# How to construct a "toy" version of Gimli permutation for three (instead of twelve) 32-bit words?

I am interested to see a "toy" version of the Gimli permutation for three (instead of twelve) 32-bit words. I see that the "core" sub-permutation of Gimli operates on three 32-bit words, but I don't know how to use it for constructing a 96-bit unkeyed permutation. Is it possible to modify the Gimli algorithm to devise such a function? If yes, how?

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of:

1. a non-linear SP-box applied to each 96-bit column individually,
2. on every second round, a linear mixing step that just swaps the first words of pairs of columns, and
3. on every fourth round, a constant addition step that XORs the first word of the first column with a 32-bit round constant.

Probably the simplest way to reduce the Gimli permutation to 96 bits would therefore be to simply drop all but the first 96-bit column and omit the linear mixing step entirely, as it's the only part of Gimli that actually mixes the columns together. This will naturally give a 96-bit permutation that should resemble the full Gimli permutation in most respects, other than having a smaller state size.

• I would do a constant addition every round then.
– Biv
Jul 18, 2019 at 18:17
• @Biv: I must defer to your superior expertise here. :) But just out of curiosity, what's your reasoning behind that recommendation? Is it a slide attack avoidance thing, or something? Jul 18, 2019 at 21:03
• @IlmariKaronen I am worried about symmetry yes. :)
– Biv
Aug 5, 2019 at 13:56
• @lyricallywicked if you remove the swap then you have only a propagation from top to bottom. The swap is required for the security of the scheme as it enable a stronger propagation between the layers. Without it, it would be extremely easy to find fix points.
– Biv
Aug 5, 2019 at 13:58
• @lyricallywicked as for the number of round, this can only be determined by a careful analysis of the differential and linear propagations.
– Biv
Aug 5, 2019 at 13:58