Extensive research has been done on the security of symmetric encryption algorithms in the black-box attack contexts, where the execution platforms are supposed to be secure. Recent studies intend to secure encryption algorithms in a more challenging but widely adopted scenario, the white-attack context (WBAC), where the adversaries have full visibility of the implementations of cryptosystems and full control over execution platforms. Various of approaches for protecting symmetric encryption algorithms in the WBAC have been proposed. Unfortunately, most existing approaches have been broken. This paper proposes a novel approach for securing symmetric encryption algorithms based on substitution-permutation network (SPN). Our key idea is to incorporate additional secret components into lookup tables to expand and dramatically change the inner states of encryption. Unlike existing approaches, these components do not need to be annihilated in adjacent rounds, and the ciphertext remains essentially unchanged. To recover the plaintext, only simple operations and the standard decryption algorithm are required. Our approach can be applied to protect SPN-based symmetric encryption algorithms such as AES. Security analysis indicates that the approach is expected to be resistant to both existing and unknown attacks. Furthermore, experimental evaluation shows that our approach performs well on various platforms.

The threshold digital signature technique is important for decentralized finance (DeFi) applications such as asset custody and cross-chain interoperations. The Edwards-curve digital signature algorithm (EdDSA) is widely used in blockchains, e.g., Libra/Diem; however, no suitable threshold solution exists. Therefore, to bridge this gap, we propose a threshold EdDSA that allows n parties to generate keys in a decentralized and distributed manner. Any t + 1-of-n parties can generate standard EdDSA signatures. This scheme supports an arbitrary threshold (t, n) and has been proven to be secure against at most t malicious adversaries. The theoretical analysis (computation complexity and communication footprints) and experimental results demonstrate that the proposed scheme performs efficiently on cloud servers and embedded devices. Furthermore, the proposed scheme is integrated with Tendermint, a blockchain framework that uses EdDSA, to generate keys and sign transactions in a decentralized manner, which indicates that this scheme is compatible with blockchains for supporting DeFi applications.