A Preimage Attack on Reduced Gimli-Hash

In CHES 2017, Bernstein et al. proposed Gimli, a 384-bit permutation with 24 rounds, which aims to provide high performance on various platforms. In 2019, the full-round (24 rounds) Gimli permutation was used as an underlying primitive for building AEAD Gimli-Cipher and hash function Gimli-Hash. They were submitted to the NIST Lightweight Cryptography Standardization process and selected as one of the second-round candidates. In ToSC 2021, Liu et al. presented a preimage attack with a divide-and-conquer method on round-reduced Gimli-Hash, which uses 5-round Gimli. In this paper, we present preimage attacks on a round-reduced variant of Gimli-Hash, in which the message absorbing phase uses 5-round Gimli and the squeezing phase uses 9-round Gimli. We call this variant as 5-9-round Gimli-Hash. Our first preimage attack on 5-9-round Gimli-Hash requires 2 ^96.44 time complexity and 2 ⁹⁷ memory complexity. This attack requires the memory for storing several precomputation tables in Gimli SP-box operations. In our second preimage attack, we take a time-memory trade-off approach, reducing memory requirements for precomputation tables but increasing computing time for solving SP-box equations by SAT solver. This attack requires 2 ^66.17 memory complexity and 2 ^96+ϵ time complexity, where ϵ is a time complexity for solving SP-box equations. Our experiments using CryptoMiniSat SAT solver show that the maximum time complexity for ϵ is about 2 ^20.57 9-round Gimli.