Zero-Sum Distinguishers for Iterated Permutations and Application to Keccak-f and Hamsi-256

Christina Boura (1, 2) , Anne Canteaut (1)

1 SECRET - Security, Cryptology and Transmissions
2 Gemalto [Meudon]

The zero-sum distinguishers introduced by Aumasson and Meier are investigated. First, the minimal size of a zero-sum is established. Then, we analyze the impacts of the linear and the nonlinear layers in an iterated permutation on the construction of zero-sum partitions. Finally, these techniques are applied to the Keccak-f permutation and to Hamsi-256. We exhibit several zero-sum partitions for 20 rounds (out of 24) of Keccak-f and some zero-sum partitions of size 2^{19} and 2^{10} for the finalization permutation in Hamsi-256.

Mots clés: Hash functions; integral properties; zero-sums; SHA-3

Domaines: Cryptographie et sécurité [cs.CR]

Christina Boura, Anne Canteaut. Zero-Sum Distinguishers for Iterated Permutations and Application to Keccak-f and Hamsi-256. Selected Areas in Cryptography - 17th International Workshop, SAC 2010,, Aug 2010, Waterloo, Ontario,, Canada. pp.1-17. ⟨hal-00738200⟩