Paper 2017/414

Symmetrically and Asymmetrically Hard Cryptography (Full Version)

Alex Biryukov and Leo Perrin


The main efficiency metrics for a cryptographic primitive are its speed, its code size and its memory complexity. For a variety of reasons, many algorithms have been proposed that, instead of optimizing, try to increase one of these hardness forms. We present for the first time a unified framework for describing the hardness of a primitive along any of these three axes: code-hardness, time-hardness and memory-hardness. This unified view allows us to present modular block cipher and sponge constructions which can have any of the three forms of hardness and can be used to build any higher level symmetric primitive: hash function, PRNG, etc. We also formalize a new concept: asymmetric hardness. It creates two classes of users: common users have to compute a function with a certain hardness while users knowing a secret can compute the same function in a far cheaper way. Functions with such an asymmetric hardness can be directly used in both our modular structures, thus constructing any symmetric primitive with an asymmetric hardness. We also propose the first asymmetrically memory-hard function, DIODON. As illustrations of our framework, we introduce WHALE and SKIPPER. WHALE is a code-hard hash function which could be used as a key derivation function and SKIPPER is the first asymmetrically time-hard block cipher.

Available format(s)
Secret-key cryptography
Publication info
A major revision of an IACR publication in ASIACRYPT 2017
white-box cryptographymemory hardnessbig-key encryptionSkipperWhaleDiodon
Contact author(s)
perrin leo @ gmail com
2017-09-07: revised
2017-05-14: received
See all versions
Short URL
Creative Commons Attribution


      author = {Alex Biryukov and Leo Perrin},
      title = {Symmetrically and Asymmetrically Hard Cryptography (Full Version)},
      howpublished = {Cryptology ePrint Archive, Paper 2017/414},
      year = {2017},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.