4
$\begingroup$

I am interested to see a "toy" version of the Gimli permutation for three (instead of twelve) 32-bit words. I see that the "core" sub-permutation of Gimli operates on three 32-bit words, but I don't know how to use it for constructing a 96-bit unkeyed permutation. Is it possible to modify the Gimli algorithm to devise such a function? If yes, how?

$\endgroup$
4
$\begingroup$

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of:

  1. a non-linear SP-box applied to each 96-bit column individually,
  2. on every second round, a linear mixing step that just swaps the first words of pairs of columns, and
  3. on every fourth round, a constant addition step that XORs the first word of the first column with a 32-bit round constant.

Probably the simplest way to reduce the Gimli permutation to 96 bits would therefore be to simply drop all but the first 96-bit column and omit the linear mixing step entirely, as it's the only part of Gimli that actually mixes the columns together. This will naturally give a 96-bit permutation that should resemble the full Gimli permutation in most respects, other than having a smaller state size.

$\endgroup$
  • 2
    $\begingroup$ I would do a constant addition every round then. $\endgroup$ – Biv Jul 18 at 18:17
  • $\begingroup$ @Biv: I must defer to your superior expertise here. :) But just out of curiosity, what's your reasoning behind that recommendation? Is it a slide attack avoidance thing, or something? $\endgroup$ – Ilmari Karonen Jul 18 at 21:03
  • 1
    $\begingroup$ @IlmariKaronen I am worried about symmetry yes. :) $\endgroup$ – Biv Aug 5 at 13:56
  • 3
    $\begingroup$ @lyricallywicked if you remove the swap then you have only a propagation from top to bottom. The swap is required for the security of the scheme as it enable a stronger propagation between the layers. Without it, it would be extremely easy to find fix points. $\endgroup$ – Biv Aug 5 at 13:58
  • 2
    $\begingroup$ @lyricallywicked as for the number of round, this can only be determined by a careful analysis of the differential and linear propagations. $\endgroup$ – Biv Aug 5 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.