Note of Multidimensional MITM Attack on 25-Round TWINE-128

TWINE is a lightweight block cipher proposed in SAC 2012 by Suzaki et al.. TWINE operates on 64-bit block and supports 80 or 128bit key, denoted as TWINE-80 and TWINE-128 respectively. TWINE has attracted some attention since its publication and its security has been analyzed against several cryptanalytic techniques in both singlekey and related-key settings. In the single-key setting, the best attack so far is reported by Boztaş et al. at LightSec’13, where a splice-andcut attack on 21-round TWINE-128 and a multidimensional meet-inthe-middle (MITM) attack on 25-round TWINE-128 are presented. Yet, the evaluation of the time complexity of the multidimensional MITM attack on 25-round TWINE-128 is somehow controversial in the way we understand. We here describe the attack in detail and explains our concerns about the time complexity of the attack. And it turns out that the multidimensional MITM attack on 25-round TWINE-128 may have a time complexity higher than exhaustive search.