In recent years, the integration of deep learning with differential cryptanalysis has led to differential neural cryptanalysis, enabling efficient data-driven security evaluation of modern cryptographic algorithms. Compared to traditional cryptanalysis, differential neural cryptanalysis enhances the efficiency and automation of the analysis by training neural networks to automatically extract statistical features from ciphertext pairs. As research advances, neural distinguisher construction faces challenges due to the absence of a unified framework capable of cross-algorithm generalization and feature optimization. There is no systematic way to build a framework from adapted data formats and network architectures, which limits their scalability across diverse ciphers and their suitability for combining different cryptanalysis methods. Besides, neural network training is data-driven, there is an urgent need to combine cryptographic theory with data analysis methods to systematically evaluate the quality of differentially generated datasets. To address these gaps, this paper proposes a novel framework for constructing related-key neural differential distinguishers that integrates three core innovations: (1) multi-ciphertext multi-difference formats to enhance dataset diversity and feature coverage, (2) structural filtering for prioritizing high-probability differential paths aligned with cryptographic architectures, and (3) Deep Residual Shrinkage Network (DRSN) with adaptive thresholding to suppress noise and amplify critical differential features. By applying this framework to two standardized algorithms DES and PRESENT, our results demonstrate data-driven breakthroughs in standard ciphers. For DES, the framework achieves an 8-round related-key neural distinguisher and improves 6/7-round distinguisher accuracy by over 40%. For PRESENT, we construct the first 9-round related-key neural distinguisher, which outperforms existing neural distinguishers in both round coverage and accuracy. Additionally, we systematically analyze dataset quality using kernel principal component analysis (KPCA) and K-means clustering, revealing a strong correlation between clustering compactness and distinguisher performance. Furthermore, we propose a validation algorithm to verify differential combinations with cryptographic advantages from a machine learning perspective, identifying ‘good’ plaintext-key differential combinations. We apply this approach to the SIMECK algorithm, demonstrating its broad applicability.

Encrypted traffic classification is crucial for critical network management tasks such as traffic type identification, resource allocation, and risk mitigation, especially given that encrypted traffic has become the dominant form of modern network communication. However, existing classification methods are typically confined to single-level feature extraction, failing to capture the multi-granularity information inherent in traffic and thus limiting their ability to characterize complex encrypted traffic patterns. To address this issue, this paper proposes BPF-GNN, a hierarchical graph feature extraction model for encrypted traffic classification. The model enables multi-granularity feature learning by constructing a three-tier graph structure (Byte-, Packet-, and Flow-level). It sequentially extracts discriminative information inherent in each granularity level and accumulates multi-dimensional traffic characteristics, significantly improving the classification accuracy of encrypted traffic. Experiments on the ISCX-VPN2016, ISCX-Tor2016, USTC-TFC2016, and MIRAGE-2024 datasets demonstrate that BPF-GNN outperforms existing methods, validating the effectiveness and superiority of the proposed hierarchical multi-granularity feature extraction approach.

Abstract In CRYPTO 2019, Gohr built a bridge between machine learning and differential cryptanalysis, which show that machine learning-aided methods have advantages over classical differential cryptanalysis. Yet, for linear cryptanalysis, there is lack of effective works showing that machine learning-aided cryptanalysis can reach the benchmark of traditional counterparts and also lack of an effective universal framework using machine learning to assist linear cryptanalysis. In this paper, we mainly focus on machine learning-aided linear cryptanalysis and application to Des. First, we propose a machine learning-aided model to distinguish different Bernoulli distributions and demonstrate the validity of the model through experiments and theoretical analysis. Based on the model, we propose a new machine learning-aided linear cryptanalysis framework, which can be applied to one bit and multiple bits key-recovery attacks. As applications, we perform one bit attacks on 3-, 4-, 5-, 6-round Des and multiple bits attack on 8-round Des. Compared with the previous works about machine learning-aided linear cryptanalysis, the results improve the success rate and the complexity. Most importantly, more rounds are covered in our work. Besides, the work indicates that machine learning-aided cryptanalysis can achieve the same or marginally better performance than classical methods.

