# Security Analysis of the Symmetric Cryptosystem Tiny Jambu
## 4 Reducing the Security Margin of TinyJambu against Differential Cryptanalysis
### Security Margin with 384 Rounds  
Our goal was to look for differential type 3 trails with a number of uncorrelated _AND_ gates X \(<\) 74, as 74 is the lowest value reported by the authors in [7]. To fulfill this task, we used the Gurobi Optimizer [9] and the refined model developed in [7]. First of all, we looked for the optimal number of active _AND_ gates X through a type 3 trail with \(l\) = 384 rounds in the TinyJambu feedback function. According to the Gurobi Optimizer, the optimal value of uncorrelated _AND_ gates in this scenario is X = 71. More precisely, the optimizer provided us with a differential trail of type 3 with 84 active _AND_ gates and 13 correlated gates. Thus, this differential trail propagates with probability \(p=~{}2^{-84+13}=2^{-71}\), as described in Table 4.  
The first row of Table 4, including \(\Delta S_{\{127...0\}}\), corresponds to the initial differential, while the following rows, including \(\Delta S_{\{255...128\}}\), \(\Delta S_{\{383...256\}}\) and \(\Delta S_{\{511...384\}}\), correspond to the differentials after 128, 256 and 384 rounds, respectively. Notice that in type 3 differences, the input/output differentials are just the values in \(\Delta S_{\{127...96\}}\) / \(\Delta S_{\{511...480\}}\), respectively, as the remaining differences in both \(\Delta S_{\{95...0\}}\) and \(\Delta S_{\{479...384\}}\) equal 0. Table 4 as a whole shows the differential propagation through the permutation \(P_{384}\) with information about the intermediate differences. Once the minimum value of uncorrelated active _AND_ gates was obtained, we honed in on a long interval of possible solutions provided by the Gurobi. Proceeding in this way, we could identify a cluster of multiple trails with the same input \(\Delta S_{\{127...0\}}\) and output \begin{table}
\begin{tabular}{c c c c c c} \hline \hline Input: \(\Delta S_{127...0}\) & 048a2000 & 00000000 & 00000000 & 00000000 \\ \hline \(\Delta S_{255...128}\) & 44800001 & 12000986 & 48800020 & 91440000 \\ \hline \(\Delta S_{383...256}\) & 40800441 & 00008100 & 0880000c & 12009120 \\ \hline Output: \(\Delta S_{511...384}\) & 40800441 & 0000000 & 0000000 & 00000000 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: A differential trail type 3 with probability \(2^{-71}\) for 384 rounds. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline Input: \(\Delta S_{127...0}\) & 01004800 & 00000000 & 0000000 & 00000000 \\ \hline \(\Delta S_{255...128}\) & 81044c80 & 24080304 & d9200000 & 22090000 \\ \hline \(\Delta S_{383...256}\) & 81004082 & 00010200 & 83000010 & 26090240 \\ \hline Output: \(\Delta S_{511...384}\) & 81004082 & 00000000 & 0000000 & 00000000 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: A differential trail type 3 with probability \(2^{-74}\) for 384 rounds. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline Probability & \(2^{-74}\) & \(2^{-75}\) & \(2^{-76}\) & \(2^{-77}\) & \(2^{-78}\) & \(2^{-79}\) & \(2^{-80}\) \\ \hline \#Trails & 1 & 5 & 9 & 14 & 20 & 24 & 30 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Differential trails with the same input/output differential masks defined in Table 2.  
\(\Delta S_{\{511...384\}}\) differential masks, which appear in Table 4. All these trails start and end at the same differentials, but the intermediate differences and the number X of _AND_ gates may be different. The distribution of such trails (#Trails) is depicted in Table 5, where the number X of active _AND_ gates ranges in the interval X \(\in[71,\ \ldots,\ 77]\). As before, by summing up all of these probabilities, we obtained a final differential probability of value  
\[p=9\cdot 2^{-71}+24\cdot 2^{-72}+27\cdot 2^{-73}+28\cdot 2^{-74}+18\cdot 2^{-75}+14 \cdot 2^{-76}+22\cdot 2^{-77}.\]  
\[p=(33.15625)\ 2^{-71}.\]  
Thus, our final differential probability is  
\[p=2^{-65.9487}. \tag{10}\]  
According to Equation (10), it can be noticed that the new differential probability is a good approach to the inequality \(p\geq 2^{-64}\) that breaks the 64-bit security.