#BlockCipher
LightNews LightNews
filippo.abyssdomain.expert
One more paper by the AWS team, showing it's safe to use non-repeating keys derived from a PRP beyond the birthday bound (even if they have unnaturally no collisions).

The implication is that it's safe to encrypt more than 2^64 messages with XAES-256-GCM. Great work!

eprint.iacr.org/2025/878
Blockcipher-Based Key Derivation without PRP/PRF Switching
We examine the use of blockcipher-based key derivation beyond the birthday bound, arguing that the analysis step of PRP/PRF switching can be eliminated in many cases. To support this, we consider a mo...
eprint.iacr.org
May 19, 2025 at 9:03 PM
eprint.ing.bot
Blood MERIDIAN: a blockcipher that is not a blockcipher (JP Aumasson) ia.cr/2026/1818
Abstract. MERIDIAN is a 128-bit blockcipher proposed as a lightweight AES alternative. We show that its “Directional Substitution” layer is not injective by giving an explicit collision. This yields a full 12-round collision for every key. Consequently, no keyed instance of MERIDIAN is a permutation, so no decryption function can invert encryption on all plaintexts, and its blockcipher and PRP security claims fail. We additionally identify a one-round differential that exceeds the claimed bound by a factor 13.37.
August 28, 2026 at 5:05 AM
aumasson.jp
I used GPT to break an ePrint cipher
www.bfswa.blog/p/blood-meri...
Blood MERIDIAN
LLM cryptanalysis of a blockcipher that is isn't a blockcipher
www.bfswa.blog
August 26, 2026 at 3:55 PM
eprint.ing.bot
Blockcipher-Based Key Derivation without PRP/PRF Switching (Fabrice Benhamouda, Shai Halevi, Panos Kampanakis, Hugo Krawczyk) ia.cr/2025/878
Abstract. We examine the use of blockcipher-based key derivation beyond the birthday bound, arguing that the analysis step of PRP/PRF switching can be eliminated in many cases. To support this, we consider a modified “ideal model” for keying cryptographic applications in the multi-instance setting, where keys are chosen to be random , rather than completely independent). Our analysis shows that typical cryptographic applications remain secure in this model. One consequence is that it is typically safe to derive close to 2^(n) keys using an n-bit blockcipher in counter mode. In particular, considering the practice of nonce-derived keys for authenticated encryption, our results imply that modes such as XAES-256-GCM that use CMAC-based key derivation are safe to use with more than 2⁶⁴ distinct nonces.
May 19, 2025 at 10:10 AM
eprint.ing.bot
Efficient Instances of Docked Double Decker With AES (Christoph Dobraunig, Krystian Matusiewicz, Bart Mennink, Alexander Tereschenko) ia.cr/2024/084
Abstract. A tweakable wide blockcipher is a construction which behaves in the same way as a tweakable blockcipher, with the difference that the actual block size is flexible. Due to this feature, a tweakable wide blockcipher can be directly used as a strong encryption scheme that provides full diffusion when encrypting plaintexts to ciphertexts and vice versa. Furthermore, it can be the basis of authenticated encryption schemes fulfilling the strongest security notions. In this paper, we present two instantiations of the docked double decker tweakable wide blockcipher: ddd-AES and bbb-ddd-AES. Both instances exclusively use similar building blocks as AES-GCM (AES and finite field multiplication), are designed for maximal parallelism, and hence, can make efficient use of existing hardware accelerators. Moreover, bbb-ddd-AES builds upon a novel beyond birthday bound secure pseudorandom function, a tweakable variant of the XOR of permutations, facilitating in the need to include a tweak in the AES evaluations without sacrificing flexibility in docked double decker.
January 19, 2024 at 8:14 AM
eprint.ing.bot
Blockcipher-Based Key Commitment for Nonce-Derived Schemes (Panos Kampanakis, Shai Halevi, Nevine Ebeid, Matt Campagna) ia.cr/2025/758
Abstract. AES-GCM has been the status quo for efficient symmetric encryption for decades. As technology and cryptographic applications evolved over time, AES-GCM has posed some challenges to certain use-cases due to its default 96-bit nonce size, 128-bit block size, and lack of key commitment. Nonce-derived schemes are one way of addressing these challenges: Such schemes derive multiple keys from nonce values, then apply standard AES-GCM with the derived keys (and possibly another 96-bit nonce). The approach overcomes the nonce length and data limit issues since each derived key is only used to encrypt a few messages. By itself, the use of nonce-derived keys does not address key commitment, however. Some schemes chose to include a built-in key commitment mechanism, while others left it out of scope. In this work, we explore efficient key