Cube-attack-like cryptanalysis, introduced by Dinur et al. at EUROCRYPT 2015, enables key recovery for Keccak and Xoodoo keyed modes using a divide-and-conquer approach. In this method, cube variables are manually selected, and the attack's complexity depends on the chosen cube variables and the key bits multiplied with these variables in the first round (related-key bits). To reduce the attack's complexity, it is essential to select cube variables in a manner that minimizes the number of related-key bits. Some papers, such as those by Song at FSE 2019 and Bi in Designs, Codes and Cryptography 2019, have proposed MILP methods to minimize the number of related-key bits. In this presentation, we explore potential improvements to these previously proposed results on cube-attack-like cryptanalysis. This work is ongoing.

The last few years have seen the proposal of several new ZK-friendly hash functions instantiated with the sponge construction. To obtain efficiency in ZK-environments, the core permutations of these primitives typically rely on a simple algebraic structure over a large prime field. This makes them potentially vulnerable to algebraic attacks using Gröbner bases. The complexity of computing Gröbner bases are - in general - notoriously hard, but there are instances in this setting where we can derive accurate estimates. This has even broken several variants of these ZK-friendly hash functions. A huge contributor to whether or not this works is the specific instance of the Constrained-Input/Constrained-Output (CICO) problem, which is intrinsic to the sponge framework, that we encounter. In this talk I will briefly go over this Gröbner basis analysis, and discuss how the CICO problem impacts what we can, and cannot, say about it. The talk will be partly based on results from this preprint.

After Gohr published his residual neural distinguisher at CRYPTO'19, many works followed that tried to improve his results using various approaches. To better assess this progress made on neural distinguishers, we wrote this paper, aiming to systemize the knowledge and practices presented for the cryptanalysis of ciphers using neural networks and to verify whether some of those practices can be generalized across datasets, ciphers, and neural networks.

Side-channel attacks (SCAs) are powerful attacks based on the information obtained from the implementation of cryptographic devices. Profiling side-channel attacks received significant attention as this type of attack defines the worst-case security assumptions. The most explored profiling attacks in the last few years are based on deep learning techniques. Such attacks are very powerful as they can break targets protected with countermeasures. They are also "easier" to deploy as they do not require pre-processing and/or feature selection. In this talk, we will cover the developments in the last eight years from the perspective of neural network architectures, going from simple multilayer perceptrons to transformers. Moreover, we will cover developments from the standpoint of attacked ciphers, going from AES to ASCON and Xoodyak.

In the random probing model, it is assumed that the side-channel adversary learns the values of the intermediates of the running cryptographic algorithm with a fixed probability. Our primary focus will be developing a framework to assess an attacker's post-leakage information regarding the secrets of the algorithm in implementations protected by masking. Additionally, we will explore how and under what conditions noisy side-channel leakages observed in a laboratory setting can be reduced to random probing leakage. In this context, we will discuss the minimum noise requirements necessary for effective masking countermeasures and explain why cipher design in prime fields is particularly advantageous in theory.

The development of the Linux kernel has been a long ongoing project. Recent strives at modernization have brought its developers to look more closely at some legacy code, including the random.c driver. This critical component is most notably responsible for supplying the system with random values. However, recent changes introduced to this process are insufficiently supported by the literature and rely on untested assumptions. In this work, we perform an in-depth study of the entropy accumulation process. Our findings contradict an earlier assumption that the distributions of the inputs to Linux's Random Number Generator are independent and identically distributed. We show instead that the various inputs are all dependent on previous values, and each follow a different distribution. Our results also confirm that the new SipHash-based function is indeed an improvement over previous Linux entropy accumulators.

We present a tweakable wide block cipher called Mystrium and show it as the fastest such primitive on low-end processors that lack dedicated AES or other cryptographic instructions, such as ARM Cortex-A7. Mystrium is based on the provably secure double-decker mode, that requires a doubly extendable cryptographic keyed (deck) function and a universal hash function. We build a new deck function called Xymmer that for its compression part uses Multimixer-128, the fastest universal hash for such processors, and for its expansion part uses a newly designed permutation, G_{512} . Deck functions can also be used in modes to build encryption, authenticated encryption, and authentication schemes, and hence, Xymmer is of independent interest. The current state-of-the-art wide tweakable block cipher Adiantum-XChaCha12-AES encrypts 4096-byte messages at 11.5 cycles per byte on ARM Cortex-A7, while for Mystrium it is 6.8 cycles per byte while having a higher claimed security.

