Curriculum Vitae
Research interests
- Design and analysis of symmetric-key primitives
- Analysis of symmetric-key ciphers in the quantum computing model
- Analysis of symmetric-key based real-world protocols
Education
Ph.D. in Computer ScienceIndian Statistical Institute, KolkataThesis: Cryptanalysis of Symmetric Key Schemes using Classical and Quantum Techniques
Jul 2016 – Jan 2022M.Tech in Computer Science & EngineeringZakir Hussain College of Engineering and Technology, Aligarh Muslim University
Jun 2014 – May 2016B.Tech in Computer EngineeringZakir Hussain College of Engineering and Technology, Aligarh Muslim University
Jun 2009 – May 2013Research experience
Research FellowSyLLab, Nanyang Technological University, Singapore (host: Prof. Thomas Peyrin)
Oct 2025 – PresentProgram-Specific ResearcherKyoto University, Japan
May 2025 – Sep 2025Postdoctoral ResearcherUniversity of Hyogo, Japan
Feb 2023 – Mar 2025Visiting ScientistR. C. Bose Centre for Cryptology and Security, Indian Statistical Institute, Kolkata
Sep 2022 – Jan 2023Project-linked PersonnelR. C. Bose Centre for Cryptology and Security, Indian Statistical Institute, Kolkata
Apr 2022 – Jun 2022Senior Project AssociateIndian Institute of Technology Bhilai
Feb 2022 – Mar 2022Industry experience
Software EngineerPhonato Studios Pvt. Ltd., India
Aug 2013 – Aug 2014Awards and grants
- Excellent Paper Award, Computer Security Symposium (CSS) 2025, for “AETHER: An Ultra-High Throughput and Low Energy Authenticated Encryption Scheme”
- IACR travel grant to attend Fast Software Encryption 2019, Paris
- Junior Research Fellowship (NET), CSIR–UGC, All India Rank 45, 2016
- GATE fellowship, CSIR, 2013
Publications
Journal papers
- CiC 2025 Journal MSX: Lightweight Block Ciphers for Microcontrollers with High-assurance against Differential and Linear Attacks
IACR Communications in Cryptology, vol. 2, issue 4, 2025.- 64/128-bit block ciphers for microcontrollers that use 32-bit integer multiplication instead of an S-box.
- Provably strong differential/linear resistance, based on Vaudenay’s decorrelation theory.
- Good performance on 32-bit microcontrollers compared with Speck, with a large security margin.
We present MSX, a new family of 64/128-bit block ciphers. It aims to provide fast execution on microcontrollers and comes with a highly reliable argument on the resistance against basic differential/linear attacks, backed by the classical differential/linear probability analysis on Feistel ciphers and Vaudenay's decorrelation theory. MSX are classical (generalized) Feistel ciphers with a round function. Similar to many existing ARX ciphers, its round function uses arithmetic operations and does not have an S-box. A unique feature of MSX is its use of 32-bit integer multiplication, which enables proving an ideally strong differential/linear property by design. It could be interpreted as an application of Vaudenay's decorrelation theory. We provide a detailed security analysis on attacks beyond differential and linear ones and conduct a benchmark on a range of popular microcontrollers with a comparison to Speck, a top performer on microcontrollers. The results show MSX's good performance on 32-bit microcontrollers, maintaining a sufficiently large security margin. MSX aims at security under single key, and related-key security is not the focus. - CiC 2025 Journal Exploring SHA Instructions and Its Application to AES-based Schemes
IACR Communications in Cryptology, vol. 2, issue 3, 2025.- SHA instructions run in parallel with AES instructions on modern CPUs; gives guidelines for combining them.
- Simpira and Areion short-input hashes become about 50% faster.
- A hybrid AEGIS-128L reaches full 256-bit forgery security while keeping its performance.
In this paper, we explore the potential of improving AES-based schemes by integrating SHA instructions alongside AES instructions, starting from the key observation that SHA instructions can be executed in parallel with AES instructions on modern processors. We investigate conditions for parallel execution, the invocation ratio, and overhead of type conversions, and then provide guidelines for efficient SHA instruction usage with AES instructions. Applying these guidelines, we integrate SHA round functions into the AES-based short-input hash functions of Simpira and Areion, resulting in approximately 50% faster performance by achieving security with fewer iterations. Besides, we apply integration of SHA instructions to AES-based AEAD schemes of AEGIS-128L, which supports a 256-bit tag but has recently been shown to fall short of providing full 256-bit forgery security. We demonstrate that hybrid schemes can achieve 256-bit forgery security for AEGIS-128L while preserving performance. - ToSC 2025(4) Journal Dialga: A Family of Low-Latency Tweakable Block Ciphers Using Multiple Linear Layers
IACR Transactions on Symmetric Cryptology, 2025(4), pp. 70–124, 2025.- Low-latency tweakable block cipher family with 128/256-bit tweaks and 256-bit keys.
