Add-Rotate-XOR (ARX) constructions build symmetric ciphers from modular addition, word-wise rotations, and XOR. Carry propagation in modular addition makes differential-linear (DL) cryptanalysis inherently bit-oriented. Focusing on hourglass(-like) DL distinguishers for the Speck family, we derive simple alignment relations between Speck’s rotation parameters and carry-related bit positions in modular addition. These relations predict systematic preferences for sparse intermediate differences and masks, and experiments on several Speck variants corroborate these patterns. Based on these relations, we develop a fast search approach that uses SMT (Satisfiability Modulo Theories) optimization to obtain optimal outer differential and linear trails under boundary constraints and a CUDA batch evaluator to estimate middle-round differential-linear approximation (DLA) correlations with a top-Kfiltering strategy. Applying this method to the Speck family, we improve the best-known DL distinguishers for 12-round Speck64 and 16-round Speck96, increasing the estimated overall correlation |bpϵ2| by factors up to 21.22(from 2−22.29to 2−21.07) and 24.13(from 2−48.32to 2−44.19), respectively. Compared to the best-known distinguishers, this reduces the required chosen-plaintext pairs by factors of about 22.44and 28.26, respectively. We further give an effective 14-round Speck64 distinguisher, extending the previously best-known effective result by one round.

In the design process of nuclear reactors, high-fidelity numerical simulations of thermo-hydraulic processes play a crucial role in evaluating the feasibility and safety of design schemes. These simulations involve complex physical processes such as coolant flow, thermal conduction, and heat transfer, necessitating the use of high-precision numerical algorithms and efficient parallel optimization methods. While mainstream commercial software is widely used in reactor design, it often falls short when it comes to meeting customized experimental scenarios and faces limitations in parallel scalability and physical model adaptability. Hence, the development of independent thermo-hydraulic parallel applications becomes essential. This paper focuses on conducting large-scale refined thermo-hydraulic analysis of core fuel rod bundles using the self-developed software YHACT. The paper elucidates the model algorithm design, parallel implementation, and analysis of test results. Two typical cases were selected for verification by comparing the obtained results with those from FLUENT. Emphasis was placed on the large-scale parallel simulation of fluid-solid coupled convection heat transfer phenomena between fuel rod bundles, utilizing a mesh scale exceeding 100 million cells. This breakthrough overcomes the scale limitations encountered with commercial software, and promises to foster further research and development in related fields.

Abstract In CRYPTO 2019, Gohr made a pioneering attempt and successfully applied deep learning to the differential cryptanalysis against NSA block cipher Speck 32/64, achieving higher accuracy than the pure differential distinguishers. By its very nature, mining effective features in data plays a crucial role in data-driven deep learning. In this paper, in addition to considering the integrity of the information from the training data of the ciphertext pair, domain knowledge about the structure of differential cryptanalysis is also considered into the training process of deep learning to improve the performance. Meanwhile, taking the performance of the differential-neural distinguisher of Simon 32/64 as an entry point, we investigate the impact of input difference on the performance of the hybrid distinguishers to choose the proper input difference. Eventually, we improve the accuracy of the neural distinguishers of Simon 32/64, Simon 64/128, Simeck 32/64 and Simeck 64/128. We also obtain related-key differential-based neural distinguishers on round-reduced versions of Simon 32/64, Simon 64/128, Simeck 32/64 and Simeck 64/128 for the first time.

Abstract Differential attack is one of the most important methods in cryptanalysis. When finding a high-probability differential trail, the effect of constant has long been ignored. In this paper, we focus on the effect of constants on the differential attack against $\mu ^2$. $\mu ^2$ is a newly proposed block cipher based on a Type-II generalized Feistel structure. Its 16-bit F function (denoted as F-box) is an ultra-lightweight permutation equipped with different constants. The designer applied the minimum number of active S-boxes to determine $\mu ^2$’ security margin in the design document. However, the F-boxes use different round constants in different rounds; the constants may lead to incompatibility of differential trails of F-boxes. Therefore, to provide a more precise differential attack on $\mu ^2$, we construct an model based on STP (Simple Theorem Prover) constraint solver to search for the valid differential trails with a more precise probability of $\mu ^2$ for different starting rounds. Finally, the related-key differential trail covers one more round than the existing methods. Analyzing the effect of constants on the validity and the probability of the differential trail reminds the designers and the attackers to have a more comprehensive analysis of specific ciphers.

