New models for the cryptanalysis of ASCON

Abstract

This paper focuses on the cryptanalysis of the ASCON family using automatic tools. We analyze two different problems with the goal to obtain new modelings, both simpler and less computationally heavy than previous works (all our models require only a small amount of code and run on regular desktop computers). The first problem is the search for Meet-in-the-middle attacks on reduced-round ASCON–XOF. Starting from the MILP modeling of Qin et al. (Meet-in-the-middle preimage attacks on sponge-based hashing. In: EUROCRYPT (4). Lecture notes in computer science, vol 14007. Springer, pp. 158–188, 2023. https://doi.org/10.1007/978-3-031-30634-1_6), we rephrase the problem in SAT, which accelerates significantly the solving time and removes the need for the “weak diffusion structure” heuristic. This allows us to reduce the memory complexity of Qin et al.’s attacks and to prove some optimality results. The second problem is the search for lower bounds on the probability of differential characteristics for the ASCON permutation. We introduce a lossy MILP encoding of the propagation rules based on the Hamming weight, in order to find quickly lower bounds which are comparable to the state of the art. We find a small improvement over the existing bound on 7 rounds.