SNOW 2.0 is a word-oriented stream cipher that has been standardized by ISO/IEC 18033-4. At FSE 2006, Nyberg et al. proposed a linear distinguisher for SNOW 2.0 with absolute correlation 2−85:89, derived from four linear approximations of the Finite State Machine (FSM). When deriving the overall correlation, they assumed these four linear approximations to be mutually independent. However, they are in fact dependent because of a shared variable, which leads to the inaccuracy of the correlation calculation. Moreover, they impose the unnecessary restriction that all masks of the distinguisher must be identical, artificially limiting the search space and yielding inaccurate conclusions about the minimum number of active S-boxes. To resolve these contradictions, we first establish a general SNOW 2.0 linear distinguisher without any unnecessary restrictions. Secondly, we present and prove an exact formula to calculate the correlations of the general SNOW 2.0 distinguishers, thereby correcting the current best absolute correlation from 2−85:89to 2−86:14. Thirdly, we establish an Mixed Integer Linear Programming (MILP) model to search for the optimal SNOW 2.0 linear approximation trail, which will be used to derive both the optimal linear approximation trail and the minimum number of active S-boxes. The results prove that the maximum absolute correlation of the SNOW 2.0 linear approximation trail is no higher than 2−75. Consequently, if the maximum absolute correlation of the linear approximation trail is taken as the security measure, then SNOW 2.0 can guarantee the 128-bit security level against the linear distinguishing attack. Based on the MILP model, we prove that the minimum number of active S-boxes of the linear distinguisher is 12, not 14 as previously reported. Finally, we observe that the identical distinguisher masks tend to yield high absolute correlation. We therefore exhaustively enumerate this large class of distinguishers and find that the best absolute correlation remains 2−86:14. Then the time/data complexity of the linear distinguishing attack on SNOW 2.0 can be evaluated as 2172:28. Additionally, our formula reveals another distinguisher whose true correlation is 2−88:37, while the result calculated by the original formula is 2−107:23. These results demonstrate that ignoring the dependency among approximations can lead to significant underestimation of the correlation.

Abstract The security of an encryption algorithm often hinges on the indistinguishability between ciphertext and random numbers. In block ciphers, pseudorandomness and super‐pseudorandomness are commonly used to depict the indistinguishability between ciphertext and random numbers. Whereas, stream cipher algorithms can be viewed as functions of variables such as the key K, initialization vector IV, and plaintext M. For an ideal stream cipher algorithm, the ciphertext sequences for any two different plaintexts should exhibit good independence across various K‐IV pairs. Consequently, the probability of the two ciphertext sequences being equal or having sufficiently long matching segments should be negligible. This study examines a new type of attack that stems from key commitment attacks. By exploiting the independence between the ciphertext sequences, a novel distinguishing attack against the stream cipher is constructed and applied to the encryption of Rocca. Focusing on the authenticated encryption algorithm Rocca, a guess‐and‐determine method is employed to demonstrate that for any plaintext and two different sets of , another plaintext can be found with a time complexity , resulting in identical ciphertext sequences except for the initial bits. Furthermore, it is proved that under chosen plaintext conditions, the time complexity of this distinguishing attack is . These findings imply that Rocca does not offer 256‐bit security against such distinguishing attacks, providing valuable insights into the design of round update functions for stream ciphers like Rocca.

L‐Feistel structure is a new iterative block cipher structure and unifies the Feistel structure and the Lai–Massey structure while maintaining the similarity of encryption and decryption. In this study, we present the first yoyo cryptanalysis against the L‐Feistel structure to evaluate the security under structural attack and give the method to recover the secret round function. We construct the fundamental yoyo distinguisher for the three‐round L‐Feistel structure, which can be used to distinguish the L‐Feistel structure from random permutation and establish the linear equations of the secret round functions. Besides, the fundamental yoyo distinguisher can be extended to more rounds when the invertible linear transformations are given. Then the equivalent structures of the L‐Feistel structure are provided, which helps reduce the guess of the starting point of the secret round functions. Finally, the process of recovering the secret round functions for the three‐round L‐Feistel structure is presented. We believe this study will enrich the application of yoyo cryptanalysis and L‐Feistel structure.

