Christina Boura
email: christina.boura@uvsq.fr

Rachelle Heim Boissier
email: rachelle.heim@uvsq.fr

Yann Rotella
email: yann.rotella@uvsq.fr

Breaking Panther

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Panther is a sponge-based lightweight AEAD scheme designed by Bhargavi, Srinivasan and Lakshmy [START_REF] Bhargavi | Panther: A sponge based lightweight authenticated encryption scheme[END_REF] and published at Indocrypt 2021. This construction works on a 328-bit state, divided as an outer part of rate r = 64 bits and an inner part of capacity c = 264 bits. The state is updated by iterating a function F that is composed of four interconnected NFSRs of sizes 19, 20, 21 and 22 nibbles respectively. This function is iterated 92 times for the initialization and the finalization part and only 4 times after the absorption of associated data (AD) or plaintext blocs or after the extraction of a block of the tag. The authors present their construction as lightweight, even if no concrete performance comparison is given with similar AEAD schemes.

A preliminary security analysis of Panther against various attacks is given in the document and the authors conclude that their construction is immune against all of the explored cryptanalysis techniques. They claim thus a security of 2 c/2 = 2 132 . However, we show in this article that Panther has an important flaw that permits devastating attacks against it. More precisely, we demonstrate that due to the low number of iterations of the function F in all the middle computations, some public information goes directly into the inner state. This fact has several consequences. In the known plaintext model, the attacker is for example able to inverse the state and to recover the secret key. In the known ciphertext (only) mode, it is possible to recover all plaintext blocks but the first six ones and also to forge the tag. A particularity of all our attacks is that they only need a single plaintext/ciphertext or a single ciphertext and the computation time is equivalent (or sometimes even smaller) to one encryption with Panther. As we will show, the main conclusion of this paper is that when using shift registers to build permutation-based constructions, one should at least take as many rounds as the size of the registers.

The rest of the paper is organized as follows. In Section 2 we provide the specifications of Panther and introduce some notations. Next, in Section 3 we describe our central observation on the diffusion of the cipher. Section 4 is dedicated to our attacks and finally we briefly describe in Section 5 their implementation.

Specification of Panther

The design of Panther is based on the sponge construction [START_REF] Bertoni | Sponge Functions[END_REF][START_REF] Bertoni | Cryptographic sponge functions[END_REF]. Its central component is a function called F that applies to a 328-bit state. The state S is divided into a r-bit outer part S and a c-bit inner part S, where r = 64 is called the rate and c = 264 the capacity. The encryption works as follows.

Initialization phase. First, in the initialization phase, the 128-bit key and the 128-bit initial value (IV) are loaded to the state. More precisely, if we denote by k i , 0 ≤ i < 128 the 128 bits of the secret key K, by iv i , 0 ≤ i < 128 the 128 bits of the IV and by x the Boolean complement of the binary value x, the initial state is loaded with the following vector:

(k 0 , . . . , k 127 , iv 0 , . . . , iv 127 , k 0 , . . . , k 63 , 1, 1, 1, 1, 1, 1, 1, 0).
The state is then updated 92 times by the function F .

Absorption phase. Both associated data and plaintexts are then processed in the absorption phase. First, associated data (AD) are incorporated to the state. This part processes data that only need to be authenticated and not necessarily encrypted. This is done by dividing the data into k blocks AD i of 64 bits each, XORing each block to the outer part of the state and by applying next the permutation F four times. This is repeated until all the AD blocks have been absorbed. This part can of course be omitted if there is no associated data to authenticate. Next, plaintext blocks are processed and ciphertext blocks are generated. For this, the plaintext is divided into n blocks of 64 bits and each block is absorbed by the outer part of the state. Once a plaintext block P i is absorbed, a 64-bit ciphertext block C i is immediately generated by outputting the outer part of the state. Four iterations of the permutation F are next applied for all blocks except for the last one.

Finalization phase. Once all plaintext blocks have been processed, the finalization mode is activated, during which the tag is generated. For this, 92 rounds of the permutation F are first applied to the state. Then, the outer part of the state is outputted as a first block of the tag and four rounds of the permutation F are next applied. The other blocks of the tag are generated in the same manner until a tag of the desired length is obtained. This procedure can be visualized in Figure 1. This state is then loaded into four interconnected NFSRs, each NFSR containing the values of the registers P , Q, R and S respectively, as can be seen in Figure 2. We provide here the full specification of the round function, even if most of these details are not needed to understand our attack nor have any effect on it.

