#Cryptanalysis
LightNews LightNews
cosic.bsky.social
In April, Tim Beyne and Vincent Rijmen from COSIC taught a two-day course on linear cryptanalysis for Master's students at KU Leuven. We recorded it and are now sharing the lectures with everyone: 8 videos on YouTube.
#Cryptography
🎥 Watch it here: www.youtube.com/playlist?lis...
Linear cryptanalysis course April 16-17, 2026 - YouTube
This course is an introduction to the security analysis (cryptanalysis) of symmetric-key cryptography. Instead of giving a broad overview, the approach follo...
www.youtube.com
November 10, 2026 at 3:10 PM
rival-elf.bsky.social
The twitter thread about the GPRS GEA algorithms was also based on a paper that had just been published at the time as well, "Cryptanalysis of the GPRS Encryption Algorithms GEA-1 and GEA-2" link.springer.com/chapter/10.1...
November 10, 2026 at 8:51 PM
robotranny.soy
theyre always cracking them by finding the secret keyword instead of digraph frequency analysis too these protagonists need to read a cryptanalysis textbook
November 6, 2026 at 2:40 AM
rwintermute.com
Advancing the frontier of cryptanalysis
Today, we’re sharing new research from @GoogleDeepMind showing how AI agents can accelerate cryptanalysis, or the science of stress-testing encryption. Our team used AI agents, guided by human supervi...
www.linkedin.com
November 8, 2026 at 11:41 PM
quantum-journal.bsky.social
Freshly published in Quantum: Cryptanalysis of Isogeny-Based Quantum Money with Rational Points by Hyeonhak Kim, Donghoe Heo, Seokhie Hong, Sangjin Lee, and Suhri Kim doi.org/10.22331/q-2...
Cryptanalysis of Isogeny-Based Quantum Money with Rational Points
Hyeonhak Kim, Donghoe Heo, Seokhie Hong, Sangjin Lee, and Suhri Kim, Quantum 10, 2263 (2026). Quantum money is a representative application in cryptography that utilizes quantum technology to achieve...
quantum-journal.org
November 11, 2026 at 9:15 AM
wavebidder.bsky.social
gave my players in a d&d campaign a vignere cipher, and they ignored the hints for where to go get the key and just did cryptanalysis. Was pretty proud of them
November 6, 2026 at 4:27 AM
isec-tugraz.bsky.social
🎉 Congratulations to Marcel Nageler! 🎉

He successfully defended his #PhD thesis “Cryptanalysis of Symmetric Primitives With Fewer Assumptions”! 🎉

We wish him the best in his future endeavors!
November 11, 2026 at 12:30 PM
eprint.ing.bot
Cryptanalysis of MinRank 2.0 (Nicolas Aragon, Maxime Bros, Ray Perlner, Daniel Smith-Tone, Javier Verbel) ia.cr/2026/2733
Abstract. MinRank is an NP-complete problem underlying the security of several post-quantum schemes. It is the hardness assumption of the NIST second-round signature candidate Mirath and of the encryption schemes of Chatterjee et al. and Debris-Alazard et al. at Eurocrypt 2026. Moreover, it is ubiquitous in the cryptanalysis of multivariate schemes, among them the third-round candidates UOV, MAYO, QR-UOV, and SNOVA. In this work, we revisit the attacks on MinRank. On the combinatorial side, we improve the polynomial part of the kernel-search attack by sharing its linear algebra across guesses, which lowers its cost by 3 to 6 bits on the Mirath parameters and the Courtois challenges, and by up to 3 bits in combination with the hybrid approach. With the improved attack, we solved Courtois challenge~D, open since 2001: an instance over 𝔽₂ with 19 × 19 matrices, 81 unknowns, and target rank 10, solved in 11434 CPU days, an estimated 2⁶¹ bit opetations. Our multi-threaded C++ code is publicly available. On the algebraic side, we show that the complexity of the Kipnis–Shamir (KS) attack is less understood than the literature suggests: the existing estimates rely on a generic Hilbert series that does not predict the rank of the Macaulay matrices of the KS equations. We prove a lower bound on the corank that explains the discrepancy, show that the attack requires a reduced instance with k ≤ m − r, and derive corrected complexity estimates, which are 1 to 24 bits above the best other attack on every Mirath parameter set. We also extend the Support-Minors and Minors modelings with the field equations, which lowers their estimates over small fields: for q = 2 and m = n = 22, by 9 to 205 bits for Support-Minors and by 17 to 278 bits for Minors. The rank predictions behind the algebraic estimates are stated as assumptions and verified experimentally. Image showing part 2 of abstract.
November 9, 2026 at 2:14 AM
quantum-news.bsky.social
Cryptanalysis of Isogeny-Based Quantum Money with Rational Points