Fast correlation attack is one of the most powerful attack methods for LFSR-based stream ciphers, and the primary problem of the attack is to construct the linear approximations with great absolute correlations. For some stream ciphers with complex structures of linear approximations, the search for the maximum absolute correlation of linear approximations has always been a difficult problem because of the extremely high amount of masks that need to be searched. In this paper, an analysis method for searching maximum absolute correlation based on the linear mask structure is developed, including the filtering technology based on mask propagation trail, a structural characteristic of linear approximations of linear transformations with fewer active bytes, and linear approximation equivalence theorem of composite function composed of the parallel identical S-boxes and linear transformation. These methods efficiently reduce the exhaustive time complexity of the masks. As applications, this paper proves that the suprema of absolute correlations of all the linear approximations for the five XOR-versions of SNOW family stream ciphers (i.e., SNOW 2.0⊕, SNOW 3G⊕, SNOW-V⊕, SNOWVi⊕, SNOW 5G⊕) are 2−9/2−15:893/2−37:964/2−37:964/2−37:964. The exhaustive time complexity of the masks can be reduced fromO(232)/O(296)/O(2384)/O(2384)/O(2384) toO(224)/O(231.98)/O(239.98)/O(239.98)/O(239.98), respectively. Furthermore, we give the provable security evaluations of the five ciphers against fast correlation attacks under the success probability of 0:99 for the known fast correlation attack method. For SNOW-V⊕/SNOW-Vi⊕/SNOW 5G⊕, the time/data/memory complexity of the optimal fast correlation attacks are allO(2227.54)/O(2227.72)/O(2227.72). The results show that SNOWV⊕/SNOW-Vi⊕/SNOW 5G⊕cannot guarantee the claimed 256- bit key security for the known fast correlation attack methods if we ignore the design constraint that the maximum length of keystream for a single pair of key and IV is 264. For SNOW 2.0⊕and SNOW 3G⊕, the time/data/memory complexity of the optimal fast correlation attacks areO(2151.94)/O(2151.35)/O(2151.35) andO(2165.91)/O(2165.43)/O(2165.43), respectively. The results show that both SNOW 2.0⊕and SNOW 3G⊕can guarantee the claimed 128-bit key security for the known fast correlation attack methods. In addition, this paper also discusses that the existing fast correlation attacks based on multiple linear approximations are invalid for these five ciphers.

Convergent encryption is an effective technique to achieve cross-user deduplication of encrypted data in cloud storage. However, it is vulnerable to brute-force attacks for data with low min-entropy. Moreover, once the content of the target data is successfully constructed through the aforementioned attacks, the corresponding index can also be obtained, leading to the risk of violating privacy during the process of data downloading. To address these challenges, we propose a key transferring-based secure deduplication (KTSD) scheme for cloud storage with support for ownership verification, which significantly improves the security against brute-force attacks during the ciphertext deduplication and downloading. Specifically, we introduce a randomly generated key in data encryption and downloading index generation to prevent the results from being inferred. And define a deduplication request index and a key request index by using the bloom filter to achieve brute-force attack resistant key transferring. An RSA-based ownership verification scheme is designed for the downloading process to effectively prevent privacy leakage. Finally, we prove the security of our schemes by security analysis and perform the performance evaluation experiments, the results of which show that compared to the state-of-the art, the cloud storage overhead can be reduced by 6.01% to 20.49% under KTSD.

The exclusive‐or (XOR) hash combiner is a classical hash function combiner, which is well known as a good PRF and MAC combiner, and is used in practice in TLS versions 1.0 and 1.1. In this work, we analyze the second preimage resistance of the XOR combiner underlying two different narrow‐pipe hash functions with weak ideal compression functions. To control simultaneously the behavior of the two different hash functions, we develop a new structure called multicollision‐and‐double‐diamond. Multicollision‐and‐double‐diamond structure is constructed using the idea of meet‐in‐the‐middle technique, combined with Joux’s multicollision and Chen’s inverse‐diamond structure. Then based on the multicollision‐and‐double‐diamond structure, we present a second preimage attack on the XOR hash combiner with the time complexity of about O ((2 n + 1)2 n /2 + ( n − l )2 n − l + ( n − k )2 n − k + 2 l +1 + 2 k +1 ) ( n is the size of the XOR hash combiner and l and k are respectively the depths of the two inverse‐diamond structures), less than the ideal time complexity O (2 n ), and memory of about O (2 k + 2 l ).

