Ciminion: Symmetric Encryption Based on Toffoli-Gates over Large Finite Fields

Motivated by new applications such as secure Multi-Party
Computation (MPC), Fully Homomorphic Encryption (FHE), and ZeroKnowledge proofs (ZK), the need for symmetric encryption schemes that minimize the number of field multiplications in their natural algorithmic description is apparent. This development has brought forward many dedicated symmetric encryption schemes that minimize the number of multiplications in F2푛 or F푝, with 푝 being prime. These novel schemes have lead to new cryptanalytic insights that have broken many of said schemes. Interestingly, to the best of our knowledge, all of the newly proposed schemes that minimize the number of multiplications use those multiplications exclusively in S-boxes based on a power mapping that is
typically 푥 3 or 푥 −1.
Furthermore, most of those schemes rely on complex and resource-intensive linear layers to achieve a low multiplication count.
In this paper, we present Ciminion, an encryption scheme minimizing the number of field multiplications in large binary or prime fields, while using a very lightweight linear layer. In contrast to other schemes that aim to minimize field multiplications in F2푛 or F푝, Ciminion relies on the Toffoli gate to improve the non-linear diffusion of the overall design. In addition, we have tailored the primitive for the use in a Farfalle-like construction in order to minimize the number of rounds of the used primitive, and
hence, the number of field multiplications as far as possible