Cryptanalysis Results on Spook

Abstract

Spook [BBB + 19] is one of the 32 candidates that has made it to the second round of the NIST Lightweight Cryptography Standardization process, and is particularly interesting since it proposes differential side channel resistance. In this paper, we present practical distinguishers of the full 6-step version of the underlying permutations of Spook, namely Shadow-512 and Shadow-384, solving challenges proposed by the designers on the permutation. We also propose practical forgeries with 4-step Shadow for the S1P mode of operation in the nonce misuse scenario, which is allowed by the CIML2 security game considered by the authors. All the results presented in this paper have been implemented.

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

“…Though our results do not pose a direct threat to the Gimli NIST candidate, low-complexity full-round distinguishers on the permutation or reduced-round attacks for a high proportion of the rounds (specially when not predicted by the designers) have been considered in some cases as an issue worth countering by proposing a tweak, as can be seen for instance in the modification [3] recently proposed by the Spook team [2] to protect against the cryptanalysis results from [15].…”

“…3. We now guess 15 . Given this, and 15 , and the output 13 that must be met, we obtain the whole state by solving another simple SP-Box equation (which is not Equation ( 10), but has a similar form).…”

“…Our aim is to find more efficient algorithms in the case of Gimli. This definition is similar to the one used in [15]. In fact, an internal symmetry distinguisher can be seen as a stronger variant of a limited birthday distinguisher of the type used in [15].…”

“…This definition is similar to the one used in [15]. In fact, an internal symmetry distinguisher can be seen as a stronger variant of a limited birthday distinguisher of the type used in [15]. Indeed, we can build a limited birthday pair using our distinguisher: by producing a pair of inputs , ′ satisfying the internal symmetry property, we obtain ⊕ ′ ∈ and ( ) ⊕ ( ′ ) ∈ .…”

“…Indeed, once we have computed the first step, the two branches 17 and 13 contain arbitrary fixed values. Then, when we try to find the right , we could have a table that for all 15 , 15 , gives all input-output values for 17 and 14 , and we could directly use this table to match the values 15 and 15 that come from (instead of having to make a guess of 15 . Let us fix 17 = 13 = 0.…”