Associated-Data Correlations in Eevee: Deterministic Forgeries against Nonce-Misuse Security

What it is

Isobe and Rahman's ePrint 2026/2518 is a cryptanalysis of the Eevee forkcipher AEAD modes Umbreon and Espeon. Both claim online AE security under nonce reuse. The attacks are deterministic: probability-one forgeries on non-empty messages.

How it works

• Two AD-only tags reveal a mask difference.
• That difference lets an attacker translate a known ciphertext from one AD value to another, so the ciphertext verifies under the new AD.
• The basic attack needs three encryption queries and one verification query.
• Partial final blocks are handled with an affine construction. For a fixed final-fragment length r, it takes n-r+3 encryption queries.
• If the forged length may be r or r-h (chosen 1 ≤ h < r < n) and the source plaintext is chosen adaptively, it takes n-r+2.
• Both constructions satisfy the padding check.
• They work for general message lengths. Espeon additionally needs at least one preceding complete block.

Preconditions / Affected

• The target is Umbreon or Espeon deployed with nonce reuse, which is the setting where they claim security. The attacker needs encryption queries and one verification attempt.
• The paper also analyzes a published short-message Espeon AD omission.

What to do

• Treat the nonce-misuse (online AE) claims for Umbreon and Espeon as broken. Don't rely on them where nonce reuse is possible.
• The paper gives no fix. Adding finalization is discussed only as an unproved countermeasure direction.
• To reproduce, the authors report a two-query attack accepted by the unmodified public C modes. They also validated the published complete-block Umbreon attack using the official ForkSkinny primitive in a specification adapter.

Caveats

• The basic attacks and their proof diagnosis overlap with independent, concurrent work by Mao et al. The authors' own contribution is the partial-block treatment.
• The page is an abstract only. It gives no concrete parameters, test vectors or code location.
• The page doesn't say whether the Eevee designers have responded.
• It is a preprint and has not been peer reviewed.