4
$\begingroup$

I am interested to see a "toy" version of the Gimli permutation for three (instead of twelve) 32-bit words. I see that the "core" sub-permutation of Gimli operates on three 32-bit words, but I don't know how to use it for constructing a 96-bit unkeyed permutation. Is it possible to modify the Gimli algorithm to devise such a function? If yes, how?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
4
$\begingroup$

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of:

  1. a non-linear SP-box applied to each 96-bit column individually,
  2. on every second round, a linear mixing step that just swaps the first words of pairs of columns, and
  3. on every fourth round, a constant addition step that XORs the first word of the first column with a 32-bit round constant.

Probably the simplest way to reduce the Gimli permutation to 96 bits would therefore be to simply drop all but the first 96-bit column and omit the linear mixing step entirely, as it's the only part of Gimli that actually mixes the columns together. This will naturally give a 96-bit permutation that should resemble the full Gimli permutation in most respects, other than having a smaller state size.

Improve this answer
$\endgroup$
7
  • 2
    $\begingroup$ I would do a constant addition every round then. $\endgroup$
    – Biv
    Commented Jul 18, 2019 at 18:17
  • $\begingroup$ @Biv: I must defer to your superior expertise here. :) But just out of curiosity, what's your reasoning behind that recommendation? Is it a slide attack avoidance thing, or something? $\endgroup$
    – Ilmari Karonen
    Commented Jul 18, 2019 at 21:03
  • 1
    $\begingroup$ @IlmariKaronen I am worried about symmetry yes. :) $\endgroup$
    – Biv
    Commented Aug 5, 2019 at 13:56
  • 3
    $\begingroup$ @lyricallywicked if you remove the swap then you have only a propagation from top to bottom. The swap is required for the security of the scheme as it enable a stronger propagation between the layers. Without it, it would be extremely easy to find fix points. $\endgroup$
    – Biv
    Commented Aug 5, 2019 at 13:58
  • 2
    $\begingroup$ @lyricallywicked as for the number of round, this can only be determined by a careful analysis of the differential and linear propagations. $\endgroup$
    – Biv
    Commented Aug 5, 2019 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.