IT security plays a vital role in our society. When multiple parties communicate via a mobile phone or chat, when money is withdrawn, or during online shopping, security takes a decisive part in protecting the users, the service operators, and in maintaining public confidence in the system. Modern cryptography can be divided into two distinct subareas, symmetric cryptography (where all parties share the same secret key) and asymmetric cryptography (where all parties are in possession of a public key and a private key). We plan to discuss in detail timely topics related to the design and analysis of symmetric cryptographic schemes with a focus on the following topics:

Theory of design. Symmetric algorithms are built in a modular way, by combining a small core primitive with a construction or mode of operation. This separation is powerful, as it allows designers to reuse primitives across many settings, but it raises the question of how primitives and constructions should be designed together.

Cryptanalysis aims to break a full algorithm, whereas security proofs usually abstract away the internals of the primitive and argue in an idealized model, so the assumptions behind provable security and the structural properties exploited in attacks can differ substantially. We want to understand better how attacks on a primitive affect the constructions built from it, and conversely how a construction can amplify or mitigate a weakness of its primitive. A related goal is to identify equivalence classes of designs and proof techniques that transfer between them. As modern proofs are long, hard to verify, and occasionally contain gaps, computer-assisted proofs and automated analysis are a promising route towards a more unified theory of design.

Theory of primitive cryptanalysis. Cryptanalysis is the primary means of assessing the security level of a primitive and plays a crucial role in symmetric cryptography. Some of the most impactful results of recent years concern theoretical models of attacks, such as the division property or the geometric approach, which have revealed deeper connections between different distinguishers and enabled stronger attacks. A natural question is which further distinguishing properties can be formalized within such frameworks and turned into successful attacks on concrete ciphers. We also plan to discuss how these models feed into tools for automated cryptanalysis. Another interesting direction concerns the key-recovery phase, notably the wrong-key hypothesis, which assumes that data analyzed under an incorrect guess behaves uniformly at random, is convenient but not fully accurate; modelling the behavior of wrong guesses more accurately, and extending automated tools to cover key recovery, are promising directions that we plan to discuss.

Addressing challenges in practical applications. Symmetric cryptography reaches real-world applications largely through standardization. We will discuss established standards and ongoing initiatives at NIST, ISO, and other bodies, in particular the cryptographic accordion, which provides a variable-input-length permutation and thereby robust, misuse-free authenticated encryption, alongside the development of a new 256-bit block cipher standard. Deployments also raise security properties that traditional settings do not cover; for instance, research on key control security for key derivation functions was initiated at the last two Dagstuhl Seminars of this series and may eventually lead NIST to consider revisions to SP 800-108. We plan to discuss and explore such security frameworks that align closely with real-world utilization requirements. Finally, practical performance is dictated by the computing environment, and hardware acceleration offers efficiency that cannot be replicated by other means. We will therefore also treat the design and security evaluation of primitives tailored to such environments.

Creative Commons BY 4.0

Christof Beierle, Maria Eichlseder, Charlotte Lefevre, and Yu Sasaki