{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T10:59:25Z","timestamp":1778065165467,"version":"3.51.4"},"reference-count":86,"publisher":"International Association for Cryptologic Research","issue":"4","license":[{"start":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T00:00:00Z","timestamp":1759881600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,12,2]]},"abstract":"<jats:p>We present Poseidonb and Poseidon2b, natural variants of Poseidon and Poseidon2, respectively, defined over binary extension fields with a target security level of 128 bits. They are specifically designed to inherit many of the circuit-friendly properties of their prime field version, and to be used together with binary extension field proving systems such as Binius. Benchmarking demonstrates the merits in proof size, proving time, and especially verification time, in comparison to traditional hash functions and other binary circuit-friendly hash functions such as Vision-32b and Anemoi.<\/jats:p>\n                  <jats:p>Due to the close similarity to their prime field counterparts, many existing cryptanalytic results directly carry over to Poseidonb and Poseidon2b. Nevertheless, we revisit the security analysis to incorporate recent advances in cryptanalysis and to account for attack vectors that do not arise in the prime field setting. In particular, we focus on algebraic cryptanalysis and subspace trails, techniques that resulted in attacks on initial versions of Poseidon defined over binary extension fields. Our complexity estimates are based on the ideal degree, now increasingly adopted as a standard measure in algebraic cryptanalysis<\/jats:p>","DOI":"10.62056\/a66ce0zn4","type":"journal-article","created":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:39:47Z","timestamp":1767915587000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["Poseidon(2)b"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1140-0520","authenticated-orcid":false,"given":"Lorenzo","family":"Grassi","sequence":"first","affiliation":[{"name":"Ponos Technology","place":["Zug, Switzerland"]},{"id":[{"id":"https:\/\/ror.org\/02c2kyt77","id-type":"ROR","asserted-by":"publisher"}],"name":"Eindhoven University of Technology","place":["Eindhoven, Netherlands"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0347-3378","authenticated-orcid":false,"given":"Dmitry","family":"Khovratovich","sequence":"additional","affiliation":[{"name":"Ethereum Foundation","place":["Singapore, Singapore"]},{"name":"ABDK Consulting","place":["Tallinn, Estonia"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-3109-146X","authenticated-orcid":false,"given":"Katharina","family":"Koschatko","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/00d7xrm67","id-type":"ROR","asserted-by":"publisher"}],"name":"Graz University of Technology","place":["Graz, Austria"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1280-6020","authenticated-orcid":false,"given":"Christian","family":"Rechberger","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/00d7xrm67","id-type":"ROR","asserted-by":"publisher"}],"name":"Graz University of Technology","place":["Graz, Austria"]},{"name":"TACEO","place":["Graz, Austria"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-9598-4005","authenticated-orcid":false,"given":"Markus","family":"Schofnegger","sequence":"additional","affiliation":[{"name":"Fabric Cryptography","place":["San Francisco, United States"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8845-7959","authenticated-orcid":false,"given":"Verena","family":"Schr\u00f6ppel","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/00d7xrm67","id-type":"ROR","asserted-by":"publisher"}],"name":"Graz University of Technology","place":["Graz, Austria"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6259-2590","authenticated-orcid":false,"given":"Zhuo","family":"Wu","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, CAS","place":["Beijing, China"]},{"name":"University of Chinese Academy of Sciences","place":["Beijing, China"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2026,1,8]]},"reference":[{"key":"ref1:cryptoeprint:2023\/342","volume-title":"TurboSHAKE","author":"Guido