Abstract:Higher order differential properties constitute a very insightful tool at the hands of a cryptanalyst allowing for probing a cryptographic primitive from an algebraic perspective. In FSE 2017, Saha et al. reported SymSum (referred to as in this paper), a new distinguisher based on higher order vectorial Boolean derivatives of SHA-3 , constituting one of the best distinguishers on the latest cryptographic hash standard. exploits the difference in the algebraic degree of highest degree monomials in the algebraic normal form of SHA-3 with regards to their dependence on round constants. Later in AFRICACRYPT 2020, Suryawanshi et al. extended using linearization techniques and in SSS 2023 also applied it to NIST-LWC finalist Xoodyak . However, a major limitation of is the maximum attainable derivative ( MAD ) of the polynomial representation, which is less than half of the widely studied ZeroSum distinguisher. This is attributed to being dependent on k -fold vectorial derivatives while ZeroSum relies on k -fold simple derivatives. In this work we overcome this limitation of by developing and validating the theory of computing with simple derivatives. This gives us a close to improvement in the MAD that can be computed. The new distinguisher reported in this work can also be combined with 1/2-round linearization to penetrate more rounds. Moreover, we identify an issue with the 2-round linearization claim made by Suryawanshi et al. which renders it invalid and also furnishes an algebraic fix at the cost of some additional constraints. Combining all the results we report , a new variant of the distinguisher based on k -fold simple derivatives that outperforms ZeroSum by a factor of for round SHA3-384 and 9-round SHA3-512 respectively while enjoying the same MAD as ZeroSum . For every other SHA-3 variant, maintains an advantage of factor 2 over the ZeroSum . Combined with 1/2-round linearization, improves upon all existing ZeroSum and distinguishers on both SHA-3 and Xoodyak . As regards Keccak , the internal permutation of SHA-3 , we report the best 15-round distinguisher with a complexity of and the first better than birthday-bound 16-round distinguisher with a complexity of (improving upon the 15/16-round results by Guo et al. in ASIACRYPT 2016). We also devise the best full-round distinguisher on the Xoodoo internal permutation of Xoodyak with a practically verifiable complexity of and furnish the first third-party distinguishers on the Belarushian-standard hash function Bash . All distinguishers presented in this work have been verified through implementations whenever practically viable. Overall, with the MAD barrier broken, emerges as a better distinguisher than ZeroSum on all fronts and adds to the state-of-the-art of cryptanalytic tools investigating non-randomnes -Abstract Truncated-

Partial-Collision Attack on the Round-Reduced Compression Function of Skein-256.

The Boomerang Attacks on the Round-Reduced Skein-512.

The Boomerang Attacks on Round-Reduced Skein-1024

Improved related-key boomerang attacks on round-reduced threefish-512

Cryptanalysis Of The Compression Function Of Simd

Impossible Differential Attack On Reduced-Round Twine

Improved Boomerang Attacks on Round-Reduced SM3 and Keyed Permutation of BLAKE-256

Cryptanalysis of Reduced-Round SipHash

Triangulating Rebound Attack on AES-like Hashing

Improved Cryptanalysis of Step-Reduced SM3

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Differential-algebraic Cryptanalysis of Reduced-Round of Serpent-256

Snowball: Another View on Side-Channel Key Recovery Tools.

Improved Impossible Differential Attack on Reduced-Round LBlock.

Chosen-Key Distinguishers on 12-Round Feistel-SP and 11-Round Collision Attacks on Its Hashing Modes

Interpolation Attacks on Round-Reduced Elephant, Kravatte and Xoofff

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Differential-Aided Preimage Attacks On Round-Reduced Keccak

Simple vs. vectorial: exploiting structural symmetry to beat the ZeroSum distinguisher

New Distinguisher on Reduced-Round Keccak Sponge Function.

Preimage attacks on reduced-round Ascon-Xof