Structural Cryptanalysis of the Eevee AEAD Family

Shuping Mao; Peng Wang; Jiadong Han; Tingting Guo; Yan Jia; Ying Chen

Paper 2026/2496

Structural Cryptanalysis of the Eevee AEAD Family

Shuping Mao, Beijing Electronic Science \& Technology Institute, Beijing, China

Peng Wang, School of Cryptology, University of Chinese Academy of Sciences, Beijing, China

Jiadong Han, School of Cryptology, University of Chinese Academy of Sciences, Beijing, China

Tingting Guo, Ningbo Key Laboratory of Information Technology Application Innovation and Security, School of Cyber Science and Engineering, Ningbo University of Technology, Ningbo, China

Yan Jia, State Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China

Ying Chen, Beijing Electronic Science \& Technology Institute, Beijing, China

Abstract

Eevee is a family of three AEAD modes, Umbreon, Jolteon, and Espeon, proposed at CCS 2023 for IoT-to-cloud secure computation. We analyze structural flaws in the algorithms of the supplied full-version specification and the proof steps underlying their online authenticated-encryption claims. An AD-free, two-encryption prefix distinguisher has advantage $1-2^{-n}$ in the ideal-forkcipher model, contradicting the specified online ideal object. Independently, the separable associated-data transform yields a four-encryption nonce-misuse distinguisher with advantage $1-2^{-n}$, a deterministic AD-only forgery, and nonempty-message forgeries obtained from cross-domain state differences. These attacks contradict the advertised nonce-misuse bounds of Umbreon and Espeon. With nonce-respecting encryption queries, one two-block Jolteon encryption permits a fresh one-block forgery with the same tag, while Espeon's short-message path permits arbitrary AD substitution. We trace these counterexamples to failures of online-prefix consistency, conditional transcript distributions, domain separation, and checksum freshness in the original proof. The authenticity attacks follow from deterministic identities, and the privacy counterexamples persist with an ideal forkcipher. We derive corresponding requirements for AD processing and message finalization, and briefly summarize supporting checks of the published C routines. The central failures concern the mode design and cannot be resolved solely by correcting implementation encodings.

Metadata

Available format(s): PDF
Category: Secret-key cryptography
Publication info: Preprint.
Keywords: Eevee Authenticated encryption Forkcipher Nonce misuse Forgery
Contact author(s): maoshuping19 @ mails ucas ac cn
p-wang @ ucas ac cn
hanjiadong25 @ mails ucas ac cn
guotingting @ nbut edu cn
jiayan2022 @ iie ac cn
ychen @ besti edu cn
History: 2026-10-15: approved; 2026-10-15: received; See all versions
Short URL: https://ia.cr/2026/2496
License: CC BY-NC-SA

BibTeX

@misc{cryptoeprint:2026/2496,
      author = {Shuping Mao and Peng Wang and Jiadong Han and Tingting Guo and Yan Jia and Ying Chen},
      title = {Structural Cryptanalysis of the Eevee {AEAD} Family},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2496},
      year = {2026},
      url = {https://eprint.iacr.org/2026/2496}
}