{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T05:55:14Z","timestamp":1787032514717,"version":"build-2736575974"},"reference-count":30,"publisher":"International Association for Cryptologic Research","issue":"4","license":[{"start":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T00:00:00Z","timestamp":1759104000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,12,2]]},"abstract":"<jats:p>The meet-in-the-middle (MITM) attack is a powerful cryptanalytic technique leveraging time-memory tradeoffs to break cryptographic primitives.      Initially introduced for block cipher cryptanalysis, it has since been extended to hash functions, particularly preimage attacks on AES-based compression functions.      Over the years, various enhancements such as superposition MITM (Bao et al., CRYPTO 2022) and bidirectional propagations have significantly improved MITM attacks, but at the cost of increasing complexity of automated search models.      In this work, we propose a unified mixed integer linear programming (MILP) model designed to  improve the search for optimal pre-image MITM attacks against AES-based compression functions.      Our model generalizes previous approaches by simplifying both the modeling and the corresponding attack algorithm. In particular, it ensures that all identified attacks are valid.      The results demonstrate that our framework not only recovers known attacks on AES and Whirlpool but also discovers new attacks with lower memory complexities, and new quantum attacks.<\/jats:p>","DOI":"10.62056\/akp2tx4e-","type":"journal-article","created":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:39:47Z","timestamp":1767915587000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["Simplified Meet-in-the-middle Preimage Attacks on AES-based Hashing"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-0067-7868","authenticated-orcid":false,"given":"Mathieu","family":"Degr\u00e9","sequence":"first","affiliation":[{"name":"Univ Rennes, Inria, CNRS, IRISA","place":["Rennes, France"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0478-8483","authenticated-orcid":false,"given":"Patrick","family":"Derbez","sequence":"additional","affiliation":[{"name":"Univ Rennes, Inria, CNRS, IRISA","place":["Rennes, France"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1329-8630","authenticated-orcid":false,"given":"Andr\u00e9","family":"Schrottenloher","sequence":"additional","affiliation":[{"name":"Univ Rennes, Inria, CNRS, IRISA","place":["Rennes, France"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"48349","published-online":{"date-parts":[[2026,1,8]]},"reference":[{"key":"ref1:DBLP:journals\/computer\/DiffieH77","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1109\/C-M.1977.217750","article-title":"Special Feature Exhaustive Cryptanalysis of the NBS Data\n  Encryption Standard","volume":"10","author":"Whitfield Diffie","year":"1977","journal-title":"Computer"},{"key":"ref2:DBLP:conf\/fse\/Sasaki11","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"378","DOI":"10.1007\/978-3-642-21702-9_22","article-title":"Meet-in-the-Middle Preimage Attacks on AES Hashing Modes\n  and an Application to Whirlpool","volume":"6733","author":"Yu Sasaki","year":"2011"},{"key":"ref3:DBLP:conf\/indocrypt\/DunkelmanSP07","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"86","DOI":"10.1007\/978-3-540-77026-8_8","article-title":"Improved Meet-in-the-Middle Attacks on Reduced-Round DES","volume":"4859","author":"Orr Dunkelman","year":"2007"},{"key":"ref4:DBLP:conf\/sacrypt\/AokiS08","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"103","DOI":"10.1007\/978-3-642-04159-4_7","article-title":"Preimage Attacks on One-Block MD4, 63-Step MD5 and\n  More","volume":"5381","author":"Kazumaro Aoki","year":"2008"},{"key":"ref5:DBLP:conf\/asiacrypt\/GuoLRW10","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"56","DOI":"10.1007\/978-3-642-17373-8_4","article-title":"Advanced