{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T00:26:47Z","timestamp":1760574407754,"version":"build-2065373602"},"reference-count":38,"publisher":"Springer Science and Business Media LLC","issue":"10","license":[{"start":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T00:00:00Z","timestamp":1750723200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T00:00:00Z","timestamp":1750723200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"ERC Starting Grant 2024","award":["101160608"],"award-info":[{"award-number":["101160608"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Des. Codes Cryptogr."],"published-print":{"date-parts":[[2025,10]]},"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>In this paper, we re-investigate the Lai\u2013Massey scheme, originally proposed in the cipher IDEA. Due to the similarity with the Feistel networks, and due to the existence of invariant subspace attacks as originally pointed out by Vaudenay at FSE 1999, the Lai\u2013Massey scheme has received only little attention by the community. As first contribution, we propose two new generalizations of such scheme that are not (extended) affine equivalent to any generalized Feistel network proposed in the literature so far. Then, inspired by the recent  construction, we propose the  structure as a generalization of the Lai\u2013Massey scheme, in which the linear combination in the Lai\u2013Massey scheme can be replaced by a non-linear one. Besides proposing concrete examples of the  construction, we analyze its cryptographic properties in the context of MPC-\/HE-\/ZK-friendly symmetric primitives.<\/jats:p>","DOI":"10.1007\/s10623-025-01672-2","type":"journal-article","created":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T02:35:17Z","timestamp":1750732517000},"page":"4173-4208","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["On generalizations of the Lai\u2013Massey scheme"],"prefix":"10.1007","volume":"93","author":[{"given":"Lorenzo","family":"Grassi","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,6,24]]},"reference":[{"key":"1672_CR1","doi-asserted-by":"publisher","first-page":"165","DOI":"10.1007\/s00009-021-01781-x","volume":"18","author":"R Aragona","year":"2021","unstructured":"Aragona R., Civino R.: On invariant subspaces in the Lai-Massey scheme and a primitivity reduction. Mediterr. J. Math. 18, 165 (2021).","journal-title":"Mediterr. J. Math."},{"key":"1672_CR2","doi-asserted-by":"crossref","unstructured":"Albrecht M.R., Cid C., Grassi L., Khovratovich D., L\u00fcftenegger R., Rechberger C., Schofnegger M.: Algebraic cryptanalysis of STARK-friendly designs: application to MARVELlous and MiMC. In: ASIACRYPT 2019\u2014Part III, volume 11923 of LNCS, pp. 371\u2013397 (2019).","DOI":"10.1007\/978-3-030-34618-8_13"},{"key":"1672_CR3","unstructured":"Bariant A.: Algebraic cryptanalysis of full Ciminion. Cryptology ePrint Archive, Paper 2023\/1283 (2023). https:\/\/eprint.iacr.org\/2023\/1283."},{"key":"1672_CR4","doi-asserted-by":"crossref","unstructured":"Bouvier C., Briaud P., Chaidos P., Perrin L., Salen R., Velichkov V., Willems D.: New design techniques for efficient arithmetization-oriented hash functions: anemoi permutations and jive compression mode. In: CRYPTO 2023\u2014Part III, volume 14083 of LNCS, pp. 507\u2013539 (2023).","DOI":"10.1007\/978-3-031-38548-3_17"},{"key":"1672_CR5","doi-asserted-by":"crossref","unstructured":"Bariant A., Boeuf A., Lemoine A., Manterola Ayala I., \u00d8ygarden M., Perrin L., Raddum H.: The algebraic freelunch efficient Gr\u00f6bner basis attacks against arithmetization-oriented primitives. Cryptology ePrint Archive, Paper 2024\/347 (2024). https:\/\/eprint.iacr.org\/2024\/347\u2014accepted at CRYPTO 2024.","DOI":"10.1007\/978-3-031-68385-5_5"},{"issue":"3","key":"1672_CR6","doi-asserted-by":"publisher","first-page":"73","DOI":"10.46586\/tosc.v2022.i3.73-101","volume":"2022","author":"A Bariant","year":"2022","unstructured":"Bariant A., Bouvier C., Leurent G., Perrin L.: Algebraic attacks against some arithmetization-oriented primitives. IACR Trans. Symmetric Cryptol. 