近日，中国科学院大学（国科大）密码学院在国际密码学顶级会议CRYPTO 2026上同时发表两篇研究论文，分别聚焦于杂凑函数的新型结构设计和低轮Feistel类密码的安全性分析，两项成果均具有重要理论价值和实际应用前景。
王鹏参会照片
CRYPTO（International Cryptology Conference，又称“美密会”）由国际密码研究协会（IACR）主办，与欧密会、亚密会并列为全球密码学领域三大旗舰会议，代表着密码学理论研究的最高水准。本届会议于2026年8月17日至20日在美国加州大学圣巴巴拉分校举行，共收到创纪录的781篇投稿，最终录用193篇论文，录用率约24.7%。国科大密码学院王鹏副教授赴美参会，并就相关研究成果作了学术报告。
论文一：突破Sponge结构原像安全性瓶颈的新型杂凑设计
第一篇论文题为《Permutation-Based Hashing With Stronger (Second) Preimage Resistance》（基于置换的具有更强（第二）原像抗性的杂凑设计），作者为孙思维教授，李顺特别研究助理，张志宇特别研究助理，法国雷恩大学博士后研究员Charlotte Lefevre，荷兰马斯特里赫特大学Bart Mennink教授，秦臻博士生以及冯登国院士。
经典Sponge杂凑结构的原像与第二原像安全性长期受限于容量参数（capacity），成为制约其高安全等级应用的关键瓶颈。该研究创造性地在吸收阶段引入Davies–Meyer型前馈机制，使置换操作不再保持传统可逆性，从而切断了已有攻击依赖的关键路径。新提出的SPONGE-DM和SPONGE-EDM系列结构，在保持与标准Sponge相同碰撞安全水平的前提下，将原像安全性提升至完整的n比特，并显著增强第二原像安全边界。更为重要的是，该改进无需增加底层置换的调用次数，仅需额外进行异或和状态保存操作，工程实现成本极低。
论文以Keccak和Ascon置换为例给出了具体实现：使用800比特的Keccak即可达到512比特的原像与第二原像安全强度，而标准1600比特的Keccak可实现1024比特的超高安全等级，完全满足我国新一代商用密码杂凑算法对极高安全性的需求。此外，该方法还能有效提升基于杂凑的后量子签名方案的安全性与效率，为高安全等级杂凑函数设计提供了一条兼顾理论强度与实现可行性的新路径。
论文二：揭示低轮Feistel“可区分”即“可解密”的内在关联
第二篇论文题为《Classical and Quantum Full Plaintext Recovery for Low-Round Feistel-Type Designs》（低轮Feistel类结构的经典与量子完整明文恢复攻击），通讯作者为王鹏副教授。
该工作重新审视了低轮Feistel结构的安全边界，揭示出一个远比传统“区分攻击”更严重的隐患：几乎所有能够区分Feistel结构与随机置换的攻击，都可以在查询复杂度基本不变的前提下，直接升级为完整明文恢复攻击。经典模型下，论文证明针对2轮Feistel的选择明文攻击和3轮Feistel的选择密文攻击，仅需3次查询即可恢复任意目标密文的全部明文。量子模型下，借助Simon算法设计的前向与后向轮扩展技术，攻击可推进至3轮Feistel的量子选择明文攻击和4轮Feistel的量子选择密文攻击，量子查询复杂度仅为O(n)。
该攻击的普适性尤为突出——其核心依赖于Feistel的两分支结构本身，而非具体轮函数，因此可推广至UFLM、Lai–Massey、Feistel-FK等类Feistel结构，并进一步适用于AEZ-core、FMix、OleF、double-decker等实际加密方案。这一成果首次系统建立了低轮Feistel中“区分性”与“解密性”之间的结构性联系，将安全分析从识别非随机性推进到恢复全部明文，为经典和量子环境下Feistel类设计的轮数选择与安全评估提供了全新警示和理论依据。
两项成果的集中发表，展示了国科大密码学院在对称密码基础理论与前沿安全分析领域的持续创新能力和国际学术影响力，也为我国自主密码算法的设计分析与标准化提供了重要技术支撑。
Abstract：The sponge is a popular construction of hash function design. It operates with a $b$-bit permutation on a $b$-bit state, that is split into a $c$-bit inner part and an $r$-bit outer part. However, the security bounds of the sponge are most often dominated by the capacity $c$: if the length of the digest is $n$ bits, the construction tightly achieves $\min\{n/2,c/2\}$-bit collision resistance, $\min\{n,c/2\}$-bit second preimage resistance, and $\min\{n,\max\{n-r,c/2\}\}$-bit preimage resistance. Here, it is noteworthy that the generic attacks matching the preimage and second preimage bounds make use of the inverse of the permutation. We demonstrate that, by a relatively simple adjustment, significantly improved preimage and second preimage resistance can be achieved. In detail, we first present the SPONGE-DM construction, that differs from the sponge by evaluating the permutation during absorption in a Davies-Meyer mode. This construction generically achieves $\min\{n/2,c/2\}$-bit collision resistance as the sponge does, but $n$-bit preimage resistance and $\min\{n,c-\log_2(\alpha)\}$-bit second preimage resistance, where $\alpha$ is the maximum size of the first preimage in blocks. Next, we investigate how improved security can be achieved with a smaller