International Association for Cryptologic Research

International Association
for Cryptologic Research

Transactions on Symmetric Cryptology, Volume 2025

Cryptanalysis: Theory Versus Practice


README

FSE2026Artifact README

Cryptanalysis: Theory versus Practice - Correcting Cryptanalysis Results on ASCON, ChaCha, and SERPENT using GPUs

Overview

Paper: Cryptanalysis: Theory versus Practice - Correcting Cryptanalysis Results on ASCON, ChaCha, and SERPENT using GPUs
Authors: Cihangir Tezcan, Gregor Leander, and Hosein Hadipour
Artifact: Contains CUDA optimizations of ASCON, CHACHA, and SERPENT for experimental verification of theoretical cryptanalysis results.

Requirements

You need a CUDA compatible device to run the codes (e.g. NVIDIA RTX 2070 Super). For fast random number generation, we use AES-NI instructions with INTEL's rdrand.h library. Thus, your CPU must support AES-NI instruction set to run the code. However, this random number generation is performed on the CPU side and can easily be replaced by any alternative.

Hardware: A CUDA device and a CPU with AES-NI support
Software: Any CUDA SDK and CUDA compiler

Quick Start

Using a CUDA compiler, compile and run the only .cu file "CUDA_Theory_vs_Practice.cu".

# 1. Compile the only .cu file "CUDA_Theory_vs_Practice.cu" with your CUDA compiler. On Visual Studio 2019 with CUDA SDK 11.0, the default parameters are as follows:
nvcc.exe" -gencode=arch=compute_52,code=\"sm_52,compute_52\" --use-local-env -ccbin
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.27.29110\bin\HostX86\x64" -x cu
-I"C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v11.0\include"
--keep-dir x64\Release -maxrregcount=0  --machine 64 --compile -cudart static
-DWIN32 -DWIN64 -DNDEBUG -D_CONSOLE -D_MBCS -Xcompiler
"/EHsc /W3 /nologo /O2 /Fdx64\Release\vc142.pdb /FS /Zi  /MD "
-o x64\Release\CUDA_Theory_vs_Practice.cu.obj "CUDA_Theory_vs_Practice.cu"

Note that the compute capability is 5.2 in the above example and you can increase or decrease it depending on your device's compute capability. For instance, if your device supports compute capability 8.9, you can replace -compute_52,code=\"sm_52,compute_52 with -compute_89,code=\"sm_89,compute_89

Once run, you are asked to choose one the three ciphers that are optimized: ASCON, CHACHA, or SERPENT. Then you are asked to choose which experiment to perform. You can choose to reproduce the results of the experiments that are provided in the paper or you can simply perform a benchmark to test your GPU speed for these ciphers. An example ASCON benchmark is as follows where the user selects 1, 3, and 12, reespectively:

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 1
(1) CUDA ASCON 6-round DL Check of CRYPTO'24 Paper (eprint 2024-871)
(2) CUDA ASCON 5.5-round DL Verification of CRYPTO'24 Paper  (eprint 2024-871)
(3) CUDA ASCON 12-round Initialization Benchmark
Choice: 3
Trial = 2^18 +  12
Time elapsed: 1065.214966 milliseconds Time of kernel: 1066.066800
no error

The above example is run on an MX250 GPU which shows that it can perform 2^30 12-round ASCON permutation ins 1.0066 seconds.

In our default parameters we define BLOCKS as 256 and THREADS as 1024. Thus, the GPU kernel is called with 256 x 1024 = 2^18 threads. In our optimizations, each thread independently performs the encryption (or permutation). Thus, when the user writes 12 for the trial number, each 2^18 thread performs 2^12 encryptions, resulting in 2^30 encryptions in total.

File Structure

Explain your artifact's organization to help users navigate.

artifact/
├── README.md                    # This file
├── LICENSE                      # License file
├── CUDA_Theory_vs_Practice.cu   # Main file to be compiled by a CUDA compiler
├── CUDA_ASCON.h                 # CUDA codes for ASCON experiments
├── CUDA_CHACHA.h                # CUDA codes for CHACHA experiments
├── CUDA_SERPENT.h               # CUDA codes for SERPENT experiments
├── rdrand.h                     # INTEL's randomness library that uses AES-NI instructions for random number generation
├── keys.txt                     # 100 random keys generated for SERPENT experiments (can be changed or modified if desired)
├── startingpoint.txt            # Can be used to continue a completed SERPENT experiment by storing the bias results in this file

Usage and Experiments

Once run, you are asked to choose one the three ciphers that are optimized: ASCON, CHACHA, or SERPENT. Then you are asked to choose which experiment to perform. You can choose to reproduce the results of the experiments that are provided in the paper or you can simply perform a benchmark to test your GPU speed for these ciphers. An example ASCON benchmark is as follows where the user selects 1, 3, and 12, reespectively:

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 1
(1) CUDA ASCON 6-round DL Check of CRYPTO'24 Paper (eprint 2024-871)
(2) CUDA ASCON 5.5-round DL Verification of CRYPTO'24 Paper  (eprint 2024-871)
(3) CUDA ASCON 12-round Initialization Benchmark
Choice: 3
Trial = 2^18 +  12
Time elapsed: 1065.214966 milliseconds Time of kernel: 1066.066800
no error

Basic Usage

Aside from choosing benchmarks to test their GPU performance, users can verify the experiments of the paper. For instance, it is claimed in [WGM24] that the 3-round differential-linear distinguisher of [CN21] has an experimental bias of 2^-12.02. The following choices performs this experiment and confirms the correctness of this result (user chooses 2 and 2 from the UI).