2022(3), 73\u2013101 (2022).","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"1672_CR7","doi-asserted-by":"crossref","unstructured":"Beyne T., Canteaut A., Dinur I., Eichlseder M., Leander G., Leurent G., Naya-Plasencia M., Perrin L., Sasaki Y., Todo Y., Wiemer F.: Out of oddity\u2014new cryptanalytic techniques against symmetric primitives optimized for integrity proof systems. In: CRYPTO 2020\u2014Part III, volume 12172 of LNCS, pp. 299\u2013328 (2020).","DOI":"10.1007\/978-3-030-56877-1_11"},{"key":"1672_CR8","doi-asserted-by":"crossref","unstructured":"Bertoni G., Daemen J., Peeters M., Van Assche G.: On the indifferentiability of the sponge construction. In: EUROCRYPT 2008, volume 4965 of LNCS, pp. 181\u2013197 (2008).","DOI":"10.1007\/978-3-540-78967-3_11"},{"key":"1672_CR9","doi-asserted-by":"crossref","unstructured":"Biham E., Shamir A.: Differential cryptanalysis of DES-like cryptosystems. In: CRYPTO 1990, volume 537 of LNCS, pp. 2\u201321 (1990).","DOI":"10.1007\/3-540-38424-3_1"},{"key":"1672_CR10","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4613-9314-6","volume-title":"Differential Cryptanalysis of the Data Encryption Standard","author":"E Biham","year":"1993","unstructured":"Biham E., Shamir A.: Differential Cryptanalysis of the Data Encryption Standard. Springer, Berlin (1993)."},{"issue":"1\u20133","key":"1672_CR11","doi-asserted-by":"publisher","first-page":"75","DOI":"10.1007\/s10623-012-9660-z","volume":"66","author":"A Bogdanov","year":"2013","unstructured":"Bogdanov A., Shibutani K.: Generalized Feistel networks revisited. Des. Codes Cryptogr. 66(1\u20133), 75\u201397 (2013).","journal-title":"Des. Codes Cryptogr."},{"issue":"3","key":"1672_CR12","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1145\/1088216.1088219","volume":"10","author":"B Buchberger","year":"1976","unstructured":"Buchberger B.: A theoretical basis for the reduction of polynomials to canonical forms. SIGSAM Bull. 10(3), 19\u201329 (1976).","journal-title":"SIGSAM Bull."},{"issue":"2","key":"1672_CR13","doi-asserted-by":"publisher","first-page":"125","DOI":"10.1023\/A:1008344232130","volume":"15","author":"C Carlet","year":"1998","unstructured":"Carlet C., Charpin P., Zinoviev V.A.: Codes, bent functions and permutations suitable for DES-like cryptosystems. Des. Codes Cryptogr. 15(2), 125\u2013156 (1998).","journal-title":"Des. Codes Cryptogr."},{"key":"1672_CR14","doi-asserted-by":"publisher","first-page":"209","DOI":"10.1016\/j.ffa.2018.11.008","volume":"56","author":"A Canteaut","year":"2019","unstructured":"Canteaut A., Perrin L.: On CCZ-equivalence, extended-affine equivalence, and function twisting. Finite Fields Their Appl. 56, 209\u2013246 (2019).","journal-title":"Finite Fields Their Appl."},{"key":"1672_CR15","doi-asserted-by":"crossref","unstructured":"Grassi L., Hao Y., Rechberger C., Schofnegger M., Walch R., Wang Q.: Horst meets fluid-SPN: griffin for zero-knowledge applications. In: CRYPTO 2023\u2014Part III, volume 14083 of LNCS, pp. 573\u2013606 (2023).","DOI":"10.1007\/978-3-031-38548-3_19"},{"issue":"1","key":"1672_CR16","doi-asserted-by":"publisher","first-page":"5","DOI":"10.46586\/tosc.v2022.i1.5-37","volume":"2022","author":"L Grassi","year":"2022","unstructured":"Grassi L., Khovratovich D., R\u00f8njom S., Schofnegger M.: The legendre symbol and the modulo-2 operator in symmetric schemes over $$\\mathbb{F} ^n_p$$ preimage attack on full grendel. IACR Trans. Symmetric Cryptol. 