Guido Bertoni3, Joan Daemen2, Seth Hoffert, Michaël Peeters1, Gilles Van Assche1 and Ronny Van Keer1
1STMicroelectronics - 2Radboud University - 3Security Pattern
27 December 2022
Looking back at 2022, we further improved the bounds of differential and linear trails in Xoodoo. In the article Tighter trail bounds for Xoodoo available on the IACR Cryptology ePrint Archive, we report on the outcome of our new trail scan effort. The importance of trail bounds is not to be repeated; instead we refer to last year's news item for a discussion. As you can see in the table below, the lower bounds have been quite significantly improved.
Next to a description of the optimizations in our trail search code that allowed us to improve the bounds, in the article we also report on a set of trails that are extendable to an arbitrary number of rounds and as such provide upper bounds for the minimum weight of trails. We summarize the new lower and upper bounds for the weight of trails in the table below. The bounds are the same for differential and linear trails.
# rounds | 1 | 2 | 3 | 4 | 5 | 6 | 8 | 10 | 12 |
---|---|---|---|---|---|---|---|---|---|
Lower bounds | 2 | 8 | 36 | 80 | 98 | 132 | 176 | 220 | 264 |
Upper bounds | 2 | 8 | 36 | 80 | 120 | 168 | 288 | 440 | 624 |