The function F can be described as follows. First the 4-bit values f p , f q , f r and f s , each one corresponding to the feedback polynomial of the corresponding NFSR are computed:

f p = P 0 ⊕ P 7 ⊕ P 10 ⊕ P 6 ⊗ P 18 f q = Q 0 ⊕ Q 4 ⊕ Q 6 ⊕ Q 7 ⊕ Q 15 ⊕ Q 3 ⊗ Q 7 f r = R 0 ⊕ R 1 ⊕ R 15 ⊕ R 17 ⊕ R 19 ⊕ R 13 ⊗ R 15 f s = S 0 ⊕ S 1 ⊕ S 4 ⊗ S 10 ⊕ S 11 ⊗ S 18
Here, the symbol ⊗ corresponds to the multiplication in the field GF (2 4 ), where the field is constructed by using the polynomial x 4 +x 3 +1.

Next, four interconnection polynomials, g p , g q , g r and g s , mixing nibbles from different registers are computed:

g p = Q 9 ⊕ R 10 ⊕ S 12 g q = P 4 ⊕ R 2 ⊕ S 5 g r = P 12 ⊕ Q 11 ⊕ S 16 g s = P 16 ⊕ Q 17 ⊕ R 2
Next one computes the 4-bit values 1 , 2 , 3 and 4 , each one corresponding to the XOR of the values f * and g * together with a constant rc i :

1 = f p ⊕ g p ⊕ rc 1 2 = f q ⊕ g q ⊕ rc 2 3 = f r ⊕ g r ⊕ rc 3 4 = f s ⊕ g s ⊕ rc 4 ,
where the constant values are rc 1 = 7, rc 2 = 9, rc 3 = b, rc 4 = d given in hexadecimal notation. After this, the vector [ 1 , 2 , 3 , 4 ] T is multiplied by a Toeplitz MDS matrix T p to create the 16-bit vector

[d 1 , d 2 , d 3 , d 4 ] T = T p × [ 1 , 2 , 3 , 4 ]
T . An 4-bit S-box Sb is then applied to each one of the nibbles d 1 , d 2 , d 3 and d 4 and the resulting 16-bit vector is then multiplied again by the matrix T p :

[t 1 , t 2 , t 3 , t 4 ] T = T p × [Sb[d 1 ), Sb(d 2 ), Sb(d 3 ), Sb(d 4 )] T .
As the specification of the matrix T p is not relevant to our attack, we omit its description here. Finally, the registers P, Q, R and S are shifted by one nibble to the right and the most-significant nibbles of each NFSR are updated by the values t 1 , t 2 , t 3 and t 4 :

P 1, Q 1, R 1, S 1
P 18 , Q 19 , R 20 , S 21 = t 1 , t 2 , t 3 , t 4
F is applied successively a certain number of times n r , where the value of n r depends on the phase considered. In the initialization phase and before the first block of tag is outputted, n r equals 92, while for all other applications of F , n r equals 4. In this section, we make an observation on Panther that is at the core of all the attacks provided next. The property that we exhibit is, as we will show, caused by the low number of applications of the state update function F in the plaintext absorption and ciphertext generation phase and has as a consequence to greatly alter the security of the cipher.

An observation on F 4

As stated above, our main observation stems from the very low number n r = 4 of times F is applied between each ciphertext output. We thus exhibit a very simple observation on F 4 . We begin by studying one application of F . Let us denote the input nibbles to F by

P 18 ||P 17 ||P 16 ||P 15 ‖P 14 || • • • ||P 0 (1) Q 19 ||Q 18 ||Q 17 ||Q 16 ‖Q 15 ||Q 14 || • • • ||Q 0 R 20 ||R 19 ||R 18 ||R 17 ‖R 16 ||R 15 ||R 14 • • • ||R 0 S 21 ||S 20 ||S 19 ||S 18 ‖S 17 ||S 16 ||S 15 ||S 14 || • • • ||S 0
As can be observed in Figure 2, because of the action of the four NFSRs to the state, the output of F is of the form