WARP , an efficient lightweight block cipher presented by Banik et al., offers a viable alternative to AES with its 128‐bit block and a 128‐bit key. It adopts a 32‐nibble type‐II generalized Feistel network (GFN) structure, incorporating a nibble permutation optimized for both security and efficiency. Notably, WARP has achieved the lowest hardware implementation among 128‐bit block ciphers. Its bit‐serial encryption‐only circuit is only 763 gate equivalents (GEs). Consequently, WARP has received significant attention since its inception. The designers evaluated the number of active Sboxes for linear trails in WARP to establish its security. To further investigate WARP ’s resistance against linear attacks, we employed an automated model to analyze the optimal linear trails/hulls of WARP . To achieve this, the problem will be transformed into a Boolean satisfiability problem (SAT). The constraints in conjunctive normal form (CNF) are used to describe the mask propagation of WARP and invoke the SAT solver to find valid solutions. The results allowed us to obtain the optimal correlation of the initial 21‐round linear trails for WARP . Furthermore, by enumerating the linear trails within a linear hull, the distribution of linear trails is revealed, and the probability of the linear hull is improved to be more accurate. This work extends the linear distinguisher from 18 to 21 rounds. Additionally, the first independent analysis of WARP ’s linear properties is presented, offering a more precise evaluation of its resistance against linear cryptanalysis.

Abstract The differential-linear attack, combining the power of the two most effective techniques for symmetric-key cryptanalysis, was proposed by Langford and Hellman at CRYPTO 1994. From the exact formula for evaluating the bias of a differential-linear distinguisher (JoC 2017), to the differential-linear connectivity table technique for dealing with the dependencies in the switch between the differential and linear parts (EUROCRYPT 2019), and to the improvements in the context of cryptanalysis of ARX primitives (CRYPTO 2020, EUROCRYPT 2021), we have seen significant development of the differential-linear attack during the last four years. In this work, we further extend this framework by replacing the differential part of the attack by rotational-XOR differentials. Along the way, we establish the theoretical link between the rotational-XOR differential and linear approximations and derive the closed formula for the bias of rotational differential-linear distinguishers, completely generalizing the results on ordinary differential-linear distinguishers due to Blondeau, Leander, and Nyberg (JoC 2017) to the case of rotational differential-linear cryptanalysis. We then revisit the rotational cryptanalysis from the perspective of differential-linear cryptanalysis and generalize Morawiecki et al.’s technique for analyzing , which leads to a practical method for estimating the bias of a (rotational) differential-linear distinguisher in the special case where the output linear mask is a unit vector. Finally, we apply the rotational differential-linear technique to the cryptographic permutations involved in , , , and . This gives significant improvements over existing cryptanalytic results, or offers explanations for previous experimental distinguishers without a theoretical foundation. To confirm the validity of our analysis, all distinguishers with practical complexities are verified experimentally. Moreover, we discuss the possibility of applying the rotational differential-linear technique to S-box-based designs or keyed primitives, and propose some open problems for future research.

This paper mainly investigates the iterative structures whose decryption is similar to the encryption. Firstly, we unify many well-known structures which share similar procedures between the decryption and the encryption, and give a sufficient and necessary condition for this structure to be bijective, which reveals many new insights into the Feistel structure as well as the Lai-Massey structure. Secondly, we analyze the security of the unified structure against the known cryptanalysis. By extending the dual structure from a Feistel structure to the unified structure, we prove that a differential of the unified structure is impossible if and only if it is a zero-correlation linear hull of its dual structure, which presents a generalized link between the impossible differential and zero-correlation linear cryptanalysis shown in CRYPTO 2015. Significantly, several constraints on the linear components of the cipher and the permutation on the branches of the cipher are specified to make the structure resilient to differential and linear cryptanalysis. Furthermore, in the case that the order of the permutation equals the number of the branches$n$, we prove that there always exist a$(3n-1)$-round impossible differential and a$(3n-1)$-round zero-correlation linear hull of the structure, and also present an algorithm to construct these distinguishers. Finally, we propose some novel structures which might be used in future block cipher designs.

Abstract In this work, we investigate how the choice of the key-expansion algorithm and its interaction with the round function affect the resistance of Simon-like ciphers against rotational-XOR cryptanalysis. We observe that, among the key-expansion algorithms we consider, Simon is most resistant, while Simeck is much less so. Implications on lightweight ciphers design are discussed and open questions are proposed.