- Multiple linear layers with SAT-optimised S-box choice, plus a reflection tweakey schedule.
- About half the delay of QARMAv2 with roughly 40% less area, at the same claimed security.
In this paper, we propose Dialga, a family of low-latency tweakable block ciphers designed to support 128/256-bit tweaks and 256-bit keys. Dialga achieves significantly small latency by leveraging multiple novel strategies. These include the use of multiple linear layers with efficient cell permutations, which enhance security against differential and linear attacks with negligible hardware overhead. We also identify the optimal choice of S-boxes for these permutations using state-of-the-art evaluation methods by SAT, enabling us to further reduce the delay of the round function. Besides, we design a reflection tweakey schedule that ensures strong security in the related-tweak setting and allows for encryption and decryption without delay overhead, reducing the circuit area. We conducted comprehensive hardware benchmarks involving Dialga and other primitives. As a result, Dialga achieves nearly half the delay of QARMAv2, while achieving approximately a 40% reduction in area, with the same claimed security. - IEEE TIT 2025 Journal Depending on DEEPAND: Cryptanalysis of NLFSR-based Lightweight Ciphers TinyJambu, Katan and Ktantan
IEEE Transactions on Information Theory, vol. 71, issue 9, pp. 7348–7366, 2025.- DEEPAND: a MILP model that captures correlations between AND gates in NLFSR-based ciphers.
- Full 384-round TinyJAMBU trail with 14 active AND gates (previously 19), and shows $P_{1024}$ is non-ideal.
- Improved KATAN trails and practical related-key distinguishers for all full-round KTANTAN variants.
Automated cryptanalysis has taken center stage in the arena of cryptanalysis since the pioneering work by Mouha et al. which showcased the power of Mixed Integer Linear Programming (MILP) in solving cryptanalysis problems that otherwise, required significant effort. Since the inception, research in this area has moved in primarily two directions. One is to model more and more classical cryptanalysis tools as optimization problems to leverage the ease provided by state-of-the-art solvers. The other direction is to improve existing models to make them more efficient and/or accurate. The current work is an attempt to contribute to the latter. In this work, a general model referred to as DEEPAND has been devised to capture the correlation between AND gates in NLFSR-based lightweight block ciphers. DEEPAND builds upon and generalizes the idea of joint propagation of differences through AND gates captured using refined MILP modeling of TinyJAMBU by Saha et al. in FSE 2020. The proposed model has been applied to TinyJAMBU, KATAN, KTANTAN and can detect correlations that were missed by earlier models. This leads to more accurate differential bounds for both the ciphers. In particular, a 384-round (full-round as per earlier specification) Type-IV trail is found for TinyJAMBU with 14-active AND gates using the new model, while the refined model reported this figure to be 19. This also reaffirms the decision of the designers to increase the number of rounds from 384 to 640. Moreover, the model succeeds in searching a full-round Type-IV trail of TinyJAMBU keyed permutation $P_{1024}$ with probability $2^{-105}$ ($\gg 2^{-128}$). This reveals the non-random properties of $P_{1024}$, thereby showing it to be non-ideal. Hence it cannot be expected to provide the same security levels as robust block ciphers. Further, the provable security of TinyJAMBU AEAD scheme should be carefully revisited. Similarly, for the variants of KATAN, several previously reported trails are improved upon by employing the DEEPAND model. Moreover, in the related-key setting, the DEEPAND model is able to make a better 140-round boomerang distinguisher (for both the data and time complexity) in comparison to the previous boomerang attack by Isobe et al. in ACISP 2013. Furthermore, for enhanced applicability, we employ the DEEPAND model on another multiple AND-based cipher, KTANTAN , in the related-key setting. Our analysis reveals practical differential distinguishers with low data and time complexities for all full-round KTANTAN variants. In summary, DEEPAND seems to capture the underlying correlation better when multiple AND gates are at play and can be adapted to other classes of ciphers as well. - TCHES 2025(2) Journal ★ Award AETHER: An Ultra-High Throughput and Low Energy Authenticated Encryption Scheme
IACR Transactions on Cryptographic Hardware and Embedded Systems, 2025(2), pp. 705–742, 2025.
★ Excellent Paper Award, Computer Security Symposium 2025- AEGIS-like authenticated encryption with a fully redesigned round update: 256-bit key, 128-bit tag.