commitment methods that can be added to any nonce-derived scheme in a black-box manner. Our focus is on options that use the underlying block cipher and no other primitive, are efficient, and only use standard primitives which are FIPS-approved. For concreteness we focus here specifically on adding key commitment to XAES-256-GCM, a nonce-scheme originally proposed by Filippo Valsorda, but these methods can be adapted to any other nonce-derived scheme. We propose an efficient CMAC-based key commitment solution, and prove its security in the ideal-cipher model. We argue that adding this solution yields a FIPS-compliant mode, quantify the data and message length limits of this mode and compare this combination to other nonce-derived modes. We also benchmark our key committing XAES-256-GCM performance. Image showing part 2 of abstract.
May 3, 2025 at 8:13 PM
eprint.ing.bot
Robust AE With Committing Security (Viet Tung Hoang, Sanketh Menda) ia.cr/2024/1542
Abstract. There has been a recent interest to develop and standardize Robust Authenticated Encryption (Robust AE) schemes. NIST, for example, is considering an Accordion mode (a wideblock tweakable blockcipher), with Robust AE as a primary application. On the other hand, recent attacks and applications suggest that encryption needs to be committing. Indeed, committing security isalso a design consideration in the Accordion mode. Yet it is unclear how to build a Robust AE with committing security. In this work, we give a modular solution for this problem. We first show how to transform any wideblock tweakable blockcipher TE to a Robust AE scheme SE that commits just the key. The overhead is cheap, just a few finite-field multiplications and blockcipher calls. If one wants to commit the entire encryption context, one can simply hash the context to derive a 256-bit subkey, and uses SE on that subkey. The use of 256-bit key on SE only means that it has to rely on AES-256 but doesn’t require TE to have 256-bit key. Our approach frees the Accordion designs from consideration of committing security. Moreover, it gives a big saving for several key-committing applications that don’t want to pay the inherent hashing cost of full committing. Image showing part 2 of abstract.
October 4, 2024 at 8:49 AM
eprint.ing.bot
Multiforked Iterated Even-Mansour and a Note on the Tightness of IEM Proofs (Elena Andreeva, Amit Singh Bhati, Andreas Weninger) ia.cr/2025/1543
Abstract. The Iterated Even-Mansour (IEM) construction was introduced by Bogdanov et al. at EUROCRYPT 2012 and can be seen as an abstraction or idealization of blockciphers like AES. IEM provides insights into the soundness of this blockcipher structure and the best possible security for any number of rounds. IEM with r permutations on n-bit blocks is secure up to q ≈ 2^(rn/(r + 1)) queries to the cipher and each permutation. Forkciphers, introduced at ASIACRYPT 2019 as expanding symmetric ciphers, have since found applications in encryption, authenticated encryption and key derivation. Kim et al. (ToSC 2020) proposed the first IEM-style forkcipher, FTEM, but their security proof is limited to a 2-round design with tweak processing based on XORing AXU hashes. This offers limited insight into practical forkciphers like ForkSkinny, which use 40 to 56 rounds and a different tweak schedule. No security results currently exist for forked IEM constructions with more than two rounds. We propose a generalized forked IEM construction called GIEM which integrates any tweakey schedule (including tweak-dependent round keys or constant keys) and thus encompasses IEM, FTEM and similar IEM-related constructions. We define three forkcipher-related instantiations, FEM (2 branches and no tweaks), FTEMid (2 branches and idealized tweakey schedule) and MFTEM (unlimited branches and AXU-based tweakey schedule). We prove that each construction achieves security similar to the respective non-forked construction. This shows the soundness of the forking design strategy and can serve as a basis for new constructions with more than two branches. In their work, Bogdanov et al. also propose an attack against IEM using q ≈ 2^(rn/(r + 1)) queries, which is used in a number of follow-up works to argue the tightness of IEM-related security bounds. In this work, we demonstrate that the attack is ineffective with the specified query complexity. To salvage the purported tightness results, we turn to an attack by Gazi (CRYPTO 2013) against cascading block ciphers and provide the necessary parameters to apply it to IEM. This validates the tightness of the known IEM security bound. Image showing part 2 of abstract. Image showing part 3 of abstract.
August 30, 2025 at 5:49 PM
gsmcracksguru.bsky.social
Block Cipher Tool V1.0.0.1