2022(1), 5\u201337 (2022).","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"1672_CR17","doi-asserted-by":"crossref","unstructured":"Grassi L., \u00d8ygarden M., Schofnegger M., Walch R.: From farfalle to megafono via ciminion: the PRF hydra for MPC applications. In: EUROCRYPT 2023\u2014Part IV, volume 14007 of LNCS, pp. 255\u2013286 (2023).","DOI":"10.1007\/978-3-031-30634-1_9"},{"issue":"2","key":"1672_CR18","first-page":"192","volume":"2016","author":"L Grassi","year":"2016","unstructured":"Grassi L., Rechberger C., R\u00f8njom S.: Subspace trail cryptanalysis and its applications to AES. IACR Trans. Symmetric Cryptol. 2016(2), 192\u2013225 (2016).","journal-title":"IACR Trans. Symmetric Cryptol."},{"issue":"2","key":"1672_CR19","doi-asserted-by":"publisher","first-page":"314","DOI":"10.46586\/tosc.v2021.i2.314-352","volume":"2021","author":"L Grassi","year":"2021","unstructured":"Grassi L., Rechberger C., Schofnegger M.: Proving resistance against infinitely long subspace trails: how to choose the linear layer. IACR Trans. Symmetric Cryptol. 2021(2), 314\u2013352 (2021).","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"1672_CR20","doi-asserted-by":"crossref","unstructured":"Hoang V.T., Rogaway P.: On generalized feistel networks. In: CRYPTO 2010, volume 6223 of LNCS, pp. 613\u2013630 (2010).","DOI":"10.1007\/978-3-642-14623-7_33"},{"key":"1672_CR21","doi-asserted-by":"crossref","unstructured":"Jakobsen T., Knudsen L.R.: The interpolation attack on block ciphers. In: FSE 1997, volume 1267 of LNCS, pp. 28\u201340 (1997).","DOI":"10.1007\/BFb0052332"},{"key":"1672_CR22","doi-asserted-by":"crossref","unstructured":"Koschatko K., L\u00fcftenegger R., Rechberger C.: Exploring the six worlds of Gr\u00f6bner basis cryptanalysis: application to anemoi. Cryptology ePrint Archive, Paper 2024\/250 (2024). https:\/\/eprint.iacr.org\/2024\/250.","DOI":"10.46586\/tosc.v2024.i4.138-190"},{"key":"1672_CR23","doi-asserted-by":"crossref","unstructured":"Knudsen L.R.: Truncated and higher order differentials. In: FSE 1994, volume 1008 of LNCS, pp. 196\u2013211 (1994).","DOI":"10.1007\/3-540-60590-8_16"},{"key":"1672_CR24","doi-asserted-by":"crossref","unstructured":"Leander G., Abdelraheem M.A., AlKhzaimi H., Zenner E.: A cryptanalysis of PRINTcipher: the invariant subspace attack. In: CRYPTO 2011, volume 6841 of LNCS, pp. 206\u2013221 (2011).","DOI":"10.1007\/978-3-642-22792-9_12"},{"key":"1672_CR25","doi-asserted-by":"crossref","unstructured":"Lai X., Massey J.L.: A proposal for a new block encryption standard. In: EUROCRYPT 1990, volume 473 of LNCS, pp. 389\u2013404 (1990).","DOI":"10.1007\/3-540-46877-3_35"},{"key":"1672_CR26","doi-asserted-by":"crossref","unstructured":"Leander G., Minaud B., R\u00f8njom S.: A generic approach to invariant subspace attacks: cryptanalysis of robin, iSCREAM and Zorro. In: EUROCRYPT 2015\u2014Part I, volume 9056 of LNCS, pp. 254\u2013283 (2015).","DOI":"10.1007\/978-3-662-46800-5_11"},{"issue":"3","key":"1672_CR27","doi-asserted-by":"publisher","first-page":"2000","DOI":"10.1109\/TIT.2022.3223139","volume":"69","author":"J Liu","year":"2023","unstructured":"Liu J., Sun B., Liu G., Dong X., Liu L., Zhang H., Li C.: New wine old bottles: Feistel structure revised. IEEE Trans. Inf. Theory 69(3), 2000\u20132008 (2023).","journal-title":"IEEE Trans. Inf. Theory"},{"issue":"1","key":"1672_CR28","doi-asserted-by":"publisher","first-page":"74","DOI":"10.46586\/tosc.v2018.i1.74-100","volume":"2018","author":"G Leander","year":"2018","unstructured":"Leander G., Tezcan C., Wiemer F.: Searching for subspace trails and truncated differentials. IACR Trans. Symmetric Cryptol. 