5
$\begingroup$

A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and 23-round permutation with a cost of $2^{32}$ and has been practical implementation. The 23-round distinguisher could be extended if 1 round for free if the rounds were shifted (the linear layer of Gimli is round dependent)

Due to round dependance of linear layer and swaps are applied every two rounds , The permutation will be viewed as SPN with only 12 rounds.

Questions:

  1. How to fix this issue in General ? Does applying swaps in every round will remove the disguiser?
  2. The column swaps in the linear layer is simple , if the column and rows swaps (cells shuffling) will increase the diffusion rate and provide extra security against distinguisher?
$\endgroup$

1 Answer 1

0
$\begingroup$

Yes, authors of this paper believe applying swap in every round would fix this distinguisher.

Paper concludes:

In order to mitigate the attacks based on internal symmetries and guess-and- determine methods (including our distinguishers on the permutation) a simple fix would be to perform a swap at each round instead of every second round. This would however imply a renewed cryptanalysis effort.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.