Skip to content

Back to the catalog

Distinguishers for the Squeezing of the Alternating Sponge and Duet
eprint.iacr.orgpaper

Distinguishers for the Squeezing of the Alternating Sponge and Duet

Cryptanalysis of the Alternating Sponge (ASP) and Duet, a permutation-based hash candidate in China's ICCS Next Generation Commercial Cryptographic Algorithm program (NGCC). The authors give an O(2^r)-query distinguisher against ASP that contradicts its claimed indifferentiability bound in some parameter regimes. They also give a distinguisher and state-recovery attack on Duet's multi-block output, using O(2^(r+c-h)) permutation queries. Collision and preimage resistance are unaffected, but Duet used as a XOF or KDF is affected, and state recovery enables length extension.

TL;DR Leurent and Mathéus break the multi-block squeezing of Duet (NGCC hash candidate) and ASP's indifferentiability claim with distinguishers and state recovery.
Open original ↗

Organisations named here

  • Alternating Sponge
  • César Mathéus
  • Duet
  • Gaëtan Leurent
  • Institute of Commercial Cryptography Standards
  • length extension
  • NGCC

Technologies named here

  • Next Generation Commercial Cryptographic Algorithm Program

Techniques named here

  • Length extension enabled by state recovery in Duet

Related in other