2018(1), 74\u2013100 (2018).","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"1672_CR29","doi-asserted-by":"crossref","unstructured":"Matsui M.: Linear cryptanalysis method for DES cipher. In: EUROCRYPT 1993, volume 765 of LNCS, pp. 386\u2013397 (1993).","DOI":"10.1007\/3-540-48285-7_33"},{"key":"1672_CR30","doi-asserted-by":"crossref","unstructured":"Matsui M.: New block encryption algorithm MISTY. In: FSE 1997, volume 1267 of LNCS, pp. 54\u201368 (1997).","DOI":"10.1007\/BFb0052334"},{"key":"1672_CR31","doi-asserted-by":"crossref","unstructured":"Nyberg K.: Generalized Feistel networks. In: ASIACRYPT 1996, volume 1163 of LNCS, pp. 91\u2013104 (1996).","DOI":"10.1007\/BFb0034838"},{"key":"1672_CR32","unstructured":"Roy A., Steiner M.: Generalized triangular dynamical system: an algebraic system for constructing cryptographic permutations over finite fields. CoRR, abs\/2204.01802 (2022)."},{"key":"1672_CR33","unstructured":"Roy A., Steiner M.J., Trevisani S.: Arion: arithmetization-oriented permutation and hashing from generalized triangular dynamical systems. CoRR, abs\/2303.04639 (2023)."},{"key":"1672_CR34","doi-asserted-by":"crossref","unstructured":"Schneier B.: Description of a new variable-length key, 64-bit block cipher (Blowfish). In: FSE 1993, volume 809 of LNCS, pp. 191\u2013204 (1993).","DOI":"10.1007\/3-540-58108-1_24"},{"key":"1672_CR35","doi-asserted-by":"crossref","unstructured":"Sun B., Xiang Z., Dai Z., Liu G., Shen X., Qu L., Fu S.: Feistel-Like structures revisited: classification and cryptanalysis. In CRYPTO 2024, volume 14923 of LNCS, pp. 275\u2013304 (2024).","DOI":"10.1007\/978-3-031-68385-5_9"},{"key":"1672_CR36","doi-asserted-by":"crossref","unstructured":"Vaudenay S.: On the Lai-Massey scheme. In: ASIACRYPT 1999, volume 1716 of LNCS, pp. 8\u201319 (1999).","DOI":"10.1007\/978-3-540-48000-6_2"},{"issue":"1","key":"1672_CR37","doi-asserted-by":"publisher","first-page":"45","DOI":"10.1007\/s10623-010-9386-8","volume":"58","author":"A Yun","year":"2011","unstructured":"Yun A., Park J.H., Lee J.: On Lai-Massey and quasi-Feistel ciphers. Des. Codes Cryptogr. 58(1), 45\u201372 (2011).","journal-title":"Des. Codes Cryptogr."},{"key":"1672_CR38","doi-asserted-by":"crossref","unstructured":"Zheng Y., Matsumoto T., Imai H.: On the construction of block ciphers provably secure and not relying on any unproved hypotheses. In: CRYPTO 1989, volume 435 of LNCS, pp. 461\u2013480 (1990).","DOI":"10.1007\/0-387-34805-0_42"}],"container-title":["Designs, Codes and Cryptography"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10623-025-01672-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10623-025-01672-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10623-025-01672-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T07:28:43Z","timestamp":1760513323000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10623-025-01672-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,24]]},"references-count":38,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2025,10]]}},"alternative-id":["1672"],"URL":"https:\/\/doi.org\/10.1007\/s10623-025-01672-2","relation":{},"ISSN":["0925-1022","1573-7586"],"issn-type":[{"type":"print","value":"0925-1022"},{"type":"electronic","value":"1573-7586"}],"subject":[],"published":{"date-parts":[[2025,6,24]]},"assertion":[{"value":"18 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"26 March 2025","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 June 2025","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 June 2025","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}