Abstract GIFT is a lightweight cipher proposed by Banik et al. at CHES’17, motivated by the design strategy of PRESENT. GIFT-64[2021] is a variant of GIFT proposed by Sun et al. at EUROCRYPT’22 to achieve better resistance against differential attack while maintaining a similar security level against linear attack. At EUROCRYPT’22, Dong et al. proposed a new rectangle framework considering the key guessing strategies for linear key-schedule ciphers, and established a uniform automatic search model for the whole rectangle attack. In this paper, we extend it to be applicable to bit-oriented ciphers, and construct an automatic search model involved in the distinguisher and key-recovery phase for GIFT. Moreover, we utilize the key relations of the linear key-schedule to the model, and find some new distinguishers both for GIFT-64 and GIFT-64[2021]. To evaluate the probability more accurately, we propose a method to calculate the probability of the 2-round middle part which connects the boomerang distinguisher for GIFT, and apply it with the SAT method to evaluate the probability of the whole distinguishers. As a result, we search out a new 20-round related-key boomerang distinguisher for GIFT-64, and achieve a 26-round attack with better time complexity than the best previous attack. For GIFT-64[2021], we find a 20-round boomerang distinguisher and give the first 26-round rectangle attack under related-key scenario.

Abstract At CRYPTO 2021, Dong et al. proposed an automatic method of Meet-in-the-Middle (MITM) key-recovery attacks. In this paper, we further extend it to a new automatic model which can be used to find low-data complexity attacks. With the help of the automatic model, we propose MITM attacks against reduced-round versions of all the six members of the SKINNY family with extremely low-data complexity. More precisely, we present MITM attacks against 19-round SKINNY-$n$-$3n$, 15-round SKINNY-$n$-$2n$, 11-round SKINNY-$n$-$n$ with three, two, one plaintext-ciphertext pairs, separately. In addition, we can attack two more rounds and three more rounds with no more than $2^8$ and $2^{32}$ data complexity, respectively.

Abstract At FSE 2008, Leurent introduced the preimage attack on MD4 by exploiting differential trails. In this paper, we apply the differential-aided preimage attack to Keccak with the message modification techniques. Instead of directly finding the preimage, we exploit differential characteristics to modify the messages, so that the differences of their hashing values and the changes of given target can be controlled. By adding some constraints, a trail can be used to change one bit at a time and reduce the time complexity by a factor of 2. When the number of rounds increases, we introduce two-stage modification techniques to satisfy part of constraints as well. In order to solve other constraints, we also combine the linear-structure technique and accordingly give a preimage attack on 5-round Keccak[$r=1440,c=160,l=80$].

Abstract We introduce an interpolation attack using the Moebius Transform. This can reduce the time complexity to get a linear system of equations for specified intermediate state bits, which is general to cryptanalysis of some ciphers with update function of low algebraic degree. Along this line, we perform an interpolation attack against Elephant-Delirium, a round 2 submission of the ongoing national institute of standards and technology (NIST) lightweight cryptography project. This is the first third-party cryptanalysis on this cipher. Moreover, we promote the interpolation attack by applying it to the Farfalle pseudo-random constructions Kravatte and Xoofff. Our attacks turn out to be the most efficient method for these ciphers thus far.

Abstract A new conditional cube attack was proposed by Li et al. at ToSC 2019 for cryptanalysis of Keccak keyed modes. In this paper, we find a new property of Li et al.’s method. The conditional cube attack is modified and applied to cryptanalysis of 5-round Ketje Jr, 6-round Xoodoo-AE and Xoodyak, where Ketje Jr is among the third round CAESAR competition candidates and Xoodyak is a Round 2 submission of the ongoing NIST lightweight cryptography project. For the updated conditional cube attack, all our results are shown to be of practical time complexity with negligible memory cost, and test codes are provided. Notably, our results on Xoodyak represent the first third-party cryptanalysis for Xoodyak.

The integral attack, exploits the balanced property of the output in the distinguisher. Usually, adversaries append some rounds after the distinguisher, guess the corresponding key bits and check whether the target bits are balanced. Few works add rounds before the distinguisher to make the key recovery attack. In the first full‐round attack on MISTY1, Todo adds one FL layer (key‐dependent linear function) before the distinguisher. In this study, the authors extend his method and give a general method, which they can use to extend some rounds (non‐linear) before the distinguisher to attack more rounds with data complexity smaller than the whole space and little extra time consumption. The basic idea is that for different subkeys guessed in the forward rounds, they set different constant values for the input of the distinguisher. Finally, the selected data space is not full. For substitution permutation network (SPN) (Feistel with SPN round function) structures with 4 bit S‐box and bit permutation, they estimate the data complexity when adding one round before the distinguishers for all 4 bit S‐boxes. Using the method, they improve the integral attacks on PRESENT, RECTANGLE, TWINE and LBlock, and their results could cover one more round.

Dynamic key-guessing techniques, which exploit the property of AND operation, could improve the differential and linear cryptanalytic results by reducing the number of guessed subkey bits and lead to good cryptanalytic results for SIMON. They have only been applied in differential and linear attacks as far as we know. In this paper, dynamic key-guessing techniques are first introduced in integral cryptanalysis. According to the features of integral cryptanalysis, we extend dynamic key-guessing techniques and get better integral cryptanalysis results than before. As a result, we present integral attacks on 24-round SIMON32, 24-round SIMON48/72, and 25-round SIMON48/96. In terms of the number of attacked rounds, our attack on SIMON32 is better than any previously known attacks, and our attacks on SIMON48 are the same as the best attacks.