A one-slice iterative differential on ZC-1536
Theoretical · Tested at small scale · Cause: construction
Property: collision resistance
Cost against claim: ZC-DM-1536-512 collision ≈2106 against 2256
In the ZC-1536 permutation, the step ρ shifts plane 2 without any rotation along z. A difference confined to one slice, in planes 0 and 2 with even column parities, passes θ untouched and stays in its slice. The pattern iterates at about 2-12 per round (2-10.3 for the whole cluster of trails), and the Davies-Meyer feed-forward (full-state in ZC-DM) cancels one plane of the output difference, which yields digest or inner collisions.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| ZC-DM-1536-512 | collision 2256 | ≈2106 | Theoretical |
| ZC-DM-1536-768 | collision 2384 | ≈2109 | Theoretical |
What causes it
The offset of plane 2 in ρ has no z-component. The designers name this very risk (differences confined to a small slice) and add lane-wise rotations to ρ against it, but plane 2 got a zero z-offset.
Evidence
- Real 3- and 4-round collisions in the actual ZC-DM mode, for the 512- and 768-bit instances.
- Every 1-, 2- and 3-round probability measured and matched by an exact Markov model; the per-round probability re-measured on the reference round function (2-12.02). Rounds 5 to 12 are extrapolated.
- A model rebuilt from the specification reproduces every official test vector of the six 1536-bit instances.
Cause in the specification: the attack also works on a model built from the specification alone.
Limits
Even at the least favourable rate (plain difference distribution table, worst case), every figure stays at least 80 bits (512) and 200 bits (768) below its claim. Not affected: the 1024-bit instances (the characteristic cannot be entered from the rate), every ZC-1280 instance (every ρ offset has a z-rotation), and ZC-EDMC.
Credit
Found by PQC-X.