Abstract Rotational‐XOR (RX) cryptanalysis is a cryptanalytic method aimed at finding distinguishable statistical properties in Addition‐Rotation‐XOR‐C ciphers, that is, ciphers that can be described only by using modular addition, cyclic rotation, XOR and the injection of constants. In this study, we extend RX‐cryptanalysis to AND‐RX ciphers, a similar design paradigm where the modular addition is replaced by vectorial bitwise AND; such ciphers include the block cipher families Simon and Simeck. We analyse the propagation of RX‐differences through AND‐RX rounds and develop a closed form formula for their expected probability. Inspired by the MILP verification model proposed by Sadeghi et al., we develop a SAT/SMT model for searching compatible RX‐characteristics in Simon‐like ciphers, that is, that there is at least one right pair of messages/keys to satisfy the RK‐characteristics. To the best of our knowledge, this is the first model that takes the RX‐difference transitions and value transitions simultaneously into account in Simon‐like ciphers. Meanwhile, we investigate how the choice of the round constants affects the resistance of Simon‐like ciphers against RX‐cryptanalysis. Finally, we show how to use an RX‐distinguisher for a key recovery attack. Evaluating our model we find compatible RX‐characteristics of up to 20, 27 and 34 rounds with respective probabilities of 2 −26 , 2 −44 and 2 −56 for versions of Simeck with block sizes of 32, 48 and 64 bits, respectively, for large classes of weak keys in the related‐key model. In most cases, these are the longest published distinguishers for the respective variants of Simeck. In the case of Simon, we present compatible RX‐characteristics for round‐reduced versions of all 10 instances. We observe that for equal block and key sizes, the RX‐distinguishers cover fewer rounds in Simon than in Simeck. Concluding the paper, we present a key recovery attack on Simeck 64 reduced to 28 rounds using a 23‐round RX‐characteristic.

Abstract Subversion of cryptography has received wide attentions especially after the Snowden Revelations in 2013. Most of the currently proposed subversion attacks essentially rely on the freedom of randomness choosing in the cryptographic protocol to hide backdoors embedded in the cryptosystems. Despite the fact that significant progresses in this line of research have been made, most of them mainly considered the classical setting, while the research gap regarding subversion attacks against post-quantum cryptography remains tremendous. Inspired by this observation, we investigate a subversion attack against existing protocol that is proved post-quantum secure. Particularly, we show an efficient way to undetectably subvert the well-known lattice-based encryption scheme proposed by Regev (STOC 2005). Our subversion enables the subverted algorithm to stealthily leak arbitrary messages to the outsider who knows the backdoor. Through theoretical analysis and experimental observations, we demonstrate that the subversion attack against the LWE encryption scheme is feasible and practical.

Abstract Hierarchical identity-based signature (HIBS) plays a core role in a large community as it significantly reduces the workload of the root private key generator. To make HIBS still available and secure in post-quantum era, constructing lattice-based schemes is a promising option. In this paper, we present an efficient HIBS scheme in polynomial rings. Although there are many lattice-based signatures proposed in recent years, to the best of our knowledge, our HIBS scheme is the first ring-based construction. In the center of our construction are two new algorithms to extend lattice trapdoors to higher dimensions, which are non-trivial and of independent interest. With these techniques, the security of the new scheme can be proved, assuming the hardness of the Ring-SIS problem. Since operations in the ring setting are much faster than those over integers and the new construction is the first ring-base HIBS scheme, our scheme is more efficient and practical in terms of computation and storage cost when comparing to the previous constructions.

In EUROCRYPT 2018, Cid et al. introduced a new concept on the cryptographic property of S-boxes: boomerang connectivity table (BCT for short) for evaluating the subtleties of boomerang-style attacks. Very recently, BCT and the boomerang uniformity, the maximum value in BCT, were further studied by Boura and Canteaut. In this paper, aiming at providing new insights, we show some new results about BCT and the boomerang uniformity of permutations in terms of theory and experiment. First, we present an equivalent technique to compute BCT and the boomerang uniformity, which seems to be much simpler than the original definition by Cid et al. Second, thanks to Carlet's idea, we give a characterization of functions f from F2nto itself with boomerang uniformity δfby means of the Walsh transform. Third, by our method, we consider boomerang uniformities of some specific permutations, mainly the ones with low differential uniformity. Finally, we obtain another class of 4-uniform BCT permutation polynomials over F2n.