Most of the existing methods for traffic sign recognition exploited deep learning technology such as convolutional neural networks (CNNs) to achieve a breakthrough in detection accuracy; however, due to the large number of CNN’s parameters, there are problems in practical applications such as high power consumption, large calculation, and slow speed. Compared with CNN, a spiking neural network (SNN) can effectively simulate the information processing mechanism of biological brain, with stronger parallel processing capability, better sparsity, and real-time performance. Thus, we design and realize a novel traffic sign recognition system [called SNN on FPGA-traffic sign recognition system (SFPGA-TSRS)] based on spiking CNN (SCNN) and FPGA platform. Specifically, to improve the recognition accuracy, a traffic sign recognition model spatial attention SCNN (SA-SCNN) is proposed by combining LIF/IF neurons based SCNN with SA mechanism; and to accelerate the model inference, a neuron module is implemented with high performance, and an input coding module is designed as the input layer of the recognition model. The experiments show that compared with existing systems, the proposed SFPGA-TSRS can efficiently support the deployment of SCNN models, with a higher recognition accuracy of 99.22%, a faster frame rate of 66.38 frames per second (FPS), and lower power consumption of 1.423 W on the GTSRB dataset.

At the Annual International Cryptology Conference in 2019, Gohr introduced a deep learning based cryptanalysis technique applicable to the reduced-round lightweight block ciphers with a short block of SPECK32/64. One significant challenge left unstudied by Gohr’s work is the implementation of key recovery attacks on large-state block ciphers based on deep learning. The purpose of this paper is to present an improved deep learning based framework for recovering keys for large-state block ciphers. First, we propose a key bit sensitivity test (KBST) based on deep learning to divide the key space objectively. Second, we propose a new method for constructing neural distinguisher combinations to improve a deep learning based key recovery framework for large-state block ciphers and demonstrate its rationality and effectiveness from the perspective of cryptanalysis. Under the improved key recovery framework, we train an efficient neural distinguisher combination for each large-state member of SIMON and SPECK and finally carry out a practical key recovery attack on the large-state members of SIMON and SPECK. Furthermore, we propose that the 13-round SIMON64 attack is the most effective approach for practical key recovery to date. Noteworthly, this is the first attempt to propose deep learning based practical key recovery attacks on 18-round SIMON128, 19-round SIMON128, 14-round SIMON96, and 14-round SIMON64. Additionally, we enhance the outcomes of the practical key recovery attack on SPECK large-state members, which amplifies the success rate of the key recovery attack in comparison to existing results.

Abstract At CRYPTO’19, Gohr built a bridge between deep learning and cryptanalysis. Based on deep neural networks, he trained neural distinguishers of SPECK32/64. Besides, with the help of neural distinguishers, he attacked 11-round SPECK32/64 using Bayesian optimization. Compared with the traditional attack, its complexity was reduced. Although his work opened a new direction of machine learning aided cryptanalysis, there are still two research gaps that researchers are eager to fill in. (i) Can the attack using neural distinguishers be used to other block ciphers? (ii) Are there effective key recovery attacks on large-size block ciphers adopting neural distinguishers? In this paper, our core target is to propose an effective neural-aided key recovery policy to attack large-size block ciphers. For large-size block ciphers, it costs too much time in pre-computation, especially in wrong key response profile, which is the main reason why there are almost no neural aided attacks on large-size block ciphers. Fortunately, we find that there is a fatal flaw in the wrong key profile. In the some experiments of SIMON32/64 and SIMON48/96, there is a regular of change in response profiles, which implies that we can use partial response instead of the complete response. Based on this, we propose a generic key recovery attack scheme which can attack large-size block ciphers. As an application, we perform a key recovery attack on 13-round SIMON64/128, which is the first practical attack using neural distinguishers to large-size ciphers. In addition, we also attack 13-round SIMON32/64 and SIMON48/96, which also shows that the neural distinguishers can be used to other block ciphers.

Abstract In CRYPTO 2019, Gohr opens up a new direction for cryptanalysis. He successfully applied deep learning to differential cryptanalysis against the NSA block cipher SPECK32/64, achieving higher accuracy than traditional differential distinguishers. Until now, one of the mainstream research directions is increasing the training sample size and utilizing different neural networks to improve the accuracy of neural distinguishers. This conversion mindset may lead to a huge number of parameters, heavy computing load, and a large number of memory in the distinguishers training process. However, in the practical application of cryptanalysis, the applicability of the attacks method in a resource-constrained environment is very important. Therefore, we focus on the cost optimization and aim to reduce network parameters for differential neural cryptanalysis.In this paper, we propose two cost-optimized neural distinguisher improvement methods from the aspect of data format and network structure, respectively. Firstly, we obtain a partial output difference neural distinguisher using only 4-bits training data format which is constructed with a new advantage bits search algorithm based on two key improvement conditions. In addition, we perform an interpretability analysis of the new neural distinguishers whose results are mainly reflected in the relationship between the neural distinguishers, truncated differential, and advantage bits. Secondly, we replace the traditional convolution with the depthwise separable convolution to reduce the training cost without affecting the accuracy as much as possible. Overall, the number of training parameters can be reduced by less than 50% by using our new network structure for training neural distinguishers. Finally, we apply the network structure to the partial output difference neural distinguishers. The combinatorial approach have led to a further reduction in the number of parameters (approximately 30% of Gohr’s distinguishers for SPECK).

