On Impossible and Truncated Distinguishers for IoT-Friendly AEAD Algorithms

In this paper, we propose a methodology for finding impossible differential distinguishers for permutations used in sponge-like constructions. Given the difference between typical block ciphers and such permutations in terms of key additions, we initiate the construction of an impossible differential trail starting from the middle round. Based on the proposed methodology, we present several new or improved truncated and impossible distinguishers for ASCON, DRYGASCON, SYCON, and SHAMASH, all of which were submitted to the NIST Lightweight Cryptography project. For ASCON, we significantly reduce the attack complexity compared to existing results, and notably, this marks the first instance of proposing specific truncated and impossible differential trails for SYCON and SHAMASH. Finally, we discuss how truncated differential distinguishers, identified using our methodology, enable key-recovery attacks in weak-key setting. The methodology of this paper is significant not only for the ciphers considered but also for other permutation-based ciphers with similar structures. Given that the target algorithms are suitable for resource-constrained devices, our results provide new insights into security for the Internet of Things.