{"id":45704876,"url":"https://github.com/hadipourh/autoguess","last_synced_at":"2026-02-25T00:06:49.075Z","repository":{"id":42623924,"uuid":"430373674","full_name":"hadipourh/autoguess","owner":"hadipourh","description":"An easy-to-use, general and open-source tool to solve the guess-and-determine problem","archived":false,"fork":false,"pushed_at":"2026-02-24T16:01:33.000Z","size":25789,"stargazers_count":29,"open_issues_count":0,"forks_count":5,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-02-24T16:32:09.824Z","etag":null,"topics":["blockcipher","constraint-programming","cryptanalysis","cryptography","groebner-basis","guess-and-determine","key-bridging","milp","minizinc","or-tools","pysat","pysmt","python3","sagemath","sat","sat-solver-application","smt","stream-ciphers"],"latest_commit_sha":null,"homepage":"https://hadipourh.github.io/autoguess","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hadipourh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-11-21T13:25:34.000Z","updated_at":"2026-02-24T16:03:43.000Z","dependencies_parsed_at":"2025-08-01T03:06:19.733Z","dependency_job_id":"494fcf11-af7b-45e0-b679-cfe0c1864e36","html_url":"https://github.com/hadipourh/autoguess","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/hadipourh/autoguess","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hadipourh%2Fautoguess","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hadipourh%2Fautoguess/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hadipourh%2Fautoguess/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hadipourh%2Fautoguess/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hadipourh","download_url":"https://codeload.github.com/hadipourh/autoguess/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hadipourh%2Fautoguess/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29806145,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-24T22:43:48.403Z","status":"ssl_error","status_checked_at":"2026-02-24T22:43:18.536Z","response_time":75,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blockcipher","constraint-programming","cryptanalysis","cryptography","groebner-basis","guess-and-determine","key-bridging","milp","minizinc","or-tools","pysat","pysmt","python3","sagemath","sat","sat-solver-application","smt","stream-ciphers"],"created_at":"2026-02-25T00:06:48.375Z","updated_at":"2026-02-25T00:06:49.065Z","avatar_url":"https://github.com/hadipourh.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Autoguess\n\n[![license](https://img.shields.io/badge/license-GPL--3.0-green.svg)](./LICENSE.txt)\n[![PyPI](https://img.shields.io/pypi/v/autoguess.svg)](https://pypi.org/project/autoguess/)\n[![DOI](https://zenodo.org/badge/430373674.svg)](https://doi.org/10.5281/zenodo.16932672)\n[![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)\n[![Docker](https://img.shields.io/badge/docker-available-blue.svg)](https://www.docker.com/)\n[![PySAT](https://img.shields.io/badge/pysat-supported-blue.svg)](https://github.com/pysathq/pysat)\n[![MiniZinc](https://img.shields.io/badge/minizinc-supported-blue.svg)](https://www.minizinc.org/)\n[![OR-Tools](https://img.shields.io/badge/or--tools-supported-blue.svg)](https://developers.google.com/optimization)\n[![Gurobi](https://img.shields.io/badge/gurobi-supported-blue.svg)](https://www.gurobi.com/)\n[![SageMath](https://img.shields.io/badge/sagemath-supported-blue.svg)](https://www.sagemath.org/)\n[![GitHub stars](https://img.shields.io/github/stars/hadipourh/autoguess?style=social)](https://github.com/hadipourh/autoguess/stargazers)\n[![GitHub forks](https://img.shields.io/github/forks/hadipourh/autoguess?style=social)](https://github.com/hadipourh/autoguess/network)\n\n\u003cp align=\"center\"\u003e\n \u003cimg src=\"miscellaneous/logo.svg\" width=\"400\" alt=\"AutoGuess Logo\"\u003e\n\u003c/p\u003e\n\n**Autoguess** is a generic and easy-to-use tool designed to assist in solving the guess-and-determine problem. It is commonly applied in areas such as identifying guess-and-determine attacks and key bridging in cryptographic systems. The tool supports multiple solving approaches, including:\n\n- **Constraint Programming (CP)** via MiniZinc\n- **Mixed-Integer Linear Programming (MILP)** via Gurobi\n- **Boolean Satisfiability (SAT)** via PySAT\n- **Satisfiability Modulo Theories (SMT)** via pySMT\n- **Algebraic methods** via SageMath and Groebner basis computation\n\nThe tool is particularly useful for cryptanalysis of symmetric-key primitives, helping researchers discover minimal guess bases for various cryptographic primitives and protocols.\n\n---\n\n## Overall Structure\n\nThe following shape represents the overall structure of Autoguess. As it can be seen, Autoguess relies on [Minizinc](https://www.minizinc.org/), [PySAT](https://github.com/pysathq/pysat), [pySMT](https://github.com/pysmt/pysmt), [Gurobi](https://www.gurobi.com/) and [SageMath](https://www.sagemath.org/). Providing a Python interface, Autoguess translates the guess-and-determine problem to a SAT, SMT, MILP or Groebner basis computation problem and then calls an appropriate solver to solve it. It also provides a lightweight **knowledge-propagation** mode that iteratively deduces variables from an initial known set without invoking any external solver. Additionally, it utilizes [Graphviz](https://pypi.org/project/graphviz/) to visualize the discovered determination flow.\n\n![programflow](miscellaneous/programflow.svg)\n\n---\n\n- [Autoguess](#autoguess)\n - [Overall Structure](#overall-structure)\n - [Installation](#installation)\n - [Prerequisites](#prerequisites)\n - [Installation Methods](#installation-methods)\n - [Method 1: pip install (Recommended)](#method-1-pip-install-recommended)\n - [Method 2: Build Docker Image Locally](#method-2-build-docker-image-locally)\n - [For ARM64 (Apple Silicon)](#for-arm64-apple-silicon)\n - [For x86\\_64 (Most Linux Systems)](#for-x86_64-most-linux-systems)\n - [Method 3: Use Pre-built Docker Image](#method-3-use-pre-built-docker-image)\n - [Method 4: Native Installation (Debian-based and macOS)](#method-4-native-installation-debian-based-and-macos)\n - [Quick Start](#quick-start)\n - [Format of Input File](#format-of-input-file)\n - [Usage](#usage)\n - [Command Line Interface](#command-line-interface)\n - [Example 1](#example-1)\n - [Example 2](#example-2)\n - [Example 3](#example-3)\n - [Example 4](#example-4)\n - [Example 5](#example-5)\n - [Example 6](#example-6)\n - [Troubleshooting](#troubleshooting)\n - [Common Issues](#common-issues)\n - [Docker Issues](#docker-issues)\n - [Missing Dependencies](#missing-dependencies)\n - [Input File Issues](#input-file-issues)\n - [Performance Tips](#performance-tips)\n - [Getting Help](#getting-help)\n - [Applications](#applications)\n - [GD Attack on 1 Round of AES with 1 Known Plaintext/Ciphertext Pair](#gd-attack-on-1-round-of-aes-with-1-known-plaintextciphertext-pair)\n - [GD Attack on 2 Rounds of AES with 1 Known Plaintext/Ciphertext Pair](#gd-attack-on-2-rounds-of-aes-with-1-known-plaintextciphertext-pair)\n - [GD Attack on 3 Rounds of AES with 1 Known Plaintext/Ciphertext Pair](#gd-attack-on-3-rounds-of-aes-with-1-known-plaintextciphertext-pair)\n - [GD Attack on 14 Rounds of Khudra with 1 Known Plaintext/Ciphertext Pair](#gd-attack-on-14-rounds-of-khudra-with-1-known-plaintextciphertext-pair)\n - [GD Attack on 11 Rounds of SKINNY-n-n with 1 Known Plaintext/Ciphertext Pair](#gd-attack-on-11-rounds-of-skinny-n-n-with-1-known-plaintextciphertext-pair)\n - [GD Attack on Enocoro128-v2](#gd-attack-on-enocoro128-v2)\n - [GD Attack on KCipher2](#gd-attack-on-kcipher2)\n - [GD Attack on SNOW1](#gd-attack-on-snow1)\n - [GD Attack on SNOW2](#gd-attack-on-snow2)\n - [GD Attack on SNOW3](#gd-attack-on-snow3)\n - [GD Attack on ZUC](#gd-attack-on-zuc)\n - [GD Attack on Bivium-A](#gd-attack-on-bivium-a)\n - [Key-bridging in Linear Attack on PRESENT](#key-bridging-in-linear-attack-on-present)\n - [Key-bridging in Integral Attack on LBlock](#key-bridging-in-integral-attack-on-lblock)\n - [Key Bridging in Impossible Differential Attack on LBlock](#key-bridging-in-impossible-differential-attack-on-lblock)\n - [Key Bridging in Zero Correlation Attack on SKINNY-64-128](#key-bridging-in-zero-correlation-attack-on-skinny-64-128)\n - [Key Bridging in Zero Correlation Attack on SKINNY-64-192](#key-bridging-in-zero-correlation-attack-on-skinny-64-192)\n - [Key Bridging in DS-MITM Attack on SKINNY-128-384](#key-bridging-in-ds-mitm-attack-on-skinny-128-384)\n - [Key Bridging in Impossible Differential Attack on T-TWINE-80](#key-bridging-in-impossible-differential-attack-on-t-twine-80)\n - [Key Bridging in Impossible Differential Attack on T-TWINE-128](#key-bridging-in-impossible-differential-attack-on-t-twine-128)\n - [The Paper](#the-paper)\n - [Citation](#citation)\n - [License](#license)\n\n## Installation\n\n### Prerequisites\n\nBefore installing Autoguess, ensure you have the following:\n\n- **Python 3.8+**: Autoguess requires Python 3.8 or higher (Python 3.11+ needed for Groebner basis support)\n- **Docker** (alternative): For a self-contained installation\n- **Git**: For cloning the repository and dependencies\n\n### Installation Methods\n\nAutoguess can be installed via `pip` (recommended), Docker, or native installer scripts.