Zero-sum distinguishers for iterated permutations and application to Keccak-f and hamsi-256

Abstract

The zero-sum distinguishers introduced by Aumasson and Meier are investigated. First, the minimal size of a zero-sum is established. Then, we analyze the impacts of the linear and the nonlinear layers in an iterated permutation on the construction of zero-sum partitions. Finally, these techniques are applied to the Keccak-f permutation and to Hamsi-256. We exhibit several zero-sum partitions for 20 rounds (out of 24) of Keccak-f and some zero-sum partitions of size 219 and 210 for the finalization permutation in Hamsi-256. © 2011 Springer-Verlag Berlin Heidelberg.