# Security Analysis of the Symmetric Cryptosystem Tiny Jambu
## 4 Reducing the Security Margin of TinyJambu against Differential Cryptanalysis
### Differential Trail Search with 640 Rounds  
Since the updated version of TinyJambu [10] increases the number of rounds in the nonce introduction to 640, we can analyze the effect of this increment on the differential trail search. First of all, it must be noticed that with a single PC, it is unfeasible to address the search of differentials when the keyed permutation is \(P_{640}\).  
At any rate, we can sketch a strategy that allows us to partially tackle this computation. Indeed, we observed in Tables 2 and 4 (as well as in many other differentials obtained in this work) that the 32 most significant bits in the two last rows of the tables coincide. That is, \(\Delta S_{383\ldots 352}=\Delta S_{511\ldots 480}\) in all the examples. The justification for such a coincidence is as follows.  
For instance, in Table 4, the row before the last is  
\begin{tabular}{c|c c c} \hline \(\Delta S_{383\ldots 256}\) & 40800441 & 00008100 & 0880000c & 12009120 \\ \hline \end{tabular}  
Then, after 96 rounds the differences would be  
\begin{tabular}{c|c c c} \hline \(\Delta S_{479\ldots 382}\) & 0000000 & 00000000 & 00000000 & 40800441 \\ \hline \end{tabular}  
Remark that \(\Delta S_{\{479\ldots 384\}}=0\) means that  
\[\Delta S_{i}=S_{i}\oplus S_{i}^{*}=0\quad\text{for}(i=384,\ldots,479), \tag{13}\]  
so that the state bits \(S_{i}\) and \(S_{i}^{*}\) are equal in the range \((i=384,\ldots,479)\).  
Next, according to the TinyJambu recurrence relationship, the new state bits \(S_{i}\) and \(S_{i}^{*}\) computed in the following 32 rounds would be as follows:  
\[S_{480+j}=S_{352+j}\oplus S_{399+j}\oplus\left(\overline{S_{422+j}\cdot S_{43 7+j}}\right)\oplus S_{443+j}\quad(j=0,\;1,\ldots,31)\]  
\[S_{480+j}^{*}=S_{352+j}^{*}\oplus S_{399+j}^{*}\oplus\left(\overline{S_{422+j }^{*}\cdot S_{437+j}^{*}}\right)\oplus S_{443+j}^{*}\quad(j=0,\;1,\ldots,31).\]  
Therefore, the differential can be written as  
\[\Delta S_{480+j}=\Delta S_{352+j}\oplus\Delta S_{399+j}\oplus\Delta\big{(} \overline{S_{422+j}\cdot S_{437+j}}\big{)}\oplus\Delta S_{443+j}\quad(j=0,\;1,\ldots,31).\]  
Thus, according to Equation (13), the following equalities hold:  
\[\Delta S_{399+j}=S_{399+j}\oplus S_{399+j}^{*}=0\quad(j=0,\;1,\ldots,31).\]  
\[\Delta S_{443+j}=S_{443+j}\oplus S_{443+j}^{*}=0\quad(j=0,\;1,\ldots,31).\]  
\[\Delta\Big{(}\overline{S_{422+j}\cdot S_{437+j}^{*}}\Big{)}=\big{(}\overline{ S_{422+j}\cdot S_{437+j}^{*}}\big{)}\oplus\left(\overline{S_{422+j}^{*} \cdot S_{437+j}^{*}}\right)=0\quad(j=0,\;1,\ldots,31).\]  
Since,  
\[S_{422+j}=S_{422+j}^{*}\quad(j=0,\;1,\ldots,31).\]  
\[S_{437+j}=S_{437+j}^{*}\quad(j=0,\;1,\ldots,31).\]  
Consequently,  
\[\Delta S_{480+j}=\Delta S_{352+j}\oplus 0\oplus 0\oplus 0,\]and the 32 most significant bits in the two last rows of the tables coincide; that is,  
\[\Delta S_{\{383...352\}}=\Delta S_{\{511...480\}}\]  
The reasoning is general for any differential trail with a number of rounds \(l=384\), 512, 640, etc., or for any multiple of 128, provided that the output differential is type 3; that is, not all of the 32 most significant bits are 0, but the remaining bits equal 0.  
This coincidence can be successfully exploited to tackle the trail search along 640 rounds. In fact, the computational problem can be split into two different search processes:  
1. Take an input differential of type 3.
2. Search for a differential trail along 512 rounds with a number X of \(AND\) gates as low as possible. Upon obtaining \(\Delta S_{\{639...512\}}\), take the 32 most significant bits \(\Delta S_{\{639...608\}}\).
3. Search for a differential trail along 128 rounds with \(\Delta S_{\{639...512\}}\) as the input differential and \(\Delta S_{\{767...640\}}=\Delta S_{\{639...608\}}\) 00000000 00000000000 as the output differential.
4. Obtain a differential trail of type 3 with 640 rounds.  
The obtained trail is probably not the optimal trail, but it exhibits a suitable number of \(AND\) gates, and it was obtained with low computational resources.