\n\n#### Method 1: pip install (Recommended)\n\nThe simplest way to install Autoguess is via pip:\n\n```bash\n# Core installation (SAT solver and visualization)\npip install autoguess\n\n# With SMT solver support (z3, cvc5 -- requires a C++20 compiler for z3)\npip install \"autoguess[smt]\"\n\n# With CP solver support (also install the MiniZinc binary)\npip install \"autoguess[cp]\"\nautoguess --install-minizinc\n\n# With Groebner basis support (via passagemath, pip-installable SageMath; requires Python \u003e= 3.11)\npip install \"autoguess[groebner]\"\n\n# With Gurobi MILP support (requires Gurobi license)\npip install \"autoguess[gurobi]\"\n\n# Everything (SMT + CP + Groebner + Gurobi)\npip install \"autoguess[all]\"\n```\n\nThe following table summarizes the available extras:\n\n| Extra | Solvers included | Notes |\n|-------|-----------------|-------|\n| *(core)* | SAT (PySAT) | Always installed |\n| `[smt]` | z3, cvc5 | z3-solver builds from source (needs C++20 compiler, e.g. GCC 11+). For boolector, install `pyboolector` manually (PyPI builds are broken). |\n| `[cp]` | MiniZinc CP | Also run `autoguess --install-minizinc` to download the MiniZinc binary |\n| `[groebner]` | Groebner basis (passagemath) | Requires Python \u003e= 3.11 and native build tools. Falls back to system SageMath if passagemath is not installed. |\n| `[gurobi]` | Gurobi MILP | Requires a Gurobi license |\n| `[all]` | All of the above | |\n\n**System dependencies** (not installed by pip):\n\n- **Python development headers** (required for `[groebner]` / `[all]`): `sudo apt install python3-dev` (Debian/Ubuntu) / `sudo dnf install python3-devel` (Fedora) — needed to build native extensions like `cysignals`\n- **MiniZinc binary**: Run `autoguess --install-minizinc` to auto-download, or install via your package manager (`brew install minizinc` / `snap install minizinc --classic`)\n- **Graphviz binary** (optional, for visualization rendering): `brew install graphviz` / `apt install graphviz`\n\n#### Method 2: Build Docker Image Locally\n\nThe easiest way is using the provided [Dockerfile](docker/DockerfileDebian) to get Autoguess and all of its dependencies at once. To do so, regardless of what OS you use:\n\n1. **Install Docker**: Follow the [Docker installation guide](https://docs.docker.com/get-docker/) for your platform\n2. **Clone this repository**:\n\n ```sh\n git clone https://github.com/hadipourh/autoguess.git\n cd autoguess\n ```\n3. **Build the Docker image**: Navigate to the directory where you cloned the repository and build a local image of Autoguess:\n\n ```sh\n docker build --platform linux/amd64 -t autoguess -f docker/DockerfileDebian .\n ```\n4. **Run Autoguess**: Once built, you can run Autoguess using the following commands:\n\n ##### For ARM64 (Apple Silicon)\n\n\n ```sh\n docker run --platform linux/amd64 -it --rm autoguess\n ```\n\n ##### For x86_64 (Most Linux Systems)\n\n ```sh\n docker run -it --rm autoguess\n ```\n\nThe provided image is self-contained and includes MiniZinc, PySAT, pySMT, and SageMath. While Autoguess also offers a direct Python interface to [Gurobi](https://www.gurobi.com/), Gurobi itself and its license are not included in the image. If you wish to use the MILP-based method to solve the guess-and-determine problem, you will need to install Gurobi separately. For Linux and macOS, you can use the installer available in [this repository](https://github.com/hadipourh/grabgurobi).\n\nOne can also build an image of Autoguess with the [DockerfileArch](docker/DockerfileArch) which is based on the [Arch Linux](https://archlinux.org/) distribution. To do so, you can use the following command:\n\n```sh\ndocker build -f docker/DockerfileArch -t autoguess_arch .\n```\n\nThen, you can run Autoguess by the following command:\n\n```sh\ndocker run --rm -it autoguess_arch\n```\n\n#### Method 3: Use Pre-built Docker Image\n\nIf you have already installed [Docker](https://www.docker.com/) and prefer to use a pre-built image instead of building locally, you can download a prebuilt image of Autoguess from [Docker Hub](https://hub.docker.com/):\n\n**For Debian-based image:**\n\n```sh\ndocker pull hoseinhadipour/autoguess\n```\n\nThen run Autoguess:\n\n```sh\ndocker run --rm -it hoseinhadipour/autoguess\n```\n\n**For Arch Linux-based image:**\n\n```sh\ndocker pull hoseinhadipour/autoguess_arch\n```\n\nThen run Autoguess:\n\n```sh\ndocker run --rm -it hoseinhadipour/autoguess_arch\n```\n\n#### Method 4: Native Installation (Debian-based and macOS)\n\nFor Debian-based Linux operating systems, you can install Autoguess natively using the provided installer script:\n\n```bash\ngit clone https://github.com/hadipourh/autoguess.git\ncd autoguess\nbash installer.sh\n```\n\nFor macOS users, you can also use the installer script, but you will need to install [Homebrew](https://brew.sh/) first. After installing Homebrew, you can use the provided installer script:\n\n```bash\nchmod +x installer_macos.sh\n./installer_macos.sh\n```\n\n**Note**: This method requires manually installing all dependencies. Review the [requirements.txt](requirements.txt) file for the complete list of Python dependencies.\n\n---\n\n## Quick Start\n\nOnce you have Autoguess installed, you can quickly test it with one of the provided examples:\n\n```bash\n# If installed via pip\nautoguess --inputfile ciphers/Example1/relationfile.txt --solver cp --maxsteps 5\n\n# Using Docker (pre-built)\n1- docker run --rm -it hoseinhadipour/autoguess\n2- python3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver cp --maxsteps 5\n\n# Or if you built Docker locally\n1- docker run --rm -it autoguess\n2- python3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver cp --maxsteps 5\n\n# Or if installed natively via scripts\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver cp --maxsteps 5\n```\n\nThis should output something like:\n\n```text\nNumber of guesses: 2\nNumber of known variables in the final state: 7 out of 7\nThe following 2 variable(s) are guessed:\nv, u\n```\n\n---\n\n## Format of Input File\n\nThe input file can be a plain text separated into the following parts:\n\n- Algebraic relations. This section begins with `algebraic relations` and includes the algebraic relations (currently the algebraic relations over GF(2) are merely supported).\n- Connection relations. This section begins with `connection relations` and includes the connections relations consisting of symmetric or implication relations.\n- Known variables. This section begins with `known` key word under which all known variables are specified.\n- Target variables. This section begins with `target` key word under which all target variables are specified.\n- The input file must be ended with a line including the `end` key word.\n- The lines starting with `#` character are interpreted as comments.\n\nThe following example, represents the overall structure of an input file.\n\n```text\n# Sample input file\nalgebraic relations\nX1*X4 + X2*X5 + X1 + X3 + X4\nX2*X3 + X1*X6 + X3*X4 + X1 \nX1*X4 + X1*X5 + X3 + X4 + X6\nX5*X6 + X4*X3 + X2\nconnection relations\nX3, X5, X2\nX1, X2, X4, X6 =\u003e X5\nknown\nX2\ntarget\nX1\nX3\nX4\nX5\nX6\nend\n```\n\nYou can find many other input files inside the [ciphers](ciphers) folder. Moreover, Autoguess supports system of relations including variables with different weights when the SAT or MILP solvers are used. [Example5](#example-5) and [ZUC](#gd-attack-on-zuc) are two example where the system of relations includes variables with different weights.\n\n---\n\n## Usage\n\n### Command Line Interface\n\nYou can access a brief help for Autoguess by running:\n\n```bash\npython3 autoguess.py -h\n```\n\n```text\nusage: autoguess.py [-h] [-i INPUTFILE] [-o OUTPUTFILE] [-mg MAXGUESS] [-ms MAXSTEPS] [-s {cp,milp,sat,smt,groebner,propagate}] [-milpd {min,max}]\n [-cps {mip,float,api,osicbc,coinbc,cbc,org.minizinc.mip.coin-bc,coin-bc,org.minizinc.mip.cplex,cplex,org.minizinc.mip.gurobi,gurobi,highs,org.minizinc.mip.highs,cp-sat,cp,lcg,int,org.minizinc.mip.scip,scip,org.minizinc.mip.xpress,xpress}]\n [-sats {cadical103,cadical153,cadical195,cryptosat,gluecard3,gluecard4,glucose3,glucose4,glucose42,lingeling,maplechrono,maplecm,maplesat,mergesat3,minicard,minisat22,minisatgh}]\n [-smts {btor,cvc5,z3}] [-cpopt {0,1}] [-tl TIMELIMIT] [-tk TIKZ] [-prep PREPROCESS] [-D D] [-tord TERM_ORDERING] [-oln OVERLAPPING_NUMBER] [-cnf2anf {simple,blockwise}]\n [-dgl {dot,circo,twopi,fdp,neato,nop,nop1,nop2,osage,patchwork,sfdp}] [-log {0,1}] [--nograph] [--findmin] [--install-minizinc] [-kn KNOWN] [-V]\n\nThis tool automates the Guess-and-Determine and Key-Bridging techniques using a variety of CP, MILP, SMT and SAT solvers, as well as the algebraic method based on Groebner basis\n\noptions:\n -h, --help show this help message and exit\n -i, --inputfile INPUTFILE\n Use an input file in plain text format\n -o, --outputfile OUTPUTFILE\n Use an output file to write the output into it\n -mg, --maxguess MAXGUESS\n An upper bound for the number of guessed variables\n -ms, --maxsteps MAXSTEPS\n An integer number specifying the depth of search\n -s, --solver {cp,milp,sat,smt,groebner,propagate}\n Solver choice\n -milpd, --milpdirection {min,max}\n MILP direction\n -cps, --cpsolver {mip,float,api,osicbc,coinbc,cbc,org.minizinc.mip.coin-bc,coin-bc,org.minizinc.mip.cplex,cplex,org.minizinc.mip.gurobi,gurobi,highs,org.minizinc.mip.highs,cp-sat,cp,lcg,int,org.minizinc.mip.scip,scip,org.minizinc.mip.xpress,xpress}\n CP solver choice\n -sats, --satsolver {cadical103,cadical153,cadical195,cryptosat,gluecard3,gluecard4,glucose3,glucose4,glucose42,lingeling,maplechrono,maplecm,maplesat,mergesat3,minicard,minisat22,minisatgh}\n SAT solver choice\n -smts, --smtsolver {btor,cvc5,z3}\n SMT solver choice\n -cpopt, --cpoptimization {0,1}\n CP optimization\n -tl, --timelimit TIMELIMIT\n Time limit for the search in seconds\n -tk, --tikz TIKZ Generate the tikz code of the determination flow graph\n -prep, --preprocess PREPROCESS\n Enable the preprocessing phase\n -D, --D D Degree of Macaulay matrix generated in preprocessing phase\n -tord, --term_ordering TERM_ORDERING\n Term ordering such as 'degrevlex' or 'deglex'\n -oln, --overlapping_number OVERLAPPING_NUMBER\n Overlapping number in block-wise CNF to ANF conversion\n -cnf2anf, --cnf_to_anf_conversion {simple,blockwise}\n CNF to ANF conversion method\n -dgl, --dglayout {dot,circo,twopi,fdp,neato,nop,nop1,nop2,osage,patchwork,sfdp}\n Layout of determination flow graph\n -log, --log {0,1} Store intermediate generated files and results\n --nograph Skip generating the determination flow graph (faster)\n --findmin Iteratively decrease max_guess to find the minimum number of guesses (SAT/SMT only)\n --install-minizinc Download and install MiniZinc binary to ~/.autoguess/minizinc/\n -kn, --known KNOWN Comma-separated list of initially known variables (for 'propagate' solver)\n -V, --version show program's version number and exit\n```\n\nHere we also provide some examples to show how our tool can easily be used to find a minimal guess basis.