Optimised the differential trail of the authenticated encryption algorithm Tiaoxin-346

Abstract

Tiaoxin-346 is a nonce-based authenticated encryption scheme designed by Ivica Nikolić and has been submitted to the CAESAR competition. Tiaoxin-346 uses three parallel structures of T3, T4, T6 as an important part of the algorithm. In this work, we give the differential analysis. The differential trail designed by designer has 30 active S-boxes (a difference goes six times through two AES rounds) and holds with a probability of at most 2−180. On the base of the forgery attack, we add one round after the last round in the original trail and make the inputs to T3 and T4 have the same difference. We assume the difference can be controlled. Therefore, there is no difference for the state T6. The probability of differential trail is 2−174. By the same method, we add one round before the first round. The probability of differential trail is 2−150. Absolutely, the probabilities are much higher than the designer's.