Bertoni","year":"2023"},{"key":"ref2:tosc\/CidGGLRS22","doi-asserted-by":"publisher","first-page":"110","DOI":"10.46586\/tosc.v2022.i1.110-137","article-title":"Influence of the Linear Layer on the Algebraic Degree in\n  SP-Networks","volume":"2022","author":"Carlos Cid","year":"2022","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref3:iacr\/BenSassonGL20-starksurvey","volume-title":"STARK Friendly Hash \u2013 Survey and Recommendation","author":"Eli Ben-Sasson","year":"2020"},{"key":"ref4:tosc\/BariantBLP22-spntrick","doi-asserted-by":"publisher","first-page":"73","DOI":"10.46586\/tosc.v2022.i3.73-101","article-title":"Algebraic Attacks against Some Arithmetization-Oriented\n  Primitives","volume":"2022","author":"Augustin Bariant","year":"2022","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref5:fse\/Knudsen94","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"196","DOI":"10.1007\/3-540-60590-8_16","article-title":"Truncated and Higher Order Differentials","volume":"1008","author":"Lars R. Knudsen","year":"1994"},{"key":"ref6:iacr\/BakBBBOP-cheaplunch","volume-title":"The Algebraic CheapLunch: Extending FreeLunch Attacks on\n  Arithmetization-Oriented Primitives Beyond CICO-1","author":"Antoine Bak","year":"2025"},{"key":"ref7:iacr\/GrassiKKRRS19-poseidon-orig","volume-title":"Starkad and Poseidon: New Hash Functions for Zero\n  Knowledge Proof Systems","author":"Lorenzo Grassi","year":"2019"},{"key":"ref8:tosc\/Grassi18","doi-asserted-by":"publisher","first-page":"133","DOI":"10.13154\/tosc.v2018.i2.133-160","article-title":"Mixture Differential Cryptanalysis: a New Approach to\n  Distinguishers and Attacks on round-reduced AES","volume":"2018","author":"Lorenzo Grassi","year":"2018","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref9:tosc\/DuvalL18","doi-asserted-by":"publisher","first-page":"48","DOI":"10.13154\/tosc.v2018.i2.48-78","article-title":"MDS Matrices with Lightweight Circuits","volume":"2018","author":"S\u00e9bastien Duval","year":"2018","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref10:books\/BihamS93","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4613-9314-6","volume-title":"Differential Cryptanalysis of the Data Encryption Standard","author":"Eli Biham","year":"1993"},{"key":"ref11:iacr\/ZhaoD25","volume-title":"Breaking Poseidon Challenges with Graeffe Transforms and\n  Complexity Analysis by FFT Lower Bounds","author":"Ziyu Zhao","year":"2025"},{"key":"ref12:asiacrypt\/KhovratovichBM23","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"301","DOI":"10.1007\/978-981-99-8742-9_10","article-title":"Generic Security of the SAFE API and Its Applications","volume":"14445","author":"Dmitry Khovratovich","year":"2023"},{"key":"ref13:MerklePhDThesis","volume-title":"Secrecy, authentication and public key systems","author":"Ralph Charles Merkle","year":"1979"},{"key":"ref14:fse\/DaemenKR97-square","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1007\/bfb0052343","article-title":"The Block Cipher Square","volume":"1267","author":"Joan Daemen","year":"1997"},{"key":"ref15:issac\/FaugereGHR14-fglm","doi-asserted-by":"publisher","first-page":"170","DOI":"10.1145\/2608628.2608669","article-title":"Sub-cubic change of ordering for Gr\u00f6bner basis: a\n  probabilistic approach","author":"Jean-Charles Faug\u00e8re","year":"2014"},{"key":"ref16:iacr\/SansoV25","volume-title":"Attacking Poseidon via Graeffe-Based Root-Finding over\n  NTT-Friendly Fields","author":"Antonio Sanso","year":"2025"},{"key":"ref17:sha3\/BertoniDPA11-keccak","volume-title":"The Keccak reference","author":"Guido Bertoni","year":"2011"},{"key":"ref18:tosc\/GrassiKR2025-subspace","doi-asserted-by":"publisher","first-page":"34","DOI":"10.46586\/tosc.v2025.i2.34-86","article-title":"Poseidon and Neptune: Gr\u00f6bner Basis\n  Cryptanalysis Exploiting Subspace Trails","volume":"2025","author":"Lorenzo Grassi","year":"2025","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref19:cc\/Lai94","doi-asserted-by":"publisher","first-page":"227","DOI":"10.1007\/978-1-4615-2694-0_23","article-title":"Higher Order Derivatives and Differential Cryptanalysis","author":"Xuejia Lai","year":"1994"},{"key":"ref20:online\/poseidonintiative24","volume-title":"Poseidon Cryptanalysis Initiative 2024\u20132026: Scrutinizing\n  Poseidon for Good","author":"Ethereum