\n\n### Example 1\n\nIn this example, given a system of symmetric relations we use Autoguess to find a minimal guess basis. The input file of this example is located in [Example1](./ciphers/Example1/relationfile.txt) which includes the following content:\n\n```text\nconnection relations\nx, s, v\nx, u, s, y, z\nv, u, s\nz, s, v, t\nu, t, x\nend\n```\n\n***CP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver cp --maxsteps 5 --dglayout circo\n```\n\nTerminal output:\n\n```text\nNumber of guessed variables is set to be at most 7\n============================================================\nCP SOLVER — Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\n============================================================\nVariables: 7 | Relations: 5\nMax guess: 7 | Max steps: 5\nSolver: cp-sat\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nCP model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.29 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (2):\n v\n u\n============================================================\n```\n\nAutoguess also generates the following graph visualizing the determination flow:\n\n![example1_dg](ciphers/Example1/Shapes/example1_dg.svg)\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver groebner\n```\n\nTerminal output:\n\n```text\n============================================================\nGRÖBNER BASIS SOLVER — Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\n============================================================\nVariables: 7 | Relations: 5\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 7 variables ...\nRing constructed in 0.00 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.00 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nANF representation generated in 0.00 seconds\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\n------------------------------------------------------------\nGuessed variable(s) (2):\n u\n y\n============================================================\n```\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver sat --maxguess 2 --maxsteps 5\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\n============================================================\nVariables: 7 | Relations: 5\nMax guess: 2 | Max steps: 5\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (2):\n x\n s\n============================================================\n```\n\nNow, we try to find the minimum number of guesses by using the `--findmin` switch. This will reduce the optimization problem (COP) into a sequence of decision problems (CSP) and solve them using SAT solvers. So, it may take more time to find the minimum number of guesses compared to finding some bounds on the number of guesses using SAT solvers.\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver sat --findmin \n```\n\nTerminal output:\n\n```text\nFIND-MIN MODE: searching for minimum guesses (starting from 7)\n============================================================\n max_guess = 7: SAT — a guess basis of size 7 exists (0.00s)\n max_guess = 6: SAT — a guess basis of size 6 exists (0.00s)\n max_guess = 5: SAT — a guess basis of size 5 exists (0.00s)\n max_guess = 4: SAT — a guess basis of size 4 exists (0.00s)\n max_guess = 3: SAT — a guess basis of size 2 exists (0.00s)\n max_guess = 2: SAT — a guess basis of size 2 exists (0.00s)\n max_guess = 1: UNSAT (0.00s)\n\n############################################################\nFIND-MIN RESULT: minimum number of guesses = 2\nTotal findmin time: 0.00s\n############################################################\n\nRe-solving with max_guess = 2 for detailed output ...\n\n(Note: the timings below are for this single verification\n solve only, not for the entire findmin search.)\n\n============================================================\nSAT SOLVER — Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\n============================================================\nVariables: 7 | Relations: 5\nMax guess: 2 | Max steps: 7\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 7 / 7\nMax steps used: 7\n------------------------------------------------------------\nGuessed variable(s) (2):\n x, s\n============================================================\n\nTotal findmin search time: 0.00s\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver smt --maxguess 2 --maxsteps 5\n```\n\nTerminal output:\n\n```text\n============================================================\nSMT SOLVER — Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\n============================================================\nVariables: 7 | Relations: 5\nMax guess: 2 | Max steps: 5\nSolver: z3\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 0.01 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (2):\n x\n v\n============================================================\n```\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example1/relationfile.txt --solver milp --maxsteps 5\n```\n\nTerminal output:\n\n```text\nGenerating the MILP model ...\nMILP model was generated after 0.00 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg50_ms5_min_5d734ea45aa1173beb95c81f6cbc98.lp\nReading time = 0.00 seconds\n: 287 rows, 167 columns, 1084 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 287 rows, 167 columns and 1084 nonzeros (Min)\nModel fingerprint: 0x0de8c583\nModel has 7 linear objective coefficients\nVariable types: 0 continuous, 167 integer (167 binary)\nCoefficient statistics:\n Matrix range [1e+00, 5e+00]\n Objective range [1e+00, 1e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 5e+01]\n\nFound heuristic solution: objective 7.0000000\nPresolve removed 90 rows and 67 columns\nPresolve time: 0.01s\nPresolved: 197 rows, 100 columns, 802 nonzeros\nVariable types: 0 continuous, 100 integer (100 binary)\n\nRoot relaxation: objective 2.516199e-02, 119 iterations, 0.00 seconds (0.00 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n 0 0 0.02516 0 75 7.00000 0.02516 100% - 0s\nH 0 0 2.0000000 0.02516 98.7% - 0s\n 0 0 1.00000 0 55 2.00000 1.00000 50.0% - 0s\n\nCutting planes:\n Gomory: 2\n Cover: 6\n Clique: 6\n MIR: 2\n RLT: 12\n BQP: 6\n\nExplored 1 nodes (245 simplex iterations) in 0.02 seconds (0.02 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 2: 2 7 \n\nOptimal solution found (tolerance 1.00e-04)\nBest objective 2.000000000000e+00, best bound 2.000000000000e+00, gap 0.0000%\nSolving process was finished after 0.02 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (2):\n x\n v\n============================================================\n```\n\n***Propagate***\n\nThe `propagate` solver does not search for a minimal guess basis. Instead, given a set of initially known variables (via `-kn`), it iteratively deduces new variables using the relations until no further progress can be made. This is useful for quickly checking how far a particular guess set can reach.\n\n```sh\nautoguess --inputfile ciphers/Example1/relationfile.txt --solver propagate --known \"u,v\"\n```\n\nTerminal output:\n\n```text\n============================================================\nKnowledge propagation started - 2026-02-23 22:29:19.842286\nProblem: Taken from https://doi.org/10.1007/978-3-642-00862-7_11: Speeding up Collision Search for Byte-Oriented Hash Functions\nTotal variables: 7\nTotal relations: 5 (symmetric: 5, implication: 0)\nInitially known variables: 2\n u, v\n============================================================\n\nIteration 1: learned 1 new variable(s)\n s \u003c-- [v, u, s]\n\nIteration 2: learned 1 new variable(s)\n x \u003c-- [x, s, v]\n\nIteration 3: learned 1 new variable(s)\n t \u003c-- [u, t, x]\n\nIteration 4: learned 1 new variable(s)\n z \u003c-- [z, s, v, t]\n\nIteration 5: learned 1 new variable(s)\n y \u003c-- [x, u, s, y, z]\n\n============================================================\nPROPAGATION SUMMARY\n============================================================\nTotal iterations: 5\nInitially known: 2\nNewly learned: 5\nTotal known after prop.: 7 / 7\nUnreachable variables: 0\nTarget variables covered: 7 / 7\nElapsed time: 0.0001 seconds\n============================================================\n```\n\n### Example 2\n\nIn this example we specify a subset of variables as the target and known variables. Note that, if you don't specify any target variable, Autoguess considers all variables as the target variables. You can find the input file of this example in [Example2](./ciphers/Example2) which includes the following contents:\n\n```text\nconnection relations\nu, v, x, y, z\nu, w, y, z\nw, x, y, z\nu, w, z\nu, w =\u003e t\nt, z, v\ntarget\nu\nv\nx\nknown\nw\nend\n```\n\n***CP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example2/example2.txt --solver cp --maxsteps 5 --dglayout circo\n```\n\nTerminal output:\n\n```text\nNumber of guessed variables is set to be at most 7\n============================================================\nCP SOLVER — Example of our paper\n============================================================\nVariables: 7 | Relations: 6\nMax guess: 7 | Max steps: 5\nSolver: cp-sat\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nCP model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.27 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n u\n============================================================\n```\n\n![example2_dg](ciphers/Example2/Shapes/example2_dg.svg)\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example2/example2.txt --solver groebner\n```\n\nTerminal output:\n\n```text\n============================================================\nGRÖBNER BASIS SOLVER — Example of our paper\n============================================================\nVariables: 7 | Relations: 6\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 7 variables ...