💻 computer science

Symfrog-512: High-Capacity Sponge-Based AEAD Cipher (1024-bit State)

This paper presents Symfrog-512, a high-capacity 1024-bit state sponge-based AEAD cipher accompanied by a complete reference implementation, deterministic test vectors, and reproducible benchmarks, with all security claims strictly bounded by the ideal permutation model and the project released under an MIT license to encourage independent verification.

Original authors: Victor Duarte Melo

Published 2026-02-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Victor Duarte Melo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very important secret diary, and you want to lock it up so only you can read it, but you also want to make sure no one has tampered with the pages while it was in the mail.

SymFrog-512 is a new, experimental "digital lockbox" designed to do exactly that. It's a piece of software that encrypts your data (scrambles it so it looks like gibberish) and adds a special seal (a tag) to prove it hasn't been changed.

Here is how it works, explained through simple analogies:

1. The Big Mixing Bowl (The Sponge)

Most digital locks use a small, fixed-size box to mix things up. SymFrog-512 uses a giant 1024-bit mixing bowl.

The Analogy: Imagine a massive industrial blender. You pour your secret message (the "rate") and your secret password (the "capacity") into it.
Why it's big: Most blenders are small, so if you mix too much, the flavors might get confused. This blender is huge. It has a massive "capacity" section that stays hidden. Even if someone tries to guess your password by watching the blender spin, they can't see the hidden part. This makes it incredibly hard to crack.

2. The Dance of the Digits (The Permutation)

Inside this giant bowl, there is a specific set of dance moves called P1024-v2.

The Analogy: Imagine 16 dancers (representing 16 chunks of data) standing in a circle. Every time the music plays (a "round"), they do a complex routine:
1. Add Spice: They add a secret ingredient (round constants).
2. Mix: They swap partners and mix their moves.
3. Twist: They do a non-linear twist (the "Chi" step) that makes the pattern impossible to predict.
4. Kick: They kick the data around using multiplication (the "Kick" layer).
5. Spin & Shuffle: They spin in place and swap positions in a specific order.
The Goal: They do this dance 24 times in a row. By the end, the original data is so thoroughly scrambled that it looks like pure random noise.

3. The Two-Step Process (Duplex Mode)

SymFrog-512 doesn't just lock the box; it does it while you are still talking to it.

The Analogy: Think of a Duplex Intercom. You can speak into it (send data) and listen to it (get encrypted data) at the same time.
How it works:
1. Absorb: You feed your secret message into the giant blender.
2. Squeeze: The blender spits out a stream of random-looking numbers (the "keystream").
3. Mix: You combine your secret message with this random stream to create the final locked file.
4. Repeat: You keep feeding the blender the locked message to keep the stream going. This ensures that if someone changes even one letter of your message, the whole stream changes, breaking the seal.

4. The Magic Seal (Authentication)

When you finish, the system generates a 256-bit "Magic Seal" (a tag).

The Analogy: Imagine a wax seal on an envelope. If someone tries to open the envelope and change the letter inside, the wax seal will break or look different.
The Security: This seal is so long (256 bits) that the chance of a hacker guessing a fake seal that looks real is like winning the lottery every day for a billion years. It's mathematically impossible to fake.

5. The File Format (The Envelope)

The paper also describes how this looks as a file on your computer.

The Header: The file starts with a 152-byte "envelope." It has a magic code ("SYMFROG1") so your computer knows what kind of lock it is.
The Key: It can use a raw 1024-bit key (a super-long password) or turn a normal password into a super-key using a special "password grinder" called Argon2id. This grinder makes it very hard for hackers to try millions of passwords quickly.
The Check: Before it even tries to unlock your file, it checks the "Header Seal." If the seal doesn't match, it stops immediately. This saves time and prevents errors.

6. How Fast Is It?

The researchers tested this on a standard computer.

The Speed: It can process data at about 131 Megabytes per second.
The Analogy: That's fast enough to encrypt a whole movie in a few seconds. It's not the absolute fastest lock in the world, but it's very fast for such a heavy-duty, high-security lock.

Why Do We Need This?

The author, Victor Duarte Melo, is an independent researcher. He isn't claiming this is the "perfect" lock that can never be broken. Instead, he is saying:

"Here is a new design. It uses a giant mixing bowl and a complex dance. Based on our math, it should be safe against standard attacks. We have published the code and the test results so that other experts can try to break it."

In summary: SymFrog-512 is a robust, high-security digital lockbox that uses a massive internal mixer to scramble your data and a super-strong seal to protect it. It's designed to be safe, transparent, and fast enough for real-world use, inviting the world to try and crack it to prove its strength.

1. Problem Statement

The paper addresses the need for a robust, high-capacity Authenticated Encryption with Associated Data (AEAD) scheme that leverages permutation-based cryptography. While existing standards like Keccak (SHA-3) and Ascon are well-established, there is a continuous drive to explore custom permutations with larger state sizes to achieve conservative security bounds. The specific challenges addressed include:

Security Margins: Achieving high resistance against generic attacks (collision and forgery) by utilizing a large internal capacity ( $c=512$ bits).
Implementation Safety: Designing a system that is resistant to implementation errors (e.g., nonce reuse, truncation) and provides clear, verifiable file formats.
Key Flexibility: Supporting both raw high-entropy keys and passphrase-derived keys via memory-hard functions (Argon2id).