Foundation","year":"2024"},{"key":"ref21:asiacrypt\/LambergerMRRS09","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1007\/978-3-642-10366-7_8","article-title":"Rebound Distinguishers: Results on the Full Whirlpool\n  Compression Function","volume":"5912","author":"Mario Lamberger","year":"2009"},{"key":"ref22:acns\/AumassonNWW13-blake2","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"119","DOI":"10.1007\/978-3-642-38980-1_8","article-title":"BLAKE2: Simpler, Smaller, Fast as MD5","volume":"7954","author":"Jean-Philippe Aumasson","year":"2013"},{"key":"ref23:crypto\/BonehDFG21-haloinf","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"649","DOI":"10.1007\/978-3-030-84242-0_23","article-title":"Halo Infinite: Proof-Carrying Data from Additive\n  Polynomial Commitments","volume":"12825","author":"Dan Boneh","year":"2021"},{"key":"ref24:crypto\/BihamS90","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/3-540-38424-3_1","article-title":"Differential Cryptanalysis of DES-like Cryptosystems","volume":"537","author":"Eli Biham","year":"1990"},{"key":"ref25:fse\/BiryukovW99-slideattack","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"245","DOI":"10.1007\/3-540-48519-8_18","article-title":"Slide Attacks","volume":"1636","author":"Alex Biryukov","year":"1999"},{"key":"ref26:iacr\/AshurMPS24-visionmark32","volume-title":"Vision Mark-32: ZK-Friendly Hash Function Over Binary\n  Tower Fields","author":"Tomer Ashur","year":"2024"},{"key":"ref27:iacr\/GabizonWC19-plonk","volume-title":"PLONK: Permutations over Lagrange-bases for Oecumenical\n  Noninteractive arguments of Knowledge","author":"Ariel Gabizon","year":"2019"},{"key":"ref28:online\/poseidon2-roundnums","volume-title":"Poseidon2 parameters","author":"HorizenLabs"},{"key":"ref29:sacrypt\/GrassiLRSWW24","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"207","DOI":"10.1007\/978-3-031-82841-6_9","article-title":"Minimize the Randomness in Rasta-Like Designs: How Far Can\n  We Go? \u2013 Application to Pasta","volume":"15517","author":"Lorenzo Grassi","year":"2024"},{"key":"ref30:phd\/Buchberger65","volume-title":"Ein Algorithmus zum Auffinden der Basiselemente des\n  Restklassenringes nach einem nulldimensionalen Polynomideal","author":"Bruno Buchberger","year":"1965"},{"key":"ref31:tosc\/LeanderTW18","doi-asserted-by":"publisher","first-page":"74","DOI":"10.13154\/tosc.v2018.i1.74-100","article-title":"Searching for Subspace Trails and Truncated Differentials","volume":"2018","author":"Gregor Leander","year":"2018","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref32:tosc\/GrassiRS21","doi-asserted-by":"publisher","first-page":"314","DOI":"10.46586\/tosc.v2021.i2.314-352","article-title":"Proving Resistance Against Infinitely Long Subspace Trails:\n  How to Choose the Linear Layer","volume":"2021","author":"Lorenzo Grassi","year":"2021","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref33:eurocrypt\/BihamBS99","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1007\/3-540-48910-x_2","article-title":"Cryptanalysis of Skipjack Reduced to 31 Rounds Using\n  Impossible Differentials","volume":"1592","author":"Eli Biham","year":"1999"},{"key":"ref34:eurocrypt\/KellerR21","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1007\/978-3-030-77886-6_2","article-title":"Mind the Middle Layer: The HADES Design Strategy\n  Revisited","volume":"12697","author":"Nathan Keller","year":"2021"},{"key":"ref35:eurocrypt\/CampaR25-anemoi","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"303","DOI":"10.1007\/978-3-031-91107-1_11","article-title":"Gr\u00f6bner Basis Cryptanalysis of Anemoi","volume":"15601","author":"Luca Campa","year":"2025"},{"key":"ref36:asiacrypt\/EichlsederGLORSW20","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"477","DOI":"10.1007\/978-3-030-64837-4_16","article-title":"An Algebraic Attack on Ciphers with Low-Degree Round\n  Functions: Application to Full MiMC","volume":"12491","author":"Maria Eichlseder","year":"2020"},{"key":"ref37:online\/sp1","volume-title":"SP1","author":"Succinct Labs","year":"2025"},{"key":"ref38:fse\/JakobsenK97-interpolationattack","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"28","DOI":"10.1007\/bfb0052332","article-title":"The Interpolation Attack on Block Ciphers","volume":"1267","author":"Thomas