Generalized Distinguishing Attack: A New Cryptanalysis of AES-like Permutations

We consider highly structured truncated differential paths to mount rebound attacks on hash functions based on AES-like permutations. We explain how such differential paths can be computed using a Mixed-Integer Linear Programming approach. Together with the SuperSBox description, this allows us to build a rebound attack with a 6-round inbound phase whereas classical rebound attacks have 4-round inbound phases. Non-square AES-like permutations seem to be more vulnerable than square ones. We illustrate this new technique by mounting the first distinguishing attack on a 11-round version of Grøstl-512 internal permutation P1024 with O(272) computational complexity and O(256) memory complexity, to be compared with the O(296) required computations of the corresponding generic attack. Previous best results on this permutation reached 10 rounds with a computational complexity of O(2392), to be compared with O(2448) required by the corresponding generic attack.