Key-Committing Security Analysis of ACORN and Deoxys

Authenticated encryption with associated data (AEAD) provides confidentiality and integrity but need not commit a ciphertext to its key. We study this additional property for ACORN-128 v3 and Deoxys-I/II. Our baseline constructions use two distinct known keys and a common nonce while allowing different associated data (AD), and produce identical complete ciphertext–tag pairs. They directly witness failures of the commitment (CMT) notions for the key (CMT-1), decryption context (CMT-3), and complete encryption input (CMT-4), as well as the full-robustness notion for AEAD (AEAD-FROB) used here. For ACORN, we prove full rank of a 293-dimensional binary control matrix, guaranteeing state collisions for arbitrary initialized states; a byte-oriented implementation uses 37-byte controllable AD suffixes and can preserve a common AD prefix. For Deoxys, we instantiate the established AD-preimage technique, requiring two forward and one inverse tweakable-block-cipher calls for the empty-message Deoxys-I construction, and one forward and two inverse calls for Deoxys-II. We also derive nonempty-message constructions and verify two-key instances with both nonce and AD common by solving a binary selection system. Fixed-version reference implementations verify all reported collisions and both decryptions. These results concern commitment under the stated input control and do not establish attacks on conventional unknown-key AEAD security or on specific deployed protocols.