📥 Download: go.cyberslinks.com/r.php?id=Cxd...

1. Samsung Services
2. Fastboot Operations (New)
3. MediaTek (MTK) Universal
4. Android General & App Manager

#BlockCipher #MDMRemove #mediatekTool #samsungTool #androidrepair
December 17, 2025 at 11:07 AM
gsmcracksguru.bsky.social
Block Cipher Tool V1.0.0.1

📥 Download: go.cyberslinks.com/r.php?id=Cxd...

1. Samsung Services
2. Fastboot Operations (New)
3. MediaTek (MTK) Universal
4. Android General & App Manager

#BlockCipher #MDMRemove #mediatekTool #samsungTool #androidrepair
November 19, 2025 at 11:00 AM
mirohaller.bsky.social
Talk 2 at #CAW in the session on large-scale deployed cryptography:
Shai Halevi or Nevine Ebeid (or both) from AWS on "Blockcipher-Based Key Commitment for Nonce-Derived Schemes"; towards the FIPS-compliant deployment of XAES-256-GCM.

caw.cryptanalysis.fun
March 18, 2025 at 1:22 AM
techgsmsoftwares.bsky.social
Block Cipher Tool V1.0.0.1

📥 Download: go.cyberslinks.com/r.php?id=Cxd...

1. Samsung Services
2. Fastboot Operations (New)
3. MediaTek (MTK) Universal
4. Android General & App Manager

#BlockCipher #MDMRemove #mediatekTool #samsungTool #androidrepair
December 17, 2025 at 11:09 AM
techgsmsoftwares.bsky.social
Block Cipher Tool V1.0.0.1

📥 Download: go.cyberslinks.com/r.php?id=Cxd...

