Abstract In lightweight block cipher designs, involutory components are often employed to minimize circuit area. However, these components can also introduce security vulnerabilities. Loong is a family of lightweight block ciphers based on the Substitution-Permutation Network (SPN) structure. Each round of Loong incorporates two involutory MDS matrices and two involutory S-boxes, resulting in a fully involutory round function. While these operations provide high diffusion and a substantial algebraic degree, the involutory nature of the design makes Loong vulnerable to weak-key attacks. In this paper, we present several notable observations regarding the round function of Loong. By exploiting the unique properties of its involutory round function, we identify weak-key differential characteristics for all three full-round variants of Loong. Specifically, the probabilities of weak-key differential characteristics for Loong-64, Loong-80, and Loong-128 are $$2^{-26.83}$$ 2 - 26.83 , $$2^{-37.42}$$ 2 - 37.42 and $$2^{-46.66}$$ 2 - 46.66 , respectively. The corresponding weak-key spaces are of sizes $$2^{36}$$ 2 36 , $$2^{52}$$ 2 52 and $$2^{96}$$ 2 96 . These findings effectively compromise the security of Loong. Furthermore, we conducted experiments on a personal computer and identified practical differential characteristics for Loong-64. Additionally, we analyze the security of block ciphers with involutory round functions in general. Our findings indicate that such designs are more prone to weak-key attacks and are even more vulnerable to general differential cryptanalysis. While the use of involutory round functions reduces circuit area and improves cipher efficiency, it also introduces significant security weaknesses.

Abstract Ascon, a family of algorithms that supports hashing and authenticated encryption, is the winner of the NIST Lightweight Cryptography Project. In this paper, we propose an improved preimage attack against 2-round Ascon-XOF-64 with a complexity of $$2^{33}$$ 2 33 via a more effective guessing strategy. Furthermore, we successfully extend our preimage attack on 2-round Ascon-XOF-64 to 2-round Ascon-XOF-128, achieving a complexity of $$2^{97}$$ 2 97 , which is currently the best preimage attack against 2-round Ascon-XOF-128. Apart from the preimage attack, we also investigate the resistance of Ascon-HASH against collision attacks. To be specific, we introduce the linearization of the inverse of S-boxes and then propose a free-start collision attack on 3-round Ascon-HASH with a complexity of $$2^{14}$$ 2 14 using a differential trail searched dedicatedly. In addition, we construct different 2-round connectors using the linearization of the inverse of S-boxes and successfully extend the collision attack to 4 rounds and 5 rounds of Ascon-HASH with complexities of $$2^{18}$$ 2 18 and $$2^{41}$$ 2 41 , respectively. Although our attacks do not compromise the security of the full 12-round Ascon-XOF and Ascon-HASH, they provide some insights into Ascon’s security.

Abstract The Generalized Feistel Structure ( $$\texttt{GFS}$$ GFS ) is one of the most widely used frameworks in symmetric cipher design. In FES 2010, Suzaki and Minematsu strengthened the cryptanalysis security of $$\texttt{GFS}$$ GFS by searching for shuffles with the best diffusion property. In ASIACRYPT 2018, Shi et al. suggested a set of shuffles, which makes $$\texttt{GFS}$$ GFS a better resistance against Demirci–Selcuk meet-in-the-middle cryptanalysis. Since these shuffles are different from the currently known good ones and also different from the shuffles used in $$\texttt{TWINE}$$ TWINE and $$\texttt{LBlock}$$ LBlock , our research focuses on a more comprehensive evaluation of $$\texttt{GFS}$$ GFS with different shuffles, including diffusion property of shuffle, differential, linear, impossible differential, zero-correlation linear, integral and Demirci–Selcuk meet-in-the-middle cryptanalysis, to find the best one. Such evaluations entail significant time consumption. Thus, we utilize Mixed Integral Linear Programming models and introduce an evaluate-and-filter strategy to achieve it efficiently. Our results verify that the shuffles discovered by Suzaki and Minematsu and those used in $$\texttt{TWINE}$$ TWINE and $$\texttt{LBlock}$$ LBlock are the best so far. We also find that the cryptanalysis resistances of $$\texttt{GFS}$$ GFS are not necessarily consistent. It is this finding that makes the necessity of our more comprehensive evaluation self-evident.

Abstract This paper proposes a new method to find high-probability truncated differentials using matrix muliplication. For Markov cipher with similar round function, suppose that the transition probability matrix of round function is $\mathcal{D}$, then $\mathcal{D}^{r}$ contains all the differential probabilities of an $r$-round block cipher. To reduce the matrix dimension, we consider the word-oriented truncated differential and the truncated transition probability matrix $\mathcal{T}$. Regardless of the effect of the $S$-box, we focus on whether there is a non-zero difference on one cell instead of the value of the difference. In this case, the matrix dimension reduces significantly and we can calculate $\mathcal{T}^{r}$ using a workstation. Then all the $r$-round truncated differential probabilities can be found from $\mathcal{T}^{r}$. And the probability in $\mathcal{T}^{r}$ is the probability of the whole truncated differential hull but not a single or several truncated differential characteristics. Besides, we make a more accurate probability estimation of the truncated differential of lightweight block cipher. Combined with the truncated differential hull, we found some longer truncated differential distinguishers. And as $\mathcal{T}^{r}$ stores all the truncated differential probabilities, we can also find all the impossible truncated differentials.

While impossible differential attack is one of the most well-known and familiar techniques for symmetric-key cryptanalysts, its subtlety and complicacy make the construction and verification of such attacks difficult and error-prone. We introduce a new set of notations for impossible differential analysis. These notations lead to unified formulas for estimation of data complexities of ordinary impossible differential attacks and attacks employing multiple impossible differentials. We also identify an interesting point from the new formulas: in most cases, the data complexity is only related to the form of the underlying distinguisher and has nothing to do with how the differences at the beginning and the end of the distinguisher propagate in the outer rounds. We check the formulas with some examples, and the results are all matching. Since the estimation of the time complexity is flawed in some situations, in this work, we show under which condition the formula is valid and give a simple time complexity estimation for impossible differential attack which is always achievable.