\nRing constructed in 0.00 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.00 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nANF representation generated in 0.00 seconds\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\n------------------------------------------------------------\nGuessed variable(s) (1):\n x\n============================================================\n```\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example2/example2.txt --solver sat --maxguess 1 --maxsteps 5\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — Example of our paper\n============================================================\nVariables: 7 | Relations: 6\nMax guess: 1 | Max steps: 5\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n u\n============================================================\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example2/example2.txt --solver smt --maxguess 1 --maxsteps 5\n```\n\nTerminal output:\n\n```text\n============================================================\nSMT SOLVER — Example of our paper\n============================================================\nVariables: 7 | Relations: 6\nMax guess: 1 | Max steps: 5\nSolver: z3\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 0.01 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n z\n============================================================\n```\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example2/example2.txt --solver milp --maxsteps 5\n```\n\nTerminal output:\n\n```text\nGenerating the MILP model ...\nMILP model was generated after 0.00 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg50_ms5_min_493b0329677a8e4da2a20c8408b175.lp\nReading time = 0.00 seconds\n: 308 rows, 177 columns, 1200 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 308 rows, 177 columns and 1200 nonzeros (Min)\nModel fingerprint: 0xbd74212b\nModel has 6 linear objective coefficients\nVariable types: 0 continuous, 177 integer (177 binary)\nCoefficient statistics:\n Matrix range [1e+00, 6e+00]\n Objective range [1e+00, 1e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 5e+01]\n\nFound heuristic solution: objective 6.0000000\nPresolve removed 215 rows and 130 columns\nPresolve time: 0.00s\nPresolved: 93 rows, 47 columns, 352 nonzeros\nVariable types: 0 continuous, 47 integer (47 binary)\n\nRoot relaxation: objective 1.269841e-01, 39 iterations, 0.00 seconds (0.00 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n 0 0 0.12698 0 30 6.00000 0.12698 97.9% - 0s\nH 0 0 3.0000000 0.12698 95.8% - 0s\nH 0 0 1.0000000 0.12698 87.3% - 0s\n 0 0 0.12698 0 30 1.00000 0.12698 87.3% - 0s\n\nExplored 1 nodes (41 simplex iterations) in 0.01 seconds (0.01 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 3: 1 3 6 \n\nOptimal solution found (tolerance 1.00e-04)\nBest objective 1.000000000000e+00, best bound 1.000000000000e+00, gap 0.0000%\nSolving process was finished after 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 7 / 7\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n z\n============================================================\n```\n\n### Example 3\n\nIn this example, we show the application of Autoguess to discover the possible early abortion techniques. The input file of this example is located in [Example3](./ciphers/Example3/relationfile.txt) which includes the following contents:\n\n```text\n# Example to describe the early abortion technique\n# (x0 \u003c\u003c\u003c 3) + S(x1) + x2 = 0\n# S(x0) + S(x2) + (x5 \u003c\u003c\u003c 2) = 0\n# L(x1 + x2) + x5 = 0\n# x2 + L(x3) = 0\n# S(x3 * S(x1 * x4)) + L(x0) + x6 = 0\n# (S(x4) xor L(x6)) + x3 = 0\nconnection relations\nx0, x1, x2\nx0, x2, x5\nx1, x2, x5\nx2, x3\nx3, x1, x4 =\u003e t\nt, x0, x6\nx4, x6, x3\n#known\n#x0\n#x4\n#x5\nend\n```\n\nWe emphasize that the lines starting with `#` are considered as comments.\n\n***CP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example3/relationfile.txt --solver cp --maxguess 5\n```\n\nTerminal output:\n\n```text\n============================================================\nCP SOLVER — Example to describe the early abortion technique\n============================================================\nVariables: 8 | Relations: 7\nMax guess: 5 | Max steps: 5\nSolver: cp-sat\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nCP model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.20 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (3):\n x1\n x5\n t\n============================================================\n```\n\nThe following graph represents the determination flow in the discovered GD attack.\n\n![example3_dg](ciphers/Example3/Shapes/example3_dg.svg)\n\nThe full content of the output file generated by Autoguess is as follows which includes many useful information guiding the user to find possible early abortion techniques:\n\n```text\nNumber of relations: 7\nNumber of variables: 8\nNumber of target variables: 8\nNumber of known variables: 0\nNumber of guessed variables: 3\nNumber of state copies (max_steps): 5\nAn upper bound for the number of guessed variables given by user (max_guess): 5\n8 out of 8 state variables are known after 5 state copies\n############################################################\nThe following 3 variable(s) are guessed:\nx1, x5, t\n############################################################\nThe following 0 variable(s) are initially known:\n\n############################################################\nTarget variables:\nx0, x1, x2, x5, x3, x4, t, x6\n############################################################\nDetermination flow:\n\nState 0:\nx1, x5 in symmetric relation [x1, x2, x5] are known: x1, x5 ===\u003e x2\n############################################################\nState 1:\nx1, x2 in symmetric relation [x0, x1, x2] are known: x1, x2 ===\u003e x0\nx2, x5 in symmetric relation [x0, x2, x5] are known: x2, x5 ===\u003e x0\nx2 in symmetric relation [x2, x3] are known: x2 ===\u003e x3\n############################################################\nState 2:\nt, x0 in symmetric relation [t, x0, x6] are known: t, x0 ===\u003e x6\n############################################################\nState 3:\nx6, x3 in symmetric relation [x4, x6, x3] are known: x6, x3 ===\u003e x4\n############################################################\nThe following variables are known in final state:\nx0, x1, x2, x5, x3, x4, t, x6\n############################################################\nThe following relations have not been used in determination (they might be used to check the correctness of guesses):\nx3, x1, x4 =\u003e t\n############################################################\nThe following variables can be deduced from multiple paths:\n\nx0 can be deduced from:\nx0, x1, x2\nx0, x2, x5\n```\n\nThe first lines give a brief description of the input. The main body, describes how the remaining variables can be deduced from the guessed variables. As you can see, three steps (state copies) are sufficient to determine all of the variables. According to the last two lines of the output files, `x0` can be deduced from two different equations, i.e., `(x0 \u003c\u003c\u003c 3) + S(x1) + x2 = 0` and `S(x0) + S(x2) + (x5 \u003c\u003c\u003c 2) = 0`. By the way, according to the determination flow, `x0` is determined before guessing `t`. Hence, a portion of wrong values for the two guessed variables, namely, `x1, x5` can be detected and excluded from the search space before guessing `x0` which results in a GD attack with less time complexity by a factor of `2^|x0|`.\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example3/relationfile.txt --solver groebner\n```\n\nTerminal output:\n\n```text\n============================================================\nGRÖBNER BASIS SOLVER — Example to describe the early abortion technique\n============================================================\nVariables: 8 | Relations: 7\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 8 variables ...\nRing constructed in 0.00 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.00 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nANF representation generated in 0.00 seconds\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\n------------------------------------------------------------\nGuessed variable(s) (3):\n x0\n x1\n x2\n============================================================\n```\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example3/relationfile.txt --solver sat --maxguess 3 --maxsteps 3\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — Example to describe the early abortion technique\n============================================================\nVariables: 8 | Relations: 7\nMax guess: 3 | Max steps: 3\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 3\n------------------------------------------------------------\nGuessed variable(s) (3):\n x3\n x4\n t\n============================================================\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example3/relationfile.txt --solver smt --smtsolver z3 --maxguess 3 --maxsteps 3\n```\n\nTerminal output:\n\n```text\n============================================================\nSMT SOLVER — Example to describe the early abortion technique\n============================================================\nVariables: 8 | Relations: 7\nMax guess: 3 | Max steps: 3\nSolver: z3\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 0.01 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 3\n------------------------------------------------------------\nGuessed variable(s) (3):\n x1\n x2\n x4\n============================================================\n```\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example3/relationfile.txt --solver milp --maxsteps 3\n```\n\nTerminal output:\n\n```text\nGenerating the MILP model ...