1. Samsung Services
2. Fastboot Operations (New)
3. MediaTek (MTK) Universal
4. Android General & App Manager

#BlockCipher #MDMRemove #mediatekTool #samsungTool #androidrepair
November 19, 2025 at 11:02 AM
renzume.com
Learn block cipher cryptanalysis through practical AES implementation exercises
https://davidwong.fr/blockbreakers/
#cryptography #aes #security #education #blockcipher
March 4, 2025 at 8:22 PM
eprint.ing.bot
Secure Onion Encryption and the Case of Counter Galois Onion (Jean Paul Degabriele, Alessandro Melloni, Martijn Stam) ia.cr/2025/2017
Abstract. The recently introduced Counter Galois Onion (CGO) is a new symmetric onion encryption scheme designed to replace the current one used by Tor, with integration in Tor’s Rust implementation Arti ongoing. Intuitively, CGO uses an updatable tweakable split-domain cipher as its building block, which provides it with the necessary non-malleability properties while attaining better performance than the alternative approach of realising it from a wide blockcipher (with full SPRP security). However, onion encryption as used in Tor with various functionality features and security trade-offs, is not that well-studied by the cryptographic community. As a result, the requirements of this important primitive which protects the privacy of millions of users on a daily basis, is not well understood and whether CGO fulfills all its security goals unclear. In this work, we initiate the study of real-world symmetric onion encryption by presenting a new security model capturing Tor’s leaky pipes functionality, associated data, and partial forward security, neither of which were covered previously. We then use this new security model to solidify the security claims of CGO in the forward direction by proving that if the underlying primitive is a suitably secure tweakable split-domain cipher, then CGO is a secure onion encryption scheme. Image showing part 2 of abstract.
November 1, 2025 at 2:04 AM
eprint.ing.bot
Tweakable Permutation-based Luby-Rackoff Constructions (Bishwajit Chakraborty, Abishanka Saha) ia.cr/2025/914
Abstract. Liskov, Rivest, and Wagner, in their seminal work, formulated tweakable blockciphers and proposed two blockcipher-based design paradigms, LRW1 and LRW2, where the basic design strategy is to xor the masked tweak to the input and output of a blockcipher. The 2-round cascaded LRW2 and 4-round cascaded LRW1 have been proven to be secure up to O(2^(3n/4)) queries, but n-bit optimal security still remains elusive for these designs. In their paper, Liskov also posed an open challenge of embedding the tweak directly in the blockcipher, and to address this, Goldenberg et al. introduced the tweakable Luby-Rackoff (LR) constructions. They showed that if the internal primitives are random functions, then for tweaks with t blocks, the construction needs t + 6 rounds to be optimally n-bit CPA secure and 2t + 8 rounds to be optimally n-bit CCA secure, where respectively t and 2t rounds were required to process the tweaks. Since blockciphers can be designed much more efficiently than pseudorandom functions, in many practical applications the internal primitives of LR ciphers are instantiated as blockciphers, which however would lead to a birthday-bound factor, which is not ideal for say lightweight cryptography. This paper addresses the following two key questions affirmatively: (1) Can Goldenberg et al.’s results be extended to LR constructions with random permutations as internal primitives without compromising the optimal n-bit security? (2) Can the number of rounds required for handling long tweaks be reduced? We formally define TLR-compatible functions, for processing the tweak, which when composed with 4-rounds and 5-rounds of LR construction with random permutations as internal primitives gives us respectively n-bit CPA and CCA secure tweakable permutations. For the security analysis, we proved general Mirror Theory result for three permutations. We also propose instantiating TLR-compatible functions with one round LR where a permutation (resp, two AXU hash functions) is used to mask single-block tweaks (resp., variable-length tweaks), thus proposing the n-bit CPA (resp., CCA) secure tweakable permutation candidates, TLRP5 and TLRP5+ (resp., TLRP7 and TLRP7+), using 5 (resp., 7) LR rounds, which is a significant reduction from the tweak-length-dependent results of Goldenberg et al. As a corollary, we also show n-bit CPA (resp., CCA) security of 5-rounds (resp. 7-rounds) permutation-based LR construction, which is quite an improvement over the existing 2n/3-bit security proved by Guo et al. Image showing part 2 of abstract. Image showing part 3 of abstract.
May 23, 2025 at 2:41 AM
eprint.ing.bot