Read more:
https://quantum-journal.org/papers/q-2026-11-10-2263/
Cryptanalysis of Isogeny-Based Quantum Money with Rational Points
Hyeonhak Kim, Donghoe Heo, Seokhie Hong, Sangjin Lee, and Suhri Kim, Quantum 10, 2263 (2026). Quantum money is a representative application in cryptography that utilizes quantum technology to achieve security that is unattainable with classical systems. Since the theoretical proposal…
quantum-journal.org
November 10, 2026 at 4:57 PM
geeknik.bsky.social
DeepMind’s supervised AI found theoretically faster attacks on legacy RSA, not a skeleton key for modern encryption. Useful cryptanalysis, sentenced to live under a much louder headline.
Google DeepMind finds 1,600x faster way to expose encryption flaws
Google DeepMind researchers used agents to uncover cryptographic techniques that expose legacy RSA weaknesses up to 1,600 times faster.
interestingengineering.com
November 9, 2026 at 8:47 PM
mimirwolv.bsky.social
that makes differential *semantic* cryptanalysis just a matter of optimal block cipher search
mimirwolv.bsky.social mimir @mimirwolv.bsky.social · 7d
cat,um. Inside of a refrigeration cycle, lasers shoot spinors at YOU!

gotta, to conserve etendue+
November 4, 2026 at 3:37 PM
undercode.bsky.social
Google DeepMind’s AI Cryptanalysis Breakthrough: Unpacking Legacy RSA Factoring vs NIST Post-Quantum Cryptography + Video

Introduction: Recent reporting surrounding Google DeepMind’s cryptanalysis research has led to widespread speculation about the vulnerability of modern encryption systems. In…
Google DeepMind’s AI Cryptanalysis Breakthrough: Unpacking Legacy RSA Factoring vs NIST Post-Quantum Cryptography + Video
Introduction: Recent reporting surrounding Google DeepMind’s cryptanalysis research has led to widespread speculation about the vulnerability of modern encryption systems. In the announcement titled “Advancing the frontier of cryptanalysis,” Pushmeet Kohli details how human-guided AI agents achieved notable efficiencies in breaking specific public-key parameters. However, these attacks target legacy RSA implementations, leaving NIST-standardized Post-Quantum Cryptography (PQC) algorithms intact and secure.
undercodetesting.com
November 7, 2026 at 1:25 AM
quantum-journal.org.web.brid.gy
Cryptanalysis of Isogeny-Based Quantum Money with Rational Points
Quantum 10, 2263 (2026). https://doi.org/10.22331/q-2026-11-10-2263 Quantum money is a representative application in cryptography that utilizes quantum technology to achieve security that is unattainable with classical systems. Since the theoretical proposal by Wiesner in 1983, the most recent instantiation is the quantum money using class group actions on elliptic curves, proposed by Montgomery and Sharif in Asiacrypt'24. In this work, we propose a concrete cryptanalysis by leveraging the efficiency of evaluating division polynomials with the coordinates of rational points, offering a speedup of $O(\log^4p)$ compared to the brute-force attack. While the resulting attack still runs in exponential time, our method provides the first nontrivial algorithmic insight into their structural hardness. Furthermore, due to the algebraic properties of rational points and quadratic twists, our technique naturally yields a more efficient verification procedure for the underlying quantum money. We believe this new line of analysis opens promising directions for future research in elliptic-curve-based quantum cryptography.
quantum-journal.org
November 10, 2026 at 8:41 PM
quantum-news.bsky.social
Researchers speed up attacks on isogeny-based quantum money