X 0 ||P 18 ||P 17 ||P 16 ‖P 15 || • • • ||P 1 (2) Y 0 ||Q 19 ||Q 18 ||Q 17 ‖Q 16 ||Q 15 || • • • ||Q 1 Z 0 ||R 20 ||R 19 ||R 18 ‖R 17 ||R 16 ||R 15 || • • • ||R 1 T 0 ||S 21 ||S 20 ||S 19 ‖S 18 ||S 17 ||S 16 ||S 15 || • • • ||S 1
where X 0 , Y 0 , Z 0 , T 0 are 4-bit values depending on the input nibbles. As the exact expression of these values has no impact on our attacks we do not provide their details here, but those can be found in Section 2.1. Thus, note that each time the state is updated, only one nibble per register is modified. The values of the other nibbles remain unchanged, they are simply shifted. As a consequence, after four state updates, only four nibbles per register have been properly modified whilst all the others remain unchanged and are simply shifted to the right. By repeating the same analysis for the following rounds, we can see that the output of F 4 is of the form

X 3 ||X 2 ||X 1 ||X 0 ‖P 18 || • • • ||P 4 (3) Y 3 ||Y 2 ||Y 1 ||Y 0 ‖Q 19 ||Q 18 || • • • ||Q 4 Z 3 ||Z 2 ||Z 1 ||Z 0 ‖R 20 ||R 19 ||R 18 || • • • ||R 4 T 3 ||T 2 ||T 1 ||T 0 ‖S 21 ||S 20 ||S 19 ||S 18 || • • • ||S 4
where the X i , Y i , Z i , T i for 0 ≤ i ≤ 3 depend on the nibbles of the input state (again, their actual expression is not of interest, for more details see the specification of F in Section 2.1).

In particular, note that the outer part nibbles of the initial state are among those nibbles that have not been modified, but simply shifted into the inner part. For a more visual representation, we colour in red the nibbles of the outer part of the input that have been moved to the inner part of the output of F 4 :

X 3 ||X 2 ||X 1 ||X 0 ‖P 18 ||P 17 ||P 16 ||P 15 || • • • ||P 4 (4) Y 3 ||Y 2 ||Y 1 ||Y 0 ‖Q 19 ||Q 18 ||Q 17 ||Q 16 ||Q 15 || • • • ||Q 4 Z 3 ||Z 2 ||Z 1 ||Z 0 ‖R 20 ||R 19 ||R 18 ||R 17 ||R 16 ||R 15 || • • • ||R 4 T 3 ||T 2 ||T 1 ||T 0 ‖S 21 ||S 18 ||S 17 ||S 16 ||S 17 ||S 16 ||S 15 || • • • ||S 4 3.

Consequences in a known ciphertext only setting

At the end of the initialisation phase, the state is a priori unknown since the key has been mixed in with the IV by the application of F 92 . The absorption of the associated data which follows does not reveal anything about the state at the beginning of the plaintext absorption/ciphertext generation phase either. However, as soon as ciphertext blocks start to be outputted, an attacker has knowledge of the outer part of the input state to each application of F 4 .

If we recall the observations on F 4 made above, the outer part of the input state to F 4 is not modified but simply shifted into the inner state.

Let C = C 0 || • • • ||C n-1 be the known ciphertext of an unknown padded plaintext M = M 0 || • • • ||M n-1 where |C i | = |M i | = 64 for 0 ≤ i < n. An output of one ciphertext block C i-1
thus not only leaks information on the outer part of the state at the entry of F 4 , but also on the inner part of the output of F 4 . As the next message block M i is then XORed only to the outer part of the output state, when the next ciphertext block C i is outputted, the attacker knows not only the outer part of the state but also 64 bits of the inner state. As more ciphertext blocks are outputted, more information on the inner state is given to the attacker. Once 6 consecutive ciphtertext blocks C i-1 , . . . , C i+4 have been outputted, the attacker knows the whole inner state and the whole outer state. The property is illustrated in Figure 3 with C 0 , . . . , C 5 .

