Differential-Linear Cryptanalysis and Cube Attacks on ChiLow

ChiLow is a family of tweakable block ciphers specifically designed for embedded code encryption, proposed at EUROCRYPT 2025. Its novel nested tweakkey schedule and a variant of the χ function significantly enhance latency and energy efficiency. This paper presents a security analysis of ChiLow from the perspectives of differential-linear cryptanalysis and cube attacks, filling some gaps in the initial security analysis made by the designers. Our main contributions are threefold: (1) Distinguishing attacks based on differential-linear cryptanalysis that can distinguish full-round ChiLow from random permutations. For ChiLow-(32+τ ), both the time complexity and data complexity of the attack are 281.03; for ChiLow-40, both complexities are 288.91. We note that the data complexities of these distinguishing attacks are valid since an adversary could query multiple devices. (2) Key recovery attacks on full-round ChiLow based on differential-linear cryptanalysis with the time complexity better than the exhaustive key search. These attacks achieve a time complexity of 2121, with data complexities of 279.5 for ChiLow-(32+τ ) and 288.42 for ChiLow-40 exceeding the data limit for one key. (3) A key recovery attack on 6-round ChiLow based on cube attacks, with a time complexity of 268 and a data complexity of 233 respecting the limit of the total number of queries. These results shed some new light on the security boundaries of ChiLow and provide valuable insights for designing low-latency ciphers in embedded systems.