$ lattice --version
LATTICE-4
A 256-bit stream cipher we attack before anyone else does. Five of its twenty rounds are broken. We publish how.
An experiment, not reviewed outside this lab. Nothing should rely on it until other people have spent years trying to break it.
diffusion.log512-bit state
Inside the cipher: two runs whose nonces differ in a single bit. Each square is one bit of the 512-bit internal state; dark means the runs disagree.
where it breaks
We run differential, linear, cube, rotational and key-recovery attacks on reduced-round versions. Red rounds have a known attack faster than trying every key. Everything from round 6 up has held so far, which leaves a safety margin of four times the broken depth.
try it
Encrypted in your browser with the full 20-round cipher, a random key, and nonce .
break it
| Rounds | Best known attack | Solved by |
|---|---|---|
| Loading the board… | ||
Nine secret keys, committed in advance by SHA-256. Ask the oracle for keystream at any nonce, recover a key, and your name goes here. Open the challenge or email us a break.
cat SPEC.md
- Key
- 256 bits
- Nonce, counter
- 96 bits, 32 bits
- State
- 16 words of 32 bits
- Rounds
- 20
- Operations
- add, rotate, XOR, one multiply
- Rotations
- 15, 16, 8, 3
- Key schedule
- re-injected every 2 rounds, round constants
- Authenticated mode
- LATTICE-4-Poly1305 (RFC 8439 construction)
- Test vectors
- 26, C and JavaScript agree
how we work
We publish what failed. LATTICE-1 looked fine until a scan of every input bit found a crack its first tests missed; four rounds of it fell for about 277 work. That result sits in the log next to the ones we're proud of.
We attack before we claim. Every version went through billions of samples of differential, linear, cube, rotational and key-recovery attacks before it got a number on this page.
We don't confuse an experiment with a product. LATTICE earns a place in real software only after other people have spent years failing to break it.