{"id":"https://openalex.org/W4414549381","doi":"https://doi.org/10.46586/tosc.v2025.i3.633-692","title":"Linear Cancellations in the MitM Attacks on Sponge Functions","display_name":"Linear Cancellations in the MitM Attacks on Sponge Functions","publication_year":2025,"publication_date":"2025-09-25","ids":{"openalex":"https://openalex.org/W4414549381","doi":"https://doi.org/10.46586/tosc.v2025.i3.633-692"},"language":"en","primary_location":{"id":"doi:10.46586/tosc.v2025.i3.633-692","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tosc.v2025.i3.633-692","pdf_url":null,"source":{"id":"https://openalex.org/S4210236173","display_name":"IACR Transactions on Symmetric Cryptology","issn_l":"2519-173X","issn":["2519-173X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Symmetric Cryptology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.46586/tosc.v2025.i3.633-692","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5022299291","display_name":"Lingyue Qin","orcid":"https://orcid.org/0000-0003-3312-2189"},"institutions":[{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lingyue Qin","raw_affiliation_strings":["Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China","institution_ids":["https://openalex.org/I99065089","https://openalex.org/I4210132990"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046388151","display_name":"Boxin Zhao","orcid":"https://orcid.org/0000-0003-4739-1339"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Boxin Zhao","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, P.R.China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111094732","display_name":"Qingliang Hou","orcid":null},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingliang Hou","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, P.R.China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Keting Jia","orcid":null},"institutions":[{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Keting Jia","raw_affiliation_strings":["Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China","institution_ids":["https://openalex.org/I99065089","https://openalex.org/I4210132990"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068633811","display_name":"Gaoli Wang","orcid":"https://orcid.org/0000-0002-2121-9306"},"institutions":[{"id":"https://openalex.org/I4210139618","display_name":"Shanghai Key Laboratory of Trustworthy Computing","ror":"https://ror.org/030qbr085","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210139618"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gaoli Wang","raw_affiliation_strings":["Shanghai Key Laboratory of Trustworthy Computing, School of Cryptology, Software Engineering Institute, East China Normal University, Shanghai, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Key Laboratory of Trustworthy Computing, School of Cryptology, Software Engineering Institute, East China Normal University, Shanghai, P.R.China","institution_ids":["https://openalex.org/I4210139618"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5038484143","display_name":"Xiaoyang Dong","orcid":"https://orcid.org/0000-0002-6723-6013"},"institutions":[{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyang Dong","raw_affiliation_strings":["Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, P.R.China; Zhongguancun Laboratory, Beijing, P.R.China; State Key Laboratory of Cryptography and Digital Economy Security, Tsinghua University, Beijing, P.R.China","institution_ids":["https://openalex.org/I99065089","https://openalex.org/I4210132990"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.12318048,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"2025","issue":"3","first_page":"633","last_page":"692"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.9677000045776367,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11130","display_name":"Coding theory and cryptography","score":0.9203000068664551,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/man-in-the-middle-attack","display_name":"Man-in-the-middle attack","score":0.8399999737739563},{"id":"https://openalex.org/keywords/hash-function","display_name":"Hash function","score":0.550599992275238},{"id":"https://openalex.org/keywords/gaussian","display_name":"Gaussian","score":0.4595000147819519},{"id":"https://openalex.org/keywords/nonlinear-system","display_name":"Nonlinear system","score":0.35190001130104065},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.33009999990463257},{"id":"https://openalex.org/keywords/order","display_name":"Order (exchange)","score":0.3203999996185303}],"concepts":[{"id":"https://openalex.org/C196491621","wikidata":"https://www.wikidata.org/wiki/Q554830","display_name":"Man-in-the-middle