TY - JOUR AU - Liu, Fukang AU - Isobe, Takanori AU - Meier, Willi PY - 2021/03/19 Y2 - 2024/03/28 TI - Exploiting Weak Diffusion of Gimli: Improved Distinguishers and Preimage Attacks JF - IACR Transactions on Symmetric Cryptology JA - ToSC VL - 2021 IS - 1 SE - Articles DO - 10.46586/tosc.v2021.i1.185-216 UR - https://tosc.iacr.org/index.php/ToSC/article/view/8837 SP - 185-216 AB - <p>The Gimli permutation proposed in CHES 2017 was designed for cross-platform performance. One main strategy to achieve such a goal is to utilize a sparse linear layer (Small-Swap and Big-Swap), which occurs every two rounds. In addition, the round constant addition occurs every four rounds and only one 32-bit word is affected by it. The above two facts have been recently exploited to construct a distinguisher for the full Gimli permutation with time complexity 2<sup>64</sup>. By utilizing a new property of the SP-box, we demonstrate that the time complexity of the full-round distinguisher can be further reduced to 2<sup>52</sup> while a significant bias still remains. Moreover, for the 18-round Gimli permutation, we could construct a distinguisher even with only 2 queries. Apart from the permutation itself, the weak diffusion can also be utilized to accelerate the preimage attacks on reduced Gimli-Hash and Gimli-XOF-128 with a divide-and-conquer method. As a consequence, the preimage attacks on reduced Gimli-Hash and Gimli-XOF-128 can reach up to 5 rounds and 9 rounds, respectively. Since Gimli is included in the second round candidates in NIST’s Lightweight Cryptography Standardization process, we expect that our analysis can further advance the understanding of Gimli. To the best of our knowledge, the distinguishing attacks and preimage attacks are the best so far.</p> ER -