A Distinguisher for the Compression Function of SIMD-512

SIMD is one of the round 2 candidates of the public SHA-3 competition hosted by NIST. It was designed by Leurent et al.. In this paper, we present a distinguisher attack on the compression function of SIMD-512. By linearizing the compression function we construct a linear code. Using techniques from coding theory to search for low Hamming weight codewords, we can find differential characteristics with low Hamming weight (and hence high probability). In the attack the differences are introduced only in the IV . Such a characteristic is the base for our distinguisher, which can distinguish the compression function of SIMD-512 from random with a complexity of 5 · 2 compression function calls. Furthermore, we can distinguish the output transformation of SIMD-512 from random with a complexity of about 22 · 2 compression function calls. So far this is the first cryptanalytic result for the SIMD hash function.