Given a differential characteristic and an existing plaintext pair that satisfies it (referred to as a right pair), generating additional right pairs at a reduced cost is an appealing prospect. The neutral bit technique, referred to as neutral differences throughout this paper, provides a solution to this challenge. Traditionally, the search for neutral differences has heavily depended on experimental testing, leading to limitations in the search range. In this work, we propose the neutral difference table and establish a link between boomerang cryptanalysis and neutral differences. Furthermore, we propose an automated search for neutral differences to address the problem of a limited search range of neutral differences, as previous approaches relied on experimental testing. This approach provides a basis for the subspace spanned by the neutral differences, and we apply this technique to both SPECK32 and LEA, where the predicted results closely match the experimental ones. Consequently, we present the improved differential‐linear distinguishers for SPECK32 and LEA, along with the 18‐round attacks on LEA192 and LEA256 with the lowest time complexity up to date.

This paper considers a new cryptanalysis called differential invariant subspace cryptanalysis, which can be used to evaluate the security of IoT-friendly word-based block ciphers. This cryptanalysis estimates the behavior of differential propagation for particularly chosen input differences, and applies to the ciphers contain only the word-based components, e.g., word-based S-boxes, word-based linear mappings, etc. Firstly, this paper proves that, for any word-based block cipher, if the S-box causes the differential invariant subspace property, it then indicates a full-round distinguisher with probability 1, even if the target cipher is believed to be resistant enough against traditional differential or linear cryptanalysis. Secondly, a class of linear-equivalent S-boxes meeting the differential invariant subspace property are constructed as L∘S∘L-1, where L is any invertible linear mapping and S is a group of S-boxes in parallel. Finally, as application, we provide a full-round differential invariant subspace distinguisher for the variant Midori128 (the only difference is that the variant version utilizes only one single type S-box instead of four types). This distinguishing is experimentally verified and could be executed within negligible time.

This study is focused on the differential clustering effect of the SPN block cipher, which employs a binary matrix as its diffusion layer. We present a novel strategy for differential estimation, named the congruent differential cluster. This method does not guarantee the optimization of each single differential characteristic but gathers a large number of characteristics satisfying a specific condition, i.e., the output differences of active S-boxes are equal. Given a binary SPN cipher, the exact probability of the congruent differential cluster can be obtained with negligible computational resources. Moreover, we consider a popular instance, binary AES-like ciphers, since the processing of their column-mixing layer can be divided into several independent parts. Therefore, if we set the output differences of the active S-boxes in the same partition to be equal, we can obtain more differential characteristics in the cluster, known as a semicongruent differential cluster. To demonstrate the application of the proposed method, we apply it to several block ciphers, i.e., Midori-64, CRAFT-64, SKINNY-64 and their variants proposed in [1]. Compared with the active S-box counting method, the congruent differential clusters have considerably higher probabilities for most instances. In addition, we find a 7-round semicongruent differential cluster for Midori-64 with probability 2-52.25, an 8-round semicongruent differential cluster for SKINNY-64 with probability 2-50.72and a 10-round semicongruent differential cluster for CRAFT-64 with probability 2-42.32. To the best of our knowledge, the semicongruent differential clusters we identify for 7-round Midori-64, 8-round SKINNY-64 and 10-round CRAFT-64 have the highest probabilities thus far among the existing differential clusters with the same rounds. Therefore, we believe that the proposed method is a valuable tool for evaluating the differential security of associated block ciphers.