attack","level":3,"score":0.8399999737739563},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.550599992275238},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.48649999499320984},{"id":"https://openalex.org/C163716315","wikidata":"https://www.wikidata.org/wiki/Q901177","display_name":"Gaussian","level":2,"score":0.4595000147819519},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.4187000095844269},{"id":"https://openalex.org/C158622935","wikidata":"https://www.wikidata.org/wiki/Q660848","display_name":"Nonlinear system","level":2,"score":0.35190001130104065},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.33009999990463257},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3292999863624573},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.3203999996185303},{"id":"https://openalex.org/C87538441","wikidata":"https://www.wikidata.org/wiki/Q389463","display_name":"Collision attack","level":5,"score":0.3181999921798706},{"id":"https://openalex.org/C111696304","wikidata":"https://www.wikidata.org/wiki/Q2303697","display_name":"Sorting","level":2,"score":0.3131999969482422},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.28619998693466187}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.46586/tosc.v2025.i3.633-692","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tosc.v2025.i3.633-692","pdf_url":null,"source":{"id":"https://openalex.org/S4210236173","display_name":"IACR Transactions on Symmetric Cryptology","issn_l":"2519-173X","issn":["2519-173X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Symmetric Cryptology","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:d6124407ea3a497f823e3552799d3df1","is_oa":true,"landing_page_url":"https://doaj.org/article/d6124407ea3a497f823e3552799d3df1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IACR Transactions on Symmetric Cryptology, Vol 2025, Iss 3 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.46586/tosc.v2025.i3.633-692","is_oa":true,"landing_page_url":"https://doi.org/10.46586/tosc.v2025.i3.633-692","pdf_url":null,"source":{"id":"https://openalex.org/S4210236173","display_name":"IACR Transactions on Symmetric Cryptology","issn_l":"2519-173X","issn":["2519-173X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IACR Transactions on Symmetric Cryptology","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"At":[0],"EUROCRYPT":[1],"2023,":[2],"Qin":[3,57],"et":[4,58],"al.":[5,59],"proposed":[6,171],"the":[7,16,32,35,38,54,62,88,97,101,111,117,121,163,176,179,218,232,241],"MitM":[8,98,183,212,226,234],"attack":[9,236,245],"framework":[10],"on":[11,29,185,237,246],"sponge":[12],"functions":[13],"by":[14,48,106,198],"separating":[15],"message":[17,66],"bits":[18],"into":[19,91,224],"two":[20,33,39],"sets":[21,40],"of":[22,31,37,64,182],"neutral":[23],"bits.":[24],"By":[25],"assigning":[26],"bit":[27,55,89],"cancellations":[28,63,90,95,103,113,138],"one":[30],"sets,":[34],"states":[36],"can":[41,152,209],"be":[42],"computed":[43],"independently":[44],"and":[45,68,93,109,139,155,167,192,202,240],"then":[46],"filtered":[47],"some":[49],"matching":[50],"equations.":[51],"To":[52],"solve":[53],"cancellations,":[56],"exhaustively":[60],"compute":[61],"all":[65],"bits,":[67],"store":[69],"them":[70],"in":[71,221],"a":[72,145],"huge":[73,81],"hash":[74,118],"table,":[75],"which":[76],"leads":[77],"to":[78,129,172],"attacks":[79,132,184,213],"with":[80,116,133,248],"memory.":[82],"In":[83,127],"this":[84],"paper,":[85],"we":[86,143,230],"separate":[87],"linear":[92,102,141,154],"nonlinear":[94,112,137,156],"for":[96],"attacks,":[99],"where":[100],"are":[104,114,170,196],"solved":[105],"Gaussian":[107],"elimination,":[108],"only":[110],"dealt":[115],"table.":[119],"Hence,":[120],"memory":[122,135,180,215],"cost":[123],"is":[124,217],"significantly":[125],"reduced.":[126],"order":[128],"search":[130,169],"new":[131,146],"efficient":[134],"(fewer":[136],"more":[140],"cancellations),":[142],"propose":[144,231],"MILP":[147,177],"model":[148],"whose":[149],"encoding":[150],"scheme":[151],"distinguish":[153],"cancellations.":[157],"Besides,":[158,205],"dedicated":[159],"tricks":[160],"such":[161],"as":[162],"so-called":[164],"weak-diffusion":[165],"structure":[166],"two-stage":[168],"further":[173],"accelerate":[174],"solving":[175],"models.Finally,":[178],"complexities":[181],"4-round":[186,190,238],"Keccak[1024],":[187],"3-round":[188,243],"Xoodyak-Xof,":[189],"Ascon-Xof,":[191],"full":[193],"Subterranean":[194],"2.0":[195],"reduced":[197],"249,":[199],"259,":[200],"216,":[201],"236,":[203],"respectively.":[204],"our":[206],"memory-efficient":[207],"approach":[208],"turn":[210],"invalid":[211],"(where":[214],"complexity":[216],"dominant":[219],"factor":[220],"old":[222],"framework)":[223],"valid":[225],"attacks.":[227],"For":[228],"example,":[229],"first":[233,242],"preimage":[235],"Keccak[768]":[239],"collision":[244],"Xoodyak-Xof":[247],"128-bit":[249],"tag.":[250]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}