We show this property in a more formal way for the first ciphertext outputs C 0 , . . . , C 5 . We consider the state at the beginning of the plaintext absorption and ciphertext generation. In the following, we use the color blue to put forward what the attacker knows (which corresponds to the ciphertext blocks). Once the first ciphertext is outputted, the entry to F 4 is as follows :

C 0 3 ||C 0 2 ||C 0 1 ||C 0 0 ‖P 14 || • • • ||P 0 C 0 7 ||C 0 6 ||C 0 5 ||C 0 4 ‖Q 15 ||Q 14 || • • • ||Q 0 C 0 11 ||C 0 10 ||C 0 9 ||C 0 8 ‖R 16 ||R 15 ||R 14 || • • • ||R 0 C 0 15 ||C 0 14 ||C 0 13 ||C 0
After the application of F 4 , the state is of the following form :

X 3 ||X 2 ||X 1 ||X 0 ‖C 0 3 ||C 0 2 ||C 0 1 ||C 0 0 ||P 14 || • • • ||P 4 Y 3 ||Y 2 ||Y 1 ||Y 0 ‖C 0 7 ||C 0 6 ||C 0 5 ||C 0 4 ||Q 15 ||Q 14 || • • • ||Q 4 Z 3 ||Z 2 ||Z 1 ||Z 0 ‖C 0 11 ||C 0 10 ||C 0 9 ||C 0 8 ||R 16 ||R 15 ||R 14 || • • • ||R 4 T 3 ||T 2 ||T 1 ||T 0 ‖C 0 15 ||C 0 14 ||C 0 13 ||C 0 12 ||S 17 ||S 16 ||S 15 ||S 14 || • • • ||S 4
The message is then XORed to the nibbles in blue, and the outer part thus takes the value of the outputted C 1 . Therefore, the state has the following form just before the next application of F 4 :

C 1 3 ||C 1 2 ||C 1 1 ||C 1 0 ‖C 0 3 ||C 0 2 ||C 0 1 ||C 0 0 ||P 14 || • • • ||P 4 C 1 7 ||C 1 6 ||C 1 5 ||C 1 4 ‖C 0 7 ||C 0 6 ||C 0 5 ||C 0 4 ||Q 15 ||Q 14 || • • • ||Q 4 C 1 11 ||C 1 10 ||C 1 9 ||C 1 8 ‖C 0 11 ||C 0 10 ||C 0 9 ||C 0 8 ||R 16 ||R 15 ||R 14 || • • • ||R 4 C 1 15 ||C 1 14 ||C 1 13 ||C 1 12 ‖C 0 15 ||C 0 14 ||C 0 13 ||C 0 12 ||S 17 ||S 16 ||S 15 ||S 14 || • • • ||S 4
As C 2 is outputted, the attacker knows 128 bits of the inner state as well as the whole outer state. This phenomenon goes on iteratively: as more consecutive ciphertexts get known, more information is given to the attacker. Once the attacker knows the 6 first ciphertext blocks C 0 , . . . , C 5 , the attacker knows the whole inner state and the whole outer state. For a visual representation of the property, see Figure 3. In general, leaks on the value of the inner state of a sponge-based cipher have a devastating effect on the security of this cipher. In the case of Panther, the attacker recovers the value of the whole inner state and, depending on the attack settings, controls or knows the outer state. Unsurprisingly, this weakness will allow an attacker to mount extremely powerful key-recovery, plaintext-recovery and forging attacks as described in the next section.

Cryptanalysis of Panther

In this section, we show how the observation of Section 3 allows us to mount three attacks including a known plaintext key recovery attack, a known ciphertext-only attack and a chosen ciphertext-only forge. Note that each of these three attacks is extremely powerful, as they simply require the knowledge of either one plaintext/ciphertext pair or of a single ciphertext.

Key-recovery attack with one plaintext/ciphertext pair

We start by describing the most powerful of our attacks, namely a known plaintext attack which recovers the full key with a single plaintext/ciphertext pair. This attack, as also all the following ones, is memoryless and its time complexity is equivalent to a single encryption or decryption with Panther. This attack is a direct consequence of our observation from Section 3. The only constraint on the pair is that the padded message M must contain at least six 64-bit blocks. As shown in Section 3, the attacker recovers the full state as soon as she knows six consecutive ciphertext blocks. Once the full state is known, one can recover the full key as F is a permutation and its inverse can be very easily computed. As the attacker can invert F and knows all the message blocks M i (and the optional associated data blocks), she can recover the initial state and thus the key. The fact that F is a permutation is not explicitly mentioned by the authors. Thus, we provide a short proof at the end of this section. From this proof one can easily deduce how to invert F .

