LATTICE Lab · npxio

Encrypt / decrypt

Key (32 bytes, hex)

Nonce (12 bytes, hex) — never reuse with the same key

Rounds: Message

Ciphertext (hex)

Avalanche: flip one key bit

Same message, same nonce, one key bit flipped. Lit squares are output bits that changed. A strong cipher changes about half of them, scattered with no pattern.

Key bit to flip:

of the first block's 512 bits changed

Tamper-proof mode (LATTICE-Poly1305)

Encrypts the message above and adds a 16-byte Poly1305 tag. Any change to the ciphertext or the sender label is rejected. Poly1305 is the standard MAC from ChaCha20-Poly1305 (RFC 8439), not our invention.

Sender label (authenticated, not encrypted)

Sealed message (ciphertext + tag, hex)

Diffusion by round (live, in your browser)

For each round count: flip one random input bit across many random states and record the worst-biased output bit. Red bars: an attacker can detect a pattern. Amber: no pattern found at this precision.

Attack scoreboard

From the offline attack suites. Brute force on the 256-bit key costs 2^256. Read the LATTICE-4 spec, every attack we ran and the test vectors.

Best attack (C tools)	LATTICE-1 (12r)	LATTICE-2 (20r)	LATTICE-3 (20r)	LATTICE-4 (20r)
Round-3 cracks, 1M pairs/bit	hundreds	69	108	0 (even at 8M)
Key recovery, 4 rounds	≈ 2^77	≈ 2^129	≈ 2^98	≈ 2^145
Key recovery, 5 rounds	≈ 2^136	≈ 2^135	≈ 2^135	≈ 2^175
Key recovery, 6 rounds	≈ 2^247	≈ 2^250	≈ 2^235	held
New classes: diff-linear, 2-bit, related-key (3r)	—	—	diff-linear held	all held
Rounds broken / margin	6 of 12 · 2x	6 of 20 · 3.3x	6 of 20 · 3.3x	5 of 20 · 4x

LATTICE-1 attack details