2
$\begingroup$

A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and 23-round permutation with a cost of $2^{32}$ and has been practical implementation. The 23-round distinguisher could be extended if 1 round for free if the rounds were shifted (the linear layer of Gimli is round dependent)

Due to round dependance of linear layer and swaps are applied every two rounds , The permutation will be viewed as SPN with only 12 rounds.

Questions:

  1. How to fix this issue in General ? Does applying swaps in every round will remove the disguiser?
  2. The column swaps in the linear layer is simple , if the column and rows swaps (cells shuffling) will increase the diffusion rate and provide extra security against distinguisher?
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.