Skip to main content
18 votes
Accepted

Doubt about published test vectors for gimli hash

I'm one of the authors of Gimli. TL;DR: Test vectors provided by the paper are indeed wrong. We had a error when we generated the paper and the test vectors have not been updated with respect to the ...
Biv's user avatar
  • 10k
7 votes
Accepted

How to build disk encryption system using forward permutations like Gimli?

Disclaimer: I'm one of the authors of the said permutation. Gimli does not aim to be used as a block cipher (in the traditional sense of it: $x \to (\sigma \circ K_{\mathit{add}})^{\mathit{nb}_{\...
Biv's user avatar
  • 10k
7 votes
Accepted

How strong is XooDoo vs AES?

Gimli is an unkeyed permutation, mapping a 384-bit input to a 384-bit output, $\{0,1\}^{384} \rightarrow \{0,1\}^{384}$. It is not a cipher by itself as you can reverse the output if you have it in ...
forest's user avatar
  • 15.3k
4 votes
Accepted

How to construct a "toy" version of Gimli permutation for three (instead of twelve) 32-bit words?

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of: a non-...
Ilmari Karonen's user avatar
4 votes
Accepted

Can ChaCha20 be repurposed as a general purpose permutation function like Gimli?

There is a library called Monocypher* that heavily utilizes derivatives of ChaCha and Salsa. (Plus Poly1305, X25519, and Ed25519.) The algorithms it uses, XChaCha20, Blake2b, and Argon2 all use ...
Future Security's user avatar
3 votes

The Gimli non-linear operator

a bit late, if I had been pinged on this, I could have answered earlier. $x \vee z$ was chosen for the following reason: $a \wedge b$ is biased towards 0. As a result if we only used $\wedge$ the ...
Biv's user avatar
  • 10k
3 votes
Accepted

What is the inverse of this variant of the Gimli SP-box?

First, note that (z << 1) ^ ((x ^ (y | ~z)) << 1) can be simplified to the shorter ~(x ^ (y & z)) << 1. ...
Samuel Neves's user avatar
  • 12.6k
2 votes
Accepted

Are libhydrogen's Gimli permutations production ready?

If you consider a feature being enabled by default as meaning the feature is production ready, then yes Gimli is production ready. However, it's still fairly new and hydrogen allows you to switch a ...
Karan Veer's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible