Improved zero-sum distinguisher for full round Keccak-f permutation

Abstract

Keccak is one of the five hash functions selected for the final round of the SHA-3 competition, and its inner primitive is a permutation called Keccak-f . In this paper, we observe that for the inverse of the only nonlinear transformation in Keccak-f , the algebraic degree of any output coordinate and the one of the product of any two output coordinates are both 3, which is 2 less than its size of 5. Combining this observation with a proposition on the upper bound of the degree of iterated permutations, we improve the zero-sum distinguisher for the Keccak-f permutation with full 24 rounds by lowering the size of the zero-sum partition from 2 1590 to 2 1575 .