Paper 2026/856

MERIDIAN: A Toroid-Inspired Permutation Block Cipher for Constrained Environments

Abstract

We introduce MERIDIAN, a 128-bit block cipher designed for resource-constrained environments as a lightweight alternative to AES-128. MERIDIAN retains the AES-128 interface, including a 128-bit block, 128-bit key, and 4×4 byte state, while reusing the standard AES S-box. This enables compatibility with existing AES-128 modes such as ECB, CBC, CFB, OFB, CTR, XTS, CMAC, CCM, and GCM, and allows implementations to reuse established S-box ROMs and GF(28) inverse circuits. The cipher is based on three round operations: Directional Substitution (DS), Meridian Diffusion (MD), and Admittance Mixing (AM), followed by a round constant. Its state is represented over the discrete torus Z4 × Z4. The MD layer combines two orthogonal byte permutations, meridian and parallel, with column mixing to obtain full byte diffusion within three rounds without requiring MDS multiplication. MERIDIAN uses twelve rounds and avoids an expanded key schedule. We present MILP-verified differential and linear bounds, including exact active-S-box counts up to eleven rounds and a sub-additive bound for twelve rounds. We also provide AES-aligned cryptanalysis covering differential, linear, integral, biclique, slide, related-key, invariant-subspace, fault, meet-in-the-middle, and algebraic attacks. A reproducible fifteen-experiment benchmark suite compares MERIDIAN directly with AES-128, including key agility, cold-start latency, energy, masking cost, memory, throughput, and hardware complexity. Empirical results show that MERIDIAN reaches strict avalanche behavior in three rounds, matches AES-128 in entropy and NIST SP 800-22 fitness, reduces unrolled gate count, lowers RAM usage, and improves constrained-device efficiency. MERIDIAN is proposed as a research prototype for further public cryptanalysis. Erratum and resolution: The originally specified round function was not a permutation. Aumasson reported a key-independent DS collision, which we reproduce and which collapses 33.7% of a natural 65 536-state class; we further establish that AM is a singular F2-linear map for 98.10% of round-key bit-planes—an independent break—and that the published one-round differential bound is exceeded 13.37-fold. All are neutralised here. Appendix D specifies MERIDIAN-v2, which evaluates both state-dependent layers in two checkerboard phases so that no layer overwrites the neighbours it reads; DS′ and AM′ are proved bijective for every key, so the cipher is a permutation and decryption inverts encryption on all inputs. Replacing the rotation index (c mod 7) + 1 by c ∧ 7 makes it uniform and XOR compatible, revising the twelve-round bound from 2−288 to 2−240. Corrected code, a reproducer for each defect, and the first published 128-bit test vectors are included. The MILP active-S-box count must be re-verified for v2, which has had no third-party cryptanalysis.

Note: This version has neutralised the previously reported vulnerability in the fundamental operations of Meridian, the Blood Meridian by Aumasson, by acknowledging its weakness honestly.