{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T22:09:13Z","timestamp":1782770953200,"version":"3.54.5"},"reference-count":33,"publisher":"Oxford University Press (OUP)","issue":"2","license":[{"start":{"date-parts":[[2021,11,3]],"date-time":"2021-11-03T00:00:00Z","timestamp":1635897600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,2,19]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>3D, an advanced encryption standard-like cipher employed three-dimensional structure, was proposed in 2008. Its recommended number of rounds is 22. Although the longest key recovery attack can currently reach 13 rounds, the complexity of existing attacks for &amp;gt;6 rounds seems to exceed the practically feasible complexity. Thus, a practical attack for 7-round 3D has yet to be developed. Recently, a lightweight block cipher called Saturnin has been selected as a second-round candidate in the National Institute of Standards and Technology standardization for lightweight cryptography. Saturnin also employs a three-dimensional structure and provides high security against quantum and classic attacks. In this paper, we investigate the yoyo attack on these two ciphers. Combined with the meet-in-the-middle technique, we apply the yoyo trick to 7-round 3D and recover the whole 512-bit secret key with $2^{15}$ plaintexts and adaptively chosen ciphertexts and $2^{16.5}$ complexity of full encryptions. To our best knowledge, it is the first practical key recovery attack for 7-round 3D to date. For Saturnin, we found a minor typo in its design report. The designers intended to make a super round containing two S-layers, but one was inadvertently omitted in the algorithm description. We propose a 5-super-round key recovery attack, which is suitable for both one-S-layer version and two-S-layer version. Since the round function of Saturnin has better diffusion, which leads that the meet-in-the-middle technique cannot be applied to this cipher directly. For the one-S-layer version, we address this problem by proposing a new technique called reducing key sets. This technique will fail on the other version, which proves the necessity of containing two S-layers in one-super-round. Finally, our attack requires $2^{39.1}$ plaintext pairs and adaptively chosen ciphertext pairs and $2^{46}$ one-round encryptions.<\/jats:p>","DOI":"10.1093\/comjnl\/bxab174","type":"journal-article","created":{"date-parts":[[2021,10,8]],"date-time":"2021-10-08T11:30:15Z","timestamp":1633692615000},"page":"479-495","source":"Crossref","is-referenced-by-count":2,"title":["Practical Attacks on Reduced-Round 3D and Saturnin"],"prefix":"10.1093","volume":"66","author":[{"given":"Tao","family":"Hou","sequence":"first","affiliation":[{"name":"PLA SSF Information Engineering University , 62 Science Avenue, Zhengzhou 450000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ting","family":"Cui","sequence":"additional","affiliation":[{"name":"PLA SSF Information Engineering University , 62 Science Avenue, Zhengzhou 450000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiyan","family":"Zhang","sequence":"additional","affiliation":[{"name":"PLA SSF Information Engineering University , 62 Science Avenue, Zhengzhou 450000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2021,11,3]]},"reference":[{"key":"2023022013491562200_","first-page":"72","article-title":"PAEQ: parallelizable permutation-based authenticated encryption","volume-title":"Information Security - 17th International Conference, ISC 2014, Hong Kong, China, October 12-14, 2014. Proceedings","author":"Biryukov","year":"2014"},{"key":"2023022013491562200_","first-page":"252","article-title":"3d: A three-dimensional block cipher","volume-title":"Cryptology and Network Security, 7th International Conference, CANS 2008, Hong-Kong, China, December 2-4, 2008. Proceedings","author":"Jr J","year":"2008"},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"160","DOI":"10.46586\/tosc.v2020.iS1.160-207","article-title":"Saturnin: a suite of lightweight symmetric algorithms for post-quantum security","volume":"2020","author":"Canteaut","year":"2020","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"1","DOI":"10.46586\/tosc.v2019.i3.1-42","article-title":"A new SNOW stream cipher called