This paper defines the conditional constant function problem (CCFP), and for a special case of CCFP, presents a quantum algorithm for solving it efficiently. Such an algorithm enables us to make new evaluations of the quantum security of Feistel block cipher in the case where quantum attackers can only perform online classical queries. Specifically, the chosen-plaintext key recovery attacks on two Feistel block cipher variants, known as Feistel-KF and Feistel-FK, are significantly improved. For Feistel-KF, a 3-round distinguisher based on the special case of CCFP is constructed, and key recovery attacks forr> 3 rounds are proposed. For Feistel-FK, the CCFP based distinguisher covers 4 rounds and the key recovery attacks are applicable forr> 4 rounds. Based on the CCFP solving algorithm, the key recovery attacks can reduce the classical memory complexity from the previous exponentialO(2cn) toO(1), wherec’s are constants. The query complexity of key recovery attacks on Feistel-KF is also significantly reduced fromO(2cn) toO(1). Besides, the CCFP solving algorithm can be extended to reduce the query complexity exponentially in attacking the 2IEM and pEDM constructions. These results indicate that quantum algorithms solving CCFP could be more promising than those solving the period finding problem.

Impossible differential cryptanalysis and impossible polytopic cryptanalysis are among the most effective techniques for evaluating the security of block ciphers. However, previous automatic search methods for their distinguishers—dimpossible differentials and impossible polytopic transitions—neither account for the influence of the key schedule in single-key settings nor are applicable to block ciphers featuring large S-boxes, variable rotations, or key-dependent permutations. Furthermore, existing approaches fail to search for clusters of impossible differentials when all details of a block cipher are considered. In contrast to previous methods that focus solely on the propagation of differences or s-difference, we redefine impossible differentials and impossible (s+ 1)-polytopic transitions based on state propagation. This redefinition enables us to overcome the limitations inherent in earlier methodologies. Theoretically, we demonstrate that traditional definitions of impossible differentials and impossible (s+ 1)-polytopic transitions correspond to subsets of our redefined concepts, which offer broader analytical perspectives. Technically, we reformulate the automatic search model and develop an SAT-based tool to efficiently evaluate our redefined impossible differentials and impossible (s+ 1)-polytopic transitions. Building upon this foundational search method, we construct a comprehensive framework for detecting clusters of impossible differentials and impossible (s+1)-polytopic transitions. This framework not only fully incorporates the details and differential properties of block ciphers but is also applicable to those employing large S-boxes while considering the full linear layer. As a result, we derive new impossible differentials for GIFT64, PRINTcipher48/96, MISTY1, RC5-32/64/128 and SPECK, as well as new clusters of impossible differentials for SPECK, DES and ARIA. In assessing resistance against impossible differentials, we apply our method to evaluate the security of GIFT64, PRINTcipher48/96, MISTY1, SPECK, SIMON, and DES while accounting for all details of the block ciphers. Moreover, we propose acceleration strategies and apply them to evaluate the security of MISTY1 and AES-128. Notably, we prove that no 5-round impossible differentials with one active input byte and one active output byte exist for AES-128, even when considering the dependencies among three consecutive round keys. Finally, in exploring new impossible (s+1)-polytopic transition, we apply our approach to PRINTcipher48, GIFT64, RC5-32/64 and SIMON32-64, successfully yielding the corresponding distinguishers for the first time.

The impossible boomerang attack is a powerful cryptanalytic technique, but existing key recovery methods face several limitations that restrict its applicability. Specifically, the key pre-guessing is coarse-grained, S-box details are ignored in the differential propagation, the complexity estimation and the key guessing order determination remain rudimentary. To overcome these issues, we introduce three key improvement measures. First, we propose a flexible partial key and difference pre-guessing technique based on directed graphs, enabling selective identification of required keys and differences for generating partial pairs and quartets. Second, we propose a pre-sieving technique to early eliminate invalid quartets by exploiting cipher-specific details. Third, we introduce an automatic key-guessing strategy based on the same directed graphs to efficiently determine valid guessing orders. We integrate these techniques to develop a unified key recovery framework for impossible boomerang attacks, accompanied by a formal and precise characterization of the overall complexity. This is the first framework to support flexible key and difference pre-guessing while incorporating block cipher details during key recovery for impossible boomerang attacks. Crucially, it enables the automatic generation of detailed recovery steps, a capability missing in prior work. As applications, under the four related-key/tweakey setting, we apply the framework to ARADI, a low-latency cipher proposed by the National Security Agency (NSA), and SKINNYe v2, a threshold-implementation-friendly cipher proposed at EUROCRYPT 2020. For ARADI, we achieve the first full-round attack with 2130data, 2253.78time, and 2235.75memory complexity. For SKINNYe v2, we present the first 34-round impossible boomerang attack with 266data, 2253.75time, and 2239.75memory complexity. These results demonstrate the framework’s significance and its substantial improvement in advancing the impossible boomerang attack.

Permutations with low multiplication depth over prime fields are highly valuable in the design of symmetric ciphers that are compatible with fully homomorphic encryption (FHE). Quadratic permutations, which have the lowest depth, have been widely used in prior designs. In this paper, we propose a construction method that can give new quadratic permutations over Fpm, and cryptographic properties such as differential uniformity and Walsh spectrum of these permutations are also characterized. We give sufficient conditions for permutations over Fpnto attain a differential uniformity ofpn−1forn≥ 3. Furthermore, it is proven that for these permutations, the maximal 2-norm of Walsh coefficients remains bounded bypn−1, provided either the lastn− 1 entries of the input mask or the lastn− 1 entries of the output mask form a nonzero vector. As an application, we design a new FHE-friendly stream cipher named YuS based on a new quadratic permutation over Fp3and a fixed linear mapping. According to our implementation, achieves YuS faster evaluation times and higher throughput compared to Masta, Pasta, Pastav2and HERA in almost all instances for both BGV and BFV schemes at 80-bit and 128-bit security levels.

Abstract The division property method is a technique for automatic searching integral distinguishers on block ciphers. Previous methods only use word-based division property to search integral distinguishers for block ciphers with large S-boxes. Since using bit-based division property may find longer integral distinguishers than word-based division property, we propose a method to automatically search the integral distinguishers based on bit-based division property for block ciphers with large S-boxes. To achieve this goal, we propose a new division property propagation table for S-boxes. Theoretically, we prove that using both the new table and the traditional method to describe the bit-based division property propagation rule of S-box will lead to the same integral distinguishers. Technically, we design a mixed-integer linear programming-based tool to search the integral distinguisher based on the new table, which helps to search new integral distinguishers for block ciphers with large S-boxes efficiently. As a result, we apply our tool to derive new integral distinguishers and get the tight bound on the rounds that no integral distinguishers exist for ICEBERG, KHAZAD, Camellia, CS-Cipher, ITUbee and SMS4. Besides, to show the availability of our integral distinguishers, we form the present best five-round and the first six-round integral attack for ICEBERG as an example.