Cryptology ePrint Archive: Report 2020/667

New Results on the SymSum Distinguisher on Round-Reduced SHA3

Sahiba Suryawanshi and Dhiman Saha and Satyam Sachan

Abstract: In ToSC 2017 Saha et al. demonstrated an interesting property of SHA3 based on higher-order vectorial derivatives which led to self-symmetry based distinguishers referred to as SymSum and bettered the complexity w.r.t the well-studied ZeroSum distinguisher by a factor of 4. This work attempts to take a fresh look at this distinguisher in the light of the linearization technique developed by Guo et al. in Asiacrypt 2016. It is observed that the efficiency of SymSum against ZeroSum drops from 4 to 2 for any number of rounds linearized. This is supported by theoretical proofs. SymSum augmented with linearization can penetrate up to two more rounds as against the classical version. In addition to that, one more round is extended by inversion technique on the final hash values. The combined approach leads to distinguishers up to 9 rounds of SHA3 variants with a complexity of only 264 which is better than the equivalent ZeroSum distinguisher by the factor of 2. To the best of our knowledge this is the best distinguisher available on this many rounds of SHA3.

Category / Keywords: SHA3 · Keccak· Distinguisher · SymSum· ZeroSum· Higher-order Derivatives

Original Publication (with minor differences): 12th International Conference on Cryptology, AFRICACRYPT2020 July 20-22, 2020.

Date: received 4 Jun 2020, last revised 4 Jun 2020

Contact author: sahibas at iitbhilai ac in

Available format(s): PDF | BibTeX Citation

Version: 20200605:195152 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]