At CRYPTO 2018, Todo et al. proposed an effective fast correlation attack using multiple linear approximations, and gave effective attacks on the Grain-like stream ciphers with the same size of LFSR and key. However, many stream ciphers require that the size of LFSR must be at least twice the key size. For this type of stream ciphers, we propose an improved fast correlation attack using multiple linear approximations. The main idea is to reduce the number of attacked bits of parity-check equations by XORing the same linear approximation at different clocks, and then further bypass some unknown variables of parity-check equations by multiple linear approximations with an expected probability. Finally, full unknown variables are recovered by solving systems of linear equations. SOSEMANUK is one of the finalists in the eSTREAM project. The best absolute correlation of linear approximations of SOSEMANUK we found is 2-20.84, which improves the linear approximations with current best absolute correlation of 2-21.41. Finally, the improved fast correlation attack method is applied to SOSEMANUK, and a fast correlation attack with time/data/memory complexity ofO(2139.75)/O(2139.37)/O(2139.37) is given, and the success probability is 0.99. It improves the current best fast correlation attack with time/data/memory complexity ofO(2147.88)/O(2145.5)/O(2147.1) (ASIACRYPT 2008). For the optional key size ranging from 128-bit to 256-bit of SOSEMANUK, our attack result shows that SOSEMANUK can only guarantee the security of 140-bit key. In addition, we declare that our new fast correlation attack method can be applied to the linear analysis of other LFSR-based stream ciphers.

SNOW-V and SNOW-Vi are two new LFSR-based stream ciphers of the SNOW family designed for the 5G mobile communication system. Correlation attack is a well-known cryptanalysis tool for LFSR-based stream ciphers. The first step of a correlation attack is to establish a linear approximation of the cipher with high correlation. The process can be modeled and solved by automatic techniques. How to efficiently model the 8-bit S-box and how to give an effective search strategy are two challenges to automatically search for linear approximations of SNOW-V-like ciphers. For the first problem, we propose a divide-and-conquer dimension reduction method for modeling large S-boxes with Mixed Integer Linear Programming (MILP). It can transform the problem of modeling a high-dimensional set into sub-problems of modeling some low-dimensional sets. For the second problem, we propose an efficient heuristic MILP search algorithm for SNOW-V-like ciphers, which is applied to searching for the linear approximations of SNOW-V, SNOW-Vi, SNOW-Vi⊞32,⊞8, SNOW-Vi⊞16,⊞16and SNOW-Viσ0ciphers with high absolute correlations. Then we get the best absolute correlations of these ciphers at present, where the linear approximation of SNOW-Vi with the absolute correlation 2-45.796improves the absolute correlation 2-47.76proposed at EUROCRYPT 2022 by Shi et al. and the absolute correlation 2-47.567proposed at DCC 2022 by Zhou et al. Thus, a correlation attack with time/data/memory complexity of 2243.79/2235.08/2235.08is got. It is also the best state recovery attack at present. Thirdly, to simplify the search algorithm of the linear approximations of SNOW-V, we give two sufficient conditions under which a linear approximation of SNOW-Vi is also a linear approximation of SNOW-V. It can be proved that the correlation attack on SNOW-V has the same attack complexity as SNOW-Vi. Finally, for SNOW-Vi⊞32,⊞8and SNOW-Viσ0, we give the best state recovery attacks so far. The current best state recovery attacks of SNOW-Vi⊞32,⊞8and SNOW-Viσ0can be reduced by a factor of 264and 262, respectively. We also give the first attack on SNOW-Vi⊞16,⊞16. We emphasize that the new heuristic MILP model can be applied to the security evaluation of correlation attacks on the LFSR-based stream cipher structures. In addition, note that the existing fast correlation attacks, including our attacks do not threaten the security of SNOW-V-like ciphers because of the design constraint that the maximum length of keystream for a single pair of key and IV vectors is 264.