Abstract KATAN ciphers are block ciphers using non‐linear feedback shift registers. In this study, the authors improve the results of conditional differential analysis on KATAN by using deep learning. Multi‐differential neural distinguishers are built to improve the accuracy of the neural distinguishers and increase the number of its rounds. Moreover, a conditional differential analysis framework is proposed based on deep learning with the multi‐differential neural distinguishers, resulting in a significant improvement than the previous. We present a practical key recovery attack on the 97‐round KATAN32 with 2 15.5 data complexity and 2 20.5 time complexity. The attack of the 82‐round KATAN48 and 70‐round KATAN64 are also presented as the best known practical results.

Abstract CRAFT is a lightweight block cipher designed by Beierle et al. to effectively resist differential fault attacks at fast software encryption 2019. In this article, Demirci‐Selçuk meet‐in‐the‐middle (DS‐MITM) attacks on round‐reduced CRAFT based on automatic search are proposed. A DS‐MITM automatic search model for CRAFT was constructed, and then, the automatic search model was used to detect a 9‐round DS‐MITM distinguisher. The strong relations between the round‐subtweakeys were observed and the key‐dependent sieve technique was adopted to reduce the memory complexity of the attack. Based on the 9‐round distinguisher, a 19‐round DS‐MITM attack can be presented. Due to the strong key relations, the time complexity can be reduced by the key‐bridging technique and the equivalent round‐subtweakey. The time complexity of the 19‐round DS‐MITM attack is 2 114.68 19‐round CRAFT encryption, the data complexity is 2 56 chosen plaintexts, and the memory complexity is 2 109 64‐bit blocks. Adding one round to the end of the 19‐round DS‐MITM attack, a 20‐round DS‐MITM attack can be proposed. The time complexity of the 20‐round attack is 2 126.94 20‐round CRAFT encryption, the data complexity is 2 56 chosen plaintexts, and the memory complexity is 2 109 64‐bit blocks.

Abstract Deoxys-BC is an internal tweakable block cipher of the authenticated encryption algorithm Deoxys, which is a third-round finalist in the CAESAR competition. In this paper, we study the property of Deoxys-BC, such as the subtweakey difference cancelation and the freedom of the tweak. Combining the differential enumeration technique with these properties, the authors achieve the key-recovery attacks on Deoxys-BC under the meet-in-the-middle attack. As a result, we get an attack on 9-round Deoxys-BC-128-128 by constructing a 6-round meet-in-the-middle distinguisher with $2^{113}$ plaintext–tweak combinations, $2^{97}$ Deoxys-BC blocks and $2^{121.6}$ 9-round Deoxys-BC-128-128 encryptions. We also present an attack on 11-round Deoxys-BC-256-128 for the first time by constructing a 7-round meet-in-the-middle distinguisher with $2^{113}$ plaintext-tweak combinations, $2^{226}$ Deoxys-BC blocks and $2^{251}$ 11-round Deoxys-BC-256-128 encryptions.

Abstract Joltik‐BC is an internal tweakable block cipher of the authenticated encryption algorithm Joltik, which was a second‐round finalist in the CAESAR competition. The authors study the key‐recovery attacks on Joltik‐BC under meet‐in‐the‐middle attack. Utilising the subtweakey difference cancellation, the freedom of the tweak and the differential enumeration, they attack on nine‐round Joltik‐BC‐64‐64 by constructing a precise six‐round meet‐in‐the‐middle distinguisher with 2 53 plaintext–tweak combinations, 2 52.91 Joltik‐BC blocks and 2 54.1 nine‐round Joltik‐BC‐64‐64 encryptions. Moreover, they attempt to attack on 11‐round Joltik‐BC‐128‐64 for the first time by constructing a seven‐round meet‐in‐the‐middle distinguisher with 2 53 plaintext–tweak combinations, 2 114 Joltik‐BC blocks and 2 123 11‐round Joltik‐BC‐128‐64 encryptions.

