The SCAN-C cipher gains no security from unusual key mixing

The analysis says SCAN-C’s 12-round design can be fully examined through its round keys, raising concerns about its current security.

Editorial illustration — not from the study.

A study of the lightweight SCAN-C cipher found that its use of XNOR rather than the more common XOR for key mixing does not add a security margin. The researchers say the result follows because the two operations are structurally equivalent for the difference analysis they use.

What the analysis found

The researchers proved that XNOR-based mixing is structurally equivalent to XOR-based mixing in differential cryptanalysis, a method that studies how differences in inputs spread through an encryption system. The corresponding difference distribution tables differ only by a permutation of their indices, so XNOR does not provide an additional security margin in this analysis.

Using an automated search based on satisfiability-modulo-theories solving, the study identified a nine-round distinguisher with a probability of 2^-51.30. Extending the analysis, the researchers reported that the complete internal key state can be recovered by recovering all 12 round keys. They estimate that this would require around 2^55 chosen plaintexts and 2^69 encryptions, and conclude that SCAN-C’s current 12-round specification is insufficiently secure.

Why the design matters

SCAN-C was designed as a lightweight block cipher for securing Controller Area Network communications. The findings indicate that its unusual XNOR key-mixing operation does not strengthen the cipher against this form of analysis, and that the specified 12-round design does not provide sufficient security according to the reported attack estimates. This gives designers a specific reason to reconsider relying on XNOR mixing as a security feature.

Evidence and limits

The study combines a mathematical proof about the equivalence of XOR and XNOR difference definitions with an SMT-based automated search of SCAN-C’s differential characteristics. The reported recovery costs are analytical estimates for the specified 12-round design: around 2^55 chosen plaintexts and 2^69 encryptions. The abstract does not report a practical attack against a deployed system, and it does not assess versions of SCAN-C with different numbers of rounds or other design changes.

Reliable AI partnerships depend on people, not just stronger models

A survey of human-AI collaboration argues that more capable AI systems do not automatically produce reliable partnerships. It identifies human-centered design, governance and attention to high-stakes uses as central to making these systems trustworthy and beneficial.

9 hours ago·6 views

AI & Computing

RNA splicing tools can follow irrelevant clues and miss RNA’s shape

Deep-learning tools for predicting RNA splicing can rely on genomic clues unrelated to splicing and miss important effects of RNA structure, a study finds. These weaknesses were linked to systematic errors, especially when the tools evaluated sequences that differed from those used for training.

20 hours ago·5 views

AI & Computing

Better-trained AI finds more flaws in unfamiliar software projects

AI vulnerability detectors often perform less well on software projects outside their training data. A study finds that cleaner, more varied training data and an encoder-based design improved detection, including a reported 6.8% gain in recall on the BigVul benchmark.

2 days ago·34 views