Meet-in-the-Middle Preimage Attacks: First Results\n  on Full Tiger, and Improved Results on MD4 and SHA-2","volume":"6477","author":"Jian Guo","year":"2010"},{"key":"ref6:DBLP:conf\/sacrypt\/BogdanovR10","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1007\/978-3-642-19574-7_16","article-title":"A 3-Subset Meet-in-the-Middle Attack: Cryptanalysis of the\n  Lightweight Block Cipher KTANTAN","volume":"6544","author":"Andrey Bogdanov","year":"2010"},{"key":"ref7:DBLP:conf\/iwsec\/Sasaki18","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"227","DOI":"10.1007\/978-3-319-97916-8_15","article-title":"Integer Linear Programming for Three-Subset\n  Meet-in-the-Middle Attacks: Application to GIFT","volume":"11049","author":"Yu Sasaki","year":"2018"},{"key":"ref8:DBLP:conf\/crypto\/CanteautNV13","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1007\/978-3-642-40041-4_13","article-title":"Sieve-in-the-Middle: Improved MITM Attacks","volume":"8042","author":"Anne Canteaut","year":"2013"},{"key":"ref9:DBLP:conf\/fse\/KhovratovichRS12","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"244","DOI":"10.1007\/978-3-642-34047-5_15","article-title":"Bicliques for Preimages: Attacks on Skein-512 and the\n  SHA-2 Family","volume":"7549","author":"Dmitry Khovratovich","year":"2012"},{"key":"ref10:DBLP:conf\/fse\/LinWZ16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"247","DOI":"10.1007\/978-3-662-52993-5_13","article-title":"Automatic Search for Key-Bridging Technique: Applications to\n  LBlock and TWINE","volume":"9783","author":"Li Lin","year":"2016"},{"key":"ref11:DBLP:conf\/crypto\/BouillaguetDF11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1007\/978-3-642-22792-9_10","article-title":"Automatic Search of Attacks on Round-Reduced AES and\n  Applications","volume":"6841","author":"Charles Bouillaguet","year":"2011"},{"key":"ref12:DBLP:conf\/crypto\/DerbezF16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1007\/978-3-662-53008-5_6","article-title":"Automatic Search of Meet-in-the-Middle and Impossible\n  Differential Attacks","volume":"9815","author":"Patrick Derbez","year":"2016"},{"key":"ref13:DBLP:conf\/asiacrypt\/ShiSDTSH18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-030-03329-3_1","article-title":"Programming the Demirci-Sel\u00e7uk Meet-in-the-Middle\n  Attack with Constraints","volume":"11273","author":"Danping Shi","year":"2018"},{"key":"ref14:DBLP:journals\/tosc\/BaoDGWZ19","doi-asserted-by":"publisher","first-page":"318","DOI":"10.13154\/tosc.v2019.i4.318-347","article-title":"Improved Meet-in-the-Middle Preimage Attacks against AES\n  Hashing Modes","volume":"2019","author":"Zhenzhen Bao","year":"2019","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref15:DBLP:conf\/eurocrypt\/BaoD00SS021","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"771","DOI":"10.1007\/978-3-030-77870-5_27","article-title":"Automatic Search of Meet-in-the-Middle Preimage Attacks on\n  AES-like Hashing","volume":"12696","author":"Zhenzhen Bao","year":"2021"},{"key":"ref16:DBLP:conf\/crypto\/DongHSLWH21","series-title":"LNCS","doi-asserted-by":"publisher","first-page":"278","DOI":"10.1007\/978-3-030-84252-9_10","article-title":"Meet-in-the-Middle Attacks Revisited: Key-Recovery,\n  Collision, and Preimage Attacks","volume":"12827","author":"Xiaoyang Dong","year":"2021"},{"key":"ref17:DBLP:journals\/tosc\/HuaDSZHW22","doi-asserted-by":"publisher","first-page":"63","DOI":"10.46586\/TOSC.V2022.I2.63-91","article-title":"Improved MITM Cryptanalysis on Streebog","volume":"2022","author":"Jialiang Hua","year":"2022","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref18:DBLP:conf\/crypto\/BaoGST22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"64","DOI":"10.1007\/978-3-031-15802-5_3","article-title":"Superposition