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 2
(1) ChaCha_differential_4round_AutomaticSearch for [WGM24]
(2) ChaCha_differential_3round for [CN21]
(3) ChaCha_differential_4round for [WGM24]
(4) ChaCha_benchmark
Choice: 2
Time elapsed: 16130.719727 milliseconds

Total counter: 8593961995
Difference from the Expected Value: -4027403
Bias: 2^-12.058582 (For an experiment with 2^34.000000 data)
no error

The above example performs 2^34 encryptions because BLOCKS, THREADS, and TRIALS are chosen as 256, 1024, and 65536, respectively and 2^34 = 256 x 1024 x 65536. Note that in the same paper, authors of [WGM24] extend this distinguisher to 4 rounds and change the output bit mask which results in just a small modification in our codes. It is claimed in [WGM24] that this new distinguisher has a bias of 2^-16.60. The following experiment shows that this claim is wrong and the distinguisher actually shows a random behavior.

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 2
(1) ChaCha_differential_4round_AutomaticSearch for [WGM24]
(2) ChaCha_differential_3round for [CN21]
(3) ChaCha_differential_4round for [WGM24]
(4) ChaCha_benchmark
Choice: 3
Time elapsed: 16132.695312 milliseconds

Total counter: 8589937468
Difference from the Expected Value: -2876
Bias: 2^-22.510152 (For an experiment with 2^34.000000 data)
no error

Although [WGM24] claims that the 4-round differential-linear distinguisher for CHACHA has a bias of 2^-16.60, the above experiment with 2^34 data provides a bias od 2^-22.51. It should be noted that the real bias is much smaller than this because 2^34 data is not enough to detect a bias of 2^-22.51. Thus, this experimental result means that the distinguisher actually is not a distinguisher and acts like a random permutation when tried with 2^34 data. When the experiment is repeated with more data, bias also drops. For instance, same experiment with 2^39 data provided a bias of 2^-24.07.

Main Experiments

Describe the key experiments that support your paper's claims.

ASCON

ASCON GPU kernels are as follows:

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 1
(1) CUDA ASCON 6-round DL Check of CRYPTO'24 Paper (eprint 2024-871)
(2) CUDA ASCON 5.5-round DL Verification of CRYPTO'24 Paper  (eprint 2024-871)
(3) CUDA ASCON 12-round Initialization Benchmark

CHACHA

CHACHA GPU kernels are as follows:

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 2
(1) ChaCha_differential_4round_AutomaticSearch for [WGM24]
(2) ChaCha_differential_3round for [CN21]
(3) ChaCha_differential_4round for [WGM24]
(4) ChaCha_benchmark

SERPENT

SERPENT GPU kernels are as follows:

(1) ASCON
(2) CHACHA
(3) SERPENT
Choose your cipher: 3
Select Cuda Device (0,1,2): 0
Choose an experiment:
(3) 3-round DL Experiment for [PZWD24]
(32) SERPENT Benchmark
(4) 4-round DL Experiment for our distinguisher (14 bit left rotation of [DIK08])
(5) 5-round DL Experiment for [HDE24]
(66) 6-round DL Experiment for [PZWD24] (final correction at eprint)
(74) 4-round DL Experiment: Middle 4 rounds of 7-round DL of [PZWD24]
(75) 5-round DL Experiment: Middle 5 rounds of 7-round DL of [PZWD24]
(76) 6-round DL Experiment: Last 6 rounds of 7-round DL of [PZWD24]

License

Apache 2.0.

Citation

Provide citation information to help others properly credit your work.

Choose the format that works best for your project:

BibTeX (for LaTeX/academic papers):

@article{Tezcan_Leander_Hadipour_2025, title={Cryptanalysis: Theory Versus Practice: Correcting Cryptanalysis Results on Ascon, ChaCha, and Serpent Using GPUs}, volume={2025}, url={https://tosc.iacr.org/index.php/ToSC/article/view/12484}, DOI={10.46586/tosc.v2025.i3.729-754}, abstractNote={
Most modern cryptanalysis results are obtained through theoretical analysis, often relying on simplifications and idealized assumptions. In this work, we use the parallel computational power of GPUs to experimentally verify a small portion of the cryptanalysis results that have been published in recent years. Our focus is on the ciphers Ascon, ChaCha, and Serpent. In none of the attacks we considered did the theoretical estimates fully match the actual practical values. More precisely, we show that the 4.5-round truncated differential with probability one, the 6-round differential-linear (DL), and the 6-round impossible differential distinguishers on Ascon, as well as the best known 7- and 7.5-round DL distinguisher on ChaCha, do not actually work in practice. Moreover, we demonstrate that the best known 10, 11, and 12-round DL attacks on Serpent perform better in practice than previously estimated. Additionally, we provide a new experimentally obtained 9-round DL distinguisher on Serpent, which can be used in 10 and 11-round attacks with reduced data complexity. In a broader sense, we recommend that cryptanalysts experimentally verify reduced versions of their theoretically obtained analysis results whenever possible. In order to simplify this process, we make our optimized code for the ciphers treated here available for future use.
}, number={3}, journal={IACR Transactions on Symmetric Cryptology}, author={Tezcan, Cihangir and Leander, Gregor and Hadipour, Hosein}, year={2025}, month={Sep.}, pages={729–754} }

Simple citation (for plain text references):

[TLH25]. Tezcan, C., Leander, G., & Hadipour, H. (2025). Cryptanalysis: Theory Versus Practice: Correcting Cryptanalysis Results on Ascon, ChaCha, and Serpent Using GPUs. IACR Transactions on Symmetric Cryptology, 2025(3), 729-754. https://doi.org/10.46586/tosc.v2025.i3.729-754
Artifact: https://github.com/cihangirtezcan/FSE2026Artifact/

Contact

For questions about this artifact: cihangir[at]metu.edu.tr