A zero-sum property for the KECCAK-f permutation with 18 rounds

Abstract

A new type of distinguishing property, named the zero-sum property has been recently presented by Aumasson and Meier [1]. It has been applied to the inner permutation of the hash function KECCAK and it has led to a distinguishing property for the KECCAK-f permutation up to 16 rounds, out of 24 in total. Here, we additionally exploit some spectral properties of the KECCAK-f permutation and we improve the previously known upper bounds on the degree of the inverse permutation after a certain number of rounds. This result enables us to extend the zero-sum property to 18 rounds of the KECCAK-f permutation, which was the number of rounds in the previous version of KECCAK submitted to the SHA-3 competition.