Meet-in-the-Middle Attacks: Updates on\n  Fundamental Security of AES-like Hashing","volume":"13507","author":"Zhenzhen Bao","year":"2022"},{"key":"ref19:DBLP:conf\/eurocrypt\/QinHDYW23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"158","DOI":"10.1007\/978-3-031-30634-1_6","article-title":"Meet-in-the-Middle Preimage Attacks on Sponge-Based\n  Hashing","volume":"14007","author":"Lingyue Qin","year":"2023"},{"key":"ref20:DBLP:conf\/crypto\/DongZQHZW24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-031-68385-5_1","article-title":"Generic MitM Attack Frameworks on Sponge Constructions","volume":"14923","author":"Xiaoyang Dong","year":"2024"},{"key":"ref21:DBLP:conf\/asiacrypt\/HouDQZW23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"370","DOI":"10.1007\/978-981-99-8727-6_13","article-title":"Automated Meet-in-the-Middle Attack Goes to Feistel","volume":"14440","author":"Qingliang Hou","year":"2023"},{"key":"ref22:DBLP:conf\/eurocrypt\/ChenGLSZ24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1007\/978-3-031-58716-0_14","article-title":"Diving Deep into the Preimage Security of AES-Like\n  Hashing","volume":"14651","author":"Shiyao Chen","year":"2024"},{"key":"ref23:DBLP:journals\/iacr\/ChenGLSZ25","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1007\/978-981-95-5018-0_6","article-title":"Scrutinizing the Security of AES-Based Hashing and One-Way\n  Functions","volume":"16245","author":"Shiyao Chen","year":"2025"},{"key":"ref24:DBLP:conf\/crypto\/SchrottenloherS22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"717","DOI":"10.1007\/978-3-031-15982-4_24","article-title":"Simplified MITM Modeling for Permutations: New (Quantum)\n  Attacks","volume":"13509","author":"Andr\u00e9 Schrottenloher","year":"2022"},{"key":"ref25:DBLP:journals\/tosc\/SchrottenloherS23","doi-asserted-by":"publisher","first-page":"146","DOI":"10.46586\/TOSC.V2023.I3.146-183","article-title":"Simplified Modeling of MITM Attacks for Block Ciphers: New\n  (Quantum) Attacks","volume":"2023","author":"Andr\u00e9 Schrottenloher","year":"2023","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref26:DBLP:books\/sp\/DaemenR02","series-title":"Information Security and Cryptography","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-60769-5","volume-title":"The Design of Rijndael - The Advanced Encryption Standard\n  (AES), Second Edition","author":"Joan Daemen","year":"2020","ISBN":"https:\/\/id.crossref.org\/isbn\/9783662607688"},{"key":"ref27:nielsen2002quantum","volume-title":"Quantum computation and quantum information","author":"Michael A Nielsen","year":"2002"},{"key":"ref28:DBLP:conf\/stoc\/Grover96","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1145\/237814.237866","article-title":"A Fast Quantum Mechanical Algorithm for Database Search","author":"Lov K. Grover","year":"1996"},{"key":"ref29:brassard2002quantum","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1090\/conm\/305\/05215","article-title":"Quantum amplitude amplification and estimation","volume":"305","author":"Gilles Brassard","year":"2002","journal-title":"Contemporary Mathematics"},{"key":"ref30:DBLP:conf\/eurocrypt\/LeurentP21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1007\/978-3-030-77870-5_3","article-title":"New Representations of the AES Key Schedule","volume":"12696","author":"Ga\u00ebtan Leurent","year":"2021"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:40:27Z","timestamp":1767915627000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/4\/9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,8]]},"references-count":30,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,1,8]]}},"URL":"https:\/\/doi.org\/10.62056\/akp2tx4e-","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,8]]},"assertion":[{"value":"2025-09-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-4-13"}}