New results on Gimli: full-permutation distinguishers and improved collisions.

\(\mathsf {Gimli}\) is a family of cryptographic primitives (both a hash function and an AEAD scheme) that has been selected for the second round of the NIST competition for standardizing new lightweight designs. The candidate \(\mathsf {Gimli}\) is based on the permutation \(\mathsf {Gimli}\), which was presented at CHES 2017. In this paper, we study the security of both the permutation and the constructions that are based on it. We exploit the slow diffusion in \(\mathsf {Gimli}\) and its internal symmetries to build, for the first time, a distinguisher on the full permutation of complexity \(2^{64}\). We also provide a practical distinguisher on 23 out of the full 24 rounds of \(\mathsf {Gimli}\) that has been implemented.