Camellia is one of the widely used block ciphers, which has been included in the NESSIE block cipher portfolio and selected as a standard by ISO/IEC. In this study, the authors observe that there exist some interesting properties of the FL / FL −1 functions in Camellia. With this observation they derive some weak keys for the cipher, based on which they present the first known 8‐round zero‐correlation linear distinguisher of Camellia with FL / FL −1 layers. This result shows that the FL / FL −1 layers inserted in Camellia cannot resist zero‐correlation linear cryptanalysis effectively for some weak keys since the currently best zero‐correlation linear distinguisher for Camellia without FL / FL −1 layers also covers eight rounds. Moreover, by using the novel distinguisher, they launch key recovery attacks on 13‐round Camellia‐192 and 14‐round Camellia‐256. To their knowledge, these results are the best for Camellia‐192 and Camellia‐256 with FL / FL −1 and whitening layers.

In this study, the authors present the first related‐key rectangle cryptanalysis of Rijndael‐160/160 and Rijndael‐192/192. The author's attack on Rijndael‐160/160 covers eight rounds. The attack complexities are 2 126.5 chosen plaintexts, 2 129.28 8‐round Rijndael‐160/160 encryptions and 2 132.82 bytes. Their attack on Rijndael‐192/192 covers ten rounds. It requires 2 179 chosen plaintexts, 2 181.09 10‐round Rijndael‐192/192 encryptions and 2 185.59 bytes memory. These are the currently best cryptanalytic results on Rijndael‐160/160 and Rijndael‐192/192 in terms of the number of attacked rounds. Furthermore, their results show that the slow diffusion in the key schedule of Rijndael makes it a target for this type of analysis.

The design of secure yet efficiently implementable cryptographic algorithms is a fundamental problem of cryptography. Lately, lightweight cryptography--optimizing the algorithms to fit the most constrained environments--has received a great deal of attention, the recent research being mainly focused on building block ciphers. As opposed to that, the design of lightweight hash functions is still far from being well investigated with only few proposals in the public domain. In this paper, we aim to address this gap by exploring the design space of lightweight hash functions based on the sponge construction instantiated with present-type permutations. The resulting family of hash functions is called spongent. We propose 13 spongent variants--or different levels of collision and (second) preimage resistance as well as for various implementation constraints. For each of them, we provide several ASIC hardware implementations--ranging from the lowest area to the highest throughput. We make efforts to address the fairness of comparison with other designs in the field by providing an exhaustive hardware evaluation on various technologies, including an open core library. We also prove essential differential properties of spongent permutations, give a security analysis in terms of collision and preimage resistance, as well as study in detail dedicated linear distinguishers.