round sandwich distinguishers with a complexity of 2 70 and 2 134 , respectively. Using the CP tool again and specifying that the “3‐3” differential pattern is satisfied in the middle rounds, we propose a six‐round differential characteristic with a probability of 2 −280 , which increases the probability by 2 25 compared to the best known six‐round differential characteristic.

With the rapid advancement of the Internet of Things (IoT), many innovative lightweight block ciphers have been introduced to meet the stringent security demands of IoT devices. Among these, the Shadow cipher stands out for its compactness, making it particularly well-suited for deployment in resource-constrained IoT nodes (IEEE Internet of Things Journal, 2021). This paper demonstrates two real-time attacks on Shadow for the first time: real-time plaintext recovery and key recovery. Firstly, numerous properties of Shadow are discussed, illustrating an equivalent representation of the two-round Shadow and the relationship between the round keys. Secondly, we introduce multiple two-round iterative linear approximations. Employing these approximations enables the derivation of full-round linear distinguishers. Moreover, we have uncovered numerous linear relationships between plaintext and ciphertext. Real-time plaintext recovery is achievable based on these established relationships. On average, it takes 5 seconds to recover the plaintext for a fixed ciphertext of Shadow-32. Thirdly, many properties of the propagation of difference through SIMON-like function are illustrated. According to these properties, various differential distinguishers up to full rounds are presented, allowing real-time key recovery. Specifically, the 64-bit master key of Shadow-32 can be retrieved in around two days on average. Experiments verify all our results.