- New inner function: 1.56× less energy and 1.25× less delay than the AES round function.
- 2.1 Tbit/s at 204.31 nJ (NanGate 15 nm) and 5.23 Tbit/s (CNFET 5 nm), ahead of all existing AEADs.
In this paper, we introduce AETHER, an authenticated encryption scheme that achieves ultra-high throughput and low energy consumption, supporting a 256-bit key and a 128-bit tag. While inspired by an AEGIS-like structure, AETHER stands out with a completely redesigned round-update function. We replace the AES round function with a new inner function optimized for ultra-low latency and energy consumption. This function incorporates Orthros’s S-box and a 16x16 binary matrix from Akleylek et al., leading to a 1.56 times reduction in energy consumption and a 1.25 times reduction in delay compared to the AES round function. To further optimize hardware performance, we design the general construction of the round-update function to be more hardware-friendly, allowing parallel execution of the inner function on all 128-bit words, thereby enhancing both throughput and security against collision-based forgery attacks. AETHER achieves a throughput of 2.1 Tbit/s and an energy consumption of only 204.31 nJ, in the Nangate 15 nm standard cell library and a throughput of 5.23 Tbit/s and energy consumption of 1.83 nJ using the CNFET-OCL 5nm library, outperforming all existing AEADs. - CiC 2024 Journal On the Key-Commitment Properties of Forkcipher-based AEADs
IACR Communications in Cryptology, vol. 1, 2024.- Key-commitment analysis of forkcipher-based AEADs: Eevee, PAEF, RPAEF and SAEF.
- Several lack key commitment: two keys giving the same ciphertext-tag are found with complexity $O(1)$.
- Results extend to CMT-1 and CMT-4; these modes should be avoided where key commitment matters.
Forkcipher-based AEADs have emerged as lightweight and efficient cryptographic modes, making them suitable for resource-constrained environments such as IoT devices and distributed decryption through MPC. These schemes, including prominent examples like Eevee (Jolteon, Espeon, and Umbreon), PAEF, RPAEF, and SAEF, leverage the properties of forkciphers to achieve enhanced performance. However, their security in terms of key commitment, a critical property for certain applications such as secure cloud services, as highlighted by Albertini et al. (USENIX 2022), has not been comprehensively analyzed until now. In this work, we analyze the key-commitment properties of forkcipher-based AEADs. We found that some of the forkcipher-based AEAD schemes lack key-commitment properties, primarily due to the distinctive manner in which they process associated data and plaintext. For two different keys and the same nonce, an adversary can identify associated data and plaintext blocks that produce identical ciphertext-tags with a complexity of $O(1)$ . Our findings apply to various forkcipher-based AEADs, including Eevee, PAEF, and SAEF, and naturally extend to less strict frameworks, such as CMT-1 and CMT-4. These findings highlight a significant limitation in the robustness of forkcipher-based AEADs. While these modes are attractive for their lightweight design and efficiency, their deployment should be restricted in scenarios where explicit robustness or key-commitment security is required. - IJACT 2024 Journal Yoyo Cryptanalysis on Future
International Journal of Applied Cryptography, vol. 4, pp. 238–249, 2024.- Yoyo cryptanalysis of the AES-like block cipher Future (AFRICACRYPT 2022).
- Secret-key distinguishers for 5 and 6 rounds with $2^{9.83}$ and $2^{58.83}$ data.
- Known-key distinguishers for 6 and 8 rounds with $2^{15}$ data.
In ASIACRYPT 2017, Rønjom et al. reported Yoyo tricks on generic rounds of SPNs. Then they applied it to AES and found the most effective way to distinguish AES in several rounds. In FSE 2018, Saha et al. distinguished AES in a known key setting up to 8 rounds. In AFRICACRYPT 2022, Gupta et al. published a block cipher Future, whose design is like AES with some tweaks. In this paper, we analysed Future by Yoyo trick in both secret key settings and known key settings. We show that in the secret key setting, one can distinguish Future upto five and six rounds with data complexity $2^{9.83}$ and $2^{58.83}$ respectively. We also demonstrate that with known key settings, one can distinguish Future with data complexity $2^{15}$ for both six and eight rounds. Our attack is based on an adaptively chosen plaintext/ciphertext attack. - ToSC 2024(1) Journal Key Committing Attacks against AES-based AEAD Schemes
IACR Transactions on Symmetric Cryptology, 2024(1), pp. 135–157, 2024.- Shows AEGIS is not fully key-committing, with a new attack on all variants, verified experimentally.