How to evaluate the security of Substitution-Permutation Network (SPN) block ciphers against impossible differential (ID) cryptanalysis is a valuable problem. In this paper, a series of methods for bounding the length of IDs of SPN block ciphers are proposed. Firstly, we propose the definitions of minimal representative set and partition table. Therefore, an improved partition-first implementation strategy for bounding the length of IDs is given. Secondly, we introduce a new definition of ladder and propose the ladder-first implementation strategy for bounding the length of IDs. In order to be able to apply ladder-first implementation strategy in practice, the methods for determining ladders and integrating a ladder into searching models are given. Thirdly, a heuristic algorithm called dynamic-ladder-partition implementation strategy is proposed. According to our experimental results, dynamic-ladder-partition implementation strategy is more suitable for SPN ciphers whose number of elements in partition tables is little. Fourthly, rotation-equivalence ID sets of ciphers are explored to reduce the number of models that need to be considered. As applications, we show that 9-round PRESENT, 5-round AES, 6-round Rijndael-160, 7-round Rijndael-192, 7-round Rijndael-224 and 7-round Rijndael-256 do not have any ID under the sole assumption that the round keys are uniformly random. What’s more, we obtain that 8-round GIFT-64, 12-round GIFT-128 and 14-round SKINNY-128 do not have any ID under the assumptions that GIFT and SKINNY are Markov ciphers and the round keys are uniformly random. Our methods fill crucial gaps on bounding the length of IDs with the differential properties of S-boxes considered. They enhance our confidence in the security and are valuable, especially for designers.

At CRYPTO 2019, Gohr first proposed neural distinguishers (NDs) on SPECK32, which are superior to the distinguishers based on the differential distribution table (DDT). Benamira et al. noted that NDs rely on the differential distribution of the last three rounds, and Bao et al. pointed out that NDs depend on the strong correlations between the bit values of ciphertext pairs satisfying the expected differential. Hence, one may guess that there exist deep relations between NDs and the differential-linear imbalances. To approximate NDs under a single ciphertext pair, we utilize differential-linear imbalances to construct simplified distinguishers. These newly constructed distinguishers offer comparable distinguishing advantages to that of NDs but with reduced time complexities. For instance, one such simplified distinguisher has only $$2^{-1.35}$$ of the original time complexity of NDs. Our experiments demonstrate that these new distinguishers achieve a matching rate of 98.2% for 5-round SPECK32 under a single ciphertext pair. Furthermore, we achieve the highest accuracies for 7-round and 8-round SPECK32 up to date by using a maximum of 512 ciphertext pairs. Finally, by replacing NDs with simplified distinguishers, we significantly reduce the time complexities of differential-neural attacks on 11–14 rounds of SPECK32.

Abstract 3D, an advanced encryption standard-like cipher employed three-dimensional structure, was proposed in 2008. Its recommended number of rounds is 22. Although the longest key recovery attack can currently reach 13 rounds, the complexity of existing attacks for >6 rounds seems to exceed the practically feasible complexity. Thus, a practical attack for 7-round 3D has yet to be developed. Recently, a lightweight block cipher called Saturnin has been selected as a second-round candidate in the National Institute of Standards and Technology standardization for lightweight cryptography. Saturnin also employs a three-dimensional structure and provides high security against quantum and classic attacks. In this paper, we investigate the yoyo attack on these two ciphers. Combined with the meet-in-the-middle technique, we apply the yoyo trick to 7-round 3D and recover the whole 512-bit secret key with $2^{15}$ plaintexts and adaptively chosen ciphertexts and $2^{16.5}$ complexity of full encryptions. To our best knowledge, it is the first practical key recovery attack for 7-round 3D to date. For Saturnin, we found a minor typo in its design report. The designers intended to make a super round containing two S-layers, but one was inadvertently omitted in the algorithm description. We propose a 5-super-round key recovery attack, which is suitable for both one-S-layer version and two-S-layer version. Since the round function of Saturnin has better diffusion, which leads that the meet-in-the-middle technique cannot be applied to this cipher directly. For the one-S-layer version, we address this problem by proposing a new technique called reducing key sets. This technique will fail on the other version, which proves the necessity of containing two S-layers in one-super-round. Finally, our attack requires $2^{39.1}$ plaintext pairs and adaptively chosen ciphertext pairs and $2^{46}$ one-round encryptions.