\nMILP model was generated after 0.00 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg50_ms3_min_c74688273c88de841250efd06ea0d9.lp\nReading time = 0.00 seconds\n: 176 rows, 110 columns, 574 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 176 rows, 110 columns and 574 nonzeros (Min)\nModel fingerprint: 0x7dfef622\nModel has 8 linear objective coefficients\nVariable types: 0 continuous, 110 integer (110 binary)\nCoefficient statistics:\n Matrix range [1e+00, 5e+00]\n Objective range [1e+00, 1e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 5e+01]\n\nFound heuristic solution: objective 8.0000000\nPresolve removed 94 rows and 66 columns\nPresolve time: 0.00s\nPresolved: 82 rows, 44 columns, 286 nonzeros\nVariable types: 0 continuous, 44 integer (44 binary)\n\nRoot relaxation: objective 4.130435e-01, 49 iterations, 0.00 seconds (0.00 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n 0 0 0.41304 0 29 8.00000 0.41304 94.8% - 0s\nH 0 0 3.0000000 0.41304 86.2% - 0s\n 0 0 1.14286 0 28 3.00000 1.14286 61.9% - 0s\n 0 0 2.00000 0 31 3.00000 2.00000 33.3% - 0s\n\nCutting planes:\n Gomory: 4\n Cover: 19\n Clique: 6\n MIR: 1\n Zero half: 3\n RLT: 14\n Relax-and-lift: 5\n\nExplored 1 nodes (110 simplex iterations) in 0.02 seconds (0.01 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 2: 3 8 \n\nOptimal solution found (tolerance 1.00e-04)\nBest objective 3.000000000000e+00, best bound 3.000000000000e+00, gap 0.0000%\nSolving process was finished after 0.02 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 3\n------------------------------------------------------------\nGuessed variable(s) (3):\n x0\n x5\n t\n============================================================\n```\n\n### Example 4\n\nIn this example, we aim to show the advantage of preprocessing phase when some algebraic relations are included in the input file. The input file of this example which is located in [Example4](./ciphers/Example4/algebraic_relations.txt) includes the following quadratic equations over `GF(2)`:\n\n```text\nalgebraic relations\nX1*X3 + X2*X4 + X1 + X3 + X4\nX2*X3 + X1*X4 + X3*X4 + X1 + X2 + X4\nX2*X4 + X3*X4 + X1 + X3 + 1\nX1*X2 + X1*X3 + X2*X3 + X3 + X4 + 1\nX1*X2 + X2*X3 + X1*X4 + X3\nX1*X3 + X1*X4 + X3*X4 + X1 + X2 + X3 + X4\nX1*X2 + X2*X4 + X1 + 1\nend\n```\n\n***CP***\n\nThe preprocessor of Autoguess is enabled by default and to disable it you can use `--preprocess 0` in front of your command when you call Autoguess. To adjust the degree of preprocessing phase you can use this switch `--D \u003cyour favorite degree, e.g., 2\u003e`. For example in the following command, we apply the preprocessing phase of Autoguess with degree of 2.\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver cp --maxsteps 10 --preprocess 1 --D 2 --dglayout circo\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 7 by 11 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:44:51.835018\n#Dependent variables: 7\n#Free variables: 3\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_676e0e7043290f519ee6de0bac1b84.txt - 2026-02-23 22:44:51.835115\nResult was written into temp/macaulay_basis_676e0e7043290f519ee6de0bac1b84.txt after 0.00 seconds\nPreprocessing finished in 1.4718 seconds\nNumber of guessed variables is set to be at most 10\n============================================================\nCP SOLVER — gdproblem\n============================================================\nVariables: 10 | Relations: 19\nMax guess: 10 | Max steps: 10\nSolver: cp-sat\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nCP model generated in 0.01 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.26 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 2\nKnown in final state: 10 / 10\nMax steps used: 10\n------------------------------------------------------------\nGuessed variable(s) (2):\n X2\n X4\n============================================================\n```\n\n![example4_dg_D2](ciphers/Example4/Shapes/example4_dg_D2.svg)\n\nNext, we call Autoguess with preprocessing of degree 3 to get a better result.\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver cp --maxsteps 10 --preprocess 1 --D 3 --dglayout circo\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 35 by 15 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:46:12.429585\n#Dependent variables: 13\n#Free variables: 1\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_88e597205e4bd22daf4ee4c083f4dc.txt - 2026-02-23 22:46:12.429697\nResult was written into temp/macaulay_basis_88e597205e4bd22daf4ee4c083f4dc.txt after 0.00 seconds\nPreprocessing finished in 1.5163 seconds\nNumber of guessed variables is set to be at most 14\n============================================================\nCP SOLVER — gdproblem\n============================================================\nVariables: 14 | Relations: 24\nMax guess: 14 | Max steps: 10\nSolver: cp-sat\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nCP model generated in 0.01 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.30 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 14 / 14\nMax steps used: 10\n------------------------------------------------------------\nGuessed variable(s) (1):\n X2\n============================================================\n```\n\n![example4_dg_D3](ciphers/Example4/Shapes/example4_dg_D3.svg)\n\nThe [Tikz](https://en.wikibooks.org/wiki/LaTeX/PGF/TikZ) code of the determination graph can also be generated by putting `--tikz 1` in front of your command when you call Autoguess.\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver groebner --preprocess 1 --D 3\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 35 by 15 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:47:05.293590\n#Dependent variables: 13\n#Free variables: 1\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_7f40767192abe937548909a93544f6.txt - 2026-02-23 22:47:05.293753\nResult was written into temp/macaulay_basis_7f40767192abe937548909a93544f6.txt after 0.00 seconds\nPreprocessing finished in 0.0808 seconds\n============================================================\nGRÖBNER BASIS SOLVER — gdproblem\n============================================================\nVariables: 14 | Relations: 24\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 14 variables ...\nRing constructed in 0.00 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.00 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nANF representation generated in 0.00 seconds\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\n------------------------------------------------------------\nGuessed variable(s) (1):\n X3\n============================================================\n```\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver sat --maxguess 1 --maxsteps 5 --preprocess 1 --D 3\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 35 by 15 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:47:55.291771\n#Dependent variables: 13\n#Free variables: 1\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_c918ac2c862f0bfbd05f830067a239.txt - 2026-02-23 22:47:55.291903\nResult was written into temp/macaulay_basis_c918ac2c862f0bfbd05f830067a239.txt after 0.00 seconds\nPreprocessing finished in 1.5456 seconds\n============================================================\nSAT SOLVER — gdproblem\n============================================================\nVariables: 14 | Relations: 24\nMax guess: 1 | Max steps: 5\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 14 / 14\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n X2\n============================================================\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver smt --maxguess 1 --maxsteps 5 --preprocess 1 --D 3\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 35 by 15 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:48:10.731367\n#Dependent variables: 13\n#Free variables: 1\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_41304864ec176a77963f8daabe4832.txt - 2026-02-23 22:48:10.731486\nResult was written into temp/macaulay_basis_41304864ec176a77963f8daabe4832.txt after 0.00 seconds\nPreprocessing finished in 1.6922 seconds\n============================================================\nSMT SOLVER — gdproblem\n============================================================\nVariables: 14 | Relations: 24\nMax guess: 1 | Max steps: 5\nSolver: z3\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 0.03 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 14 / 14\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n VULX1x3 (represents: X2 * X4)\n============================================================\n```\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example4/algebraic_relations.txt --solver milp --maxsteps 5 --preprocess 1 --D 3\n```\n\nTerminal output:\n\n```text\n------------------------------------------------------------\nPREPROCESSING (Macaulay matrix)\n------------------------------------------------------------\nNumber of algebraic equations: 7\nNumber of algebraic variables: 4\nNumber of algebraic monomials: 11\nSpectrum of degrees: [2]\nMacaulay matrix was generated in full matrixspace of 35 by 15 sparse matrices over finite field of size 2\nGaussian elimination was started - 2026-02-23 22:48:29.854185\n#Dependent variables: 13\n#Free variables: 1\nGaussian elimination was finished after 0.00 seconds\nWriting the results into the temp/macaulay_basis_170a23f2bde01f3bbf6fb967d3c415.txt - 2026-02-23 22:48:29.854295\nResult was written into temp/macaulay_basis_170a23f2bde01f3bbf6fb967d3c415.txt after 0.00 seconds\nPreprocessing finished in 1.6932 seconds\nGenerating the MILP model ...