- Also attacks Rocca-S, in the strict FROB setting, so the attacks also hold for CMT-1 and CMT-4.
- Rocca and Tiaoxin-346 resist the same techniques, which guides the design of round-update functions.
Recently, there has been a surge of interest in the security of authenticated encryption with associated data (AEAD) within the context of key commitment frameworks. Security within this framework ensures that a ciphertext chosen by an adversary does not decrypt to two different sets of key, nonce, and associated data. Despite this increasing interest, the security of several widely deployed AEAD schemes has not been thoroughly examined within this framework. In this work, we assess the key committing security of several AEAD schemes. First, the AEGIS family, which emerged as a winner in the Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR), and has been proposed to standardization at the IETF. A now outdated version of the draft standard suggested that AEGIS could qualify as a fully committing AEAD scheme; we prove that it is not the case by proposing a novel attack applicable to all variants, which has been experimentally verified. We also exhibit a key committing attack on Rocca-S. Our attacks are executed within the FROB game setting, which is known to be one of the most stringent key committing frameworks. This implies that they remain valid in other, more relaxed frameworks, such as CMT-1, CMT-4, and so forth. Finally, we show that applying the same attack techniques to Rocca and Tiaoxin-346 does not compromise their key-committing security. This observation provides valuable insights into the design of such secure round update functions for AES-based AEAD schemes. - Sci. Rep. 2024 Journal Implementing Grover's on AES-based AEAD Schemes
Scientific Reports, vol. 14, art. 21105, 2024.- First cost estimates of Grover key search against Rocca-S, AEGIS-128 and Tiaoxin-346.
- With MAXDEPTH $= 2^{40}$: about $1.09 \times 2^{253}$ gates for Rocca-S and $1.14 \times 2^{124}$ for AEGIS-128.
- Circuits implemented in Qiskit; all three ciphers stay secure under NIST’s current figures.
Extensive research is currently underway to determine the security of existing ciphers in light of the advancements in quantum computing. Against symmetric key cryptography, Grover’s search algorithm is a prominent attack, capable of reducing search costs to the square root. For using Grover’s algorithm, it is imperative to embed the target cipher into a quantum circuit. Even so, this area of research is relatively new; it has garnered significant attention from the research community. In this study, we provide the first estimation of the cost of Grover’s key search attack against the AES-based AEAD schemes Rocca-S, AEGIS-128, and Tiaoxin-346. Our analysis considers circuit depth restrictions specified in NIST’s PQC standardization process. Considering NIST’s maximum depth constraints, we present the overall cost of these attacks using gate count and depth-times-width metrics. We observed that for $\textsf{MAXDEPTH} = 2^{40}$ , Rocca-S, AEGIS-128, and Tiaoxin-346 can be retrieved using Grover’s search algorithm with gate count of $1.09 \times 2^{253}$, $1.14 \times 2^{124}$, and $1.22 \times 2^{124}$ respectively. Concerning the current updated values by NIST, these ciphers are secure in terms of the cost of implementing Grover’s attack for key recovery. The quantum circuits of these ciphers are implemented using QISKIT, an open-source software development kit (SDK) designed for working with quantum computers running on the IBM Quantum Experience platform. - TCHES 2024(2) Journal Gleeok: A Family of Low-Latency PRFs and its Applications to Authenticated Encryption
IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(2), pp. 545–587, 2024.- Low-latency PRF family with 256-bit keys, built from three 128-bit branches.
- Two branches resist statistical attacks and the third resists algebraic attacks.
- About 360 ps latency (NanGate 15 nm), on par with 128-bit-key low-latency designs; used for short-input AE.
In this paper, we propose a new family of low-latency pseudorandom functions (PRFs), dubbed Gleeok. Gleeok utilizes three 128-bit branches to achieve a 256-bit key size while maintaining low latency. The first two branches are specifically designed to defend against statistical attacks, especially for differential attacks, while the third branch provides resilience against algebraic attacks. This unique design enables Gleeok to offer ultralow latency while supporting 256-bit keys, setting it apart from existing ciphers dedicated to low-latency requirements. In addition, we propose wide-block variants having three 256-bit branches. We also present an application of Gleeok to short-input authenticated encryption which is crucial for memory encryption and various realtime communication applications. Furthermore, we present comprehensive hardware implementation results that establish the capabilities of Gleeok and demonstrate its competitiveness against related schemes in the literature. In particular, Gleeok achieves a minimum latency of roughly 360 ps with the NanGate 15 nm cell library and is thus on par with related low-latency schemes that only feature 128-bit keys while maintaining minimal overhead when equipped in an authenticated mode of operation. - JCEN 2024 Journal Differential Fault Attack on AES-based Encryption Schemes: Application to B5G/6G Ciphers — Rocca, Rocca-S and AEGIS
Journal of Cryptographic Engineering, vol. 14, pp. 595–607, 2024. - IEEE TIT 2024 Journal Revisiting the Boomerang Attack From a Perspective of 3-Differential
IEEE Transactions on Information Theory, vol. 70, issue 7, pp. 5343–5357, 2024.- Exact fixed-key probability of $d$-differentials via quasi-$d$-differential transition matrices.