In this paper, a general model for evaluating the correlations of correlation attack distinguishers for an LFSR-based stream cipher is given by the Walsh spectrum theory of composite functions. We transform equivalently the linear approximations with$k$consecutive keystream words into that of a composite function consisting of several simple functions, which enables cryptanalysts to derive linear approximations of any LFSR-based stream cipher by this model and to search for linear trails with high absolute correlations. This model suits any LFSR-based stream cipher, does not need the implicit independence assumption widely used in previous cryptanalysis, and can theoretically ensure that the correlation obtained is the accurate correlation of a correlation attack distinguisher. In addition, we prove that it is enough to consider the distinguishers where the masks of all LFSR elements are zero except for those of a maximal linearly independent system of LFSR elements involved in the update function and output function. As applications, the approximation processes for the correlation attack distinguishers of SNOW-V, SNOW2.0, ZUC, and Grain-128 are exhibited respectively by this method. Moreover, by the proposed method we can perform a full coverage search for binary linear approximations of them. For SNOW-V, we prove that the approximation given by our model is equivalent to that by Shi et al. at EUROCRYPT 2022, and is simpler and more intuitive. For SNOW2.0, we find more linear approximations with the best correlation. For ZUC, for the first time we get the accurate correlations of a series of linear approximations including the known results, and give the supremum of the absolute correlations for a larger set of linear approximations. For Grain-128, utilizing our method, we rediscover the best known correlation as well, which provides more support for the validity of our general model. Our work can give some evidence for the provable security of LFSR-based stream ciphers against correlation attack to some extent, and may provide the key clues in the analysis of complex stream ciphers.

The rapid development of genomic high-throughput sequencing has identified a large number of DNA regulatory elements with abundant epigenetics markers, which promotes the rapid accumulation of functional genomic region data. The comprehensively understanding and research of human functional genomic regions is still a relatively urgent work at present. However, the existing analysis tools lack extensive annotation and enrichment analytical abilities for these regions. Here, we designed a novel software, Genomic Region sets Enrichment Analysis Platform (GREAP), which provides comprehensive region annotation and enrichment analysis capabilities. Currently, GREAP supports 85 370 genomic region reference sets, which cover 634 681 107 regions across 11 different data types, including super enhancers, transcription factors, accessible chromatins, etc. GREAP provides widespread annotation and enrichment analysis of genomic regions. To reflect the significance of enrichment analysis, we used the hypergeometric test and also provided a Locus Overlap Analysis. In summary, GREAP is a powerful platform that provides many types of genomic region sets for users and supports genomic region annotations and enrichment analyses. In addition, we developed a customizable genome browser containing >400 000 000 customizable tracks for visualization. The platform is freely available at http://www.liclab.net/Greap/view/index.

Abstract This work presents a structural attack against the type‐II generalised Feistel network (GFN) with secret internal functions. First, equivalent structures of the 7‐round type‐II GFN are provided, which helps reduce the first guess of the secret round functions. Then, two yoyo game distinguishers are simultaneously employed for these structures to reduce the data complexity by half. Based on these two distinguishers, it is found that the original yoyo game algorithm, proposed to attack the 5‐round Feistel structure, is not suitable for these structures, owing to the characteristics of the yoyo game cycle. To solve this problem, the partial look‐up table recycling technique is presented, which can utilise collision cycles with insufficient information. This technique performs better as the width of each branch ‘ n ’ grows. For yoyo game attacks, this study systematically investigates its cycle characteristics to determine the reason for the short collision cycle. For 7‐round type‐II GFNs, this work presents the first decomposition thus far, which can be executed within a time complexity of O( n 2 4 n + 3 ) and a data complexity of O(2 3 n + 2 ). We believe this work enriches the yoyo game attack and the application of type‐II GFNs.

In this paper, we present a new technique for recovering the secret inner components of block cipher structures. This technique does not simply distinguish a block cipher structure from a random permutation but recovers the secret inner components. In addition, our technique is more general than ad hoc structural cryptanalysis for specific structures. A new tool, the Inequality Constraints Table (ICT), is introduced to characterize the constraint relation of the secret inner components. If a complete ICT can be constructed, the secret components will be determined by a recursive algorithm. Based on the fundamental structure, an iterative method is proposed to construct an equivalent structure to simplify the initial guess regarding the secret components. Finally, we apply the new technique to several block cipher structures and obtain the secret component recovery results for the 5-round MISTY structure, 23- and 25- round Skipjack structure. To the best of our knowledge, this is the first time to present the structural cryptanalysis against the 5-round MISTY structure, 23- and 25-round Skipjack structure.