SAFER is a family of block ciphers, which is comprised of SAFER K, SAFER SK, SAFER+ and SAFER++. SAFER SK was proposed to strengthen the key schedule of SAFER K. SAFER+ was designed as an AES candidate and SAFER++ was among the cryptographic primitives selected for the second phase of the NESSIE project. This paper presented the first zero-correlation linear cryptanalytic attack against the SAFER block cipher family. We investigated the linear properties of PHT employed as the linear layer of the SAFER block ciphers, and identified zero-correlation linear approximations for SAFER SK, SAFER+ and SAFER++. Moreover, we displayed several characterizations of the undisturbed bits, and found that there exists an undisturbed bit in the exponential S-box, which can be applied to reduce the computational complexity in the key recovery attacks on 5 rounds of SAFER SK/128 and 4(5) rounds of SAFER+/128(256), 5(6) rounds of SAFER++/128(256). More rounds of the SAFER block ciphers can be attacked with the linear relations of correlation zero.

The block cipher KASUMI, proposed by ETSI SAGE over 10 years ago, is widely used for security in many synchronous wireless standards nowadays. For instance, the confidentiality and integrity of 3G mobile communications systems depend on the security of KASUMI. Up to now, there is a great deal of cryptanalytic results on KASUMI. However, its security evaluation against the recent zero‐correlation linear attacks is still lacking. In this study, combining with some observations on the FL , FO and FI functions, the authors select some special input/output masks to refine the general 5‐round zero‐correlation linear approximations and propose the 6‐round zero‐correlation linear attack on KASUMI. Moreover, under the weak key conditions that the second keys of the FL function in rounds 2 and 8 have the same values at 1st–8th and 11th–16th bit‐positions, they expand the attack to 7‐round KASUMI (2–8). These weak keys take 1/2 14 of the key space. The new zero‐correlation linear attack on the 6‐round needs about 2 118 encryptions with 2 62.9 known plaintexts and 2 54 bytes memory. For the attack under weak keys conditions on the last 7 rounds, the data complexity is about 2 62.1 known plaintexts, and the time complexity is about 2 110.5 encryptions, and the memory requirement is about 2 85 bytes.

Khudra is a lightweight block cipher for field-programmable gate arrays, which appeared in SPACE 2014. In this paper, we consider the security of Khudra against the related-key attack. Firstly, we give some observations of F-function. Then we design a simple searching algorithm for related-key differential characteristics. By utilizing the observations and the searching algorithm, we launch related-key differential attacks on 16-round Khudra and full Khudra without whitening keys. Furthermore, we build a 13-round related-key rectangle distinguisher and attack on 16-round Khudra, which requires 253 chosen plaintexts and 264.08 encryptions. Moreover, with the 13-round distinguisher, there exists an attack on full Khudra without whitening keys. Then, we present a 14-round related-key impossible differential distinguisher. However, the 14-round distinguisher cannot work well, we propose a 11-round related-key impossible differential, which lead to an attack on 14-round Khudra without the pre-whitening keys. These results provide a helpful understanding of Khudra security evaluation against related-key attack. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract In an attribute‐based signature (ABS), users sign signatures based on some predicate of attributes, using keys issued by a central authority. A signature reveals nothing about the attributes of the signer beyond the fact that they satisfy the signing predicate. This paper presents an ABS scheme for the case of threshold predicates from lattices. This scheme is existentially unforgeable against selective predicate and static chosen message attacks in the standard model, with respect to the hardness of the small integer solution problem. To the best of our knowledge, this work constitutes the first ABS scheme based on lattices, which is conjectured to thwart the quantum threat. Copyright © 2014 John Wiley & Sons, Ltd.

An attribute-based ring signature scheme with constant size and constant number of pairings computation is proposed. The signer signs messages by using a subset of its attributes. All the users who possess the subset of these attributes form a ring. It requires that anyone cannot tell who generates the signature in this ring. Furthermore, anyone out of this ring could not forge the signature on behalf of the ring. It is proved to be unforgeable in the standard model and unconditionally anonymous. To the best of the authors' knowledge, such a construction is introduced for the first time.