# How to construct a “toy” version of Gimli permutation for three (instead of twelve) 32-bit words?

I am interested to see a "toy" version of the Gimli permutation for three (instead of twelve) 32-bit words. I see that the "core" sub-permutation of Gimli operates on three 32-bit words, but I don't know how to use it for constructing a 96-bit unkeyed permutation. Is it possible to modify the Gimli algorithm to devise such a function? If yes, how?

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of:

1. a non-linear SP-box applied to each 96-bit column individually,
2. on every second round, a linear mixing step that just swaps the first words of pairs of columns, and
3. on every fourth round, a constant addition step that XORs the first word of the first column with a 32-bit round constant.

Probably the simplest way to reduce the Gimli permutation to 96 bits would therefore be to simply drop all but the first 96-bit column and omit the linear mixing step entirely, as it's the only part of Gimli that actually mixes the columns together. This will naturally give a 96-bit permutation that should resemble the full Gimli permutation in most respects, other than having a smaller state size.

• I would do a constant addition every round then. – Biv Jul 18 at 18:17
• @Biv: I must defer to your superior expertise here. :) But just out of curiosity, what's your reasoning behind that recommendation? Is it a slide attack avoidance thing, or something? – Ilmari Karonen Jul 18 at 21:03
• @IlmariKaronen I am worried about symmetry yes. :) – Biv Aug 5 at 13:56
• @lyricallywicked if you remove the swap then you have only a propagation from top to bottom. The swap is required for the security of the scheme as it enable a stronger propagation between the layers. Without it, it would be extremely easy to find fix points. – Biv Aug 5 at 13:58
• @lyricallywicked as for the number of round, this can only be determined by a careful analysis of the differential and linear propagations. – Biv Aug 5 at 13:58