A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and 23-round permutation with a cost of $2^{32}$ and has been practical implementation. The 23-round distinguisher could be extended if 1 round for free if the rounds were shifted (the linear layer of Gimli is round dependent)

Due to round dependance of linear layer and swaps are applied every two rounds , The permutation will be viewed as SPN with only 12 rounds.


  1. How to fix this issue in General ? Does applying swaps in every round will remove the disguiser?
  2. The column swaps in the linear layer is simple , if the column and rows swaps (cells shuffling) will increase the diffusion rate and provide extra security against distinguisher?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.