- Boomerang probability written exactly as a sum of quasi-3-differential trail correlations, with no independence assumptions.
- On GIFT, some optimal boomerang characteristics have probability zero, so half-round-key designs may be over-estimated.
In this paper, inspired by the work of Beyne and Rijmen at CRYPTO 2022, we explore the accurate probability of $d$-differential in the fixed-key model. The theoretical foundations of our method are based on a special matrix - quasi-d-differential transition matrix, which is a natural extension of the quasidifferential transition matrix. The role of quasi-d-differential transition matrices in polytopic cryptanalysis is analogous to that of correlation matrices in linear cryptanalysis. Therefore, the fixed-key probability of a $d$-differential can be exactly expressed as the sum of the correlations of its quasi-d-differential trails. Then we revisit the boomerang attack from a perspective of 3-differential. Different from previous works, the probability of a boomerang distinguisher can be exactly expressed as the sum of the correlations of its quasi-3-differential trails without any assumptions in our work. In order to illustrate our theory, we apply it to the lightweight block cipher GIFT. It is interesting to find the probability of every optimal 3-differential characteristic of an existing 2-round boomerang is zero, which can be seen as an evidence that the security of block ciphers adopting half-round key XOR might be overestimated previously to some extent in differential-like attacks. - ToSC 2023(4) Journal Revisiting Yoyo Tricks on AES
IACR Transactions on Symmetric Cryptology, 2023(4), pp. 28–57, 2023.- Shows the published 5- and 6-round Yoyo distinguishers on AES succeed with probability only about 0.5.
- Revised 5-round distinguisher reaches success probability 0.81 with $2^{30.65}$ data.
- Proves the 6-round distinguisher would need $2^{129.15}$ data, invalidating it.
At Asiacrypt 2017, Rønjom et al. presented key-independent distinguishers for different numbers of rounds of AES, ranging from 3 to 6 rounds, in their work titled “Yoyo Tricks with AES”. The reported data complexities for these distinguishers were 3, 4, $2^{25.8}$, and $2^{122.83}$, respectively. In this work, we revisit those key-independent distinguishers and analyze their success probabilities. We show that the distinguishing algorithms provided for 5 and 6 rounds of AES in the paper of Rønjom et al. are ineffective with the proposed data complexities. Our thorough theoretical analysis has revealed that the success probability of these distinguishers for both 5-round and 6-round AES is approximately 0.5, with the corresponding data complexities mentioned earlier. We investigate the reasons behind this seemingly random behavior of those reported distinguishers. Based on our theoretical findings, we have revised the distinguishing algorithm for 5-round AES. Our revised algorithm demonstrates success probabilities of approximately 0.55 and 0.81 for 5-round AES, with data complexities of $2^{29.95}$ and $2^{30.65}$, respectively. We have also conducted experimental tests to validate our theoretical findings, which further support our findings. Additionally, we have theoretically demonstrated that improving the success probability of the distinguisher for 6-round AES from 0.50000 to 0.50004 would require a data complexity of $2^{129.15}$. This finding invalidates the reported distinguisher by Rønjom et al. for 6-round AES. - IEEE TQE 2022 Journal Grover on Katan: Quantum Resource Estimation
IEEE Transactions on Quantum Engineering, vol. 3, pp. 1–9, 2022.- Depth-optimised reversible quantum circuits for the KATAN block cipher family.
- AND gates and $T$-depth-one Toffoli gates give the shallowest circuits.
- Full Grover key-search cost estimated in ProjectQ under NIST’s depth limits.