\nMILP model was generated after 0.00 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg50_ms5_min_11d3a43ee22ec0813703f97835cb8d.lp\nReading time = 0.00 seconds\n: 728 rows, 444 columns, 3268 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 728 rows, 444 columns and 3268 nonzeros (Min)\nModel fingerprint: 0xc1841a82\nModel has 8 linear objective coefficients\nVariable types: 0 continuous, 444 integer (444 binary)\nCoefficient statistics:\n Matrix range [1e+00, 1e+01]\n Objective range [1e+00, 1e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 5e+01]\n\nFound heuristic solution: objective 8.0000000\nPresolve removed 687 rows and 417 columns\nPresolve time: 0.01s\nPresolved: 41 rows, 27 columns, 208 nonzeros\nVariable types: 0 continuous, 27 integer (27 binary)\nFound heuristic solution: objective 7.0000000\n\nRoot relaxation: objective 1.000000e+00, 1 iterations, 0.00 seconds (0.00 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n* 0 0 0 1.0000000 1.00000 0.00% - 0s\n\nExplored 1 nodes (1 simplex iterations) in 0.01 seconds (0.01 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 3: 1 7 8 \n\nOptimal solution found (tolerance 1.00e-04)\nBest objective 1.000000000000e+00, best bound 1.000000000000e+00, gap 0.0000%\nSolving process was finished after 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 1\nKnown in final state: 14 / 14\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (1):\n AADO0x2x3 (represents: X1 * X3 * X4)\n============================================================\n```\n\n### Example 5\n\nIn this example, we show how to build an input file consisting of variables with different weights. The input file of this example is located in [Example5](./ciphers/Example5/example5.txt) which includes the following contents:\n\n```text\nconnection relations\nx0, x1, x2\nx0, x2, x5\nx1, x2, x5\nx2, x3\nx3, x1, x4 =\u003e t\nt, x0, x6\nx4, x6, x3\nweights\nx0 1\nx1 2\nx2 1\nx3 3\nx4 1\nx5 2\nx6 3\nt 2\nend\n```\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example5/example5.txt --solver sat --maxguess 3 --maxsteps 5 --dglayout circo\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — gdproblem\n============================================================\nVariables: 8 | Relations: 7\nMax guess: 3 | Max steps: 5\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.00 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.00 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 5\n------------------------------------------------------------\nGuessed variable(s) (3):\n x0\n x2\n x4\n============================================================\n```\n\nAs it can be seen, the variables with minimum weights have been chosen as the guess basis.\n\n![example5_dg](ciphers/Example5/Shapes/example5_dg.svg)\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example5/example5.txt --solver milp --maxsteps 3\n```\n\nTerminal output:\n\n```text\nGenerating the MILP model ...\nMILP model was generated after 0.00 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg50_ms3_min_9b386bd93e4ea29a7a452cd33c9180.lp\nReading time = 0.00 seconds\n: 176 rows, 110 columns, 574 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 176 rows, 110 columns and 574 nonzeros (Min)\nModel fingerprint: 0xaa75b0d7\nModel has 8 linear objective coefficients\nVariable types: 0 continuous, 110 integer (110 binary)\nCoefficient statistics:\n Matrix range [1e+00, 5e+00]\n Objective range [1e+00, 3e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 5e+01]\n\nFound heuristic solution: objective 15.0000000\nPresolve removed 94 rows and 66 columns\nPresolve time: 0.00s\nPresolved: 82 rows, 44 columns, 286 nonzeros\nVariable types: 0 continuous, 44 integer (44 binary)\n\nRoot relaxation: objective 4.503817e-01, 49 iterations, 0.00 seconds (0.00 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n 0 0 0.45038 0 30 15.00000 0.45038 97.0% - 0s\nH 0 0 6.0000000 0.45038 92.5% - 0s\nH 0 0 4.0000000 0.45038 88.7% - 0s\nH 0 0 3.0000000 0.45038 85.0% - 0s\n\nCutting planes:\n Gomory: 1\n Cover: 4\n Clique: 4\n MIR: 2\n Flow cover: 2\n Zero half: 2\n RLT: 11\n Relax-and-lift: 2\n\nExplored 1 nodes (53 simplex iterations) in 0.01 seconds (0.00 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 4: 3 4 6 15 \n\nOptimal solution found (tolerance 1.00e-04)\nBest objective 3.000000000000e+00, best bound 3.000000000000e+00, gap 0.0000%\nSolving process was finished after 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 3\nKnown in final state: 8 / 8\nMax steps used: 3\n------------------------------------------------------------\nGuessed variable(s) (3):\n x0\n x2\n x4\n============================================================\n```\n\n### Example 6\n\nIn this example, we try to analyze a toy stream cipher which its keystream generation phase works based on the following state machine:\n\n```text\nfor i = 0 ... N:\n x_0_i+1 \u003c--- f0(x_6_i, x_7_i \u003c\u003c\u003c 16)\n x_1_i+1 \u003c--- f1(x_7_i, x_0_i \u003c\u003c\u003c 8)\n x_2_i+1 \u003c--- f2(x_0_i, x_1_i \u003c\u003c\u003c 16)\n x_3_i+1 \u003c--- f3(x_1_i, x_2_i \u003c\u003c\u003c 8)\n x_4_i+1 \u003c--- f4(x_2_i, x_3_i \u003c\u003c\u003c 16)\n x_5_i+1 \u003c--- f5(x_3_i, x_4_i \u003c\u003c\u003c 8)\n x_6_i+1 \u003c--- f6(x_4_i, x_5_i \u003c\u003c\u003c 16)\n x_7_i+1 \u003c--- f7(x_5_i, x_6_i \u003c\u003c\u003c 8)\n z_i+1 \u003c--- g(x_7_i, x_2_i)\n```\n\nwhere `f0, ..., f7`, and `g` are some functions. The following shape represnts how the state machine of this toy stream cipher works.\n\n![rabbit_0](ciphers/Example6//Shapes/rabbit_0.svg)\n\nAssuming that the output words, i.e., `z_i` for `i = 1, 2, ...` are known, we aim to find the minimum number of guessed variables to retrieve the initial state, namely, `x_0_0, x_1_0, ..., x_7_0`.\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example6/relationfile_rabit_9clk_mg6_ms22.txt --solver sat --maxguess 6 --maxsteps 12 --tikz 1\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — rabit 9 clock cycles\n============================================================\nVariables: 88 | Relations: 80\nMax guess: 6 | Max steps: 12\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.05 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.81 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\nKnown in final state: 88 / 88\nMax steps used: 12\n------------------------------------------------------------\nGuessed variable(s) (6):\n x_5_1\n x_4_0\n x_6_1\n x_0_2\n x_1_2\n x_0_3\n============================================================\nGenerating the tikz code ...\n```\n\n![rabbit_dg](ciphers/Example6/Shapes/rabbit_dg.svg)\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/Example6/relationfile_rabit_9clk_mg6_ms22.txt --solver groebner\n```\n\nTerminal output:\n\n```text\n============================================================\nGRÖBNER BASIS SOLVER — rabit 9 clock cycles\n============================================================\nVariables: 88 | Relations: 80\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 88 variables ...\nRing constructed in 0.00 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.00 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nANF representation generated in 0.00 seconds\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 0.86 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\n------------------------------------------------------------\nGuessed variable(s) (6):\n x_0_3\n x_4_4\n x_6_6\n x_3_7\n x_2_8\n x_3_8\n============================================================\n```\n\n---\n\n## Troubleshooting\n\n### Common Issues\n\n#### Docker Issues\n\n- **Permission denied**: On Linux, you may need to run Docker commands with `sudo` or add your user to the docker group\n- **Platform issues on ARM64**: Always use `--platform linux/amd64` flag for Apple Silicon Macs\n- **Out of memory**: For large problems, increase Docker memory limits in Docker Desktop settings\n\n#### Missing Dependencies\n\n- **ModuleNotFoundError**: If running natively, ensure all dependencies are installed.\n- **Solver not found**: Some solvers require separate installation (e.g., Gurobi requires a license)\n- **MiniZinc not found**: Install MiniZinc following the instructions in Method 3\n\n#### Input File Issues\n\n- **File format**: Ensure your input file follows the correct format as described in the [Format of Input File](#format-of-input-file) section\n- **Path issues**: Use absolute paths or ensure files are in the correct relative location\n- **Syntax errors**: Check that your algebraic and connection relations are properly formatted\n\n### Performance Tips\n\n- **Large problems**: Use the `--timelimit` parameter to set reasonable time bounds\n- **Solver selection**: Different solvers perform better on different types of problems. So try different solvers if you encounter performance issues.\n- **Guess bounds**: If you are looking for some bounds on the number of guesses, use `--maxguess \u003cnumber\u003e` to limit the number of guesses and use SAT solvers.\n- **Preprocessing**: If the input relations include algebraic relations, use preprocessing phase with `--preprocess 1` and `--D \u003cdegree\u003e` to derive new relations (using Macaulay matrix) and set the solver to one of the many available solvers, e.g., `--solver sat` or `--solver cp`, or `--solver groebner`.\n- **Minimization problem**: If you want to find the minimum number of guesses, use `--solver cp` or `--solver milp` to solve the problem as a constraint optimization problem or a mixed-integer linear programming problem, respectively. However, the optimization problem (COP) may take longer to solve compared to finding a bound on the number of guesses using SAT solvers (that is a CSP or SAT problem). You may want to reduce the optimization problem (COP) into a sequence of decision problems (CSP) by using `--maxsteps \u003cnumber\u003e` to limit the number of steps in the search space.\n- **Maximization problem**: Since the first version of Autoguess, it is possible to find the maximum number of determined variables in the final state given a set of variables/relations in which a subset of variables are already known (or guessed). This feature is avaialble when using the MILP solvers. To determine the direction of optimization, you can use the `--milpd \u003cmax/min\u003e` switch to set the direction of optimization to `max` or `min`. The default value is `min` to find minimal guess basis.