Abstract Rotation symmetric Boolean functions have been extensively studied in the recent years because of their applications in cryptography. In this study, a novel method to constructp‐variable 1‐resilient rotation symmetric functions overGF(p) is proposed based on a Latin square with maximum cycle structure, which is not required to solve any equation system. And a lower bound on the number ofp‐variable 1‐resilient rotation symmetric functions is given. At last, an equivalent characterization ofp‐variable 1‐resilient rotation symmetric functions overGF(p) is demonstrated, as a direct corollary, the number ofp‐variable 1‐resilient rotation symmetric functions is represented by all the solutions of the equation system. Copyright © 2017 John Wiley & Sons, Ltd.

Light encryption device (LED) is a 64 bit lightweight block cipher proposed by Guo et al . at CHES 2011, and its key size is primarily defined as 64 and 128 bits. This study studies differential fault analysis (DFA) of LED using the technique of Super‐Sbox analysis. Under various fault models, the fault pattern propagation rule of the Super‐Sbox can be obtained, based on which the efficiency of fault attack on LED can be greatly improved. For LED‐64, under the nibble‐based fault model, a random nibble fault at the 30th round can reduce the size of key search space to 2 7 –2 20 (average 2 14.02 ). Even if a random nibble fault is injected into the 29th round, the size of the key search space can also be reduced to about 2 17.43 –2 17.72 (average 2 17.65 ) using early‐abort technique. Although under the byte‐based fault model, a random byte fault at the 30th round can reduce the size of the key space to 2 7 –2 16 (average 2 11.92 ). If the adversary has the capability of injecting two random nibble faults at some specified rounds, then the above fault attack on LED‐64 can be similarly extended to LED‐128, and the size of the exhaustive search space for the 128 bit key can be reduced to 2 15 –2 27.94 (average 2 21.96 ). These results demonstrate that Super‐Sbox is a powerful technique that can be used to obtain significant improvements in the key filtration, and thus improve the efficiency of DFA on some special ciphers.

Abstract PRINCE is a lightweight block cipher whose block size and key size are 64‐bit and 128‐bit, respectively. The core component of PRINCE is PRINCE which is wrapped by the initial and final key whitening. PRINCEcore adopts a 12‐round SPN structure. This paper exploits some new vulnerabilities of PRINCE from an aspect different from previous results, and applies truncated differential cryptanalysis to PRINCE. The result demonstrates that for several reduced versions of PRINCE, there exist 5‐round and 6‐round (out of 12 rounds) truncated differential distinguishers. We introduce a key‐recovery attack on 7‐round PRINCEcore using two 5‐round distinguishers, the data complexity is 250 chosen plaintexts and the time complexity is 248.2 7‐round encryptions, with a storage of about 222.6 counters. Both the distinguishers and key‐recovery attacks are not related to the value of α. Copyright © 2015 John Wiley & Sons, Ltd.

In this paper, a new method is presented to compute the 2-adic complexity of pseudo-random sequences. With this method, the 2-adic complexities of all the known sequences with ideal 2-level autocorrelation are determined in a unified way. Results show that their 2-adic complexities equal their periods. In other words, their 2-adic complexities attain the maximum. In addition, 2-adic complexities of two classes of optimal autocorrelation sequences with period N ≡ 1mod4, namely Legendre sequences and Ding-Helleseth-Lam sequences, are investigated. This method also can be used to compute the linear complexity of binary sequences regarded as sequences over other finite fields.

In this study, the minimal polynomials and the linear complexity of interleaved binary sequences are investigated. Both the linear complexity and the minimal polynomials of low correlation zone sequences constructed by Zhou et al. are completely determined. Besides, an open problem proposed by Li and Tang is discussed. At last, a sufficient condition and a necessary condition are presented about when the linear complexity of the interleaved sequences constructed by Tang et al. attains the maximum.

Many block ciphers use permutations defined on F(22k) with low differential uniformity, high nonlinearity, and high algebraic degree as their S-boxes to provide confusion. It is well known that, for a function on F(2n), the lowest differential uniformity is 2 and the functions achieving this lower bound are called almost perfect nonlinear (APN) functions. However, due to the lack of knowledge on APN permutations on F(22k), differentially 4-uniform permutations are usually chosen as S-boxes. For example, the currently endorsed Advanced Encryption Standard chooses one such function, the multiplicative inverse function, as its S-box. By a recent survey on differentially 4-uniform permutations over F(22k), there are only five known infinite families of such functions, and most of them have small algebraic degrees. In this paper, we apply the powerful switching method to discover many CCZ-inequivalent infinite families of such functions on F(22k) with optimal algebraic degree, wherekis an arbitrary positive integer. This greatly expands the list of differentially 4-uniform permutations and hence provide more choices for the S-boxes. Furthermore, lower bounds for the nonlinearity of the functions obtained in this paper are presented and they imply that some infinite families have high nonlinearity.

