New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

Gutierrez, Antonio Florez; Leurent, Gaëtan; Naya-Plasencia, Maŕıa; Perrin, Léo; Schrottenloher, André; Sibleyras, Ferdinand

doi:10.1007/978-3-030-64837-4_2

Cited by 10 publications

(10 citation statements)

References 21 publications

(43 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Though our results do not pose a direct threat to the Gimli NIST candidate, lowcomplexity full-round distinguishers on the permutation or reduced-round attacks for a high proportion of the rounds (specially when not predicted by the designers) have been considered in some cases as an issue worth countering by proposing a tweak, as can be seen, for instance, in the modification proposed by the Spook team [2] to protect against the cryptanalysis results from [16]. In September 2020, after the results of [18] were made public, the NIST offered the submitters of second-round algorithms to propose status updates. In their document [6], the designers of Gimli acknowledged the collision attacks of Sect.…”

Section: Discussionmentioning

confidence: 99%

“…2 Differences with [18]. This article is an extended version of the paper "New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions" which appeared in the proceedings of ASIACRYPT 2020 [18]. Our new contributions are the state-recovery attacks explored in Sect.…”

Section: Introductionmentioning

confidence: 99%

“…Our implementations (23-round distinguisher, reduced-round collision attack, search for linear trails) are available at this URL. 2 Differences with [18]. This article is an extended version of the paper "New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions" which appeared in the proceedings of ASIACRYPT 2020 [18].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Internal Symmetries and Linear Properties: Full-permutation Distinguishers and Improved Collisions on Gimli

et al. 2021

Self Cite

View full text Add to dashboard Cite

Gimli is a family of cryptographic primitives (both a hash function and an AEAD scheme) that has been selected for the second round of the NIST competition for standardizing new lightweight designs. The candidate Gimli is based on the permutation Gimli, which was presented at CHES 2017. In this paper, we study the security of both the permutation and the constructions that are based on it. We exploit the slow diffusion in Gimli and its internal symmetries to build, for the first time, a distinguisher on the full permutation of complexity 2 64 . We also provide a practical distinguisher on 23 out of the full 24 rounds of Gimli that has been implemented. Next, we give (full state) collision and semi-free start collision attacks on Gimli-Hash, reaching, respectively, up to 12 and 18 rounds. On the practical side, we compute a collision on 8-round Gimli-Hash. In the quantum setting, these attacks reach 2 more rounds. Finally, we perform the first study of linear trails in Gimli, and we find a linear distinguisher on the full permutation.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Internal Symmetries and Linear Properties: Full-permutation Distinguishers and Improved Collisions on Gimli

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…Security Analysis. Since the Gimli permutation was first introduced in 2017 [129], several in-depth analyses [89,[130][131][132][133][134][135] have been conducted. For each scheme, the best-known attacks are shown in Table 7.…”

Section: Nistir Second Round Status Reportmentioning

confidence: 99%

Status report on the second round of the NIST lightweight cryptography standardization process

Turan¹,

McKay²,

Chang³

et al. 2021

View full text Add to dashboard Cite

The National Institute of Standards and Technology (NIST) initiated a public standardization process to select one or more Authenticated Encryption with Associated Data (AEAD) and hashing schemes suitable for constrained environments. In February 2019, 57 candidates were submitted to NIST for consideration. Among these, 56 were accepted as firstround candidates in April 2019. After four months, NIST selected 32 of the candidates for the second round. In March 2021, NIST announced 10 finalists to move forward to the final round of the selection process. The finalists are ASCON, Elephant, GIFT-COFB, Grain-128AEAD, ISAP, PHOTON-Beetle, Romulus, SPARKLE, TinyJAMBU, and Xoodyak. This report describes the evaluation criteria and selection process, which is based on public feedback and internal review of the second-round candidates.

show abstract

“…In Asiacrypt 2020, Flórez‐Gutiérrez et al. [5] performed 24‐round and 28‐round distinguishing attacks against round‐shifted GIMLI with time complexities of 2 32 and 2 64 , respectively. Although many rounds of round‐shifted GIMLI were analysed by the distinguishing attacks, there is no relation to the security of GIMLI‐CIPHER or GIMLI‐HASH .…”

Section: Introductionmentioning

confidence: 99%

A preimage attack on reduced GIMLI‐HASH with unbalanced squeezing phase

Lee

Kang

Chang

et al. 2022

IET Information Security

View full text Add to dashboard Cite

In Conference on Cryptographic Hardware and Embedded System 2017, Bernstein et al. proposed GIMLI, a 384‐bit permutation with 24 rounds, which aims to provide high performance on various platforms. In 2019, the full‐round (24 rounds) GIMLI permutation was used as an underlying primitive for building AEAD GIMLI‐CIPHER and hash function GIMLI‐HASH, which were submitted to the NIST Lightweight Cryptography Standardisation process and selected as one of the second‐round candidates. In Transactions on Symmetric Cryptology 2021, Liu et al. presented a preimage attack with a divide‐and‐conquer method on round‐reduced GIMLI‐HASH, which uses 5‐round GIMLI. In this paper, preimage attacks on a round‐reduced variant of GIMLI‐HASH is presented, in which the message absorbing phase uses 5‐round GIMLI and the squeezing phase uses 9‐round GIMLI. This variant is called as 5–9‐round GIMLI‐HASH. The authors’ preimage attack on 5–9‐round GIMLI‐HASH requires 296.44 time complexity and 297 memory complexity. Also, this method can be reached up to round shifted 10‐round GIMLI in the squeezing phase. The authors’ first attack requires the memory for storing several precomputation tables in GIMLI SP‐box operations. In the authors’ second attack, a time‐memory trade‐off approach is taken, reducing memory requirements for precomputation tables but increasing computing time for solving SP‐box equations by using SAT solver. This attack requires 266.17 memory complexity and 296+ϵ time complexity, where ϵ is a time complexity for solving SP‐box equations. The authors’ experiments using CryptoMiniSat SAT solver show that the maximum time complexity for ϵ is about 220.57 9‐round GIMLI.

show abstract

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

Cited by 10 publications

References 21 publications

Internal Symmetries and Linear Properties: Full-permutation Distinguishers and Improved Collisions on Gimli

Internal Symmetries and Linear Properties: Full-permutation Distinguishers and Improved Collisions on Gimli

Status report on the second round of the NIST lightweight cryptography standardization process

A preimage attack on reduced GIMLI‐HASH with unbalanced squeezing phase

Contact Info

Product

Resources

About