← Projects

Alaniz Cipher

Ongoing research

An encryption scheme built on polynomial systems coupled by sheaves on graphs, documented version by version, including the ones that broke.

Publishing a cipher so that others can break it looks like a bad idea, and when the goal is for it to hold against a quantum computer too and nobody has proven it does, it is the only honest way to get closer.

Alaniz Cipher is an encryption scheme I design and publish version by version. Two versions have already fallen, and the whole story is in the lab. Its design goal is post-quantum encryption, and “secure” and “quantum resistant” are just that, design goals, not claims.

Under the hood it rests on the NL-SMIP problem, a polynomial system whose secret coefficients are coupled through sheaf cohomology on graphs.

Two broken versions

v1 used a σ that cubed each component, and A. Rodríguez Langa broke it with a scaling attack. v2 gave σ an SPN structure to resist that attack, and I broke it myself in the v3 paper. With d = 2 and p = 17 it took 20 queries and about 5.7 s of symbolic computation, and the attack worked on all 10 randomly generated keys.

v3, from April 2026, redesigned the scheme, with probabilistic encryption and a σ that works on vectors. Its security figures do not hold.

A v4 that turned into something else

v4 began as a public key proposal, and I dropped it on finding that the scheme was symmetric, because encrypting required the secret. The security figures of that proposal do not hold either. It carried on as a primitive for hash functions, which was not the plan.

In that v4, and this is measured, coupling the input of the S-boxes adds one bit of CICO ideal degree per round, and the effect is generic, not specific to sheaves. The preprint “Placement is a Primitive” tells it. The number of rounds and the cost against Poseidon2 are extrapolations from that measured law, not measurements, and the case of four or more rounds and the real 64-bit Goldilocks field are still open.

It is not production-ready encryption and it has no external audit. What it does have is a record of every time it was wrong, which in cryptography is worth more than it looks.

Fig. 1A letter through the machine

Pick a letter or type it and encrypt itThe machine at rest

The letter goes in through the wheel on the left as its ASCII code written in base 17, a pair of F₁₇. The four stations in a cycle are the C4 graph of the demo in the v3 code, with a pair of F₁₇ at each. The gear trains are the sheaf restrictions, linear and invertible, and carry the message from station to station so that, when the loop closes, the first one gets back the pair it already had. At each station the A shaft sets y = A·s, the cam is σ, the only nonlinear part, the B gears multiply it and the sum wheel gives c = y + B·σ(y), which the two output wheels show. This is the deterministic form of v1 and v2, here with the σ of v2. v1 cubed each component and A. Rodríguez Langa broke it with a scaling attack, because then σ(2y) = 8·σ(y) and subtracting eight times one ciphertext from the ciphertext of its double wipes out the cam. I broke v2 myself later, by interpolation and Gröbner bases, and v3 encrypts with a nonce and a vector σ that this machine does not draw. The matrices, the cam profile and the flywheel belong to this drawing, not to a key. Security is a design goal, not a fact.

Links

License MIT (v3) · Apache-2.0 (v4)

Related