Experimentally obtained differential-linear distinguishers for Sycon

Abstract Sycon is an authenticated encryption algorithm with associated data submitted to NIST’s recently finalized lightweight cryptography competition. Ascon won the competition, while Sycon was eliminated in the first round. Subsequently, the designers proposed an improved version of Sycon that closely resembles Ascon . In this work, we optimize the latest Sycon permutation for GPUs using CUDA, achieving a processing rate of $$2^{34.89}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>34.89</mml:mn> </mml:mrow> </mml:msup> </mml:math> full 12-round Sycon permutations per second on an RTX 4090 GPU. This optimization enables us to experimentally derive differential-linear (DL) distinguishers, which combine differential and linear characteristics to enhance their effectiveness. We present several 2-round and 3-round probability-one truncated differential characteristics, along with 2-round, 3-round, and 4-round linear characteristics. Using these characteristics, we introduce the first 5-round DL distinguishers for Sycon with a bias of $$2^{-8.55}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>8.55</mml:mn> </mml:mrow> </mml:msup> </mml:math> . We also improve the reported $$2^{-2.8}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>2.8</mml:mn> </mml:mrow> </mml:msup> </mml:math> bias for the 4-round DL distinguisher to $$2^{-2.57}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>2.57</mml:mn> </mml:mrow> </mml:msup> </mml:math> . Furthermore, we present 5-round practical key recovery DL biases for Sycon when used in Ascon -mode: $$2^{-15.25}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>15.25</mml:mn> </mml:mrow> </mml:msup> </mml:math> for key recovery, $$2^{-15.22}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>15.22</mml:mn> </mml:mrow> </mml:msup> </mml:math> for related key scenarios, and $$2^{-12.75}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mo>-</mml:mo> <mml:mn>12.75</mml:mn> </mml:mrow> </mml:msup> </mml:math> for IV misuse. Our observations indicate that Sycon ’s permutation, though marginally slower in software due to additional rotation operations within its linear layer, might offer better resistance to DL cryptanalysis compared to Ascon . We also address the issue of misreported test vectors for Sycon and provide corrected vectors to aid accurate analyses. Our code is available for future analyses and verification.