Paper 2017/181

New techniques for trail bounds and application to differential trails in Keccak

Silvia Mella, Joan Daemen, and Gilles Van Assche


We present new techniques to efficiently scan the space of high-probability differential trails in bit-oriented ciphers. Differential trails consist in sequences of state patterns that we represent as ordered lists of basic components in order to arrange them in a tree. The task of generating trails with probability above some threshold starts with the traversal of the tree. Our choice of basic components allows us to efficiently prune the tree based on the fact that we can tightly bound the probability of all descendants for any node. Then we extend the state patterns resulting from the tree traversal into longer trails using similar bounding techniques. We apply these techniques to the 4 largest Keccak-f permutations, for which we are able to scan the space of trails with weight per round of 15. This space is orders of magnitude larger than previously best result published on Keccak-f[1600] that reached 12, which in turn is orders of magnitude larger than any published results achieved with standard tools, that reached at most 9. As a result we provide new and improved bounds for the minimum weight of differential trails on 3, 4, 5 and 6 rounds. We also report on new trails that are, to the best of our knowledge, the ones with the highest known probability.

Available format(s)
Publication info
Published by the IACR in TOSC 2017
Contact author(s)
silvia mella @ unimi it
joan daemen @ st com
gilles vanassche @ st com
2017-02-27: received
Short URL
Creative Commons Attribution


      author = {Silvia Mella and Joan Daemen and Gilles Van Assche},
      title = {New techniques for trail bounds and application to differential trails in Keccak},
      howpublished = {Cryptology ePrint Archive, Paper 2017/181},
      year = {2017},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.