SNOW-V","volume":"2019","author":"Ekdahl","year":"2019","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"350","DOI":"10.46586\/tosc.v2020.iS1.350-389","article-title":"ESTATE: A lightweight and low energy authenticated encryption mode","volume":"2020","author":"Chakraborti","year":"2020","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"2023022013491562200_","first-page":"67","article-title":"The design of a stream cipher LEX","volume-title":"Selected Areas in Cryptography, 13th International Workshop, SAC 2006, Montreal, Canada, August 17-18, 2006 Revised Selected Papers","author":"Biryukov","year":"2006"},{"key":"2023022013491562200_","first-page":"156","article-title":"The boomerang attack","volume-title":"Fast Software Encryption, 6th International Workshop, FSE \u201899, Rome, Italy, March 24-26, 1999, Proceedings","author":"Wagner","year":"1999"},{"key":"2023022013491562200_","first-page":"11","article-title":"The boomerang attack on 5 and 6-round reduced AES","volume-title":"Advanced Encryption Standard - AES, 4th International Conference, AES 2004, Bonn, Germany, May 10-12, 2004, Revised Selected and Invited Papers","author":"Biryukov","year":"2004"},{"key":"2023022013491562200_","first-page":"362","article-title":"Initial observations on skipjack: Cryptanalysis of skipjack-3xor","volume-title":"Selected Areas in Cryptography \u201898, SAC\u201998, Kingston, Ontario, Canada, August 17-18, 1998, Proceedings","author":"Biham","year":"1998"},{"key":"2023022013491562200_","first-page":"217","article-title":"Yoyo tricks with AES","volume-title":"Advances in Cryptology - ASIACRYPT 2017 - 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I","author":"R\u00f8njom","year":"2017"},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"133","DOI":"10.46586\/tosc.v2018.i2.133-160","article-title":"Mixture differential cryptanalysis: a new approach to distinguishers and attacks on round-reduced AES","volume":"2018","author":"Grassi","year":"2018","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"2023022013491562200_","first-page":"280","article-title":"The retracing boomerang attack","volume-title":"Advances in Cryptology - EUROCRYPT 2020 - 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10-14, 2020, Proceedings, Part I","author":"Dunkelman","year":"2020"},{"key":"2023022013491562200_","first-page":"157","article-title":"Square attacks on 3d cipher","volume":"32","author":"Meiyi","year":"2010","journal-title":"Journal of Electronics and Information Technology"},{"key":"2023022013491562200_","first-page":"109","article-title":"New truncated differential cryptanalysis on 3d block cipher","volume-title":"Information Security Practice and Experience - 8th International Conference, ISPEC 2012, Hangzhou, China, April 9-12, 2012. Proceedings","author":"Koyama","year":"2012"},{"key":"2023022013491562200_","first-page":"427","article-title":"Meet-in-the-middle attacks revisited: Focusing on key-recovery and collision attacks","volume":"2021","author":"Dong","year":"2021","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1142\/S0129054117500022","article-title":"Meet-in-the-middle attack on 11-round 3d block cipher","volume":"28","author":"Li","year":"2017","journal-title":"Int. J. Found. Comput. Sci."},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1109\/C-M.1977.217750","article-title":"Special feature exhaustive cryptanalysis of the NBS data encryption standard","volume":"10","author":"Diffie","year":"1977","journal-title":"Computer"},{"key":"2023022013491562200_","first-page":"337","article-title":"Key recovery attacks on 3-round even-mansour, 8-step led-128, and full AES2","volume-title":"Advances in Cryptology - ASIACRYPT 2013 - 19th International Conference on the Theory and Application of Cryptology and Information Security, Bengaluru, India, December 1-5, 2013, Proceedings, Part I","author":"Dinur","year":"2013"},{"key":"2023022013491562200_","first-page":"439","article-title":"Cryptanalysis of iterated even-mansour schemes with two keys","volume-title":"Advances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Application of Cryptology and Information Security, Kaoshiung, Taiwan, R.O.C., December 7-11, 2014. Proceedings, Part I","author":"Dinur","year":"2014"},{"key":"2023022013491562200_","first-page":"433","article-title":"New attacks on feistel structures with improved memory complexities","volume-title":"Advances in Cryptology - CRYPTO 2015 - 35th Annual Cryptology Conference, Santa Barbara, CA, USA, August 16-20, 2015, Proceedings, Part I","author":"Dinur","year":"2015"},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"721","DOI":"10.1007\/s10623-017-0353-5","article-title":"Improved meet-in-the-middle attacks on reduced-round kalyna-128\/256 and kalyna-256\/512","volume":"86","author":"Lin","year":"2018","journal-title":"Des. Codes Cryptogr."