Read more:
https://quantumzeitgeist.com/asiacrypt24-isogeny-based-quantum-money-speed/
Researchers Speed Up Attacks On Isogeny-based Quantum Money
Researchers detail faster cryptanalysis of Isogeny-Based Quantum Money schemes, potentially weakening their security.
quantumzeitgeist.com
November 11, 2026 at 12:54 PM
beetific.ca
Some near future zoomer brainrot version of this

en.wikipedia.org/wiki/The_wor...
US Navy procedure called for the padding to be added to the start and end of the message, which were vulnerable to cryptanalysis because of the use of common phrases and words (such as "Yours sincerely") in those sections.[10] The words chosen for padding should have been obviously irrelevant to the actual message, but Nimitz's enciphering clerk used a phrase that "[just] popped into my head."[11] Historians note similarity to Lord Tennyson's poem "The Charge of the Light Brigade" about the eponymous battle, which was also fought on October 25 (1854), as the poem twice contains the phrase "All the world wonder’d".
November 10, 2026 at 2:55 AM
informaq.bsky.social
Recent structural attacks on Classic McEliece demonstrate key-recovery costs below claimed security levels across all parameter sets. Germany's BSI now advises against new deployments, recommending ML-KEM and FrodoKEM instead.

#PostQuantumCryptography #QuantumSecurity #Cryptanalysis
BSI Discontinues Classic McEliece Recommendation Following Cryptanalytic Breakthroughs
postquantum.com
November 8, 2026 at 8:17 PM
eprint.ing.bot
Differential-Neural Cryptanalysis of ChaCha and Related ARX Stream Ciphers (Nimai Parsa, Nitin Kumar Sharma) ia.cr/2026/2382
Abstract. The paper presents the first-ever differential neural cryptanalysis of the Latin Dances family of Salsa, ChaCha, and Forró. First, we provide a systematic differential-neural study of the ARX stream cipher ChaCha. We train and compare six neural architectures, viz.: Gohr’s residual network, DBitNet, an Inception network, an MLP-ResNet, an SE-ResNet, and a self-attention network on a 3-round reduced version of ChaCha. We train in both the classical single-pair setting and a multi-pair setting that combines up to sixteen ciphertext pairs through a log-odds rule. We extend the study for breadth to other ARX ciphers, Salsa, *ChaCha, and Forró. We provide the first-ever distinguisher for 4.5 rounds of Salsa with accuracy of 0.53 for one pair and 0.60 for 16 pairs. Also, for Forró the first-ever distinguisher for 1.25 rounds of Salsa with accuracy of 1 for single and multiple pairs. We also introduce a family of experimental round-1-XOR variants () that isolate the contribution of the first round’s diffusion to distinguishability. Finally, we investigate the trained 3-round ChaCha distinguisher with four explainability experiments and show that, although the output difference is its dominant feature, it is not a pure differential distinguisher: its decision is interpretable as a learned mixture of round-1 truncated differentials, five of which already account for 99% of the high-confidence ciphertext pairs. Image showing part 2 of abstract.
November 9, 2026 at 1:35 AM
intcyberdigest.bsky.social
Source: linkedin.com/posts/googledeepmi…

Don't miss out on any news, join our newsletter: internationalcyberdigest.com/ne…