Jakobsen","year":"1997"},{"key":"ref39:acisp\/AshurBM24","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"225","DOI":"10.1007\/978-981-97-5028-3_12","article-title":"Algebraic Cryptanalysis of the HADES Design Strategy:\n  Application to Poseidon and Poseidon2","volume":"14896","author":"Tomer Ashur","year":"2024"},{"key":"ref40:crypto\/BouvierBCPSVW23","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"507","DOI":"10.1007\/978-3-031-38548-3_17","article-title":"New Design Techniques for Efficient Arithmetization-Oriented\n  Hash Functions: Anemoi Permutations and Jive Compression Mode","volume":"14083","author":"Cl\u00e9mence Bouvier","year":"2023"},{"key":"ref41:tosc\/LefevreBM25","doi-asserted-by":"publisher","first-page":"97","DOI":"10.46586\/tosc.v2025.i1.97-137","article-title":"To Pad or Not to Pad? Padding-Free Arithmetization-Oriented\n  Sponges","volume":"2025","author":"Charlotte Lefevre","year":"2025","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref42:soda\/Ben-SassonCKL23","doi-asserted-by":"publisher","first-page":"700","DOI":"10.1137\/1.9781611977554.ch30","article-title":"Elliptic Curve Fast Fourier Transform (ECFFT) \u2013 Part I:\n  Low-degree Extension in Time \\(O(n \\log n)\\) over all Finite Fields","author":"Eli Ben-Sasson","year":"2023"},{"key":"ref43:DBLP:conf\/crypto\/BellareR97","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"470","DOI":"10.1007\/BFB0052256","article-title":"Collision-Resistant Hashing: Towards Making UOWHFs\n  Practical","volume":"1294","author":"Mihir Bellare","year":"1997"},{"key":"ref44:eurocrypt\/GrassiRR17","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"289","DOI":"10.1007\/978-3-319-56614-6_10","article-title":"A New Structural-Differential Property of 5-Round AES","volume":"10211","author":"Lorenzo Grassi","year":"2017"},{"key":"ref45:moc\/Berlekamp70-factorization","doi-asserted-by":"crossref","first-page":"713","DOI":"10.1090\/S0025-5718-1970-0276200-X","article-title":"Factoring polynomials over large finite fields","volume":"24","author":"Elwyn R. Berlekamp","year":"1970","journal-title":"Mathematics of Computation"},{"key":"ref46:dagstuhl\/GauravaramKMMRS09-grostl","series-title":"Dagstuhl Seminar Proceedings","article-title":"Gr\u00f8stl \u2013 a SHA-3 candidate","volume":"09031","author":"Praveen Gauravaram","year":"2009"},{"key":"ref47:jsc\/BardetFS15","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1016\/J.JSC.2014.09.025","article-title":"On the complexity of the F5 Gr\u00f6bner basis\n  algorithm","volume":"70","author":"Magali Bardet","year":"2015","journal-title":"J. Symb. Comput."},{"key":"ref48:tosc\/AlyABDS20-marvellous","doi-asserted-by":"publisher","first-page":"1","DOI":"10.13154\/tosc.v2020.i3.1-45","article-title":"Design of Symmetric-Key Primitives for Advanced\n  Cryptographic Protocols","volume":"2020","author":"Abdelrahaman Aly","year":"2020","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref49:crypto\/GrassiHRSWW23-griffin","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"573","DOI":"10.1007\/978-3-031-38548-3_19","article-title":"Horst Meets Fluid-SPN: Griffin for Zero-Knowledge\n  Applications","volume":"14083","author":"Lorenzo Grassi","year":"2023"},{"key":"ref50:tosc\/GrassiRR16","doi-asserted-by":"publisher","first-page":"192","DOI":"10.13154\/tosc.v2016.i2.192-225","article-title":"Subspace Trail Cryptanalysis and its Applications to AES","volume":"2016","author":"Lorenzo Grassi","year":"2016","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref51:fse\/BouraCC11","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"252","DOI":"10.1007\/978-3-642-21702-9_15","article-title":"Higher-Order Differential Properties of Keccak and\n  Luffa","volume":"6733","author":"Christina Boura","year":"2011"},{"key":"ref52:tit\/BouraC13","doi-asserted-by":"publisher","first-page":"691","DOI":"10.1109\/tit.2012.2214203","article-title":"On the Influence of the Algebraic Degree of F\\({}^{-1}\\) on\n  the Algebraic Degree of G \\(\\circ\\) F","volume":"59","author":"Christina Boura","year":"2013","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref53:arxiv\/EliaS11","volume-title":"Improvements on Cantor-Zassenhaus Factorization Algorithm","author":"Michele