%0 Conference Proceedings %T Alzette: A 64-Bit ARX-box: (feat. CRAX and TRAX) %+ Ruhr-Universität Bochum [Bochum] %+ University of Luxembourg [Luxembourg] %+ Cryptologie symétrique, cryptologie fondée sur les codes et information quantique (COSMIQ) %+ CryptoExperts %+ University of Edinburgh %A Beierle, Christof %A Biryukov, Alex %A Cardoso dos Santos, Luan %A Grossschädl, Johann %A Perrin, Léo %A Udovenko, Aleksei %A Velichkov, Vesselin %A Wang, Qingju %Z Part of the work of Christof Beierle was funded by Deutsche Forschungsgemeinschaft (DFG), project number 411879806, and part of the work of Christof Beierle was performed while he was at the University of Luxembourg and funded by the SnT CryptoLux RG budget. Luan Cardoso dos Santos is supported by the Luxembourg National Research Fund through grant PRIDE15/10621687/SPsquared. Part of the work of Aleksei Udovenko was performed while he was at the University of Luxembourg and funded by the Fonds National de la Recherche Luxembourg (project reference 9037104).Part of the work by Vesselin Velichkov was performed while he was at the University of Luxembourg. The work of Qingju Wang is funded by the University of Luxembourg Internal Research Project (IRP) FDISC. The experiments presented in this paper were carried out using the HPC facilities of the University of Luxembourg %< avec comité de lecture %B CRYPTO 2020 - 40th Annual International Cryptology Conference %C Santa Barbara, United States %3 Lecture Notes in Computer Science %V 12172 %P 419-448 %8 2020-08-17 %D 2020 %R 10.1007/978-3-030-56877-1_15 %K (tweakable) block cipher %K Related-tweak setting %K Long trailstrategy %K Alzette %K MEDCo %K MELCC %Z Computer Science [cs]/Cryptography and Security [cs.CR]Conference papers %X S-boxes are the only source of non-linearity in many symmet-ric primitives. While they are often defined as being functions operatingon a small space, some recent designs propose the use of much larger ones(e.g., 32 bits). In this context, an S-box is then defined as a subfunctionwhose cryptographic properties can be estimated precisely.We present a 64-bit ARX-based S-box calledAlzette, which can be eval-uated in constant time using only 12 instructions on modern CPUs. Itsparallel application can also leverage vector (SIMD) instructions. Oneiteration ofAlzettehas differential and linear properties comparable tothose of the AES S-box, and two are at least as secure as the AES superS-box. As the state size is much larger than the typical 4 or 8 bits, thestudy of the relevant cryptographic properties ofAlzetteis not trivial.We further discuss how such wide S-boxes could be used to constructround functions of 64-, 128- and 256-bit (tweakable) block ciphers withgood cryptographic properties that are guaranteed even in the related-tweak setting. We use these structures to design a very lightweight 64-bitblock cipher (Crax) which outperforms SPECK-64/128 for short mes-sages on micro-controllers, and a 256-bit tweakable block cipher (Trax)which can be used to obtain strong security guarantees against powerfuladversaries (nonce misuse, quantum attacks). %G English %2 https://inria.hal.science/hal-03135836/document %2 https://inria.hal.science/hal-03135836/file/2019-1378.pdf %L hal-03135836 %U https://inria.hal.science/hal-03135836 %~ INRIA %~ INRIA-ROCQ %~ TESTALAIN1 %~ INRIA2 %~ INRIA-ROYAUMEUNI