Ling Song
Current Organizations / Institutes
The organizations/institutes from the scholar's latest article
Previous Organizations / Institutes
The organizations / institutes from the scholar's other articles in the past ten years
Research Subjects
Ling Song has a total of 54 co-authors. Here are the top co-authors by number of shared publications:
- Qianqian Yang
Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
12 shared publications - Lei Hu
Chinese Academy of Sciences
10 shared publications - Jian Weng
Guangzhou University
6 shared publications - Danping Shi
State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China
5 shared publications - Yincen Chen
College of Cyber Security, Jinan University
5 shared publications - Jiahao Zhao
Chinese Academy of Sciences
4 shared publications
Latest Publications
- Open Access
- 11 August 2026
- Published by Springer Nature
- p. 406-437
Exploiting Strong Key Bridges: Full-Fledged Automatic Rectangle Attacks on Deoxys-BC and SKINNY
- 11 August 2026
- Published by Springer Nature
- p. 406-437
Open AccessExploiting Strong Key Bridges: Full-Fledged Automatic Rectangle Attacks on Deoxys-BC and SKINNY
- 31 October 2025
- Published by Springer Nature
- p. 3-23
Improving the Differential-Linear Attack with Applications to GIFT-COFB, GIFT-64 and HyENA
- 31 October 2025
- Published by Springer Nature
- p. 3-23
Improving the Differential-Linear Attack with Applications to GIFT-COFB, GIFT-64 and HyENA
- Open Access
- 7 July 2025
- Published by International Association for Cryptologic Research in IACR Communications in Cryptology
- Vol. 2 (2)
A Holistic Framework for Impossible Boomerang Attacks
In 2011, Lu introduced the impossible boomerang attack at DCC. This powerful cryptanalysis technique combines the strengths of the impossible differential and boomerang attacks, thereby inheriting the advantages of both cryptographic techniques. In this paper, we propose a holistic framework comprising two generic and effective algorithms and a MILP-based model to search for the optimal impossible boomerang attack systematically. The first algorithm incorporates any key guessing strategy, while the second integrates the meet-in-the-middle (MITM) attack into the key recovery process. The MILP-based model combines the generic key recovery algorithms and supports the arbitrary location of the contradiction. Our highly flexible framework treats the distinguisher and the extended part as a whole, returning the optimal attack parameters and complexity. When applying our framework to Deoxys-BC-256, Deoxys-BC-384, Joltik-BC-128, Joltik-BC-192, and SKINNYe v2, we achieve several significant improvements. We achieve the first 11-round impossible boomerang attacks on Deoxys-BC-256 and Joltik-BC-128. For SKINNYe v2, we achieve the first 33-round impossible boomerang attack, then using the MITM approach in the key recovery attack, the time complexity is significantly reduced. Additionally, for the 14-round Deoxys-BC-384 and Joltik-BC-192, the time complexity of the impossible boomerang attack is reduced by factors exceeding 2 27 and 2 12 , respectively.
- 7 July 2025
- Published by International Association for Cryptologic Research in IACR Communications in Cryptology
- Vol. 2 (2)
Open AccessA Holistic Framework for Impossible Boomerang Attacks
In 2011, Lu introduced the impossible boomerang attack at DCC. This powerful cryptanalysis technique combines the strengths of the impossible differential and boomerang attacks, thereby inheriting the advantages of both cryptographic techniques. In this paper, we propose a holistic framework comprising two generic and effective algorithms and a MILP-based model to search for the optimal impossible boomerang attack systematically. The first algorithm incorporates any key guessing strategy, while the second integrates the meet-in-the-middle (MITM) attack into the key recovery process. The MILP-based model combines the generic key recovery algorithms and supports the arbitrary location of the contradiction. Our highly flexible framework treats the distinguisher and the extended part as a whole, returning the optimal attack parameters and complexity. When applying our framework to Deoxys-BC-256, Deoxys-BC-384, Joltik-BC-128, Joltik-BC-192, and SKINNYe v2, we achieve several significant improvements. We achieve the first 11-round impossible boomerang attacks on Deoxys-BC-256 and Joltik-BC-128. For SKINNYe v2, we achieve the first 33-round impossible boomerang attack, then using the MITM approach in the key recovery attack, the time complexity is significantly reduced. Additionally, for the 14-round Deoxys-BC-384 and Joltik-BC-192, the time complexity of the impossible boomerang attack is reduced by factors exceeding 2 27 and 2 12 , respectively.