Be sure to join our TG channel: t.me/IntCyberDigest
Advancing the frontier of cryptanalysis | Google DeepMind | 30 comments
We’re sharing new research demonstrating how AI agents can accelerate cryptanalysis - the science of stress-testing encryption. 🔒 Guided by humans, our models uncovered two major weaknesses in legacy 1024-bit RSA cryptosystems. While modern 2048-bit systems remain safe from these specific exploits, this work highlights a key shift. As we enter a new era of AI-enabled math and computation, we can no longer rely on historical hardness assumptions and must continuously stress-test cryptographic standards. Our VP Science Pushmeet Kohli explains more ↓ https://lnkd.in/eKU6VKMp | 30 comments on LinkedIn
www.linkedin.com
November 8, 2026 at 9:02 PM
eprint.ing.bot
Differential Cryptanalysis of SPEEDY: Revised Security Evaluation and Improved Key Recovery Attack (Xinwei Yu, Wentao Zhang, Zairui Zhang, Chunning Zhou) ia.cr/2026/2746
Abstract. The resistance of a block cipher against differential cryptanalysis (DC) is a fundamental criterion for evaluating its security. SPEEDY is a family of low-latency SPS-type block ciphers designed by Leander et al. The designers presented two evaluations of SPEEDY against DC: the first restricted 1-bit-to-1-bit differential propagations through the S-box and used the higher-order branch numbers to estimate the maximum expected differential probability (EDP) of differential trails; the second imposed a structural restriction and assumed that all 1-bit-to-1-bit propagations through an active S-box are possible to estimate the minimum number of active S-boxes. Zhang later exhibited a counterexample to the designers’ first evaluation and introduced the notion of partition branch number, relaxing some of the propagation restrictions to allow multi-bit-to-1-bit transitions on some S-box layers and refining the evaluation. However, these evaluations consider only restricted spaces of differential characteristics and therefore inaccurately estimate the security of SPEEDY against DC, which means that the resistance of SPEEDY against DC remains unclear so far. To address this problem, we propose an efficient search method based on search patterns. Unlike previous evaluations, our method imposes no a priori structural restrictions on the allowed differential characteristics; it uses computational pruning to keep the search tractable and performs a conservative security evaluation of the pruned region, thereby providing an accurate evaluation over the global space. At the framework level, we decompose an r-round differential characteristic into an (r-1)-round core trail and an r-round extended trail. By extending a core trail independently at both ends, the two additional S-box layers are handled by two separate models, each containing only one S-box layer and solvable efficiently. At the implementation level, we further introduce a short-round reuse via hash-map concatenation technique, which concatenates short-round core trails to construct longer-round core trails, thereby avoiding expensive long-round MILP models. For 4 rounds, we narrow the minimum number of active S-boxes from the previously reported 35 to [33,34] and find a characteristic with 34 active S-boxes outside the previous search spaces. We also obtain the highest-probability differential characteristics known to date for 2 to 5 rounds. In particular, the 2-, 3-, and 4-round characteristics disprove the designers’ branch-number-based security claims. Furthermore, using the quasidifferential framework, we evaluate the found characteristics and obtain several 5-round distinguishers outperforming those used in existing key recovery attacks in terms of EDP. Finally, we optimize the probabilistic extension parameters used in a previous key recovery attack, which yields the best known key recovery attack on SPEEDY-7-192, with data complexity 2^(173.48) and time complexity 2^(173.69) encryptions. Image showing part 2 of abstract. Image showing part 3 of abstract.
November 9, 2026 at 2:16 AM
scholar42.bsky.social
Keep the scale straight: 1024-bit RSA was retired years ago, and 2048-bit keys are untouched. The real story is method. Agents reproduced a 1,380 core-year computation in 391, with the math checked in Lean 4. Cryptanalysis just got a faster pair of hands.
November 8, 2026 at 4:01 PM
fercerezales.bsky.social
en.wikipedia.org/wiki/Cryptan...
Cryptanalysis of the Enigma - Wikipedia
en.wikipedia.org
November 2, 2026 at 2:16 PM
eprint.ing.bot
Dual Coppersmith: Finding Small Roots Without Multivariate Polynomial Systems (Taehun Kang, Jebin Kim, Changmin Lee, JeongHwan Lee) ia.cr/2026/2740
Abstract. The multivariate Coppersmith algorithm is a central tool in public-key cryptanalysis for finding a small hidden root of modular polynomial equations. It consists of two stages. First, a lattice-reduction (LR) stage constructs auxiliary equations satisfied by the hidden root over ℤ. Second, a root-recovery (RR) stage solves these equations. The RR stage can be a bottleneck: auxiliary polynomials may not isolate the root, and solving them can take exponential time in the worst case, even when LR is feasible. We introduce Dual Coppersmith, which replaces algebraic root recovery with geometric recovery from a modular orthogonal lattice. Our construction embeds the hidden root as a short lattice vector, and we prove that LLL recovers its direction whenever a sufficient gap separates it from all independent lattice vectors. The root can then be recovered directly from coordinate ratios. To analyze this gap, we propose a heuristic model for the second successive minimum by examining both the full lattice and a structured sublattice. Under this model, Dual Coppersmith achieves the standard Coppersmith product-size bound without solving an auxiliary polynomial system. Experiments on the approximate common divisor (ACD) and Herrmann-May (HM) problems support the model’s predictions and demonstrate root recovery in higher-dimensional instances where the Gröbner-based baseline reaches its timeout. Image showing part 2 of abstract.