We've shown that with only one plaintext/ciphertext pair, an attacker can recover the key with a very easy and straightforward procedure. The attack is memoryless and, as for time, it is equivalent to a single encryption or decryption with Panther.

Proof that F is a permutation Let

I = P 18 || • • • ||P 0 ||Q 19 || • • • ||Q 0 ||S 20 || • • • ||S 0 ||R 21 || • • • ||R 0 ∈ F 328 2
be an input to F , and let

O = P 18 || • • • ||P 0 ||Q 19 || • • • ||Q 0 ||S 20 || • • • ||S 0 ||R 21 || • • • ||R 0
be its image by F . We show that I is uniquely determined by O.

First, note that all P i , 0 < i ≤ 18, Q j , 0 < j ≤ 19, R k , 0 < k ≤ 20 and S , 0 < ≤ 21 are uniquely determined by O since

P i = P i-1
for 0 < i ≤ 18

Q j = Q j-1 for 0 < j ≤ 19 R k = R k-1 for 0 < k ≤ 20 S = S -1 for 0 < ≤ 21
Thus, we now only need to show that P 0 , Q 0 , R 0 and S 0 are uniquely determined by O. First, note that (P 18 , Q 19 , R 20 , S 21 ) uniquely determines the value of

1 = P 0 ⊕ P 7 ⊕ P 10 ⊕ P 6 ⊗ P 18 ⊕ Q 9 ⊕ R 10 ⊕ S 12 ⊕ rc 1 2 = Q 0 ⊕ Q 4 ⊕ Q 6 ⊕ Q 7 ⊕ Q 15 ⊕ Q 3 ⊗ Q 7 ⊕ P 4 ⊕ R 2 ⊕ S 5 ⊕ rc 2 3 = R 0 ⊕ R 1 ⊕ R 15 ⊕ R 17 ⊕ R 19 ⊕ R 13 ⊗ R 15 ⊕ P 12 ⊕ Q 11 ⊕ S 16 ⊕ rc 3 4 = S 0 ⊕ S 1 ⊕ S 4 ⊗ S 10 ⊕ S 11 ⊗ S 18 ⊕ P 16 ⊕ Q 17 ⊕ R 2 ⊕ rc 4
as both the matrix T p and the S-box Sb are invertible (T p being MDS). Since the P i , 0 < i ≤ 18, Q j , 0 < j ≤ 19 R k , 0 < k ≤ 20 and S , 0 < ≤ 21 are also uniquely determined by O as shown just above, it comes that

P 0 = 1 ⊕ P 7 ⊕ P 10 ⊕ P 6 ⊗ P 18 ⊕ Q 9 ⊕ R 10 ⊕ S 12 ⊕ rc 1 Q 0 = 2 ⊕ Q 4 ⊕ Q 6 ⊕ Q 7 ⊕ Q 15 ⊕ Q 3 ⊗ Q 7 ⊕ P 4 ⊕ R 2 ⊕ S 5 ⊕ rc 2 R 0 = 3 ⊕ R 1 ⊕ R 15 ⊕ R 17 ⊕ R 19 ⊕ R 13 ⊗ R 15 ⊕ P 12 ⊕ Q 11 ⊕ S 16 ⊕ rc 3 S 0 = 4 ⊕ S 1 ⊕ S 4 ⊗ S 10 ⊕ S 11 ⊗ S 18 ⊕ P 16 ⊕ Q 17 ⊕ R 2 ⊕ rc 4
are also uniquely determined by O. We've shown that F is injective which is sufficient to prove that it is a permutation. Further, it is easy to see from this proof how to invert F .

Plaintext-recovery attack with one known ciphertext

In this section, we show how our observation on F 4 also allows one to mount attacks in a known ciphertext only setting. Even if this attack does not recover the secret key, it is nevertheless devastating as it allows the attacker to recover full plaintext blocks. More precisely, for any padded message

M = M 0 || • • • ||M n-1
where |M i | = 64 for all i and such that n ≥ 6, one can fully recover all plaintext blocks from the seventh on.

