# Security Analysis of the Symmetric Cryptosystem Tiny Jambu
## 1 Introduction
In addition, we improved a forgery attack, for condition (e), which is the best cryptanalytical attack currently reported against the cryptosystem TinyJambu. The remaining conditions are included in the parameters and specifications of the algorithm itself, given by the designers. In the original TinyJambu proposal [6], the authors analyzed the success probability of a forgery attack against a nonce introduction and quantified such a probability as \(2^{-80}\), where \(80\) was the number of active _AND_ gates in a particular differential trail. Since the probability of \(2^{-80}\) is extremely low, the designers claimed immunity for TinyJambu against this kind of cryptanalysis. Later, in reference [7], the authors developed a more refined model of differential trail search and evidenced the correlation among active _AND_ gates. According to these additional features, they could compute more precisely the probability of forgery attack and provided a new probability of value \(2^{-70.64}\). In this work, we used the same search model developed in [7] and sought a maximum number of different trails with a minimum number of uncorrelated _AND_ gates. The final result is the computation of a success probability of value \(2^{-65,948}\), which is improved from previous numerical results. To compute such a probability, we adapted the programs provided in [8] and carried out a more exhaustive search of differential trails of type 3 on a keyed permutation of 384 rounds. To obtain these numerical results, we used a desktop PC with a 13 th Gen Intel (R) Core (TM) i9-13900K with 3.00 GHz, RAM of 128 GB with 24 cores and a Microsoft Windows 11 Pro operating system. Note that our computational resources were quite general. We also used Python version 3.11 64-bit and Gurobi Optimizer version 10.0.1 build v10.0.1 rc0 (win64) [9]. In the TinyJambu updated design [10], the number of rounds in the nonce introduction was increased to 640. The new design wins in security but loses in performance. At any rate, our results show a reduced security margin compared to that given by the designers (first version of TinyJambu with 384 rounds), although their impact was less for the 640-round updated version. In addition, we introduced a new strategy to simplify the trail search computation when the 640-round problem was tackled. Concerning the randomness study, we analyzed in detail what would be the TinyJambu keystream sequence by concatenating the stream of bits that the algorithm uses in the phases of encryption/decryption. The generation of these sequences is symmetric in both emission and reception. Later, a wide and powerful battery of statistical tests (graphical tests, Diehard battery of tests or FIPS Test 140-2 from the NIST) were applied to these keystream sequences. To our knowledge, this is the first time that such a deep statistical analysis has been performed over TinyJambu sequences as most attacks against this cryptosystem have been conducted in the cryptanalyses of block ciphers [11; 12]. The rest of this paper is organized as follows. In Section 2, we describe the TinyJambu candidate of the NIST Lightweight Cryptography Standardization Project. Next, in Section 3, we consider the security analysis found in the literature about this lightweight cryptosystem. In Section 4, we reduce the security margin of TinyJambu by improving the search for optimal differential trails and, consequently, the final differential probability in the nonce introduction phase. The 640-round problem is also considered. Next, we analyze the keystream sequence of this cryptosystem in terms of randomness. Finally, the conclusions and future work in Section 6 conclude the paper.