Open AccessGrøstl Distinguishing Attack: A New Rebound Attack of an AES-like Permutation
Author(s) -
Victor Cauchois,
Clément Gomez,
Reynald Lercier
Publication year - 2017
Publication title -
iacr transaction on symmetric cryptology
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.715
H-Index - 10
ISSN - 2519-173X
DOI - 10.46586/tosc.v2017.i3.1-23
Subject(s) - permutation (music) , computer science , computation , hash function , byte , differential (mechanical device) , algorithm , arithmetic , parallel computing , mathematics , computer security , computer hardware , physics , acoustics , engineering , aerospace engineering
We consider highly structured truncated differential paths to mount a new rebound attack on Grøstl-512, a hash functions based on two AES-like permutations, P1024 and Q1024, with non-square input and output registers. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with a SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. This yields the first distinguishing attack on a 11-round version of P1024 and Q1024 with about 272 computations and a memory complexity of about 256 bytes, to be compared with the 296 computations required by the corresponding generic attack. Previous best results on this permutation reached 10 rounds with a computational complexity of about 2392 operations, to be compared with the 2448 computations required by the corresponding generic attack.