- Open Access
- 24 May 2025
- Published by Springer Nature in Cybersecurity
- Vol. 8 (1) , 1-17
Preimage and collision attacks on reduced Ascon using algebraic strategies
Ascon, a family of algorithms that supports hashing and authenticated encryption, is the winner of the NIST Lightweight Cryptography Project. In this paper, we propose an improved preimage attack against 2-round Ascon-XOF-64 with a complexity of $$2^{33}$$ via a more effective guessing strategy. Furthermore, we successfully extend our preimage attack on 2-round Ascon-XOF-64 to 2-round Ascon-XOF-128, achieving a complexity of $$2^{97}$$ , which is currently the best preimage attack against 2-round Ascon-XOF-128. Apart from the preimage attack, we also investigate the resistance of Ascon-HASH against collision attacks. To be specific, we introduce the linearization of the inverse of S-boxes and then propose a free-start collision attack on 3-round Ascon-HASH with a complexity of $$2^{14}$$ using a differential trail searched dedicatedly. In addition, we construct different 2-round connectors using the linearization of the inverse of S-boxes and successfully extend the collision attack to 4 rounds and 5 rounds of Ascon-HASH with complexities of $$2^{18}$$ and $$2^{41}$$ , respectively. Although our attacks do not compromise the security of the full 12-round Ascon-XOF and Ascon-HASH, they provide some insights into Ascon’s security.- 24 May 2025
- Published by Springer Nature in Cybersecurity
- Vol. 8 (1) , 1-17
Open AccessPreimage and collision attacks on reduced Ascon using algebraic strategies
Ascon, a family of algorithms that supports hashing and authenticated encryption, is the winner of the NIST Lightweight Cryptography Project. In this paper, we propose an improved preimage attack against 2-round Ascon-XOF-64 with a complexity of $$2^{33}$$ via a more effective guessing strategy. Furthermore, we successfully extend our preimage attack on 2-round Ascon-XOF-64 to 2-round Ascon-XOF-128, achieving a complexity of $$2^{97}$$ , which is currently the best preimage attack against 2-round Ascon-XOF-128. Apart from the preimage attack, we also investigate the resistance of Ascon-HASH against collision attacks. To be specific, we introduce the linearization of the inverse of S-boxes and then propose a free-start collision attack on 3-round Ascon-HASH with a complexity of $$2^{14}$$ using a differential trail searched dedicatedly. In addition, we construct different 2-round connectors using the linearization of the inverse of S-boxes and successfully extend the collision attack to 4 rounds and 5 rounds of Ascon-HASH with complexities of $$2^{18}$$ and $$2^{41}$$ , respectively. Although our attacks do not compromise the security of the full 12-round Ascon-XOF and Ascon-HASH, they provide some insights into Ascon’s security. - 3 May 2025
- Published by Springer Nature
- p. 322-341
A Note on Neutral Bits for ARX Ciphers from the Perspective of BCT
- 3 May 2025
- Published by Springer Nature
- p. 322-341
A Note on Neutral Bits for ARX Ciphers from the Perspective of BCT
- 14 March 2025
- Published by Springer Nature in Designs, Codes and Cryptography
- Vol. 93 (7) , 2611-2655
Generalized impossible differential attacks on block ciphers: application to SKINNY and ForkSKINNY
- 14 March 2025
- Published by Springer Nature in Designs, Codes and Cryptography
- Vol. 93 (7) , 2611-2655
Generalized impossible differential attacks on block ciphers: application to SKINNY and ForkSKINNY
- 25 December 2024
- Published by Springer Nature
- p. 40-57
Improving Differential-Neural Cryptanalysis for Large-State SPECK
- 25 December 2024
- Published by Springer Nature
- p. 40-57
Improving Differential-Neural Cryptanalysis for Large-State SPECK
- 9 December 2024
- Published by Springer Nature
- p. 361-391
Generic Differential Key Recovery Attacks and Beyond
- 9 December 2024
- Published by Springer Nature
- p. 361-391
Generic Differential Key Recovery Attacks and Beyond
- Open Access
- 1 November 2024
- Published by Springer Nature in Cybersecurity
- Vol. 7 (1) , 1-17
Revisiting the shuffle of generalized Feistel structure
The Generalized Feistel Structure ( $$\texttt{GFS}$$ ) is one of the most widely used frameworks in symmetric cipher design. In FES 2010, Suzaki and Minematsu strengthened the cryptanalysis security of $$\texttt{GFS}$$ by searching for shuffles with the best diffusion property. In ASIACRYPT 2018, Shi et al. suggested a set of shuffles, which makes $$\texttt{GFS}$$ a better resistance against Demirci–Selcuk meet-in-the-middle cryptanalysis. Since these shuffles are different from the currently known good ones and also different from the shuffles used in $$\texttt{TWINE}$$ and $$\texttt{LBlock}$$ , our research focuses on a more comprehensive evaluation of $$\texttt{GFS}$$ with different shuffles, including diffusion property of shuffle, differential, linear, impossible differential, zero-correlation linear, integral and Demirci–Selcuk meet-in-the-middle cryptanalysis, to find the best one. Such evaluations entail significant time consumption. Thus, we utilize Mixed Integral Linear Programming models and introduce an evaluate-and-filter strategy to achieve it efficiently. Our results verify that the shuffles discovered by Suzaki and Minematsu and those used in $$\texttt{TWINE}$$ and $$\texttt{LBlock}$$ are the best so far. We also find that the cryptanalysis resistances of $$\texttt{GFS}$$ are not necessarily consistent. It is this finding that makes the necessity of our more comprehensive evaluation self-evident.- 1 November 2024