\n\n### Getting Help\n\nIf you encounter issues:\n\n1. Check the [GitHub Issues](https://github.com/hadipourh/autoguess/issues) page\n2. Refer to the comprehensive examples in this README\n3. Contact the author at hsn.hadipour@gmail.com\n\n---\n\n## Applications\n\nThe following sections include some of the applications of our tool running on a laptop with the following configuration:\n\n```text\nOS: macOS 15.7.4 (arm64)\nCPU: Apple M4\nRAM: 24 GB\n```\n\n### GD Attack on 1 Round of AES with 1 Known Plaintext/Ciphertext Pair\n\n![aes_1_round_gd_dg](ciphers/AES/Shapes/GD-1Round/aes_1_round_gd_dg.svg)\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_1r_mg6_ms14.txt --solver sat --maxguess 6 --maxsteps 14\n```\n\nTerminal outputs:\n\n```text\n============================================================\nSAT SOLVER — aes1kp 1 Rounds\n============================================================\nVariables: 96 | Relations: 1168\nMax guess: 6 | Max steps: 14\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.08 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\nKnown in final state: 96 / 96\nMax steps used: 14\n------------------------------------------------------------\nGuessed variable(s) (6):\n X_0_0_2, K_0_1_2, X_0_2_0, X_0_3_0, W_0_1_1, K_1_3_1\n============================================================\n```\n\nAs you can see Autoguess finds a GD attack on 1 round of AES in less than a second. Autoguess uses [CaDiCaL](http://fmv.jku.at/cadical153/) as the SAT solver by default. However, user can simply choose another SAT solver among `cadical153,glucose3,glucose4,lingeling,maplechrono,maplecm,maplesat,minicard,minisat22,minisat-gh` by this switch : `--satsolver SAT_SOLVER_NAME`.\n\nNow, we try to find the minimum number of guesses by using the `--findmin` switch. This will reduce the optimization problem (COP) into a sequence of decision problems (CSP) and solve them using SAT solvers. So, it may take more time to find the minimum number of guesses compared to finding some bounds on the number of guesses using SAT solvers.\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_1r_mg6_ms14.txt --solver sat --maxsteps 14 --findmin\n```\n\nTerminal outputs:\n\n```text\n============================================================\nFIND-MIN MODE: searching for minimum guesses (starting from 96)\n============================================================\n max_guess = 96: SAT — a guess basis of size 64 exists (0.00s)\n max_guess = 64: SAT — a guess basis of size 64 exists (0.00s)\n max_guess = 63: SAT — a guess basis of size 63 exists (0.00s)\n max_guess = 62: SAT — a guess basis of size 62 exists (0.00s)\n max_guess = 61: SAT — a guess basis of size 61 exists (0.00s)\n max_guess = 60: SAT — a guess basis of size 60 exists (0.00s)\n max_guess = 59: SAT — a guess basis of size 59 exists (0.00s)\n max_guess = 58: SAT — a guess basis of size 58 exists (0.00s)\n max_guess = 57: SAT — a guess basis of size 57 exists (0.00s)\n max_guess = 56: SAT — a guess basis of size 56 exists (0.00s)\n max_guess = 55: SAT — a guess basis of size 55 exists (0.00s)\n max_guess = 54: SAT — a guess basis of size 54 exists (0.00s)\n max_guess = 53: SAT — a guess basis of size 53 exists (0.00s)\n max_guess = 52: SAT — a guess basis of size 52 exists (0.00s)\n max_guess = 51: SAT — a guess basis of size 51 exists (0.00s)\n max_guess = 50: SAT — a guess basis of size 50 exists (0.00s)\n max_guess = 49: SAT — a guess basis of size 49 exists (0.00s)\n max_guess = 48: SAT — a guess basis of size 48 exists (0.00s)\n max_guess = 47: SAT — a guess basis of size 47 exists (0.00s)\n max_guess = 46: SAT — a guess basis of size 46 exists (0.00s)\n max_guess = 45: SAT — a guess basis of size 45 exists (0.00s)\n max_guess = 44: SAT — a guess basis of size 44 exists (0.00s)\n max_guess = 43: SAT — a guess basis of size 43 exists (0.00s)\n max_guess = 42: SAT — a guess basis of size 42 exists (0.00s)\n max_guess = 41: SAT — a guess basis of size 41 exists (0.00s)\n max_guess = 40: SAT — a guess basis of size 40 exists (0.00s)\n max_guess = 39: SAT — a guess basis of size 39 exists (0.00s)\n max_guess = 38: SAT — a guess basis of size 38 exists (0.00s)\n max_guess = 37: SAT — a guess basis of size 37 exists (0.00s)\n max_guess = 36: SAT — a guess basis of size 36 exists (0.00s)\n max_guess = 35: SAT — a guess basis of size 35 exists (0.00s)\n max_guess = 34: SAT — a guess basis of size 34 exists (0.00s)\n max_guess = 33: SAT — a guess basis of size 33 exists (0.00s)\n max_guess = 32: SAT — a guess basis of size 32 exists (0.00s)\n max_guess = 31: SAT — a guess basis of size 31 exists (0.00s)\n max_guess = 30: SAT — a guess basis of size 30 exists (0.00s)\n max_guess = 29: SAT — a guess basis of size 29 exists (0.00s)\n max_guess = 28: SAT — a guess basis of size 28 exists (0.00s)\n max_guess = 27: SAT — a guess basis of size 27 exists (0.00s)\n max_guess = 26: SAT — a guess basis of size 26 exists (0.00s)\n max_guess = 25: SAT — a guess basis of size 25 exists (0.00s)\n max_guess = 24: SAT — a guess basis of size 24 exists (0.00s)\n max_guess = 23: SAT — a guess basis of size 23 exists (0.00s)\n max_guess = 22: SAT — a guess basis of size 22 exists (0.00s)\n max_guess = 21: SAT — a guess basis of size 21 exists (0.00s)\n max_guess = 20: SAT — a guess basis of size 20 exists (0.00s)\n max_guess = 19: SAT — a guess basis of size 19 exists (0.00s)\n max_guess = 18: SAT — a guess basis of size 18 exists (0.00s)\n max_guess = 17: SAT — a guess basis of size 17 exists (0.00s)\n max_guess = 16: SAT — a guess basis of size 16 exists (0.00s)\n max_guess = 15: SAT — a guess basis of size 15 exists (0.00s)\n max_guess = 14: SAT — a guess basis of size 14 exists (0.00s)\n max_guess = 13: SAT — a guess basis of size 13 exists (0.00s)\n max_guess = 12: SAT — a guess basis of size 12 exists (0.00s)\n max_guess = 11: SAT — a guess basis of size 9 exists (0.00s)\n max_guess = 9: SAT — a guess basis of size 9 exists (0.01s)\n max_guess = 8: SAT — a guess basis of size 8 exists (0.00s)\n max_guess = 7: SAT — a guess basis of size 7 exists (0.02s)\n max_guess = 6: SAT — a guess basis of size 6 exists (0.02s)\n max_guess = 5: UNSAT (52.46s)\n\n############################################################\nFIND-MIN RESULT: minimum number of guesses = 6\nTotal findmin time: 52.67s\n############################################################\n\nRe-solving with max_guess = 6 for detailed output ...\n\n(Note: the timings below are for this single verification\n solve only, not for the entire findmin search.)\n\n============================================================\nSAT SOLVER — aes1kp 1 Rounds\n============================================================\nVariables: 96 | Relations: 1168\nMax guess: 6 | Max steps: 14\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.09 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.01 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\nKnown in final state: 96 / 96\nMax steps used: 14\n------------------------------------------------------------\nGuessed variable(s) (6):\n X_0_0_2, K_0_1_2, X_0_2_0, X_0_3_0, W_0_1_1, K_1_3_1\n============================================================\n\nTotal findmin search time: 52.67s\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_1r_mg6_ms14.txt --solver smt --smtsolver z3 --maxguess 6 --maxsteps 14 \n```\n\nTerminal output:\n\n```text\n============================================================\nSMT SOLVER — aes1kp 1 Rounds\n============================================================\nVariables: 96 | Relations: 1168\nMax guess: 6 | Max steps: 14\nSolver: btor\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 0.46 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 1.10 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\nKnown in final state: 96 / 96\nMax steps used: 14\n------------------------------------------------------------\nGuessed variable(s) (6):\n X_0_0_0, X_0_0_1, K_0_1_3, K_0_3_1, W_0_1_0, K_1_2_0\n============================================================\n```\n\nIn the above command we have used [Boolector](https://github.com/boolector/boolector) as the SMT solver.\nNote that Boolector project has been officially archived in 2024 and is no longer maintained.\n\n***MILP***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_1r_mg6_ms14.txt --solver milp --maxguess 10 --maxsteps 14\n```\n\nTerminal outputs:\n\n```text\nGenerating the MILP model ...\nMILP model was generated after 0.02 seconds\nSet parameter Username\nSet parameter LicenseID to value 2782105\nAcademic license - for non-commercial use only - expires 2027-02-23\nRead LP format model from file temp/milp_mg10_ms14_min_a0f9cf732211135c51793acd11593b.lp\nReading time = 0.04 seconds\n: 39458 rows, 20480 columns, 212544 nonzeros\nSet parameter MIPFocus to value 0\nSet parameter Threads to value 0\nSet parameter OutputFlag to value 1\nGurobi Optimizer version 13.0.1 build v13.0.1rc0 (mac64[arm] - Darwin 24.6.0 24G517)\n\nCPU model: Apple M4\nThread count: 10 physical cores, 10 logical processors, using up to 10 threads\n\nOptimize a model with 39458 rows, 20480 columns and 212544 nonzeros (Min)\nModel fingerprint: 0x853798bd\nModel has 64 linear objective coefficients\nVariable types: 0 continuous, 20480 integer (20480 binary)\nCoefficient statistics:\n Matrix range [1e+00, 4e+01]\n Objective range [1e+00, 1e+00]\n Bounds range [1e+00, 1e+00]\n RHS range [1e+00, 1e+02]\n\nPresolve removed 5093 rows and 3298 columns\nPresolve time: 0.48s\nPresolved: 34365 rows, 17182 columns, 197325 nonzeros\nVariable types: 0 continuous, 17182 integer (17182 binary)\nFound heuristic solution: objective 7.0000000\nDeterministic concurrent LP optimizer: primal and dual simplex\nShowing primal log only...\n\nConcurrent spin time: 0.19s (can be avoided by choosing Method=3)\n\nSolved with primal simplex\n\nRoot relaxation: objective 4.241545e-09, 7530 iterations, 1.39 seconds (5.72 work units)\n\n Nodes | Current Node | Objective Bounds | Work\n Expl Unexpl | Obj Depth IntInf | Incumbent BestBd Gap | It/Node Time\n\n 0 0 0.00000 0 1315 7.00000 0.00000 100% - 2s\nH 0 0 6.0000000 0.00000 100% - 11s\n 0 0 0.00000 0 1619 6.00000 0.00000 100% - 11s\n 0 0 0.00000 0 1700 6.00000 0.00000 100% - 13s\n 0 0 0.00000 0 2213 6.00000 0.00000 100% - 19s\n 0 0 0.00000 0 2213 6.00000 0.00000 100% - 19s\n 0 0 0.00000 0 2195 6.00000 0.00000 100% - 22s\n ....