Shadow is a block cipher for Internet of Things (IoT) Nodes proposed in the IEEE IoT Journal in 2021. The primary design principle of shadow is the adoption of a variant 4-branch Feistel structure to ensure a fast diffusion. We refer to this structure as the shadow structure and prove that it is almost identical to the Feistel structure, which invalidates the design principle. We also present a new structural distinguisher that can distinguish the shadow structure from a random permutation with only two plaintext/ciphertext pairs. Additionally, we demonstrate that the key-recovery attacks utilizing the impossible differential proposed by Liu et al. in the Cybersecurity Journal in 2023 and the integral characteristic proposed by Mirzaie et al. in the IEEE IoT Journal are infeasible. Instead, we extend our distinguisher to a key-recovery attack using only one plaintext/ciphertext pair by exploiting the key schedule. Moreover, upon investigating shadow’s round function, we observe that only specific forms of monomials can appear in the ciphertext, leading to an integral distinguisher involving four plaintext/ciphertext pairs. Notably, the algebraic degree does not exceed 12 for shadow-32 and 20 for shadow-64, regardless of the number of rounds used. Our results show that shadow is highly vulnerable to algebraic attacks, emphasizing the need for careful consideration of algebraic attacks when incorporating AND, rotation, and xor operations in cipher design.

The ARX structure, which comprises three fundamental operations—Addition, Rotation, and XOR—makes it well-suited for lightweight cryptography. To design a secure and efficient ARX cipher, it is necessary to find the optimal structure by properly combining the order, number of operations, and rotation amounts. CHAM64 is an ARX block cipher with a 64-bit block size, which is proposed as an attempt to enhance the lightweight characteristics of LEA. In this paper, we present Secure And Efficient CHAM (SAECHAM), a variant of CHAM64 with a rearranged order of operations and adjusted rotation amounts. By changing the order of the operations in CHAM64, six different CHAM-like structures can be created. We propose the properties that can be eliminated in the implementation process depending on the rotation amount in each structure. To improve suitability for constrained environments such as 8-bit and 16-bit microcontrollers, we reduce the search space for rotation amounts and analyze the number of instructions. Using an SMT solver-based automatic search method, we analyze the security of 62 CHAM64 variants through differential and linear analysis. Among them, we find four variants with equal or better resistance to differential and linear cryptanalysis compared to CHAM64. As a result, we propose the variant with the fewest instructions among them as SAECHAM. Through software implementations on 8-bit AVR, 16-bit MSP430, 32-bit ARM Cortex-M3 and Cortex-M4 platforms, we demonstrate that SAECHAM is efficient in terms of encryption speed and also performs efficiently when implemented using SIMD operations in high-performance CPUs.

In this paper, we propose a fault injection attack on A5/3 used in GSM. This attack is based on the fault assumption in. That is, it is assumed that we can decrease the number of rounds in block cipher KASUMI of A5/3 by injecting some faults. With small number of fault injections, we can recover the session key of A5/3 supporting a 64-bit session key. This is the first known cryptanalytic result on A5/3 so far.