Paper 2026/2430

Distinguishers for the Squeezing of the Alternating Sponge and Duet

Abstract

Recently, the Institute of Commercial Cryptography Standards (ICCS) launched the Next Generation Commercial Cryptographic Algorithm Program (NGCC), which includes a standardization process for cryptographic hash functions. In this note, we analyze the mode of operation of Duet, one of the hash-function candidates. Duet is a permutation-based hash function directly inspired by the Alternating Sponge (ASP). Both constructions use two permutations on $b=r+c$ bits, split into an outer part of $r$ bits and an inner part of $c$ bits. We first present a distinguisher against ASP requiring $\mathcal{O}(2^r)$ permutation queries, which contradicts the claimed indifferentiability bound in a non-trivial parameter regime. We then introduce a distinguisher and a state-recovery attack against Duet. Both attacks require only a constant number of $h$-bit output blocks, with $h\leq c$, and $\mathcal{O}(2^{r+c-h})$ permutation queries. These attacks do not affect the claimed collision or preimage resistance, but they distinguish Duet's multi-block output from random, with consequences if Duet is used as a XOF or a KDF; state recovery also enables length extension.