As shown in the previous sections, knowing the six first ciphertext blocks allows one to recover the full state. Thus, the attacker also knows the full state after another application of F 4 , that is when the rest of the plaintext blocks M i , i ≥ 6 are absorbed. To recover these blocks, the attacker only needs to XOR the known ciphertext block C i , i ≥ 6 to the outer part of the state after each application of F 4 . With only known ciphertext of sufficient length, an attacker can recover the whole plaintext except for the first 384 bits. This attack is also memoryless and requires only one ciphertext. Concerning the time complexity, it is striking that this attack is more efficient than a decryption since one does not need to go through the initialisation phase and the absorption of the associated data.

Forging attacks

Last but not least, our observation on F 4 can also allow one to launch forging attacks both in a known plaintext and in a known ciphertext only setting.

To begin, an attacker with access to plaintext/ciphertext pairs can recover the key with the method described in Section 4.1. Thus, she can generate a valid tag for any chosen plaintext and any chosen ciphertext.

In the known ciphertext only setting, let us consider a ciphertext C composed of n blocks of 64 bits with n ≥ 6 and let T be the valid tag for C. As explained in Section 3.2, when six consecutive ciphertext blocks are outputted, the full state is known by the attacker. In particular, the value of the last six ciphertext blocks fully determines the state at the end of the absorption phase. Thus, for any ciphertext C composed of m blocks such that m ≥ 6, if the six last blocks of C are equal to those of C, the two states will fully collide at the end of the ciphertext generation phase, and thus at the beginning of the tag generation phase. It stems that T is also a valid tag for C .

As the other attacks presented above, this forging attack is very powerful as it is memoryless and requires only one valid ciphertext/tag pair.

The time complexity is also negligible, as the attacker does not even need to apply F once. The forged ciphertexts can have any length as long as they have at least 6 blocks, and only the last 6 blocks are constrained. As a consequence, one can build as many valid ciphertext/tag pairs as they wish. Forging is thus not only possible but also very easy and with a large degree of freedom for the attacker.

Implementation

All of the described attacks need negligible memory and computational ressources and can thus easily be implemented. Therefore, we implemented all of them in C in order to confirm their validity. Our code is accessible online1 .

Our program works in the following way. First, a random 128-bit key, a random 128-bit initial value (IV) and a random 512-bit plaintext are generated. Since Panther has a rate of 64 bits, the plaintext is processed in 8 blocks. The code does not generate associated data as our attacks work regardless. The plaintext is then encrypted with the key and IV and the corresponding ciphertext and tag are returned. The three attacks are then launched. Key recovery. First, we implemented a function that takes as input the plaintext/ciphertext pair and returns the secret key. The program verifies that the key returned matches with the random secret key that was generated.

Plaintext recovery. Second, we implemented a function that takes as input the ciphertext and returns all plaintext blocks but the first six. Once the plaintext blocks are recovered, the program verifies that they match the actual plaintext encrypted.

Forge. Lastly, we implemented a function that takes as input the ciphertext and returns a forged ciphertext which has the same tag. We then implemented a function that checks whether the forged ciphertext is valid. This function takes as input the key and the IV. It works as a decryption function on the forged ciphertext and returns the valid 128-bit tag for the forged ciphertext. The program then verifies that the forged ciphertext tag matches the initial ciphertext tag.

Repairing Panther

The main problem in the cipher's design comes from the fact that the number of rounds that the function F needs to be iterated in the middle computation was wrongly estimated. While determining the least number of rounds for the cipher to resist all known attacks is not an easy task, a minimum requirement is that the function F r provides full diffusion, in the sense that at the end of the computation every output bit depends on all input bits. Computing the minimal round r ensuring a full diffusion for F r is an easy procedure that we implemented. The code can be found together with the attacks code. This simple computation permitted us to affirm that the minimal number of rounds for reaching full diffusion is 46.

We can therefore conclude that at least 46 rounds are needed in the middle part of the cipher in order to resist the presented attacks. Of course, this minimal number of rounds does not necessarily guarantee the resistance of the cipher against other attacks, for example those exploiting a low algebraic degree. To determine this, a more in-depth analysis of the structure of F is required but such an analysis is out-of-scope of the current article.

.