Google introduced a new cryptographic library called Google Tink, which aims to provide cryptographic schemes for different tasks. For the task of authenticated encryption scheme, Google introduced Google Tink streaming Authenticated Encryption with Associated Data's (AEAD). To express the security the scheme aims to provide, a new security notion had to be introduced, nOAE2, from the existing nOAE. We believe a better approach is to think about the security proof while designing the scheme. In this presentation, we present a new authenticated encryption mode we developed called Deck-Tink, for which we proved a security bound using the jammin cipher as a model. We go further and provide an instantiation for the mode called Xoofff-Tink, which uses Xoofff as its deck function. Xoofff-Tink provides additional features that other deck function AE modes, e.g. Deck-Plain, do not possess, such as out-of-order and lost messages. We implement our Xoofff-Tink scheme in C and Rust to increase its usability and integration potential and report the benchmark performance against different schemes.

Authenticated encryption (AE) is a cryptographic mechanism that allows communicating parties to protect the confidentiality and integrity of messages exchanged over a public channel, provided they share a secret key. In this work, we present new AE schemes leveraging the SHA-3 standard functions SHAKE128 and SHAKE256, offering 128 and 256 bits of security strength, respectively, and their “Turbo” counterparts. They support session-based communication, where a ciphertext authenticates the sequence of messages since the start of the session. They are online, allowing on-the-fly decryption and authentication of long data streams, without needing to buffer the entire cryptogram before validating it. And, thanks to the collision resistance of (Turbo)SHAKE, they are committing in the strongest sense, meaning that they provide strong guarantees that a ciphertext uniquely binds to the key, plaintext and associated data. The AE schemes we propose have the unique combination of advantages that 1) their security is based on the security claim of SHAKE, that has received a large amount of public scrutiny, and that 2) they make use of the standard Keccak-p permutation that not only receives more and more dedicated hardware support, but also allows competitive software-only implementations thanks to the TurboSHAKE instances.

Differential cryptanalysis is one of the most powerful techniques in cryptanalysis, particularly for iterated ciphers. This attack exploits the propagation of high-probability differentials over the intermediate rounds of an iterated cipher. Any differential to an iterated permutation defines a set of trails containing the possible intermediate differences through the rounds and the differential probability (DP) of a differential is the sum of the DPs of the corresponding differential trails. The DP of a differential trail is typically estimated as the product of the DPs of the individual round differentials. However, as shown in the paper "Plateau Characteristics" by Daemen and Rijmen, and more recently in the paper "Differential Cryptanalysis in the Fixed-Key Model" by Beyne and Rijmen, this is not always the case. In this work, we explore methods to compute the exact DP of a differential trail in cryptographic permutations by examining the scaled Walsh-Hadamard spectrum of the solution sets of the round differentials. We present a general expression for the exact DP of a trail and look at simplifications over this expression when these solution sets are affine. For trails over three or more rounds, our approach requires finding compatible pairs of elements, where one element belongs to an affine space at the input of a non-linear layer and the other element is in an affine space at its output. This aspect will be further addressed in the next talk.

Consider the following cryptanalytic setup: We have two linear systems of equations that describe possible values before and after a nonlinear layer. The task is to find solutions to these systems that are compatible. Think for example of possible input and output differentials that have a nonzero differential probability. I discuss a general and efficient algorithm to solve such systems. The algorithm is optimised for permutations with sbox sizes up to five bit, such as Xoodoo and Ascon.

Differential and linear cryptanalysis are the most important analytical tools for designing and evaluating the security of symmetric cryptographic primitives. The design of modern symmetric cryptographic primitives, like AES and Keccak permutation, is motivated by the wide trail strategy, that underlies the design of round functions with good resistance against differential and linear cryptanalysis. In a nutshell, good resistance against differential and linear cryptanalysis requires the absence of high-probability differential propagation patterns, called differential trails, and high-correlation propagation patterns, called linear trails. Hence, proving bounds for the probability of differential and correlation of linear trails is an important task in the design and security evaluation of symmetric cryptographic primitives. For some primitives, these bounds can be proved analytically. An example is AES with its simple proof that a 4-round differential trail has probability at most 2^-150. Proving this bound in a simple way is possible for AES since its round functions work on groups of the bits (bytes), and process state bits in these groups. In this case, we say the primitive is aligned or have a strong alignment. For other primitives with round functions that do not work on groups of bits as in AES, we talk about weak alignment or we say the primitive is unaligned. For an unaligned primitive, like Keccak, a computer assistance is required to prove strong upper bounds on the probability of differential and correlation of linear trails. Computer-aided tools can be classified into two categories: tools based on general-purpose solvers (like SAT solver or MILP) and dedicated tools. In this presentation we explain how we performed trail search with dedicated tools in a number of well-known permutations and specifically on Subterranean 2.0.

