Grøstl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation

Abstract

We consider highly structured truncated differential paths to mount a new rebound attack on Grøstl-512, a hash functions based on two AES-like permutations, P1024 and Q1024, with non-square input and output registers. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with a SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. This yields the first distinguishing attack on a 11-round version of P1024 and Q1024 with about 272 computations and a memory complexity of about 256 bytes, to be compared with the 296 computations required by the corresponding generic attack. Previous best results on this permutation reached 10 rounds with a computational complexity of about 2392 operations, to be compared with the 2448 computations required by the corresponding generic attack.

Integral distinguishers for Grøstl‐512 and Kupyna‐512 permutation functions

“…In [4], Jean et al proposed 8, 9 and 10-round rebound distinguishers against the two permutations. Then, Cauchois et al proposed 11round rebound distinguishers [5]. As for the integral distinguishers of P and Q, Li et al [6] presented 11-round integral distinguishers, which were improved by Minier and Thomas in [7].…”

“…where , 2, 3, 4, 5, 6, 11] and τ Q = [1,3,5,11,0,2,4,6]. Finally, the MixBytes operation multiplies each column of the state matrix by a circulant MDS constant matrix M independently, where…”