Question related to Gimli : usage, security, cryptanalysis.
The IACR Paper (also published at CHES 2017) can be found here.
Gimli is a 384-bit permutation designed to be fast on most of platforms (but not necessarily the fastest on each of them).
It aims to be used in constrained environment such as ARM-m3/m4 but can also be easily vectorized (AVX & SSE) to reach high performance on such CPUs.
Gimli aimed to be used as a permutation mostly in sponge constructions. The 384 bits width of the permutation allow r = 128, c = 256. This will provide a 128 bit security margin without sacrificing a lot in the rate. Such security cannot be attained with smaller permutation (e.g. for a width of 256 bits).
Note: Biv is one of the authors.