This article presents the cost analysis of mounting Grover’s key search attack on the family of KATAN block cipher. Several designs of the reversible quantum circuit of KATAN are proposed. Owing to the National Insitute of Standards and Technology’s (NIST) proposal for postquantum cryptography standardization, the circuits are designed focusing on minimizing the overall depth. We observe that the reversible quantum circuits designed using AND gates and $T$-depth one Toffoli gate give more shallow circuits. Grover oracle for KATAN is designed based on the reversible circuits, which are used further to mount Grover’s key search attack on KATAN. The designs are implemented using the software framework ProjectQ, which provides a resource estimation tool to perform an appropriate cost analysis in an automated way. While estimating the resources, NIST’s depth restrictions are also respected. - ToSC 2021(3) Journal Boomeyong: Embedding Yoyo within Boomerang and its Applications to Key Recovery Attacks on AES and Pholkos
IACR Transactions on Symmetric Cryptology, 2021(3), pp. 137–169, 2021.- New technique embedding a yoyo trail inside a boomerang trail, the first merger of these two tools.
- 6-round key recovery on AES-128 with time $2^{78}$, and 10-round key recovery on Pholkos.
- AES results verified experimentally on a small-scale AES variant.
This work investigates a generic way of combining two very effective and well-studied cryptanalytic tools, proposed almost 18 years apart, namely the boomerang attack introduced by Wagner in FSE 1999 and the yoyo attack by Ronjom et al. in Asiacrypt 2017. In doing so, the s-box switch and ladder switch techniques are leveraged to embed a yoyo trail inside a boomerang trail. As an immediate application, a 6-round key recovery attack on AES-128 is mounted with time complexity of $2^{78}$. A 10-round key recovery attack on recently introduced AES-based tweakable block cipher Pholkos is also furnished to demonstrate the applicability of the new technique on AES-like constructions. The results on AES are experimentally verified by applying and implementing them on a small scale variant of AES. We provide arguments that draw a relation between the proposed strategy with the retracing boomerang attack devised in Eurocrypt 2020. To the best of our knowledge, this is the first attempt to merge the yoyo and boomerang techniques to analyze SPN ciphers and warrants further attention as it has the potential of becoming an important cryptanalysis tool. - IEEE TQE 2020 Journal Quantum Attacks on HCTR and its Variants
IEEE Transactions on Quantum Engineering, vol. 1, pp. 1–8, 2020.- Quantum attacks on the HCTR and HCH constructions without superposition queries to the encryption oracle.
- Further attacks on HCTR, tweakable HCTR and HCH that do use superposition queries.
Recently, in Asiacrypt 2019, Bonnetain et al. have shown attacks by quantum adversaries on FX construction and Even-Mansour Cipher without using superposition queries to the encryption oracle. In this article, we use a similar approach to mount new attacks on Hash-Counter (HCTR) and Hash-Counter-Hash (HCH) constructions. In addition, we mount attacks on HCTR, tweakable-HCTR, and HCH using the superposition queries to the encryption oracle using strategies proposed by Leander and May in Asiacrypt 2017 and Kaplan et al. in Crypto 2016. - ToSC 2018(4) Journal New Yoyo Tricks with AES-based Permutations
IACR Transactions on Symmetric Cryptology, 2018(4), pp. 102–127, 2018.- First use of the Yoyo trick to distinguish public permutations, plus a new “inside-out” Yoyo starting from an inner round.
- First deterministic 8-round distinguisher of AESQ (used in PAEQ) and a 16-round impossible-differential distinguisher.
- One of the best 8-round known-key distinguishers on AES, with complexity $2^{30}$.
In Asiacrypt 2017, Rønjom et al. reported some interesting generic properties of SPNs, leading to what they call the Yoyo trick, and applied it to find the most efficient distinguishers on AES. In this work, we explore the Yoyo idea in distinguishing public permutations for the first time. We introduce the notion of nested zero difference pattern which extends the Yoyo idea and helps to compose it using improbable and impossible differential strategies to penetrate higher number of rounds. We devise a novel inside-out application of Yoyo which enables us to start the Yoyo game from an internal round. As an application, we investigate the AES-based public permutation AESQ used inside the authenticated cipher PAEQ. We achieve the first deterministic distinguisher of AESQ up to 8 rounds and the first 9-round distinguisher of AESQ that start from the first round with a practical complexity of around $2^{26}$. We manage to augment Yoyo with improbable and impossible differentials leading to distinguishers on 9, 10, 12 rounds with complexities of about $2^{2}$, $2^{28}$, $2^{126}$ respectively. Further, with impossible differentials and a bi-directional Yoyo strategy, we obtain a 16-round impossible differential distinguisher with a complexity of $2^{126}$. Our results outperform all previous records on AESQ by a substantial margin. As another application, we apply the proposed strategies on AES in the known-key setting leading to one of the best 8-round known-key distinguisher with a complexity of $2^{30}$. Finally, this work amplifies the scope of the Yoyo technique as a generic cryptanalysis tool.
Conference papers
- SAC 2025 Conference Breaking the Twinkle Authentication Scheme and Analyzing Its Underlying Permutation
Selected Areas in Cryptography (SAC 2025), LNCS vol. 16207, Springer, 2025.- Recovers Twinkle-AE’s 512/1024-bit authentication key with only $O(2^t)$ queries, giving universal forgery.
- Practical distinguishers on up to 5 rounds of the 1280-bit permutation Twinkle-P; 6 rounds at $2^{74.32}$.
- The mode attack exploits the gap between claimed confidentiality and integrity; matched-level variants stay secure.
This paper studies the Twinkle family of low-latency symmetric key schemes designed by Wang et al. (CiC 2024). In particular, it presents cryptanalysis of both the mode and the underlying primitive. Twinkle is a PRF-based design, and an authenticated encryption scheme Twinkle-AE is specified based on a dedicated PRF called Twinkle-PRF. To achieve low latency, Twinkle-PRF uses a large key and state to produce sufficient randomness in a single step. Twinkle-AE uses a 1024- or 512-bit key for authentication and generates a $t$-bit tag, where $t \in \{64, 128\}$. It claims to provide $t$ bits of integrity. Several Twinkle-AE parameter sets claim higher confidentiality than integrity. In this setup, for any ciphertext, an adversary can obtain the message after $O(2^t)$ decryption attempts by guessing the tag, allowing attacks in the chosen-ciphertext setting. We show that a 1024- or 512-bit authentication key can be recovered using only $O(2^t)$ queries. The recovered authentication key enables the generation of valid ciphertexts for arbitrary plaintexts, thus achieving universal forgery. In the second part of the paper, we perform cryptanalysis on reduced-round variants of the 1280-bit public permutation Twinkle-P, which serves as a core component of Twinkle-PRF. We investigate impossible differential, zero-correlation linear, integral, and differential-linear distinguishers by developing automated analytic tools. We provide practical distinguishers for up to 5 rounds, and the longest distinguisher reaches 6 rounds with a complexity of $2^{74.32}$. This surpasses the round bounds evaluated by the designers. We stress that our attacks on mode exploits the gap between the claimed confidentiality and integrity levels, thus have no impact on the parameter sets having the same security level. Our attacks on the permutation do not have any significant impact on the whole specifications. Moreover, we note that Twinkle-AE-512b/Twinkle-AE-1024b and Twinkle-PA remain secure, and the versions we attacked would also be secure if the claimed confidentiality level matched the integrity level. - INDOCRYPT 2024 Conference BIZness: Bit Invariant Zero-Sum Property Based on Division Trail
Progress in Cryptology – INDOCRYPT 2024, Proceedings, Part II, 2024. - INDOCRYPT 2024 Conference ASURA: An Efficient Large-State Tweakable Block Cipher for ARM Environment
Progress in Cryptology – INDOCRYPT 2024, Proceedings, Part I, 2024. - ACISP 2023 Conference Ghidle: Efficient Large-State Block Ciphers for Post-quantum Security
Australasian Conference on Information Security and Privacy (ACISP 2023), pp. 403–430, 2023. - ACNS 2023 Conference Divide and Rule: DiFA — Division Property Based Fault Attacks on PRESENT and GIFT
Applied Cryptography and Network Security (ACNS 2023), pp. 89–116, 2023.- New fault attacks built on the division property, with fault invariants independent of where the fault is injected.
- GIFT-64 key recovered with 30 nibble faults; PRESENT-80 key space cut from $2^{80}$ to $2^{16}$ with 15 faults.
- Best fault attacks on PRESENT and GIFT in terms of fault-injection rounds.
The division property introduced by Todo in Crypto 2015 is one of the most versatile tools in the arsenal of a cryptanalyst which has given new insights into many ciphers primarily from an algebraic perspective. On the other end of the spectrum we have fault attacks which have evolved into the deadliest of all physical attacks on cryptosystems. The current work aims to combine these seemingly distant tools to come up with a new type of fault attack. We show how fault invariants are formed under special input division multi-sets and are independent of the fault injection location. It is further shown that the same division trail can be exploited as a multi-round Zero-Sum distinguisher to reduce the key-space to practical limits. As a proof of concept division trails of PRESENT and GIFT are exploited to mount practical key-recovery attacks based on the random nibble fault model. For GIFT-64, we are able to recover the unique master-key with 30 nibble faults with faults injected at rounds 21 and 19. For PRESENT-80, DiFA reduces the key-space from $2^{80}$ to $2^{16}$ with 15 faults in round 25 while for PRESENT-128, the unique key is recovered with 30 faults in rounds 25 and 24. This constitutes the best fault attacks on these ciphers in terms of fault injection rounds. We also report an interesting property pertaining to fault induced division trails which shows its inapplicability to attack GIFT-128. Overall, the usage of division trails in fault based cryptanalysis showcases new possibilities and reiterates the applicability of classical cryptanalytic tools in physical attacks. - AFRICACRYPT 2020 Conference Cryptanalysis of FlexAEAD
Progress in Cryptology – AFRICACRYPT 2020, LNCS vol. 12174, Springer, 2020.- Iterated truncated differential with probability $2^{-7}$ per round on FlexAEAD’s keyed permutation (NIST LWC round 1).
