Automatic Verification of Differential Characteristics: Application to Reduced Gimli

Liu, Fukang; Isobe, Takanori; Meier, Willi

doi:10.1007/978-3-030-56877-1_8

Cited by 20 publications

(25 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we will present some notations, the description of the Gimli permutation and its applications to hashing. Meanwhile, some useful properties of the SP-box discussed in [LIM20] will be introduced as well.…”

Section: Preliminariesmentioning

confidence: 99%

“…Suppose (OX, OY, OZ) = SP (IX, IY, IZ). Several properties have been discussed in [LIM20] and we list some useful ones for our attacks. Property 1.…”

Section: Properties Of the Sp-boxmentioning

confidence: 99%

“…Similar to the method to turn the 6-round semi-free-start collisions into collisions in [LIM20], to efficiently mount the preimage attack on reduced Gimli-XOF-128, some conditions will be added. Specifically, when the target is n rounds of Gimli, an equivalent problem to find the preimage of Gimli-XOF-128 can be described as below:…”

Section: Preimage Attacks On Round-reduced Gimli-xof-128mentioning

confidence: 99%

“…The collision attack on 6-round Gimli-Hash[ZDW19] is proven to be flawed in[LIM20]. In addition, it seems that the collision attack framework in [GLNP + 20] can not work when the swap operation is used in the first round.…”

mentioning

confidence: 99%

“…In addition, it seems that the collision attack framework in [GLNP + 20] can not work when the swap operation is used in the first round. Indeed, the collision attack framework in [GLNP + 20] is very similar to the semi-free-start collision attack on 8-round Gimli-Hash in[LIM20] and the swap operation in the first round will destroy such a structure to find collisions or semi-free-start collisions.2 It is possible to make the memory complexity negligible with Floyd's cycle finding algorithm[Flo67].…”

mentioning

confidence: 99%

See 4 more Smart Citations

Exploiting Weak Diffusion of Gimli: Improved Distinguishers and Preimage Attacks

Liu

Isobe

Meier

2021

ToSC

Self Cite

View full text Add to dashboard Cite

The Gimli permutation proposed in CHES 2017 was designed for cross-platform performance. One main strategy to achieve such a goal is to utilize a sparse linear layer (Small-Swap and Big-Swap), which occurs every two rounds. In addition, the round constant addition occurs every four rounds and only one 32-bit word is affected by it. The above two facts have been recently exploited to construct a distinguisher for the full Gimli permutation with time complexity 264. By utilizing a new property of the SP-box, we demonstrate that the time complexity of the full-round distinguisher can be further reduced to 252 while a significant bias still remains. Moreover, for the 18-round Gimli permutation, we could construct a distinguisher even with only 2 queries. Apart from the permutation itself, the weak diffusion can also be utilized to accelerate the preimage attacks on reduced Gimli-Hash and Gimli-XOF-128 with a divide-and-conquer method. As a consequence, the preimage attacks on reduced Gimli-Hash and Gimli-XOF-128 can reach up to 5 rounds and 9 rounds, respectively. Since Gimli is included in the second round candidates in NIST’s Lightweight Cryptography Standardization process, we expect that our analysis can further advance the understanding of Gimli. To the best of our knowledge, the distinguishing attacks and preimage attacks are the best so far.

show abstract

Section: Preliminariesmentioning

confidence: 99%

“…Suppose (OX, OY, OZ) = SP (IX, IY, IZ). Several properties have been discussed in [LIM20] and we list some useful ones for our attacks. Property 1.…”

Section: Properties Of the Sp-boxmentioning

confidence: 99%

Section: Preimage Attacks On Round-reduced Gimli-xof-128mentioning

confidence: 99%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations