Masking schemes are widely adopted strategies for countering side‐channel analysis (SCA) attacks. The initial hardware masking strategy, threshold implementation (TI), provides robust security against glitches in hardware platforms. The minimum number of shares required for a TI scheme depends not only on the desired security order but also on the algebraic degree of the target function. For instance, implementing a second‐order TI scheme for quadratic nonlinear functions requires at least five shares to ensure security, leading to substantially high implementation costs for higher order TI schemes. To address this issue, Shahmirzadi et al. proposed a method in CHES 2021 for constructing a 3‐share second‐order masking scheme. Despite its advancements, their search method is complex and time consuming. Our study presents a more efficient search method for a 3‐share second‐order masking scheme, ensuring both uniformity and second‐order probing security. Our approach can find a valid second‐order scheme in under a minute, making it tens to over a 1000 times faster than the method described in CHES 2021. Utilizing our methodology, we have effectively constructed second‐order secure implementations for several cryptographic primitives (e.g., Keccak, SKINNY, Midori, PRESENT, PRINCE, GIFT, and RECTANGLE) and evaluated their implementation costs and security.

SM4 is a popular block cipher issued by the Office of State Commercial Cryptography Administration (OSCCA) of China. In this paper, we use the bit‐slicing technique that has been shown as a powerful strategy to achieve very fast software implementations of SM4. We investigate optimizations on two frontiers. First, we present a more efficient bit‐sliced representation for SM4, which enables running 64 blocks in parallel with 256‐bit registers. Second, we describe an optimized algorithm for data form transformations, also allowing efficient implementations of SM4 under Counter (CTR) mode and Galois/Counter mode. The above optimizations contribute to a significant performance gain on one core compared with the state‐of‐the‐art results. This work is an extension of the conference paper at Inscrypt 2022, awarded the best paper award.

At EUROCRYPT 2015, Dinur et al. proposed cube-attack-like cryptanalysis on reduced-round Keccak. The process of recovering the key is divided into the preprocessing and the online phase. The preprocessing phase is setting a look-up table by computing the cube sum of involved key bits. The online phase is computing the cube sum of auxiliary variables and recording the matching values in the table as candidates. Auxiliary variables help balance the complexity of the two phases by reducing the number of involved key bits. Following this idea, a series of works has been presented, mainly focusing on a better selection of cube variables, auxiliary variables and involved key bits. We provide new methods to select auxiliary variables and involved key bits. The first step is to get a precise algebraic expression of each bit after one round permutation. Then, combined with the corresponding constraints on these variables, we can construct a Mixed-integer Linear Programming (MILP) model. Secondly, unlike the previous idea that auxiliary variables are chosen to satisfy the CP-kernel property just for the consideration of controlling diffusion, we cancel this restriction and adopt a more skilled selection of auxiliary variables. Based on these two steps, we improve the cube-attack-like cryptanalysis in terms of the complexity.

In this study, the authors settle the feasibility of mixed integer linear programming (MILP)‐aided bit‐based division property for ciphers with non‐bit‐permutation linear layers. First, they transform the complicated linear layers to their primitive representations. Then, the original Copy and exclusive OR models are generalised, and these models are exploited to depict the primitive representations. Accord‐ ingly, the MILP‐aided bit‐based division property can be applied to much more primitives with complicated linear layers. As an illus‐ tration, they rst evaluate the bit‐based division properties of some word‐oriented block ciphers. For Midori64, they obtain a 7‐round integral distinguisher, which achieves one more round than the previous results. At the same time, the data requirements of some existing distinguishers are also reduced. They decrease the data complexities of 4‐round and 5‐round distinguishers for LED and Joltik‐BC by half. Then, the bit‐based division properties of some bit‐oriented ciphers such as Serpent and Noekeon are considered. The data complexities of their distinguishers for short rounds are reduced. Besides, they evaluate the bit‐based division properties of the internal permutations in some hash functions. An 18‐round zero‐sum distinguisher for SPONGENT‐88 is proposed, which achieves four more rounds than the previous ones. Some integral distinguishers for PHOTON permutations are improved.

This paper provides security evaluations of a lightweight block cipher called BORON proposed by Bansod et al. There is no third-party cryptanalysis towards BORON. Designers only provided coarse and simple security analysis. To fill this gap, security bounds of BORON against differential and linear cryptanalysis are presented in this paper. By automatic models based on the SMT solver STP, we search for differential and linear trails with the minimal number of active S-boxes and trails with optimal probability and bias. Then, we present key-recovery attacks towards round-reduced BORON. This paper is the first third-party cryptanalysis towards BORON.

SIMON is a family of lightweight block ciphers publicly released by National Security Agency (NSA). Up to now, there have been many cryptanalytic results on it by means of impossible differential, integral, zero‐correlation linear cryptanalysis and so forth. In this study, the authors analyse the characteristic of the Boolean functions of SIMON32 and find that the presentation of zero‐sum property is influenced by the degree of the corresponding Boolean function. As a result, the zero‐sum integral distinguisher for 14‐round SIMON32 is identified which is same to the one given by Wang et.al . Inspired by this finding, they also experimentally find the zero‐sum integral distinguisher for 16‐round SIMON48. Then, the integral attacks on 22‐round SIMON32, 22‐round SIMON48/72 and 23‐round SIMON48/96 are given. They improve the previous integral attack on SIMON32 from 21‐round to 22‐round, and the first integral attack on SIMON48 is proposed.

SM4 is a Chinese commercial block cipher standard used for wireless communication in China. In this paper, we use the partial linear approximation table of S-box to search for three rounds of iterative linear approximations of SM4, based on which the linear approximation for 20-round SM4 has been constructed. However, the best previous identified linear approximation only covers 19 rounds. At the same time, a linear approximation for 19-round SM4 is obtained, which is better than the known results. Furthermore, we show the key recovery attack on 24-round SM4 which is the best attack according to the number of rounds.