\n 3956 1865 1.73377 34 445 6.00000 1.00000 83.3% 2261 579s\n^C (manually interrupted)\nInterrupt request received\n 4037 1849 1.00455 28 931 6.00000 1.00000 83.3% 2301 581s\n\nExplored 4050 nodes (9379254 simplex iterations) in 581.44 seconds (2720.99 work units)\nThread count was 10 (of 10 available processors)\n\nSolution count 2: 6 7 \n\nSolve interrupted\nBest objective 6.000000000000e+00, best bound 1.000000000000e+00, gap 83.3333%\nSolving process was finished after 581.45 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\nKnown in final state: 96 / 96\nMax steps used: 14\n------------------------------------------------------------\nGuessed variable(s) (6):\n K_0_0_2, K_0_0_3, K_0_1_3, K_0_2_0, W_0_0_2, W_0_3_3\n============================================================\n```\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_1r_mg6_ms14.txt --solver groebner --log 1\n```\n\nTerminal outputs:\n\n```text\n============================================================\nGRÖBNER BASIS SOLVER — aes1kp 1 Rounds\n============================================================\nVariables: 96 | Relations: 1168\nTerm ordering: degrevlex | Overlapping: 2\nCNF→ANF method: simple\n------------------------------------------------------------\nPOLYNOMIAL RING CONSTRUCTION\n------------------------------------------------------------\nGenerating Boolean Polynomial Ring in 96 variables ...\nRing constructed in 0.01 seconds\n------------------------------------------------------------\nHORN-SAT GENERATION\n------------------------------------------------------------\nHorn-SAT problem generated in 0.02 seconds\n------------------------------------------------------------\nCNF → ANF CONVERSION (simple)\n------------------------------------------------------------\nResults were written into the temp/anf_94efe633bf5f01b2c4d3ab440c347a.anf\nANF representation generated in 0.01 seconds\nMain ideal stored at: temp/main_ideal_94efe633bf5f01b2c4d3ab440c347a\n------------------------------------------------------------\nGRÖBNER BASIS COMPUTATION\n------------------------------------------------------------\nGröbner basis computed in 1.07 seconds\nAll guess bases were written into temp/guess_basis_94efe633bf5f01b2c4d3ab440c347a.txt\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 6\n------------------------------------------------------------\nGuessed variable(s) (6):\n K_0_0_0\n K_0_0_1\n K_0_0_2\n K_0_0_3\n K_0_1_3\n K_0_2_3\n============================================================\n```\n\nIf we use the Groebner basis, Autoguess generates multiple minimal guess bases at once and stores them inside the [temp](temp) folder. For example, in the above example, in addition to `[K_1_3_3, K_1_3_2, K_1_3_1, K_1_3_0, K_1_2_0, K_1_1_0]` Autoguess discovered many other minimal guess bases some of which are represented below:\n\n```text\nK_1_2_2, K_1_2_1, K_1_1_3, K_1_1_2, K_1_0_0, X_0_1_1\nK_1_2_2, K_1_2_1, K_1_1_3, K_1_1_2, K_1_0_0, X_0_3_3\nK_1_2_2, K_1_2_1, K_1_1_3, K_1_1_2, K_1_1_0, K_1_0_0\nK_1_2_2, K_1_2_1, K_1_2_0, K_1_1_3, K_1_1_2, K_1_0_0\nK_1_3_0, K_1_0_3, K_1_0_2, X_0_2_3, X_0_1_2, X_0_0_1\nK_1_3_0, K_1_0_3, K_1_0_2, K_1_0_1, X_0_2_3, X_0_1_2\nK_1_3_0, K_1_0_3, K_1_0_2, K_1_0_1, K_1_0_0, X_0_1_2\nK_1_3_0, K_1_0_3, K_1_0_2, K_1_0_1, K_1_0_0, X_0_2_3\nK_1_3_0, K_1_1_1, K_1_0_3, K_1_0_2, X_0_2_3, X_0_0_1\nK_1_3_0, K_1_1_1, K_1_0_3, K_1_0_2, K_1_0_1, X_0_2_3\nK_1_3_0, K_1_1_1, K_1_0_3, K_1_0_2, K_1_0_1, K_1_0_0\nK_1_3_0, K_1_1_2, K_1_1_1, K_1_0_3, K_1_0_2, X_0_0_1\nK_1_3_0, K_1_1_2, K_1_1_1, K_1_0_3, K_1_0_2, X_0_2_3\nK_1_3_0, K_1_1_2, K_1_1_1, K_1_0_3, K_1_0_2, K_1_0_1\nK_1_3_0, K_1_2_0, K_1_1_1, K_1_1_0, K_1_0_1, X_0_2_3\nK_1_3_0, K_1_2_0, K_1_1_1, K_1_1_0, K_1_0_1, X_0_3_0\nK_1_3_0, K_1_2_0, K_1_1_1, K_1_1_0, K_1_0_2, K_1_0_1\nK_1_3_0, K_1_2_0, K_1_1_3, K_1_1_2, K_1_0_0, X_0_0_2\nK_1_3_0, K_1_2_0, K_1_1_3, K_1_1_2, K_1_0_1, K_1_0_0\n ...\n ...\n```\n\n---\n\n### GD Attack on 2 Rounds of AES with 1 Known Plaintext/Ciphertext Pair\n\n![aes_2_rounds_10g_gd_dg](ciphers/AES/Shapes/GD-2Rounds-10G/aes_2_rounds_10g_gd_dg.svg)\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_2r_mg10_ms20.txt --solver sat --maxguess 10 --maxsteps 22\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — aes1kp 2 Rounds\n============================================================\nVariables: 144 | Relations: 2332\nMax guess: 10 | Max steps: 22\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.24 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 7.08 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 10\nKnown in final state: 144 / 144\nMax steps used: 22\n------------------------------------------------------------\nGuessed variable(s) (10):\n K_0_1_0, K_0_3_2, W_0_0_2, K_1_1_3, X_1_2_0, W_0_2_3, K_1_3_3, X_1_3_3, W_1_2_2, W_1_3_2\n============================================================\n```\n\n***SMT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_2r_mg10_ms20.txt --solver smt --smtsolver z3 --maxguess 10 --maxsteps 20\n```\n\nTerminal output:\n\n```text\n============================================================\nSMT SOLVER — aes1kp 2 Rounds\n============================================================\nVariables: 144 | Relations: 2332\nMax guess: 10 | Max steps: 20\nSolver: z3\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSMT model generated in 2.24 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 37.80 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 10\nKnown in final state: 144 / 144\nMax steps used: 20\n------------------------------------------------------------\nGuessed variable(s) (10):\n K_0_2_1, X_1_0_2, X_1_1_0, W_0_1_3, X_1_2_0, K_1_3_3, X_1_3_3, W_1_0_2, W_1_0_3, W_1_3_2\n============================================================\n```\n\n***Groebner***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_2r_mg10_ms20.txt --solver groebner --overlapping_number 100\n```\n\nTerminal output:\n\n```text\n(This output is from the old version of Autoguess running on a different machine: OS: Linux 5.4.0-84-generic - Ubuntu, CPU: Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz, RAM: 16 GB)\nGenerating the Boolean Polynomial Ring in 144 variables\nGeneration of the Boolean polynomial ring was finished after 0.03 seconds\nCNF to ANF conversion using the block-wise method was started - 2021-04-03 12:22:23.463899\nResults were written into the temp/anf_b55c6bf2574c3b718107cafd93e211.anf\nAlgebraic representation in ANF form was generated after 220.32 seconds\nComputing the Groebner basis was started - 2021-04-03 12:26:03.802563\nComputing the Groebner basis was finished after 36356.55 seconds\nNumber of guesses: 10\nThe following 10 variable(s) are guessed:\nK_2_3_3, K_2_3_2, K_2_3_0, K_2_2_3, K_2_2_2, K_2_2_1, K_2_1_3, K_2_1_2, K_2_0_3, K_2_0_2\n```\n\n---\n\n### GD Attack on 3 Rounds of AES with 1 Known Plaintext/Ciphertext Pair\n\n![aes_3_rounds_gd_dg](ciphers/AES/Shapes/GD-3Rounds-15G/aes_3_rounds_gd_dg.svg)\n\n***SAT***\n\n```sh\npython3 autoguess.py --inputfile ciphers/AES/relationfile_aes1kp_3r_mg15_ms22.txt --solver sat --maxguess 15 --maxsteps 22\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — aes1kp 3 Rounds\n============================================================\nVariables: 192 | Relations: 3472\nMax guess: 15 | Max steps: 22\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.44 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 37.86 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 15\nKnown in final state: 192 / 192\nMax steps used: 22\n------------------------------------------------------------\nGuessed variable(s) (15):\n X_0_2_2, W_0_3_0, K_2_0_0, X_2_0_0, K_2_1_0, K_2_1_2, K_2_2_0, K_2_2_1, X_2_3_1, X_2_3_2, K_3_1_0, W_2_1_2, W_2_1_3, W_2_2_3, W_2_3_3\n============================================================\n```\n\n---\n\n### GD Attack on 14 Rounds of Khudra with 1 Known Plaintext/Ciphertext Pair\n\n![khudra_14r_gd_dg](ciphers/Khudra/Shapes/khudra_14r_gd_dg.svg)\n\n***SAT***\n\nSolving with [Lingeling](https://github.com/arminbiere/lingeling).\n\n```sh\npython3 autoguess.py --inputfile ciphers/Khudra/relationfile_khudra_alternative_14r_mg4_ms16.txt --solver sat --satsolver lingeling --maxguess 4 --maxsteps 16\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — khudra_alternative 14 Rounds\n============================================================\nVariables: 70 | Relations: 61\nMax guess: 4 | Max steps: 16\nSolver: lingeling\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.04 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.65 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 4\nKnown in final state: 70 / 70\nMax steps used: 16\n------------------------------------------------------------\nGuessed variable(s) (4):\n x_3_3\n x_12_1\n x_13_2\n x_14_3\n============================================================\n```\n\nSolving with [CaDiCaL](https://github.com/arminbiere/cadical153).\n\n```sh\npython3 autoguess.py --inputfile ciphers/Khudra/relationfile_khudra_alternative_14r_mg4_ms16.txt --solver sat --satsolver cadical153 --maxguess 4 --maxsteps 16\n```\n\nTerminal output:\n\n```text\n============================================================\nSAT SOLVER — khudra_alternative 14 Rounds\n============================================================\nVariables: 70 | Relations: 61\nMax guess: 4 | Max steps: 16\nSolver: cadical153\n------------------------------------------------------------\nMODEL GENERATION\n------------------------------------------------------------\nSAT model generated in 0.03 seconds\n------------------------------------------------------------\nSOLVING\n------------------------------------------------------------\nSolving finished in 0.61 seconds\n\n============================================================\nRESULTS\n============================================================\nNumber of guesses: 4\nKnown in final state: 70 / 70\nMax steps used: 16\n------------------------------------------------------------\nGuessed variable(s) (4):\n x_2_0\n x_12_1\n x_13_2\n x_14_3\n============================================================\n```\n\n***SMT***\n\nSolving via [cvc5](https://cvc5.github.io):\n\n```sh\npython3 autoguess.py --inputfile ciphers/Khudra/relationfile_khudra_alternative_14r_mg4_ms16.txt --solver smt --smtsolver cvc5 --maxguess 4 --maxsteps 16\n```\n\nTerminal output:\n\n```text\n===============================================","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhadipourh%2Fautoguess","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhadipourh%2Fautoguess","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhadipourh%2Fautoguess/lists"}