Iterative Differential Characteristic of TRIFLE BC
TRIFLE is a Round 1 candidate of the NIST Lightweight Cryptography Standardization process. In this paper, we present an interesting 1 round iterative differential characteristic of the underlying block cipher TRIFLE BC used in TRIFLE, which holds with probability of (2^ 3} Consequently, it allows to mount distinguishing attack on TRIFLE BC for up to 43 (out of 50) rounds with data complexity (2^{124} and time complexity (2^{124} Most importantly, with such an iterative differential characteristic, the forgery attack on TRIFLE can reach up to 21 (out of 50) rounds with data complexity (2^{63} and time complexity (2^{63} Finally, to achieve key recovery attack on reduced TRIFLE, we construct a differential characteristic covering three blocks by carefully choosing the positions of the iterative differential characteristic. As a result, we can mount key recovery attack on TRIFLE for up to 11 rounds with data complexity (2^{63} and time complexity (2^{104} Although the result in this paper cannot threaten the security margin of TRIFLE, we hope it can help further understand the security of TRIFLE.
IACR Cryptol. ePrint Arch.