This paper proposes a fast voltage control scheme including synchronous generators and static var compensators (SVCs) for power systems with high penetration of wind power. The scheme is able to reduce the fast voltage variations and improve the post-fault voltage dynamics. Taking an industrial power system with high penetration of wind power as an example, a reduced system model has been derived based on phasor measurement units (PMUs). By applying Padé approximation, the time delay of PMU measurements is compensated. Then, a fast voltage control model with synchronous generators and SVCs is established. The solution to the voltage control problem is formulated as a linear quadratic regulator. The industrial power system is used to verify the effectiveness of the proposed control scheme.

This study concentrates on finding all truncated impossible differentials in substitution–permutation networks (SPNs) ciphers. Instead of using the miss‐in‐the‐middle approach, the authors propose a mathematical description of the truncated impossible differentials. First, they prove that all truncated impossible differentials in an r + 1 rounds SPN cipher could be obtained by searching entry ‘0’ in D ( P ) r , where D ( P ) denotes the differential pattern matrix (DPM) of P ‐layer, thus the length of impossible differentials of an SPN cipher is upper bounded by the minimum integer r such that there is no entry ‘0’ in D ( P ) r . Second, they provide two efficient algorithms to compute the DPMs for both bit‐shuffles and matrices over GF(2 n ). Using these tools they prove that the longest truncated impossible differentials in SPN structure is 2‐round, if the P ‐layer is designed as an maximum distance separable (MDS) matrix. Finally, all truncated impossible differentials of advanced encryption standard (AES), ARIA, AES‐MDS, PRESENT, MAYA and Puffin are obtained.

Abstract S‐box is one of the most important components of modern cipher. For efficient implementation and to avoid a purely algebraic construction, utilizing special cipher structure and small‐size random permutation to design S‐boxes seems to be an attractive approach. In this paper, we focus on the structure‐recovery problem on three kinds of S‐boxes, that is, specify the inner transformations from the look‐up table, which allows a much more efficient hardware implementation. For a given n‐bit bijection, with introducing equivalent structures, we decompose it into three‐layer Feistel/MISTY/Lai–Massey within time complexity O(2n/2) and 2 − n/2 part of the full codebook. Copyright © 2017 John Wiley & Sons, Ltd.

The well-known Welch–Gong (WG) stream cipher, proposed by Nawaz and Gong in 2005, was submitted to the hardware profile of the eSTREAM project. In the last several years, the original WG has come under several cryptanalytic attacks. However, as for the final version of WG, no attack has been published on it until now. In this paper, an efficient key recovery attack on the final WG stream cipher in the related key setting is proposed. Under related keys, we can recover the 128-bit secret key of WG-128 with a time complexity of |$2^{89}$| and a memory complexity of |$2^{45}$|⁠. The success probability of the attack is 0.6321. This result shows that our attack on WG-128 is much better than an exhaustive key search in the related key setting. Furthermore, our cryptanalytic results show that WG with IV size no less than 80 bits is vulnerable to a related key attack. The main feature of our attack is that it is independent of the number of steps in the key/IV setup of WG, and then increasing the number of steps in the key/IV setup cannot strengthen the resistance of WG against a related key attack. Finally, a recommended approach to repair the weakness and strengthen the resistance of WG against a related key attack is presented.

Maximum distance separable (MDS) matrices are widely used in the design of block ciphers. However, it is highly nontrival to find MDS matrices which could be used in practice. This paper focuses on the design of efficient MDS matrices for substitution-permutation networks (SPNs). We provide a new method to construct and count these MDS matrices. Moreover, we identified an interesting class of Cauchy matrices (named compact Cauchy matrices) which has the fewest different entries and is thus more favorable for implementation. Finally, we prove that all compact Cauchy matrices could be modified into an involution compact Cauchy matrix, and show how to maximize the occurrences of entry “1” in a compact Cauchy matrix.