Symmetric-Key Cryptography

Status	Statement	Tags
	192-Round AES Pairwise Independence Theorem 7 proves the bound for 192-round censored AES – real AES S-boxes and mixing layer, but a subset of the mixing layers removed. The source conjectures the same round count suffices for AES itself, and calls proving it an outstanding open problem. The best proved bound for actual AES is Liu, Tessaro and Vaikuntanathan’s, which needs more than 9000 rounds. 4 open	Block Ciphers Limited Independence Pseudorandom Permutations T Wise Independencetight-bound
	Constant-round Luby–Rackoff, quantum Resolved for r=7. Carolan (Compressed Permutation Oracles, ePrint 2025/1734, STOC 2026) proves seven-round Luby-Rackoff with truly random round functions is indistinguishable from a random invertible permutation against Omega(N^{1/12}) bidirectional quantum queries (his Theorem 6.5), exactly this page’s conjecture with r=7 – and states, without full proof here, that the result lifts to pseudorandom round functions (the strong qPRP form) by a standard hybrid argument. The paper’s own abstract calls this ‘resolving an open question of (Zhandry, 2012).’	Feistel Networks Pseudorandom Permutations Quantum Query Complexityotherequivalenceresearch-solved
	Two-block sponge attack, quadratic advice Open: whether the multi-instance two-block sponge attack of advantage (S^2T4/C²⁾S lifts to an auxiliary-input attack of advantage S^2T4/C^2, matching the best proved security bound. Settled in the multi-instance model; no partial result in the auxiliary-input model. 7 open	Collision Finding Collision Resistant Hashing Time Space Tradeoffspromlower-boundadaptation (ai)
	Quantum two-block MD collisions Open, in both directions and with no partial result: whether the best known quantum preprocessing attack, of advantage ST^2/N + T^3/N, is optimal for two-block Merkle-Damgård collisions. The source reports that no matching quantum bounds are known at any block length. 7 open	Collision Finding Collision Resistant Hashing Quantum Query Complexity Quantum Random Oracle Model Time Space Tradeoffsqromtight-bound
	Erasing real-or-random vs Boneh–Zhandry Open: whether erasing real-or-random security implies Boneh-Zhandry security. The reverse non-implication is proved only in the quantum random oracle model, and this direction is one of six non-implications the source paper conjectures and does not prove. 5 open	Quantum Cryptography Quantum Encryption Notionsseparation
	6-round Feistel indifferentiability Whether 6-round Feistel is fully indifferentiable from a random permutation is open, bridging the proven r=5 attack and the proven r>=8 construction. 2 open	Feistel Networks Indifferentiability Pseudorandom Permutationsothertight-bound
	Generalized mirror theory The fully generalized Mirror Theory bound for arbitrary cycle-consistent multi-graphs up to the information-theoretic limit is open; current techniques only reach component size O(N^{1/4}). 2 open	Block Ciphers Mirror Theory Pseudorandom Permutationslower-bound
	Logarithmic independence implies PRP Open at independence order log n. The same implication is refuted at order 4 and at every constant order by an explicit construction; the logarithmic-order form is untouched, and no unconditional proof of it can be expected. 5 open	Limited Independence Pseudorandom Permutationscharacterization
	One erasing challenge vs many embedding learns Open: whether a single erasing two-ciphertext challenge query, with classical learning queries, implies security against polynomially many embedding-model superposition learning queries. One of six non-implications the source paper conjectures, and on its own account the one that would close the most remaining cells. 5 open	Quantum Cryptography Quantum Encryption Notionsseparation
	Standard real-or-random vs embedding two-ciphertext Open: whether one standard-oracle real-or-random challenge query implies one embedding-model two-ciphertext challenge query, with classical learning queries on both sides. Both notions are singleton classes in the source’s classification, and this is one of six non-implications it conjectures. 5 open	Quantum Cryptography Quantum Encryption Notionsseparation
	OWFs are black-box helpful for CRHFs Open in both directions. Two relaxations — distributional and class-reduction helpfulness — are proved conditional on the Simon-oracle amplification conjecture; neither yields the universal auxiliary primitive the full statement needs. 4 open	Black Box Separations Collision Resistant Hashing One Way Functionsotherseparation
	Salt Length vs. Call Count Fully open in both directions: no construction with \(O(\lambda)\)-length, message-independent salts and \(O(1)\) Merkle-Damgård calls is known, and no proof that none can exist, nor any trade-off between the two, has been given either. 4 open	Indifferentiability Random Oracle Modelromcharacterization
	Short-Salt MD Combiner Security Open in both directions: the source’s Theorem 3.1 proves security only when salts exceed the message by at least the security parameter, and reports neither an attack nor a security proof once the salts shrink to a constant number of blocks. 4 open	Indifferentiability Random Oracle Modelromcharacterizationadaptation (ai)
	3-way collision, oblivious sequential curve Open: closing the factor-root-S gap between the proved oblivious lower bound and a matching table-and-hunt algorithm for finding a 3-way collision with an oblivious sequential branching program. 2 open	Collision Finding Random Oracle Model Time Space Tradeoffsromtight-boundadaptation (ai)
	Censoring can only hurt Open. The censored side is proved at essentially optimal round count with matching lower bounds; what is missing is the transfer of any such bound to uncensored AES at the same round count. 5 open	Block Ciphers Pseudorandom Permutationslower-bound
	STB conjecture (Merkle-Damgård) Open for non-constant B in the regime ST^2 > 2^n, where the best published security bound and the best published attack are a factor of up to S apart; settled at B=1, B=2, every constant B, B~T, and every 2<B<T with ST^2 <= 2^n. 6 open	Collision Finding Collision Resistant Hashing Random Oracle Model Time Space Tradeoffsromtight-boundbarrier (ai)
	STB conjecture (sponge) Open for every B >= 2 except B ~ T: at B=2 in the regime ST^3 > C, and at B >= 3 with a gap of about T/B. The source asks for a proof or a refutation and takes no position. 7 open	Collision Finding Collision Resistant Hashing Time Space Tradeoffspromtight-boundbarrier (ai)
	Tight \(k\)-collision time-space tradeoff The exact tight time-space tradeoff for k>=3 collisions under preprocessing is open; only the k=2 case has a matching upper and lower bound. 2 open	Collision Finding Random Oracle Model Time Space Tradeoffsromtight-bound
	XOR as a Weak 2-Immunizer The single unresolved cell in the source’s own table: XOR fails as a strong 2-immunizer under Alekhnovich, a bilinear pairing fails as a weak one under SXDH, a random oracle succeeds even with auxiliary input. The weak case for XOR is left open with a conjectured answer and a concrete route to it. 4 open	Backdoored Primitives Black Box Separations Pseudorandom Generatorsseparationadaptation (ai)
	AES t-Wise Independence, t > 2 Named by the source as the first of the two outstanding open problems that come of its work. It proves almost pairwise independence (t = 2) for multi-round AES with independent round keys, and an existential t-wise result for key-alternating ciphers with most permutations, but nothing for concrete AES beyond t = 2. Its Appendix B attacks 4-wise independence in the width-1 case with the same S-box. 4 open	Block Ciphers Limited Independence Pseudorandom Permutations T Wise Independencecharacterizationbarrier (ai)