feed-forward, and we present the SPONGE-EDM$^a$ family of functions, indexed by a parameter $a\in\{0,\ldots,b\}$. These functions replace the permutation during absorption in the sponge by an Encrypted Davies-Meyer mode, but with only $a$ bits of feed-forward. For $a=b$, comparable bounds as for SPONGE-DM are obtained, and these bounds gradually decrease to the original sponge bounds for decreasing values of $a$. We present various instantiations of SPONGE-DM and SPONGE-EDM$^a$ using the Keccak and Ascon permutations, and concretely demonstrate the immediate security and performance gains of these instances. For example, one can achieve up to $512$-bit preimage and second preimage resistance using the $800$-bit Keccak permutation (rather than 1600-bit in SHA-3), and likewise, one can use the $1600$-bit Keccak permutation to easily achieve up to $1024$-bit preimage and second preimage resistance (therewith properly fitting within the recently announced Chinese call for a new generation of cryptographic algorithms). Finally, we show the benefits of using these instantiations in the context of hash-based signature schemes whose security relies solely on the (second) preimage resistance of the underlying hash functions (such as Ascon-Sign).
论文信息：Siwei Sun. Shun Li. Zhiyu Zhang. Charlotte Lefevre. Bart Mennink. Zhen Qin. Dengguo Feng: “Permutation-Based Hashing With Stronger (Second) Preimage Resistance" ” in the 46th Annual International Cryptology Conference (CRYPTO 2025)（CCF-A）
Abstract：The Feistel (Luby-Rackoff) structure underlies numerous block-cipher and mode-of-operation designs, whose security is traditionally assessed via indistinguishability. For low-round Feistel constructions, a variety of classical and quantum distinguishing attacks are known. In this work, we show that such distinguishing attacks can be systematically upgraded to full plaintext recovery with essentially the same query complexity. We establish classical recovery attacks on the 2-round Feistel under CPA and the 3-round Feistel under CCA using only three queries, and introduce quantum-assisted forward/backward extension techniques based on Simon’s algorithm that yield recovery attacks on the 3-round Feistel under qCPA and the 4-round Feistel under qCCA. We further prove that the attacks extend to the Unified Feistel-Lai-Massey (UFLM) framework and therefore apply to a broad class of two-branch constructions. As a consequence, we obtain plaintext-recovery attacks on 4/5/6-round Feistel-FK and on several practical enciphering schemes, including AEZ-core, FMix, OleF, double-decker, and docked-double-decker. Overall, our results reveal a fundamental connection between distinguishing and full plaintext recovery in low-round two-branch Feistel-type designs, in both classical and quantum settings.
论文信息：Tingting Guo. Peng Wang. Jiwu jing. Shuping Mao. Gang Liu: “Classical and Quantum Full Plaintext Recovery for Low-Round Feistel-Type Designs” in the 46th Annual International Cryptology Conference (CRYPTO 2025)（CCF-A）
