Paper 2026/501

More Brisés in Ballet: Extending Differential and Linear Cryptanalysis

Gabriele Bellini, University of Milan

Alessandro De Piccoli, University of Milan

Michela Gallone, University of Milan

David Gerault, Technology Innovation Institute

Yun Ju Huang

Paul Huynh, Technology Innovation Institute

Matteo Onger, University of Milan

Simone Pelizzola, University of Milan

Andrea Visconti, University of Milan

Abstract

In this work, we present new cryptanalytic results on the Ballet block cipher family, a simplified Lay-Massey ARX construction with a linear key schedule, winner of the symmetric algorithm category in the 2018–2020 Chinese National Cryptographic Algorithm Competition. Despite winning the competition, the cipher has received limited attention outside the Chinese Association for Cryptologic Research (CACR) community. We provide the first classical key recovery attacks in the literature, new explicit differential and linear trails (up to 16 rounds for differential, and 16 for linear, while the original paper only provided a bound for 9 rounds), improved impossible differential trails (8 rounds instead of 7), and the first differential-linear analysis of Ballet (up to 20 rounds). Our results lead to key recovery attacks on up to 16 rounds of Ballet-128/128/46, 17 rounds of Ballet-128/256/48 and 22 rounds of Ballet-256/256/74, extending the cryptanalytic understanding of this ARX-based design and contributing new insight into its security margin, an area that the designers themselves note warrants further study.

@misc{cryptoeprint:2026/501,
      author = {Emanuele Bellini and Gabriele Bellini and Alessandro De Piccoli and Michela Gallone and David Gerault and Yun Ju Huang and Paul Huynh and Matteo Onger and Simone Pelizzola and Andrea Visconti},
      title = {More Brisés in Ballet: Extending Differential and Linear Cryptanalysis},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/501},
      year = {2026},
      url = {https://eprint.iacr.org/2026/501}
}