Search

Given a differential characteristic and an existing plaintext pair that satisfies it (referred to as a right pair), generating additional right pairs at a reduced cost is an appealing prospect. The neutral bit technique, referred to as neutral differences throughout this paper, provides a solution to this challenge. Traditionally, the search for neutral differences has heavily depended on experimental testing, leading to limitations in the search range. In this work, we propose the neutral difference table and establish a link between boomerang cryptanalysis and neutral differences. Furthermore, we propose an automated search for neutral differences to address the problem of a limited search range of neutral differences, as previous approaches relied on experimental testing. This approach provides a basis for the subspace spanned by the neutral differences, and we apply this technique to both SPECK32 and LEA, where the predicted results closely match the experimental ones. Consequently, we present the improved differential-linear distinguishers for SPECK32 and LEA, along with the 18-round attacks on LEA192 and LEA256 with the lowest time complexity up to date.

The exclusive-or (XOR) hash combiner is a classical hash function combiner, which is well known as a good PRF and MAC combiner, and is used in practice in TLS versions 1.0 and 1.1. In this work, we analyze the second preimage resistance of the XOR combiner underlying two different narrow-pipe hash functions with weak ideal compression functions. To control simultaneously the behavior of the two different hash functions, we develop a new structure called multicollision-and-double-diamond. Multicollision-and-double-diamond structure is constructed using the idea of meet-in-the-middle technique, combined with Joux’s multicollision and Chen’s inverse-diamond structure. Then based on the multicollision-and-double-diamond structure, we present a second preimage attack on the XOR hash combiner with the time complexity of about O2n+12n/2+n−l2n−l+n−k2n−k+2l+1+2k+1) (n is the size of the XOR hash combiner and l and k are respectively the depths of the two inverse-diamond structures), less than the ideal time complexity O2n, and memory of about O2k+2l.

A lightweight block cipher, Saturnin, is an AES-like algorithm.In a resource-constrained environment, Saturnin can also provide high security.The impossible differential analysis on Saturnin was proposed.First, based on the structure of Saturnin, the sufficient condition of 3.5-round impossible differential distinguisher of Saturnin was presented and proved, and 270.1truncated impossible differential distinguishers could be quickly constructed by utilizing the sufficient condition.Then, from the constructed 270.1distinguishers, the 64 distinguishers could be picked out pointedly and classified into four types.Four attack trails could be obtained by appending two rounds before the four types of distinguishers.These four attack trails had the same plaintext structure and a number of common subkey bits.With the help of these two properties, the complexity of the attack scheme could be reduced.Combined with the analysis technologies such as early abort, present the 5.5-round impossible differential attack scheme with 2176.88chosen plaintexts, 2143.88 256-bit blocks, and 2176.915.5-round encryption.As so far, this is the known attack scheme for Saturnin against impossible differential attack.

Abstract The issue of security and privacy plays an important role in the Internet of Things (IoT) and directly affects its wide applications. In order to meet the security requirements in the IoT environment, a series of lightweight encryption schemes have been proposed. Meanwhile, cryptanalysis against these schemes is critical to the security of IoT. In this paper, a practical distinguishing attack on an IoT‐friendly lightweight cipher ALLPC is presented. Specifically, it is found that there exists a fixed point in the differential of ALLPC's S‐box, then a differential trail with a period of 14‐round has been proposed. By connecting to the periodic differential trail, a differential trail is constructed for the full‐round ALLPC with a probability of 2−24. Applying such property, one can distinguish the full‐round ALLPC block cipher from a random permutation in about 10 min on a laptop.

The security of AES-192 against multiple impossible differentials attack is studied in this paper. Based on two types of impossible differentials for 4-round AES, two 7-round attack trails of AES-192 with the same plaintext and ciphertext difference structure are proposed. A new optimum combination of these two attack trails is applied in our attack so that the plaintext pairs can be reused and data complexity can be reduced. Furthermore, this new optimum combination also can reduce the time complexity in the master key recovering phase. Our attack can also reduce the number of subkeys by key schedule considerations. For each attack trail, only 15-byte subkeys need to be guessed. Combined with the master key recovering technique based on the key schedule algorithm, the early abort technique for plaintext pairs, and the sieve method for plaintext pairs based on quick sort etc., we have obtained the best result so far in terms of time complexity for impossible differential cryptanalysis of AES-192. The time, memory, and data complexities are 2109.2 7-round AES encryptions, 286.5 bytes and 2106.3 chosen plaintexts, respectively.

