Alaniz Cipher

In March 2026 I published a cipher with my surname on it and left it in plain view so that others could try to break it. A. Rodríguez Langa managed it by leaning on a single algebraic identity, and ever since, this experiment has mostly been a list of who broke what.

A cipher is a machine that mixes a message with a secret key so that undoing the mix without the key costs more than anyone can pay. The design goal of this one is for the price to stay high for a quantum computer too. Whether it gets there is not proven, and the only honest way to get closer is to publish every version and let people attack it.

Inside, it rests on the NL-SMIP problem, a polynomial system whose secret coefficients are coupled through sheaf cohomology on graphs. The part that does the nonlinear mixing is called σ, and almost all of this story is about it.

Two versions on the floor

v1 used a σ that cubed each component. That has a consequence that fits in one line, because if the input is multiplied by λ the output comes out multiplied by λ³, and on that identity, σ(λy) = λ³σ(y), A. Rodríguez Langa built a scaling attack that broke it. That cryptanalysis opened the path to v2 and, eventually, to v3.

v2 gave σ an SPN structure, layers of substitution and permutation, to withstand that attack. It fell somewhere else, and I broke it myself in the v3 paper. Any deterministic encryption of the form c = As + Bσ(As) with bounded-degree σ allows full key recovery through polynomial interpolation and Gröbner bases. For d = 2 and p = 17 it took 20 chosen-plaintext queries and about 5.7 s of symbolic computation, and the attack worked on all 10 randomly generated keys.

v3, from 24 April 2026, changed the structure. Encryption became probabilistic, with a nonce-derived stream (SHAKE-256), and σ began to act vectorially in F_p^d through a monomial power permutation. The PQ-128 security estimate in that paper was later revisited in the v4 repository, and it does not hold.

The public key that was not

v4 started as a public-key proposal, and I dropped it on finding that the scheme was actually symmetric, because encrypting required the secret. A public-key padlock is one that anyone can close and only the keyholder can open. If closing it also takes the key, what is left is an ordinary lock, and the security figures I had given for that design lost their support.

The work carried on, outside the plan, as a primitive for hash functions, the ones that boil any message down to a short fingerprint, in their arithmetization-oriented variety. The central result is measured and told in the preprint “Placement is a Primitive”. Coupling the S-box inputs adds one bit of CICO ideal degree per round, putting the same coupling in the linear layer or after the S-box adds nothing, and the effect is generic rather than specific to sheaves. Where the part goes matters more than the part. Round counts and cost relative to Poseidon2 are extrapolations from that measured law, not measurements, and four or more rounds and the real 64-bit Goldilocks field are still open.

None of this is production-ready encryption, and it has had no external audit. Nor is there a formal worst-case to average-case reduction for NL-SMIP, a limitation shared by all multivariate cryptography. “Secure” and “quantum-resistant” are design goals, and the security figures for v3 and for the v4 public-key proposal do not hold. What does hold, for now, is the log.