Elia","year":"2011"},{"key":"ref54:eurocrypt\/ChenBBZ23-hyperplonk","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"499","DOI":"10.1007\/978-3-031-30617-4_17","article-title":"HyperPlonk: Plonk with Linear-Time Prover and High-Degree\n  Custom Gates","volume":"14005","author":"Binyi Chen","year":"2023"},{"key":"ref55:crypto\/BariantBBHOR25-resultant","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"335","DOI":"10.1007\/978-3-032-01901-1_11","article-title":"Improved Resultant Attack Against Arithmetization-Oriented\n  Primitives","volume":"16004","author":"Augustin Bariant","year":"2025"},{"key":"ref56:crypto\/LeanderAAZ11","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"206","DOI":"10.1007\/978-3-642-22792-9_12","article-title":"A Cryptanalysis of PRINTcipher: The Invariant Subspace\n  Attack","volume":"6841","author":"Gregor Leander","year":"2011"},{"key":"ref57:eurocrypt\/LeanderMR15","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"254","DOI":"10.1007\/978-3-662-46800-5_11","article-title":"A Generic Approach to Invariant Subspace Attacks:\n  Cryptanalysis of Robin, iSCREAM and Zorro","volume":"9056","author":"Gregor Leander","year":"2015"},{"key":"ref58:fse\/MendelRST09","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"260","DOI":"10.1007\/978-3-642-03317-9_16","article-title":"The Rebound Attack: Cryptanalysis of Reduced Whirlpool\n  and Gr\u00f8stl","volume":"5665","author":"Florian Mendel","year":"2009"},{"key":"ref59:eurocrypt\/BertoniDPA13-keccak","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"313","DOI":"10.1007\/978-3-642-38348-9_19","article-title":"Keccak","volume":"7881","author":"Guido Bertoni","year":"2013"},{"key":"ref60:eurocrypt\/BertoniDPA08","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"181","DOI":"10.1007\/978-3-540-78967-3_11","article-title":"On the Indifferentiability of the Sponge Construction","volume":"4965","author":"Guido Bertoni","year":"2008"},{"key":"ref61:iacr\/GrassiKS23-poseidon2-updated","volume-title":"Poseidon2: A Faster Version of the Poseidon Hash\n  Function","author":"Lorenzo Grassi","year":"2023"},{"key":"ref62:iacr\/AumassonKMQ23","volume-title":"SAFE: Sponge API for Field Elements","author":"Jean-Philippe Aumasson","year":"2023"},{"key":"ref63:crypto\/BeyneCDELLNPSTW20-outofoddity","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"299","DOI":"10.1007\/978-3-030-56877-1_11","article-title":"Out of Oddity: New Cryptanalytic Techniques Against\n  Symmetric Primitives Optimized for Integrity Proof Systems","volume":"12172","author":"Tim Beyne","year":"2020"},{"key":"ref64:icalp\/Ben-SassonBHR18","series-title":"LIPIcs","doi-asserted-by":"publisher","DOI":"10.4230\/lipics.icalp.2018.14","article-title":"Fast Reed-Solomon Interactive Oracle Proofs of Proximity","volume":"107","author":"Eli Ben-Sasson","year":"2018"},{"key":"ref65:africacrypt\/GrassiKS23-poseidon2","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"177","DOI":"10.1007\/978-3-031-37679-5_8","article-title":"Poseidon2: A Faster Version of the Poseidon Hash\n  Function","volume":"14064","author":"Lorenzo Grassi","year":"2023"},{"key":"ref66:online\/safeAPI","volume-title":"SAFE (Sponge API for Field Elements) \u2013 A Toolbox for\n  ZK Hash Applications","author":"Jean-Philippe Aumasson","year":"2022"},{"key":"ref67:stoc\/KaltofenS95-factorization","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1145\/225058.225166","article-title":"Subquadratic-time factoring of polynomials over finite\n  fields","author":"Erich L. Kaltofen","year":"1995"},{"key":"ref68:eurocrypt\/DiamondP25-binius","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1007\/978-3-031-91134-7_4","article-title":"Succinct Arguments over Towers of Binary Fields","volume":"15604","author":"Benjamin E. Diamond","year":"2025"},{"key":"ref69:fips\/180-4","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.FIPS.180-4","volume-title":"FIPS 180-4: Secure Hash Standard (SHS)","author":"NIST","year":"2015","journal-title":"FIPS"},{"key":"ref70:moc\/CantorZ81-factorization","doi-asserted-by":"publisher","first-page":"587","DOI":"10.2307\/2007663","article-title":"A New Algorithm for Factoring Polynomials Over Finite\n  Fields","volume":"36","author":"David G. Cantor","year":"1981","journal-title":"Mathematics