Structural Cryptanalysis of the Eevee AEAD Family

What it is

A preprint (ePrint 2026/2496, not peer-reviewed) that breaks the security claims of Eevee's three AEAD modes: Umbreon, Jolteon and Espeon. The analysis targets the algorithms in the supplied full-version specification and the proof steps behind the online authenticated-encryption claims.

How it works

The attacks fall into two independent groups.

Privacy and nonce misuse

• A two-encryption prefix distinguisher with no AD has advantage 1 − 2^−n in the ideal-forkcipher model. It contradicts the specified online ideal object.
• The separable AD transform gives a four-encryption nonce-misuse distinguisher, also with advantage 1 − 2^−n.
• The same AD transform gives a deterministic AD-only forgery, plus forgeries on nonempty messages built from cross-domain state differences.
• These contradict the advertised nonce-misuse bounds of Umbreon and Espeon.

Nonce-respecting forgeries

• Jolteon: one two-block encryption yields a fresh one-block forgery that reuses the same tag.
• Espeon: the short-message path allows arbitrary AD substitution.

The authors trace the failures to the original proof: online-prefix consistency, conditional transcript distributions, domain separation and checksum freshness. The authenticity attacks follow from deterministic identities. The privacy counterexamples persist even with an ideal forkcipher, so they are not artifacts of a weak primitive.

Preconditions / Affected

• Anyone using Umbreon or Espeon and relying on nonce-misuse resistance is affected.
• Jolteon and Espeon are exposed to forgery even when nonces are respected.
• The page does not say how Umbreon fares against the nonce-respecting forgeries.

What to do

The page gives no patch. It derives requirements for AD processing and message finalization, but the abstract does not state them. Treat any Eevee deployment as unsafe on the claimed properties until you have read the paper's requirements section. The abstract says the flaws "cannot be resolved solely by correcting implementation encodings." The authors checked the published C routines and place the failures in the mode design, so fixing the code will not close them.

Caveats

• This is a preprint, and the attacks were not independently verified here.
• The analysis follows the supplied full-version specification. Its fit with other Eevee versions, such as the CCS 2023 proceedings text, is not stated.
• The abstract gives no concrete bit-level attack costs beyond query counts and distinguishing advantage.