- 6-round deterministic distinguisher and 7-round key recovery using the Yoyo game on a Super-Sbox structure.
- First key-recovery attack on FlexAEAD’s internal permutation; all practical attacks verified experimentally.
This paper analyzes the internal keyed permutation of FlexAEAD which is a round-1 candidate of the NIST LightWeight Cryptography Competition. In our analysis, we report an iterated truncated differential leveraging on a particular property of the AES S-box that becomes useful due to the particular nature of the diffusion layer of the round function. The differential holds with a low probability of $2^{-7}$ for one round which allows it to penetrate the same number of rounds as claimed by the designers, but with a much lower complexity. Moreover, it can be easily extended to a key-recovery attack at a little extra cost. We further report a Super-Sbox construction in the internal permutation, which is exploited using the Yoyo game to devise a 6-round deterministic distinguisher and a 7-round key recovery attack for the 128-bit internal permutation. Similar attacks can be mounted for the 64-bit and 256-bit variants. All these attacks outperform the existing results of the designers as well as other third-party results. The iterated truncated differentials can be tweaked to mount forgery attacks similar to the ones given by Eichlseder et al. Success probabilities of all the reported distinguishing attacks are shown to be high. All practical attacks have been experimentally verified. To the best of our knowledge, this work reports the first key-recovery attack on the internal keyed permutation of FlexAEAD. - ACNS 2019 Conference Cryptanalysis of ForkAES
Applied Cryptography and Network Security (ACNS 2019), 2019.- Cryptanalysis of ForkAES, the AES-based forkcipher of Andreeva et al. for encrypting and authenticating short messages.
- Studies the forked structure, which encrypts the middle state twice and outputs two blocks per call.
Forkciphers are a new kind of primitive proposed recently by Andreeva et al. for efficient encryption and authentication of small messages. They fork the middle state of a cipher and encrypt it twice under two smaller independent permutations. Thus, forkciphers produce two output blocks in one primitive call.
Talks
- AETHER: An Ultra-High Throughput and Low Energy Authenticated Encryption Scheme Invited talk, Crypto Winter School 2025, IIT Bhilai, Bhilai, India · December 11, 2025
- Key Committing Attacks against AES-based AEAD Schemes Invited talk, National Workshop on Cryptology 2025, IIT Bhilai, Bhilai, India · December 8, 2025
- Key Committing Attacks against AES-based AEAD Schemes Invited talk, IIIT Delhi, Delhi, India · February 20, 2025
- Locking Secrets: End-to-End Encryption and the Importance of Commitment Invited talk, University of Hyogo (JENESYS program, Ministry of Foreign Affairs, Japan), Kobe, Japan · November 15, 2024
- Key Committing Attacks against AES-based AEAD Schemes Invited talk, IIT Bhilai, Bhilai, India · September 29, 2024
- Key Committing Attacks against AES-based AEAD Schemes Conference talk, Fast Software Encryption (FSE) 2024, Leuven, Belgium · March 25, 2024
- Quantum Cryptography Invited talk, Chandigarh University, Chandigarh, India · November 20, 2023
- Capturing the Dependency between Correlated AND gates using MILP Invited talk, Universität Mannheim, Mannheim, Germany · August 1, 2023
- Quantum Cryptanalysis Invited talk, Faculty Development Program on "Cryptography and Blockchain", Chandigarh University, Chandigarh, India · November 16, 2022
- Boomeyong: Embedding Yoyo within Boomerang and its Applications to Key Recovery Attacks on AES and Pholkos Conference talk, Fast Software Encryption (FSE) 2022, Athens, Greece · March 22, 2022
- Quantum Security of Classical Cryptosystems Invited talk, Summer School on Quantum Information and Quantum Technology 2021, IISER Kolkata, Kolkata, India · July 2, 2021
- New Yoyo Tricks with AES-based Permutations Conference talk, Fast Software Encryption (FSE) 2019, Paris, France · March 27, 2019