of Computation"},{"key":"ref71:iacr\/DiamondP24-fribinius","volume-title":"Polylogarithmic Proofs for Multilinears over Binary Towers","author":"Benjamin E. Diamond","year":"2024"},{"key":"ref72:tosc\/GuoJNQSS16","doi-asserted-by":"publisher","first-page":"33","DOI":"10.13154\/tosc.v2016.i1.33-56","article-title":"Invariant Subspace Attack Against Midori64 and The\n  Resistance Criteria for S-box Designs","volume":"2016","author":"Jian Guo","year":"2016","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref73:rfc\/SaarinenA15-blake2","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7693","volume-title":"The BLAKE2 Cryptographic Hash and Message Authentication\n  Code (MAC)","author":"Markku-Juhani O. Saarinen","year":"2015","journal-title":"Request for Comments"},{"key":"ref74:tcc\/Ben-SassonCKL22","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"467","DOI":"10.1007\/978-3-031-22318-1_17","article-title":"Scalable and Transparent Proofs over All Large Fields, via\n  Elliptic Curves \u2013 ECFFT Part II","volume":"13747","author":"Eli Ben-Sasson","year":"2022"},{"key":"ref75:fse\/Lai94","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"75","DOI":"10.1007\/3-540-60590-8_6","article-title":"Additive and Linear Structures of Cryptographic Functions","volume":"1008","author":"Xuejia Lai","year":"1994"},{"key":"ref76:iacr\/Perrin24","volume-title":"Security Analysis of XHASH8\/12","author":"L\u00e9o Perrin","year":"2024"},{"key":"ref77:iacr\/GrassiHRSWW22-griffin","volume-title":"A New Feistel Approach Meets Fluid-SPN: Griffin for\n  Zero-Knowledge Applications","author":"Lorenzo Grassi","year":"2022"},{"key":"ref78:eurocrypt\/Matsui93","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"386","DOI":"10.1007\/3-540-48285-7_33","article-title":"Linear Cryptanalysis Method for DES Cipher","volume":"765","author":"Mitsuru Matsui","year":"1993"},{"key":"ref79:BakBBHJ2025","volume-title":"Solving CICO-2 bounty instances of Poseidon","author":"Antoine Bak","year":"2025"},{"key":"ref80:crypto\/BariantBLAOPR24-freelunch","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1007\/978-3-031-68385-5_5","article-title":"The Algebraic FreeLunch: Efficient Gr\u00f6bner Basis\n  Attacks Against Arithmetization-Oriented Primitives","volume":"14923","author":"Augustin Bariant","year":"2024"},{"key":"ref81:asiacrypt\/YangZYLT24-resultant","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"457","DOI":"10.1007\/978-981-96-0941-3_15","article-title":"A New Security Evaluation Method Based on Resultant for\n  Arithmetic-Oriented Algorithms","volume":"15490","author":"Hong-Sen Yang","year":"2024"},{"key":"ref82:online\/poseidon2b","volume-title":"Poseidon2b","author":"Poseidon2b","year":"2025"},{"key":"ref83:uss\/GrassiKRRS21-poseidon","first-page":"519","article-title":"Poseidon: A New Hash Function for Zero-Knowledge Proof\n  Systems","author":"Lorenzo Grassi","year":"2021"},{"key":"ref84:iacr\/GrassiKKRRS19-poseidon-updated","volume-title":"Poseidon: A New Hash Function for Zero-Knowledge Proof\n  Systems (Updated Version)","author":"Lorenzo Grassi","year":"2019"},{"key":"ref85:fse\/KhovratovichN10","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"333","DOI":"10.1007\/978-3-642-13858-4_19","article-title":"Rotational Cryptanalysis of ARX","volume":"6147","author":"Dmitry Khovratovich","year":"2010"},{"key":"ref86:tosc\/KoschatkoLR24-sixworlds","doi-asserted-by":"publisher","first-page":"138","DOI":"10.46586\/tosc.v2024.i4.138-190","article-title":"Exploring the Six Worlds of Gr\u00f6bner Basis\n  Cryptanalysis: Application to Anemoi","volume":"2024","author":"Katharina Koschatko","year":"2024","journal-title":"IACR Transactions on Symmetric Cryptology"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:41:00Z","timestamp":1767915660000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/4\/15"}},"subtitle":["Binary Field Versions of Poseidon\/Poseidon2"],"short-title":[],"issued":{"date-parts":[[2026,1,8]]},"references-count":86,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,1,8]]}},"URL":"https:\/\/doi.org\/10.62056\/a66ce0zn4","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,8]]},"assertion":[{"value":"2025-10-08","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-4-30"}}