Pencil: A Domain-Extended PRF with Full n-bit Security \ for Strengthening GCM and More (Ritam Bhaumik, Jean Paul Degabriele) ia.cr/2025/383
Abstract. We consider the problem of constructing efficient pseudorandom functions with Beyond-Birthday-Bound (BBB) security from blockciphers. More specifically, we are interested in variable-output-length pseudorandom functions (PRF) whose domain is twice that of the underlying blockcipher. We present two such constructions, Pencil and ♯Pencil, which provide weak PRF and full PRF security, respectively, where both achieve full n-bit security. While several recent works have focused on constructing BBB PRFs from blockciphers, much less attention has been given to weak PRF constructions which can potentially be constructed more efficiently and still serve as a useful primitive. Another understudied problem in this domain, is that of extending the domain of a BBB PRF, which turns out to be rather challenging. Besides being of theoretical interest in itself, this is also a very practical problem. Often, the input to the BBB PRF is a nonce, but random nonces are much easier to handle in practice as they do not require maintaining state—which can be very cumbersome in distributed systems and encrypted cloud storage. Accordingly, in order to maintain a BBB security bound, one requires random nonces of size between 1.5n and 2n bits long and corresponding BBB (weak) PRF constructions that admit matching input sizes. NIST has recently announced a pre-draft call for comments to standardise AEAD schemes that can encrypt larger amounts of data and admit larger nonces. The call lists two approaches. The first is to define an analogue of GCM using a 256-bit blockcipher, and the second is based on a recent proposal by Gueron, to extend GCM with a key derivation function (KDF) called DNDK to increase its security. In essence, DNDK is a BBB-secure expanding weak pseudorandom function with a domain size of 192 bits that is realised from AES. Our work makes relevant contributions to this domain in two important ways. Firstly, an immediate consequence of our work is that one can construct a GCM analogue with BBB security from ♯Pencil, without resorting to a 256-bit blockcipher. Our second contribution is that ♯Pencil can be used as a KDF in combination with GCM in an analogous manner to DNDK-GCM. However, ♯Pencil being a full PRF as opposed to DNDK which is only a weak PRF, allows one to prove the KDF-GCM composition secure as an AEAD scheme. Finally, when contrasting Pencil and DNDK as weak PRFs with comparable parameters, our construction requires only half the blockcipher calls. Image showing part 2 of abstract. Image showing part 3 of abstract.
March 4, 2025 at 8:03 AM
eprint.ing.bot
On Tweakable Correlation Robust Hashing against Key Leakages (Chun Guo, Xiao Wang, Kang Yang, Yu Yu) ia.cr/2024/163
Abstract. We continue the study of blockcipher-based (tweakable) correlation robust hash functions, which are central building blocks of circuit garbling and oblivious-transfer extension schemes. As results, we first enhance the multi-user tweakable correlation robust notion of Guo et al. (CRYPTO 2020) with a {} that tells the adversary whether a certain user key satisfies the adversarially-chosen predicate. We then investigate the state-of-the-art hash construction of Guo et al. with respect to our new security definition, providing security proof as well as matching attacks. As an application, we exhibit an OT extension protocol with non-trivial multi-user security.
February 6, 2024 at 11:00 AM
eprint.ing.bot
Towards Minimizing Non-linearity in Type-II Generalized Feistel Networks (Yuqing Zhao, Chun Guo, Weijia Wang) ia.cr/2023/1295
Abstract. Recent works have revisited blockcipher structures to achieve MPC- and ZKP-friendly designs. In particular, Albrecht et al. (EUROCRYPT 2015) first pioneered using a novel structure SP networks with partial non-linear layers (P-SPNs) and then (ESORICS 2019) repopularized using multi-line generalized Feistel networks (GFNs). In this paper, we persist in exploring symmetric cryptographic constructions that are conducive to the applications such as MPC. In order to study the minimization of non-linearity in Type-II Generalized Feistel Networks, we generalize the (extended) GFN by replacing the bit-wise shuffle in a GFN with the stronger linear layer in P-SPN and introducing the key in each round. We call this scheme Generalized Extended Generalized Feistel Network (GEGFN). When the block-functions (or S-boxes) are public random permutations or (domain-preserving) functions, we prove CCA security for the 5-round GEGFN. Our results also hold when the block-functions are over the prime fields F_p, yielding blockcipher constructions over (F_p)^*.
September 28, 2023 at 3:21 AM