Three personality types (resilient, overcontrolled, and undercontrolled) have been repeatedly verified across different languages and cultures, different personality models, and different stages of development. Undercontrollers are socially maladapted types with high impulsivity and low self-control. Research shows they are at risk for externalizing problems, such as aggressiveness, impulsivity, and antisocial behavior. The aim of this study was to develop an intervention to reduce externalizing problems of undercontrolled personality types in primary school students. Participants were 69 undercontrolled primary school students from two primary schools in North China. The experimental group underwent 14 weeks of systematic experiential mental health activities, while the control group performed typical daily classroom activities. Personality and externalizing problem behaviors were measured before the intervention, at the end of the intervention, and 4 months post-intervention. The results showed that the intervention significantly reduced the level of externalizing problems of undercontrolled primary school students. The effects of the intervention were maintained at the 4-month follow-up. This study provides some reference and suggestions on how to intervene in the externalizing problem behaviors of undercontrolled primary school students.

In this paper, we present a new structure-recovery cryptanalysis against 16-round Skipjack-like structure in which all the inner transformations are unknown. Our attack is divided into three phases. In the first phase, we use yoyo game to recover the outermost round functions. In the second phase, we use integral attack to achieve the round functions in round 2/3/4/13/14/15. A series of equations based on integral distinguishers is established to recover these inner transformations. However, effective integral distinguishers cannot be constructed for shorter rounds. For this reason, we propose a guess and determine attack to recover the residue round functions in the third phase. For n-bit Skipjack-like cipher, our attack can be executed within time complexity O(22.81×n/4) and data complexity O(2n/2), and thus can lead to a practical attack against 16-round Skipjack cipher.

Deoxys is a third-round candidate of the CAESAR authenticated encryption competition. In this paper, we present the first cryptanalysis of Deoxys in the single-key model. Specifically, we propose a multiple impossible differentials attack of 8-round Deoxys-BC-256, which can reuse the plaintexts to sieve subkeys, so that the sieving efficiency can be improved. Meanwhile, we improve the process of sieving subkeys and utilize various techniques, including tweak schedule considerations, early abort technique, the new early abort technique, and so on, which help to reduce the complexity. The time, memory, and data complexities are 2123.9 memory accesses, 299.2 bytes, and 2117 chosen plaintexts, respectively.

In this paper, we provide two types of pattern matrices for the diffusion layer P, both can be used as classification criteria for the substitution-permutation network (SPN) structures: if the pattern matrices of distinct SPN structures are equal, then these structures may have the same impossible differential (ID)/zero correlation linear hull (ZC) and the same differential/linear active S-boxes. We introduce some interesting properties of the pattern matrices. Applying our results, we arrive at several interesting facts. First, all the SPN structures with MDS-type diffusion layers fall into the same class and have the same ID/ZC/minimum number of active S-boxes. Second, we provide several interesting properties of pattern matrices and build the links between the P-layer and that after several popular operations. Finally, we investigate the properties of pattern matrices for bit shuffles, the pattern matrices keep the same if and only if the n-partition characteristics of them are equal. Our results are helpful in the designing of block ciphers.

In this paper, we present preimage attacks on several hashing modes instantiating reduced-round LBlock. It is observed that the omission of the network twist in the last round and the diffusion of the permutation in round function are the key points for our successful attack. First, to guarantee the validity of our attack, we prove one proposition on the round function. Then, utilizing the property of LBlock and several meet-in-the-middle techniques, we present a preimage attack on Davies-Meyer hashing mode instantiating 13-round LBlock, of which the time complexity is about O(255.4) 13-round compression function computations, less than the ideal complexity O(264) and the memory complexity is about 212 32-bit memory. Furthermore, we extend our results to the Matyas-Meyer-Oseas mode and MP mode with some changes. Finally, we convert the preimage attack into preimage attack or second preimage attack on the corresponding hash functions with Merkle-Damgard structure.

Loiss is a novel byte-oriented stream cipher proposed in 2011. In this paper, based on solving systems of linear equations, we propose an improved Guess and Determine attack on Loiss with a time complexity of 2231 and a data complexity of 268, which reduces the time complexity of the Guess and Determine attack proposed by the designers by a factor of 216. Furthermore, a related key chosen IV attack on a scaled-down version of Loiss is presented. The attack recovers the 128-bit secret key of the scaled-down Loiss with a time complexity of 280, requiring 264 chosen IVs. The related key attack is minimal in the sense that it only requires one related key. The result shows that our key recovery attack on the scaled-down Loiss is much better than an exhaustive key search in the related key setting.