# Security Analysis of the Symmetric Cryptosystem Tiny Jambu
## 3 Security of TinyJambu against Cryptanalytic Attacks
### Differential Probabilities  
In reference [6], the designers searched for differential trails under four different constraints related to the bit positions \(S_{i}\) and \(S_{i}^{*}\) of the states before and after the permutation \(P_{l}\). The four types of differences are enumerated as follows:  
**Type 1 differences**: Input differences only exist at the 32 most significant bits (MSBs) of the input differential, that is, \(\Delta S_{\{127\ldots 96\}}\), with no constraints on the output differential.  
**Type 2 differences**: No constraints on the input differential while output differences only exist at the 32 MSBs of the output differential, that is, \(\Delta S_{\{511\ldots 480\}}\).  
**Type 3 differences**: Both input and output differences jointly exist at the 32 MSBs in input and output differentials, that is, in \(\Delta S_{\{127\ldots 96\}}\) and \(\Delta S_{\{511\ldots 480\}}\), respectively.  
**Type 4 differences**: No constraints at all.  
Concerning TinyJambu, type 3 is the most interesting scenario since, as described in item 2 of Section 2.2, the cryptosystem introduces a 96-bit nonce to three blocks of 32 bits each. Thus, in type 3, the input and output differences of an optimal trail can be injected as if they were the first and second 32-bit nonce blocks, respectively. Later, taking the previous output difference as the new input difference, we can compute a new optimal trail and its output difference can be injected as the third 32-bit nonce block. The type 3 differential trails allow this manipulation in the nonce introduction. Thus, the differential cryptanalysis exploits the introduction of the three nonce blocks in the frame of a nonce forgery attack. In brief, in this nonce setup phase, we have a keyed permutation with 384 rounds and an introduction of just three 32-bit blocks. The associated data introduction also allows the exploitation of this kind of forgery attack, but in such a case, the number of 32-bit blocks to be introduced may be larger.  
According to [6], the maximum probability found by the designers for a differential trail of type 3 was \(p=2^{-80}\), which is enough to guarantee 64-bit security. Nevertheless, in [7] (p. 166), the authors, making use of their refined model with correlated \(AND\) gates, found a better differential trail, and its evolution is presented in Table 2 in hexadecimal format. It is a differential trail type 3 with \(l=384\) rounds. Moreover, along this trail, they counted X = 88 active \(AND\) gates with 14 correlated gates. Therefore, their success probability is \(p=\ 2^{-88+14}=2^{-74}\). Later, they computed the differential probability by identifying a cluster of trails with the same input and output differentials but with different values of X. The number of trails associated with each probability (#Trails) is depicted in Table 3.  
By summing up the probability of each trail multiplied by the number of trails found, they computed the following differential probability:  
\[p=1\cdot 2^{-74}+5\cdot 2^{-75}+9\cdot 2^{-76}+14\cdot 2^{-77}+20\cdot 2^{-78}+24 \cdot 2^{-79}+30\cdot 2^{-80}.\]Therefore, the final differential probability given in [7] is  
\[p=2^{-70.68}, \tag{9}\]  
which is higher than the first probability \(p=2^{-80}\) obtained by the designers and referenced in [6].