Conclusion

In this paper we showed several devastating attacks in different scenarios against the AEAD scheme Panther. All of our attacks are extremely powerful as they are memoryless, require a single plaintext/ciphertext or a single ciphertext and have negligible execution time. This work shows that this design cannot be used in its current form to securely transmit data. We also demonstrate that special care is required when combining the sponge construction with an NFSR-based update function. More precisely, the inner part should always remain secret in sponge-like constructions, hence, when using shift registers, the number of rounds should at least be the size of the register, so that all bits in the inner part cannot be deduced from the ciphertext. We believe that modifying Panther in order for it to resist our attacks requires to greatly increase the number of rounds of the update function (from 4 to at least 46) in order to get full diffusion. However, in this scenario, the lightweight character of the cipher will very probably not be ensured any more, limiting thus the interest of someone to use it.

Fig. 1 .

 1 Fig. 1. Panther's global structure

Fig. 2 .

 2 Fig. 2. Function F

Fig. 3 .

 3 Fig. 3. Attack on Panther. The blue nibbles correspond to the nibbles known to the attacker, while the grey nibbles are values that are a priori unknown.

  The cipher's function F applies to the 328-bit state. This state can be seen as 82 nibbles split into four unequally-sized registers P , Q, R and S. The register P contains the 19 nibbles P 18 , . . . , P 0 , the register Q the 20 nibbles Q 19 , . . . , Q 0 , the register R the 21 nibbles R 20 , . . . , R 0 and finally the register S the 22 nibbles S 21 , . . . , S 0 . The outer part S is composed by the last four nibbles of each register :S= (P 15 , P 16 , P 17 , P 18 , Q 16 , Q 17 , Q 18 , Q 19 , R 17 , R 18 , R 19 , R 20 , S 18 , S 19 , S 20 , S 21 ). We use the following notation to denote an arbitrary state of Panther, where everything left to the symbol‖is the outer state. P 18 ||P 17 ||P 16 ||P 15 ‖P 14 ||...||P 0 Q 19 ||Q 18 ||Q 17 ||Q 16 ‖Q 15 ||Q 14 ||...||Q 0 R 20 ||R 19 ||R 18 ||R 17 ‖R 16 ||R 15 ||R 14 ...||R 0 S 21 ||S 20 ||S 19 ||S 18 ‖S 17 ||S 16 ||S 15 ||S 14 ||...||S 0

	2.1 State update function F

https://github.com/panthercryptanalyst/Panther-cryptanalysis


Olivier Dennler

Samuel Blanquart

François Coste

Catherine Belleannée

Nathalie Théret

Nathalie Théret Functional

Functional Motif Prediction in ADAMTS-TSL proteins Based on Module(s) and Phenotype(s) Co-appearance

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction and Objective

Association of Multiple Evolutionary Histories

The Hyalectanase Spacer: Validation, Prediction and Diversity

Functional Motif Prediction in ADAMTS-TSL proteins Based on Module(s) and Phenotype(s) Co-appearance

Olivier Dennler 1,2 , Samuel Blanquart 2 , François Coste 2 , Catherine Belleannee 2 and Nathalie Theret

  1,2 1 Univ Rennes, Inserm, EHESP, Irset -UMR S1085, F-35043 Rennes 2 Univ Rennes, Inria, CNRS, IRISA, UMR 6074, Rennes, France olivier.dennler@inria.fr

	❖ Multi-genes (26 H. sapiens paralogs)	Hypothesis:
			During evolution,
	❖ Multi-domains		modules gained at
			the same time than a
	❖ Partial knowledge / experimental data [1]	phenotype, are
			involved in this
	=> A new method to identify functional	phenotype
	motif
	❖ Ortholog and paralog	Module segmentation
	sequences	Paloma-2	Module-Gene-Species reconciliation
			Seadog-MD [2]
	❖ Protein-Protein
	Interaction (PPI) and
	module evolutions on a common gene phylogeny	Gene tree inference (Pasta, RaxML, Treefix)	PPI Ancestral
			Scenario
	❖ Module(s) and Phenotype(s) Co-appearance(s)	PPI extraction Psicquic and munual llitérature	Reconstruction PastML [3]
	Hyalectanases gene tree	Module signature
			Module gained in the spacer

Other ADAMTS-TSL H. sapiens Hyalectanases ❖ 173 ADAMTS-TSL in 9 species ❖ 1700 modules, 119 PPIs ❖ 36 Co-appearances Co-appeared Modules