This paper shows practical committing attacks against Rocca-S, an authenticated encryption with associated data scheme designed for 6G applications. Previously, the best complexity of the attack was 2 64 by Derbez et al. in ToSC 2024(1)/FSE 2024. We show that the committing attack against Rocca by Takeuchi et al. in ToSC 2024(2)/FSE 2025 can be applied to Rocca-S, where Rocca is an earlier version of Rocca-S. We show a concrete test vector of our attack. We also point out a committing attack that exploits equivalent keys.

Generalized Feistel structures (GFS) are widely employed as the underlying structure of primitives like block ciphers and hash functions. In order to improve its slow diffusion, several design ideas have been proposed. In this contribution, we explore the (im)possibility of further improving the round diffusion of GFS by modifying its round permutations. First, we generalize a technique called sub-block dividing, which further divides each sub-block into smaller blocks. We prove that the diffusion round of a round permutation with sub-block dividing is four, regardless of the number of sub-blocks. Moreover, we show that the round diffusion of GFS can be improved by alternately using two different round permutations instead of a single permutation. We present the first results that, by using two round permutations, 10- and 12-block GFS partially and fully reach the lower bounds on the diffusion round, respectively.

At CRYPTO 2019, constructions of a pseudorandom function from public random permutations were presented. We consider one of the constructions called Sum of Even-Mansour (SoEM), and present quantum attacks against the construction. Our attacks are based on two quantum algorithms, Simon's algorithm and Grover's algorithm, and derive the secret key. We also present quantum attacks against natural variants of SoEM.