Abstract The security analysis of symmetric ciphers is a time-consuming and labor-intensive process that traditionally relies on manual derivation and mathematical modeling for specific algorithms. This paper introduces a fully automated analysis software framework designed to evaluate the security of any round-based symmetric cipher constructed from common primitives like S-boxes, bit permutations, and XOR operations. Our approach leverages the LLVM compiler infrastructure and the KLEE symbolic execution engine to automatically convert C implementations of cryptographic algorithms into a structured representation of state bits and update functions. By employing a frontend that uses custom annotations to identify round functions, it translates the algorithm into a series of Bit Expressions, and we introduce multiple modular backends that process those Expressions to applicable form of performing various types of analyzing methods. We demonstrate the tool’s effectiveness by implementing a differential and linear cryptanalysis backend with help of SAT solver, Division Property integral cryptanalysis backend with help of MILP solver, and a degree estimation backend based on Numeric Mapping method. As an experimental result, we apply these automated analysis techniques to several finalists from the NIST Lightweight Cryptography (LWC) competition, successfully reproducing and improving some existing cryptanalytic results. This work significantly lowers the barrier for cryptographic research by providing a powerful and adaptable platform for automatically assessing the security of both existing and newly designed symmetric ciphers.

Abstract The fast correlation attack (FCA) is one of the most important cryptanalytic techniques against LFSR-based stream ciphers. In CRYPTO 2018, Todo et al. found a new property for the FCA and proposed a novel algorithm which was successfully applied to the Grain family of stream ciphers. Nevertheless, these techniques cannot be directly applied to Grain-like small state stream ciphers with keyed update, such as Plantlet, Fruit-v2 and Fruit80. In this paper, we study the security of Grain-like small state stream ciphers by the FCA. We first observe that the number of required parity-check equations can be reduced when there are multiple different parity-check equations. With exploiting the Skellam distribution, we introduce a sufficient condition to identify the correct LFSR initial state and derive a new relationship between the number and bias of the required parity-check equations. Then, a modified algorithm is presented based on this new relationship, which can recover the LFSR initial state no matter what the round key bits are. Under the condition that the LFSR initial state is known, an algorithm is given against the degraded system and to recover the NFSR state at some time instant, along with the round key bits. As cases study, we apply our cryptanalytic techniques to Plantlet, Fruit-v2 and Fruit-80. As a result, for Plantlet, our attack takes $ 2^{73.75} $ time complexity and $ 2^{73.06} $ keystream bits to recover the full 80-bit key. Regarding Fruit-v2, $ 2^{55.34} $ time complexity and $ 2^{55.62} $ keystream bits are needed to determine the secret key. As for Fruit-80, $2^{64.47}$ time complexity and $2^{62.82}$ keystream bits are required to recover the secret key. More flexible attacks can be obtained with lower data complexity at the cost of increasing the attack time. Especially, for Fruit-v2, a key recovery attack can be launched with data complexity of $2^{42.38}$ and time complexity of $2^{73.31}$. Moreover, we have implemented our attack methods on a toy version of Fruit-v2. The attack matches the expected complexities predicted by our theoretical analysis quite well, which proves the validity of our cryptanalytic techniques.

Abstract Nonlinear feedback shift register (NFSR) is one of the most important cryptographic primitives in lightweight cryptography. At ASIACRYPT 2010, Knellwolf et al. proposed conditional differential attack to perform a cryptanalysis on NFSR-based cryptosystems. The main idea of conditional differential attack is to restrain the propagation of the difference and obtain a detectable bias of the difference of the output bit. QUARK is a lightweight hash function family which is designed by Aumasson et al. at CHES 2010. Then the extended version of QUARK was published in Journal of Cryptology 2013. In this paper, we propose an improved conditional differential attack on QUARK. One improvement is that we propose a method to select the input difference. We could obtain a set of good input differences by this method. Another improvement is that we propose an automatic condition imposing algorithm to deal with the complicated conditions efficiently and easily. It is shown that with the improved conditional differential attack on QUARK, we can detect the bias of output difference at a higher round of QUARK. Compared to the current literature, we find a distinguisher of U-QUARK/D-QUARK/S-QUARK/C-QUARK up to 157/171/292/460 rounds with increasing 2/5/33/8 rounds respectively. We have performed the attacks on each instance of QUARK on a 3.30 GHz Intel Core i5 CPU, and all these attacks take practical complexities which have been fully verified by our experiments. As far as we know, all of these results have been the best thus far.

In this paper, we describe a sub-maximal degree monomial test and propose a heuristic algorithm for searching favourable cubes, for testing Boolean functions formed by stream ciphers. We apply them to Trivium, and mount a distinguisher on Trivium reduced to 839 rounds with 237complexity, which is so far the best distinguisher on reduced Trivium.

In this paper, we for the first time construct three cubic rotation symmetric bent functions in 2k+3, k ≥ 0, variables. Our work solves the open problem left by Gao et al. (IEEE TIT 58(7): 4908–4913, 2012).

In this paper, it is proven that a family of 2k-variable Boolean functions, including the function recently constructed by Tang et al. [IEEE TIT 59(1): 653-664, 2013], are almost perfect algebraic immune for any integer k ≥ 3. More exactly, they achieve optimal algebraic immunity and almost perfect immunity to fast algebraic attacks. The functions of such family are balanced and have optimal algebraic degree. A lower bound on their nonlinearity is obtained based on the work of Tang et al., which is better than that of Carlet-Feng function. It is also checked for 3 ≤ k ≤ 9 that the exact nonlinearity of such functions is very good, which is slightly smaller than that of Carlet-Feng function, and some functions of this family even have a slightly larger nonlinearity than Tang et al.'s function. To sum up, among the known functions with provable good immunity against fast algebraic attacks, the functions of this family make a trade-off between the exact value and the lower bound of nonlinearity.

In this correspondence, first we give a decomposition of symmetric Boolean functions, then we show that almost all symmetric Boolean functions, including these functions with good algebraic immunity, behave badly against fast algebraic attacks. Besides, we improve the relations between algebraic degree and algebraic immunity of symmetric Boolean functions.