Panel: Quynh Dang, Frank Denis, Florian Mendel and Gilles Van Assche
Subject: For standards to be adopted in the real world, they should satisfy requirements of actual users, namely those that use these primitives in the protocols they design. In the past there has often been a mismatch in standards and the expectations/wishes of users. We will discuss ways to improve this situation. The current NIST standards FIPS 202 (SHA-3), SP800-185 (cSHAKE and modes) and expected ASCON standard could (and should) be extended to offer Keccak-based AEAD as well as a protocol design suite built around Ascon-p and Keccak-p. In the second part of the discussion session we will try to generate ideas what we can do to convince NIST and other standardization bodies, such as IETF or ISO to do just that.

Sponge and duplex construction usually require that the input message be padded. Previous work has managed to remove this padding at the cost of a restricted structure. Furthermore, earlier proofs of the duplex rely on composing the sponge, which incurs an extra efficiency cost, widely believed to be avoidable. We show that by revisiting older construction that make use of non-cryptographic permutation this costs can indeed be avoided.

This presentation provides a comprehensive overview of Mirror Theory through which Patarin, in 2003, conjectured a lower bound on the number of distinct solutions to a system of affine bivariate equations over a finite field. We begin by discussing the treatment of transcripts through graph-theoretic techniques proposed by Dutta et al. in 2019. Next, we move on to brief descriptions of security proofs of various message authentication codes (MACs), whose bounds have been analyzed within the framework of Patarin’s H-coefficients technique (or Hoang and Tessaro’s generalized expectation method) using Mirror Theory. These include the nEHtM of Dutta et al., 2019 – along with a refinement by Choi et al., 2020, PDMMAC of Chakraborti et al., 2021, and CLRW2 of Mennink, 2018 and Jha et al., 2020. Finally, we conclude with a discussion of the recent work by Dutta et al. in 2024, which finally proves a tight bound for Mirror Theory.

A tweakable wide blockcipher is a construction which behaves in the same way as a tweakable blockcipher, with the difference that the actual block size is flexible. Due to this feature, a tweakable wide blockcipher can be directly used as a strong encryption scheme that provides full diffusion when encrypting plaintexts to ciphertexts and vice versa. Furthermore, it can be the basis of authenticated encryption schemes fulfilling the strongest security notions. In this paper, we present three instantiations of the docked double decker tweakable wide blockcipher: ddd-AES, ddd-AES^+, and bbb-ddd-AES. These instances exclusively use similar building blocks as AES-GCM (AES and finite field multiplication), are designed for maximal parallelism, and hence, can make efficient use of existing hardware accelerators. ddd-AES is a birthday bound secure scheme, and ddd-AES^+ is an immediate generalization to allow for variable length tweaks. bbb-ddd-AES achieves security beyond the birthday bound provided that the same tweak is not used too often. Moreover, bbb-ddd-AES builds upon a novel conditionally beyond birthday bound secure pseudorandom function, a tweakable variant of the XOR of permutations, facilitating in the need to include a tweak in the AES evaluations without sacrificing flexibility in docked double decker. We furthermore introduce an authenticated encryption mode aaa specifically tailored to be instantiated with ddd-AES and bbb-ddd-AES, where special attention is given to how the nonce and associated data can be processed. We prove that this mode is secure in the nonce-respecting setting, in the nonce-misuse setting, as well as in the setting where random nonces are used.

Circulant matrices are a class of matrices which are valued for their efficient computation and strong algebraic properties. In symmetric crytography, they are used to construct circulant-like functions for the mixing layer of some cryptographic primitives. An example are Circulant Column Parity Mixers which are used in cryptographic primitives like Xoodoo and Keccak-f. These circulant-like functions have strong connections with commutative algebra, which we will explore in this talk.

We investigate properties of the map χ : 𝔽^ℤ₂ → 𝔽^ℤ₂, x ⟼ y defined by y_i = x_i + (x_i+1+1)x_i+2. It is used in several cryptographic algorithms, such as Keccak and Xoodoo. We discover, the order of the related maps χ_n, that χ is surjective and its full state diagram. By considering "the" vector space isomorphism between 𝔽ⁿ₂ and 𝔽_2ⁿ, one gets a univariate representation of the map χ_n. We discuss that χ_n is only a power function (x ⟼ x^e) when n =3, and the number of different univariate expressions with coefficients in the base field. Lastly, we extend the definition of χ to that of polynomial automorphisms and conjecture that the function rule for χ will only give a bijection if n is odd and the underlying finite field is 𝔽₂.

We investigate shift-invariant vectorial Boolean functions on n bits that are lifted from Boolean functions on k bits, for k smaller than n. We consider such functions that are not necessarily permutations, but are, in some sense, almost bijective, and their cryptographic properties. This is joint work with Jan Kristian Haugland.