- Published by Springer Nature in Cybersecurity
- Vol. 7 (1) , 1-17
Open AccessRevisiting the shuffle of generalized Feistel structure
The Generalized Feistel Structure ( $$\texttt{GFS}$$ ) is one of the most widely used frameworks in symmetric cipher design. In FES 2010, Suzaki and Minematsu strengthened the cryptanalysis security of $$\texttt{GFS}$$ by searching for shuffles with the best diffusion property. In ASIACRYPT 2018, Shi et al. suggested a set of shuffles, which makes $$\texttt{GFS}$$ a better resistance against Demirci–Selcuk meet-in-the-middle cryptanalysis. Since these shuffles are different from the currently known good ones and also different from the shuffles used in $$\texttt{TWINE}$$ and $$\texttt{LBlock}$$ , our research focuses on a more comprehensive evaluation of $$\texttt{GFS}$$ with different shuffles, including diffusion property of shuffle, differential, linear, impossible differential, zero-correlation linear, integral and Demirci–Selcuk meet-in-the-middle cryptanalysis, to find the best one. Such evaluations entail significant time consumption. Thus, we utilize Mixed Integral Linear Programming models and introduce an evaluate-and-filter strategy to achieve it efficiently. Our results verify that the shuffles discovered by Suzaki and Minematsu and those used in $$\texttt{TWINE}$$ and $$\texttt{LBlock}$$ are the best so far. We also find that the cryptanalysis resistances of $$\texttt{GFS}$$ are not necessarily consistent. It is this finding that makes the necessity of our more comprehensive evaluation self-evident. - 28 June 2024
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Internet of Things Journal
- Vol. 11 (19) , 31368-31384
Preimage Attacks on Xoodyak and Gaston Based on Algebraic Strategies
As the Internet of Things (IoT) continues to grow, the urgency to bolster IoT device security escalates, particularly in evaluating the security of lightweight ciphers. Since the inception of Keccak (also known as SHA-3), embedding a permutation within a certain operational mode has become a pivotal approach in designing lightweight cryptography. This led to numerous permutation-based lightweight ciphers tailored for IoT applications. Among them, Xoodyak and Gaston are typical examples and even incorporate Keccak’s non-linear operation χ within their round functions. This paper focuses on assessing the security of Keccak-like lightweight hash functions against preimage attacks. We introduce a generic preimage attack framework from an algebraic perspective and propose a new linearization method that leverages the algebraic properties of χ in the permutation. Additionally, in order to find good guessing strategies, we develop automatic tools based on bit-level MILP on Xoodyak and Gaston. As a result, the complexity of finding a preimage for 2-round Xoodyak-XOF with a 128-bit digest is 294.66 while that for 3-round Xoodyak-XOF can be reduced from 2125.06 to 2123.91 and memory consumption from 297 to a negligible level. This marks the most efficient preimage attack against a 3-round Xoodyak-XOF to date. Furthermore, we present the first preimage attacks on 1-/2-round Gaston with complexities of 290.56 and 2122.15, respectively.
- 28 June 2024
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Internet of Things Journal
- Vol. 11 (19) , 31368-31384
Preimage Attacks on Xoodyak and Gaston Based on Algebraic Strategies
As the Internet of Things (IoT) continues to grow, the urgency to bolster IoT device security escalates, particularly in evaluating the security of lightweight ciphers. Since the inception of Keccak (also known as SHA-3), embedding a permutation within a certain operational mode has become a pivotal approach in designing lightweight cryptography. This led to numerous permutation-based lightweight ciphers tailored for IoT applications. Among them, Xoodyak and Gaston are typical examples and even incorporate Keccak’s non-linear operation χ within their round functions. This paper focuses on assessing the security of Keccak-like lightweight hash functions against preimage attacks. We introduce a generic preimage attack framework from an algebraic perspective and propose a new linearization method that leverages the algebraic properties of χ in the permutation. Additionally, in order to find good guessing strategies, we develop automatic tools based on bit-level MILP on Xoodyak and Gaston. As a result, the complexity of finding a preimage for 2-round Xoodyak-XOF with a 128-bit digest is 294.66 while that for 3-round Xoodyak-XOF can be reduced from 2125.06 to 2123.91 and memory consumption from 297 to a negligible level. This marks the most efficient preimage attack against a 3-round Xoodyak-XOF to date. Furthermore, we present the first preimage attacks on 1-/2-round Gaston with complexities of 290.56 and 2122.15, respectively.