2. Methodology

The authors propose SymFrog-512, a new AEAD scheme built upon a custom 1024-bit permutation ( $P_{1024-v2}$ ) operating in a duplex sponge mode.

A. Core Parameters

State Size: 1024 bits (128 bytes), split into:
- Rate ( $r$ ): 512 bits (64 bytes) for data absorption/squeezing.
- Capacity ( $c$ ): 512 bits (64 bytes) for security.
Tag Length: 256 bits (32 bytes).
Nonce Length: 256 bits (32 bytes).
Key Length: 1024 bits (128 bytes).
Rounds: 24 per permutation call.

B. The $P_{1024-v2}$ Permutation

The permutation operates on 16 little-endian 64-bit words. Each of the 24 rounds applies the following layers:

AddRoundConstants: XORs round constants (derived via SHAKE256) into the capacity words ( $S[8..15]$ ).
Mixer: XORs rate words with capacity words ( $S[i] \leftarrow S[i] \oplus S[i+8]$ ).
Chi Nonlinearity: Applies a 4-word Boolean nonlinearity (similar to Keccak) to groups of words.
Kick Layer: Introduces data-dependent mixing using 64-bit multiplication and an oddness mask, followed by rotation.
Rotate and Shuffle: Rotates words (19 or 61 bits) and permutes word positions via a fixed P-box to ensure diffusion.

C. AEAD Mode (Duplex Sponge)

Initialization: The state is initialized with the Key, Nonce, and a fixed ASCII identifier, followed by one permutation.
Associated Data (AD): Absorbed in 64-byte blocks with domain separation constants ($0xA0$).
Encryption/Decryption:
- Generates a 512-bit keystream block using a custom Output Transform (mixing rate and capacity, then applying a SplitMix64 finalizer).
- XORs plaintext with keystream to produce ciphertext.
- Crucially, the resulting ciphertext is absorbed back into the state (ciphertext feedback), ensuring symmetric transcripts for encryption and decryption.
Finalization: A final permutation with a tag domain constant ($0xF0$) produces the 256-bit authentication tag.

D. File Format & Robustness

The implementation defines a 152-byte header containing magic bytes, version, flags (for Argon2id), salt, nonce, and a keyed header authentication tag.

Early Reject: The header tag is verified before decrypting the ciphertext, preventing wasted computation on invalid keys.
Key Derivation: Optional support for Argon2id (via libsodium) for passphrase-based keys.
Safety: Includes constant-time tag comparison, atomic file writes, and memory zeroing.

3. Key Contributions

Specification of SymFrog-512: A complete, open specification for a high-capacity AEAD scheme with a 1024-bit state, designed for 64-bit architectures.
Security Analysis in the Ideal Permutation Model: The paper provides formal proofs for:
- Confidentiality (IND-CPA): Bounded by the birthday bound of the capacity ( $q^2/2^{c+1}$ ). With $c=512$ , this is negligible.
- Authenticity (INT-CTXT): Bounded by the capacity collision probability plus the tag guessing probability ( $2^{-256}$ ).
Custom Output Transform: A novel extraction function that mixes both rate and capacity lanes before applying a SplitMix64 finalizer, breaking simple "read-the-rate" patterns found in standard sponge constructions.
Empirical Validation:
- Benchmarks: Achieved 435.1 ns per permutation and 131.7 MiB/s throughput on a 64 MiB buffer.
- Diffusion Checks: Demonstrated that a single-bit input difference spreads to ~512 bits (random-like) within 4 rounds, with full diffusion by round 24.
- Regression Artifacts: Provided SHA-256 checksums for test vectors across various plaintext lengths to ensure reproducibility.

4. Results

Performance: The reference implementation is highly efficient, processing data at over 130 MiB/s on standard hardware, limited primarily by the permutation speed.
Security Bounds: The design achieves a theoretical security level of 256 bits against forgery and 256 bits against collision-based distinguishing attacks, assuming the permutation behaves ideally.
Correctness: The reference implementation successfully encrypts and decrypts files of varying sizes (0 to 1MB+) with perfect round-trip fidelity, verified via checksums.

5. Significance

Conservative Security: By utilizing a 512-bit capacity, SymFrog-512 offers a massive security margin against generic attacks, far exceeding the requirements for most practical applications. This is particularly relevant for long-term data protection.
Transparency and Reproducibility: The paper explicitly links the specification to a public reference implementation, includes test vectors, and encourages public cryptanalysis of the $P_{1024-v2}$ permutation.
Engineering Best Practices: The inclusion of a robust file format with header authentication and constant-time operations addresses common practical vulnerabilities (e.g., timing attacks, partial decryption on bad keys) often overlooked in theoretical designs.
Contribution to the Field: It serves as a concrete example of how to construct a high-performance AEAD using a large-state permutation, contributing to the diversity of post-quantum and permutation-based cryptographic primitives.

Note on Limitations: The authors explicitly state that the security of the permutation itself ( $P_{1024-v2}$ ) against dedicated cryptanalysis (e.g., algebraic attacks, differential cryptanalysis) has not been proven and remains open for public scrutiny. The security claims rely on the Ideal Permutation Model.