In this study, the authors propose a new concept named similar-bent function and the authors present two general methods to construct balanced sequences with low correlation by using similar-bent functions and orthogonal similar-bent functions. The authors find that the bent sequence sets are special cases of our construction. The authors also investigate the linear complexity of the new constructed sequences. If a suitable similar-bent function is given, the sequences constructed by it can have high-linear complexity. As examples, the authors construct two new low-correlation sequence sets. One constructed based on Dobbertin's iterative function is asymptotically optimal with respect to the Welch bound and the other one is constructed based on Kasami function whose sequences have a high-linear complexity.

Rotation symmetric Boolean functions (RSBFs) that are invariant under circular translation of indices have been used as components of different cryptosystems. In this paper, even-variable-balanced RSBFs with maximum algebraic immunity (AI) are investigated. At first, we give an original construction of 2m-variable-balanced RSBFs with maximum AI. Then we improve the construction to obtain more 2m-variable-balanced RSBFs with maximum AI, and these new RSBFs have higher non-linearity than all previously obtained RSBFs. Further, we generalise our construction of 2m-variable RSBFs to a new construction that can generate any even-variable RSBFs.

Impossible differential cryptanalysis is a very popular tool for analysing the security of modern block ciphers and the core of such attack is based on the existence of impossible differentials. Currently, most methods for finding impossible differentials are based on the miss-in-the-middle technique and they are very ad hoc. In this study, the authors concentrate on substitution–permutation network (SPN) ciphers whose diffusion layer is defined by a linear transformation P. Based on the theory of linear algebra, the authors propose several criteria on P and its inversion P-1 to characterise the existence of 3/4-round impossible differentials. The authors further discuss the possibility to extend these methods to analyse 5/6-round impossible differentials. Using these criteria, impossible differentials for reduced-round Rijndael are found that are consistent with the ones found before. New 4-round impossible differentials are discovered for block cipher ARIA. Many 4-round impossible differentials are firstly detected for a kind of SPN cipher that employs a 32×32 binary matrix proposed at ICISC 2006 as its diffusion layer. It is concluded that the linear transformation should be carefully designed in order to protect the cipher against impossible differential cryptanalysis.

SHACAL-1, known as one of the finalists of the NESSIE project, originates from the compression component of the widely used hash function SHA-1. The requirements of confusion and diffusion are implemented through mixing operations and rotations other than substitution and permutation, thus there exists little literature on its immunity against fault attacks. In this paper, we apply differential fault analysis on SHACAL-1 in a synthetic approach. We introduce the random word fault model, present some theoretical arguments, and give an efficient fault attack based on the characteristic of the cipher. Both theoretical predications and experimental results demonstrate that, 72 random faults are needed to obtain 512 bits key with successful probability more than 60%, while 120 random faults are enough to obtain 512 bits key with successful probability more than 99%.

The preimage distributions of perfect nonlinear functions from an Abelian group of ordernto an Abelian group of order3or4, respectively, are studied. Based on the properties of the preimage distributions of perfect nonlinear functions from an Abelian group of order3rto an Abelian group of order3, the weight distributions of the ternary linear codesCPifrom the perfect nonlinear functionsPi(x) fromF3rto itself are determined. These results suggest that two open problems, proposed by Carlet, Ding, and Yuan in 2005 and 2006, respectively, are answered.

In this paper, the weight distributions of two classes of linear codes based on all known explicit perfect nonlinear functions fromFqmto itself are determined using a unified approach. All the minimal codewords of these codes are characterized according to their weights, which suggests that their covering structures are determined. Finally, all the minimal access sets of the secret sharing schemes based on their dual codes are obtained.

In this correspondence, we introduce a method to construct Boolean functions in any number of variables, with optimal algebraic immunity. Remarkably, all functions of this type with an odd number of variables can be obtained in this way. We study some cryptographic properties, such as balancedness, algebraic degree of the constructed functions. Moreover, a lower bound of the number of Boolean functions with optimal algebraic immunity is given.

In this note, it is proved that for each odd positive integer n there are exactly two n-variable symmetric Boolean functions with maximum algebraic immunity.