},{"key":"2023022013491562200_","first-page":"343","article-title":"Rijndael for AES","volume-title":"The Third Advanced Encryption Standard Candidate Conference, April 13-14, 2000, New York, USA","author":"Daemen","year":"2000"},{"key":"2023022013491562200_","first-page":"175","article-title":"Security of the AES with a secret s-box","volume-title":"Fast Software Encryption - 22nd International Workshop, FSE 2015, Istanbul, Turkey, March 8-11, 2015, Revised Selected Papers","author":"Tiessen","year":"2015"},{"key":"2023022013491562200_","first-page":"102","article-title":"Cryptanalysis of feistel networks with secret round functions","volume-title":"Selected Areas in Cryptography - SAC 2015 - 22nd International Conference, Sackville, NB, Canada, August 12-14, 2015, Revised Selected Papers","author":"Biryukov","year":"2015"},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"69304","DOI":"10.1109\/ACCESS.2019.2918350","article-title":"A structural attack on type-i generalized feistel networks","volume":"7","author":"Cui","year":"2019","journal-title":"IEEE Access"},{"key":"2023022013491562200_","first-page":"43","article-title":"Cryptanalysis of forkaes","volume-title":"Applied Cryptography and Network Security - 17th International Conference, ACNS 2019, Bogota, Colombia, June 5-7, 2019, Proceedings","author":"Banik","year":"2019"},{"key":"2023022013491562200_","first-page":"650","article-title":"A new encryption standard of ukraine: The kalyna block cipher","volume":"2015","author":"Oliynykov","year":"2015","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"2023022013491562200_","first-page":"123","article-title":"The SKINNY family of block ciphers and its low-latency variant MANTIS","volume-title":"Advances in Cryptology - CRYPTO 2016 - 36th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2016, Proceedings, Part II","author":"Beierle","year":"2016"},{"key":"2023022013491562200_","article-title":"Submission to CAESAR: Deoxys v1.41","author":"Jean","year":"2016"},{"key":"2023022013491562200_","first-page":"1","article-title":"GOST R 34.12-2015: Block cipher \u201dkuznyechik\u201d","volume":"7801","author":"Dolmatov","year":"2016","journal-title":"RFC"},{"key":"2023022013491562200_","first-page":"1","article-title":"GOST R 34.11-2012: Hash function","volume":"6986","author":"Dolmatov","year":"2013","journal-title":"RFC"},{"key":"2023022013491562200_","doi-asserted-by":"crossref","first-page":"450","DOI":"10.1007\/978-3-540-74735-2_31","article-title":"PRESENT: an ultra-lightweight block cipher","volume-title":"Cryptographic Hardware and Embedded Systems - CHES 2007, 9th International Workshop, Vienna, Austria, September 10-13, 2007, Proceedings","author":"Bogdanov","year":"2007"},{"key":"2023022013491562200_","first-page":"16","article-title":"Printcipher: A block cipher for ic-printing","volume-title":"Cryptographic Hardware and Embedded Systems, CHES 2010, 12th International Workshop, Santa Barbara, CA, USA, August 17-20, 2010. Proceedings","author":"Knudsen","year":"2010"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/2\/479\/49256420\/bxab174.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/2\/479\/49256420\/bxab174.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,10]],"date-time":"2023-11-10T14:47:34Z","timestamp":1699627654000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/66\/2\/479\/6419808"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,3]]},"references-count":33,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2021,11,3]]},"published-print":{"date-parts":[[2023,2,19]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxab174","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"value":"0010-4620","type":"print"},{"value":"1460-2067","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2023,2]]},"published":{"date-parts":[[2021,11,3]]}}}