## New bounds on differential trails in Keccak-*f*

15 March 2017

In a joint work with **Silvia Mella** (STMicroelectronics and University of Milano), we propose a framework for bounding the weight of differential trails. We apply this on Keccak-*f* with widths of 200, 400, 800 and 1600 bits to show that **no trail of weight less than 92 over 6 rounds exist** in either of these Keccak-*f* instances. Should a 6-round differential trail be used as part of a collision attack, the ratio of complying pairs is thus guaranteed to be at most 2^{-92}.

This work improves over our results of FSE 2012, both extending the coverage of differential trails both over the different Keccak-*f* widths and over a higher weight per round. In particular, Silvia was able to scan all 3-round trails up to weight 45. At 15 per round, and given the exponential growth of trail number per weight, this is a significant improvement over previous works.

Silvia presented her work at FSE 2017. The paper can be found here.