<figure><img src="image_1.png" /></figure>

HAL
open science

# Note: Full-round distinguisher for Synergy

Orr Dunkelman, Eran Lambooij, Gaëtan Leurent

► To cite this version:

Orr Dunkelman, Eran Lambooij, Gaëtan Leurent. Note: Full-round distinguisher for Synergy. 2026. [https://inria.hal.science/hal-05468328v1](https://inria.hal.science/hal-05468328v1).

HAL Id: hal-05468328

[https://inria.hal.science/hal-05468328v1](https://inria.hal.science/hal-05468328v1)

Preprint submitted on 20 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
Note: Full-round distinguisher for Synergy

Orr Dunkelman¹,²

Eran Lambooij³

Gaëtan Leurent³

¹University of Haifa, Israel

²TU Berlin, Germany

³Inria, France

July 3, 2025

This short note looks at the proposed cipher Synergy [1]. Synergy is a 16-round, 64-bit Feistel construction with a data-dependent rotation as the round function The master-key is 1024 bits and the roundkeys are computed by applying some PRNGs to a state initialized by the master-key. We can assume the round-keys to be independent as only 512 bits of key material is absorbed into the state.

The round function $f_k : \{0, 1\}^{32} \rightarrow \{0, 1\}^{32}$ can be described by:

$$f_k(x) = k \oplus f(x)$$

$$f(x) = \tau_{x[4:0]}(x),$$

where $\tau_i$ denotes left rotation by $i$ bits, and $x[4:0]$ extracts bits 0 to 4.

An interesting observation is that if the difference in the 5 least significant bits of the inner round function is 0, the output difference hamming-weight is equal to the input difference hamming weight. In other words, if we have a one bit input difference, the probability of getting a one bit output difference is $\frac{27}{32}$.

This observation leads to the following differential characteristic, which holds with probability $(27/32) \cdot (1/32) \approx 2^{-5.25}$, where $e_i = 1 \ll i$:

$$(e_i, 0) \xrightarrow{p=27/32} (e_j, e_i) \xrightarrow{p=2^{-5}} (0, e_j) \rightarrow (e_j, 0)$$

for $32 > i, j > 4$.

By starting with the input difference $(0, e_i)$, this results in a 16-round characteristic with a probability of approximately $2^{-26.23}$.

We can improve the probability of the characteristic by allowing for any difference in the left hand side in the last round:

$$(e_i, e_j) \rightarrow \dots 12\text{-rounds} \rightarrow (0, e_i) \rightarrow (e_i, 0) \rightarrow (e_j, e_i) \rightarrow (*, e_j)$$

This characteristic will have a probability of $2^{-5} \cdot 2^{-5.25 \cdot 4} \cdot (27/32) \approx 2^{-25.74}$. We can skip the first round by picking the input values of the form: $p_1 = (A, B)$ and $p_2 = (A \oplus e_i, B \oplus f(A) \oplus f(A \oplus e_i))$, with $A, B \in \{0, 1\}^{32}$ and $i \ge 5$. This gives us a probability of $2^{-20.74}$ to observe a one bit difference in the right hand side of the output difference.

To verify the above probabilities we did a short experiment by encrypting $2^{32}$ pairs with input difference $(0, 0 \times 100)$ and counting the number of pairs where the hamming weight of (part of) the output difference is 1. For the full output difference we got a probability of $2^{-25.96}$, for the right half we get a probability of $2^{-21.29}$ and for the left half we get a probability of $2^{-22.96}$.

## References

[1] Lindman A.: Synergy: A Lightweight Block Cipher with Variable Bit Rotation Feistel Network. Eprint 2025/1051.