November 9, 2026 at 2:15 AM
eprint.ing.bot
A Crypto-Agile Mixed-Radix NTT Accelerator for Negacyclic and Trinomial Rings (JaeSeok Lee, DongHyun Shin, YoungBeom Kim, Seog Chung Seo) ia.cr/2026/2610
Abstract. Hardware accelerators for lattice-based post-quantum cryptography (PQC) have largely converged on the radix-2 number-theoretic transform (NTT). The spectrum of standards that crypto-agility must accommodate, however, extends beyond NIST. In response to advances in cryptanalysis and to reduce the attack surface, national authorities are standardizing or recommending lattice-based algorithms with alternative algebraic structures, as well as schemes built on entirely different primitives. For instance, NTRU+, selected in the Korean PQC competition and currently undergoing standardization, is defined over a trinomial ring whose degree is divisible by three and thus requires a mixed-radix NTT comprising both radix-2 and radix-3 layers, whereas SMAUG-T employs an NTT-unfriendly modulus. Support for heterogeneous algebraic structures is therefore no longer optional but a prerequisite for crypto-agile design; existing radix-2-centric accelerators, however, fail to meet this requirement. In this paper, we present a crypto-agile mixed-radix NTT accelerator that performs transforms over both negacyclic and trinomial rings on a single datapath. Our contributions are threefold. First, we design a unified butterfly unit that integrates two parallel radix-2 butterflies, one radix-3 butterfly, and the trinomial transform on shared arithmetic resources, in which a generic 17-bit Montgomery path and an ML-DSA-specific 23-bit reduction path share the same two DSPs. Second, we propose a conflict-free memory mapping that guarantees in-place parallel access across all mixed-radix layers with a single 1-bit bank-selection function, namely address parity for radix-2 and a fixed address bit for radix-3, and requires neither mapping tables, nor coefficient reordering, nor additional BRAMs. Third, we introduce a generalized modular constant division that combines the multiple alignment of Montgomery reduction with the quotient estimation of Barrett reduction to perform the 3⁻¹ scaling of the radix-3 inverse NTT without any DSP. Implemented on an Artix-7 FPGA, the proposed core supports all security levels of ML-KEM, ML-DSA, HAETAE, SMAUG-T, and NTRU+ using 5,279 LUTs, 4 DSPs, and 9 BRAMs at 141.5~MHz. For NTRU+, it achieves a 4.1–13.0× improvement in area-time product (ATP) over approaches that resort to radix-2-only cores via degree lifting, and new moduli of up to 17 bits can be integrated at the cost of fewer than 20 LUTs. Image showing part 2 of abstract. Image showing part 3 of abstract.
November 9, 2026 at 2:00 AM
eprint.ing.bot
A Probabilistic Extension of the Division Property: Integral Distinguishers with Key-Independent Bounds (Jules Baudrin, Christina Boura, Patrick Derbez, Gregor Leander, Yevhen Perehuda) ia.cr/2026/2602
Abstract. Classical integral cryptanalysis relies on zero-sum properties that, for every key, hold with probability one. Existing arguments against such deterministic integrals, based on the division property and its algebraic variants, only exclude this extreme case: once the zero-sum probability falls below one, they say nothing about its actual value, nor about a probabilistic bias that could still be exploited. We develop a tool combining MILP-based trail search with a recursive evaluation of assignments to the constant inputs. It estimates the probability that no valid trail remains and uses an additional heuristic to predict the zero-sum probability. Applying this tool to PRESENT and GIFT, we obtain probabilistic integral distinguishers for 6 to 9 rounds, including 6- and 7-round PRESENT distinguishers using 2⁴ and 2¹² plaintexts per structure, respectively. For the ASCON permutation, we obtain 4- and 5-round distinguishers using as few as 2 and 2¹² inputs per structure. We further explain algebraically the large bias of the 6-round PRESENT distinguisher, showing how the S-box and bit permutation restrict the way active variables combine. Finally, we show how these distinguishers can be used for key recovery, reducing both the data and time complexities compared to their deterministic variants for PRESENT and GIFT-64. Image showing part 2 of abstract.
November 9, 2026 at 1:59 AM
negativepid.bsky.social
Breaking codes: cryptanalysis #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime
Breaking codes: cryptanalysis - Negative PID
If cryptography is the art of hiding meaning, cryptanalysis is the science of removing its shelter. From its earliest days, cryptanalysis was not an academic
negativepid.blog
November 1, 2026 at 3:07 PM