DC/LC analysis of Keccak-f[25]
Differential cryptanalysis

1 trails of length 2 read and checked.
1 trails of length 3 read and checked.
1 trails of length 4 read and checked.
1 trails of length 5 read and checked.
1 trails of length 6 read and checked.
1 trails of length 7 read and checked.
1 trails of length 8 read and checked.
Minimum weight: 8
       1 trails of weight  8
       1 trails of weight 16
       1 trails of weight 23
       1 trails of weight 30
       1 trails of weight 37
       1 trails of weight 44
       1 trails of weight 51

Showing the trails up to weight 51 (in no particular order).

2-round differential trail of total weight 8
* Profile related to χ:
Propagation weights:    4   4
Active rows:            2   2
* Profile related to θ:
Gaps:      2   0
Kernel:    N   k
Previous round would have weight at least 14
Round 0 (weight 4, θ-gap 2) after previous χ, then before χ (2 active rows):
X.XXX  |  .....
X.XXX  |  ..X..
..+XX  |  ..X..
X.XXX  |  .....
X.XXX  |  .....
---OO
Round 1 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  .....
..X..  |  .....
..X..  |  ..X..
.....  |  .....
.....  |  ...X.
-----

3-round differential trail of total weight 16
* Profile related to χ:
Propagation weights:    6   6   4
Active rows:            3   2   2
* Profile related to θ:
Gaps:      2   0   0
Kernel:    N   N   k
Previous round would have weight at least 15
Round 0 (weight 6, θ-gap 2) after previous χ, then before χ (3 active rows):
X.XX.  |  .....
X.XXX  |  X....
XXXXX  |  ..+.X
X.XXX  |  .....
X.X.X  |  ..X..
OOO--
Round 1 (weight 6, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  X.X..
X....  |  .....
..+XX  |  ..+..
.....  |  X.XX.
.XX..  |  .....
OOOOO
Round 2 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
..X..  |  .X...
.....  |  ....X
..+..  |  ..+..
..X..  |  .....
.....  |  .....
-----

4-round differential trail of total weight 23
* Profile related to χ:
Propagation weights:    5   9   5   4
Active rows:            2   4   2   2
* Profile related to θ:
Gaps:      1   0   1   0
Kernel:    N   N   N   k
Previous round would have weight at least 10
Round 0 (weight 5, θ-gap 1) after previous χ, then before χ (2 active rows):
.X...  |  .....
....X  |  ..XX.
XX+.X  |  ..+.X
.X..X  |  .....
.X..X  |  .....
O----
Round 1 (weight 9, θ-gap 0) after previous χ, then before χ (4 active rows):
.....  |  .....
XXXX.  |  ...X.
..+.X  |  ..+X.
.....  |  ..XX.
.....  |  ...X.
OOOOO
Round 2 (weight 5, θ-gap 1) after previous χ, then before χ (2 active rows):
.....  |  .....
.XXX.  |  .....
.X+X.  |  ..+..
.X.X.  |  ....X
.X.X.  |  ...XX
--O--
Round 3 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  .....
.....  |  .X...
..+..  |  ..+..
....X  |  .....
....X  |  X....
-----

5-round differential trail of total weight 30
* Profile related to χ:
Propagation weights:    6   7   7   6   4
Active rows:            3   3   3   2   2
* Profile related to θ:
Gaps:      1   0   0   0   0
Kernel:    N   N   N   N   k
Previous round would have weight at least 10
Round 0 (weight 6, θ-gap 1) after previous χ, then before χ (3 active rows):
X....  |  .....
X.X..  |  ....X
XXX..  |  X.+..
X.X..  |  .....
..X..  |  ..X..
-O---
Round 1 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  X.XX.
....X  |  ..X..
X.+X.  |  ..+..
.....  |  X....
.XX..  |  .....
OOOOO
Round 2 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.X.X.  |  .....
..X..  |  .X...
..+..  |  ..+..
X...X  |  ....X
.....  |  .X.XX
OOOOO
Round 3 (weight 6, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  .....
XX...  |  XX.X.
..+..  |  ..+..
....X  |  X..X.
..XX.  |  .....
OOOOO
Round 4 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  .....
X....  |  .....
..+..  |  ..+..
X....  |  ...X.
.....  |  .X...
-----

6-round differential trail of total weight 37
* Profile related to χ:
Propagation weights:    6   7   7   7   6   4
Active rows:            3   3   3   3   2   2
* Profile related to θ:
Gaps:      1   0   0   0   0   0
Kernel:    N   N   N   N   N   k
Previous round would have weight at least 10
Round 0 (weight 6, θ-gap 1) after previous χ, then before χ (3 active rows):
X....  |  .....
X.X..  |  ....X
XXX..  |  X.+..
X.X..  |  .....
..X..  |  ..X..
-O---
Round 1 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  X.XX.
....X  |  ..X..
X.+X.  |  ..+..
.....  |  X....
.XX..  |  .....
OOOOO
Round 2 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.X.X.  |  .....
..X..  |  .X...
..+..  |  ..+..
X...X  |  ....X
.....  |  .X.XX
OOOOO
Round 3 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  .X...
XX...  |  XX.X.
..+..  |  ..+..
..X.X  |  ...X.
...X.  |  .....
OOOOO
Round 4 (weight 6, θ-gap 0) after previous χ, then before χ (2 active rows):
.X...  |  .X.X.
X...X  |  .....
..+..  |  ..+..
..XX.  |  .X.XX
.....  |  .....
OOOOO
Round 5 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
...X.  |  .....
.....  |  .....
..+..  |  ..+..
...X.  |  .X...
.....  |  ....X
-----

7-round differential trail of total weight 44
* Profile related to χ:
Propagation weights:    4   7   7   7  10   5   4
Active rows:            2   3   3   3   5   2   2
* Profile related to θ:
Gaps:      2   0   0   0   0   1   0
Kernel:    N   k   k   k   N   N   k
Previous round would have weight at least 14
Round 0 (weight 4, θ-gap 2) after previous χ, then before χ (2 active rows):
X.XXX  |  .....
X.XXX  |  ..X..
..+XX  |  ..X..
X.XXX  |  .....
X.XXX  |  .....
---OO
Round 1 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  .....
.XX..  |  ...X.
.XX..  |  ..X..
.....  |  .....
.....  |  ..XX.
-----
Round 2 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  .....
...X.  |  X....
..X..  |  ..XX.
.....  |  X....
..XX.  |  .....
-----
Round 3 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
.....  |  ..X..
X....  |  .....
..+X.  |  ..+..
X..X.  |  .X.X.
.....  |  .X...
-----
Round 4 (weight 10, θ-gap 0) after previous χ, then before χ (5 active rows):
..X..  |  X....
.....  |  ....X
..+..  |  X.+..
...X.  |  .X...
XX..X  |  X....
OOOOO
Round 5 (weight 5, θ-gap 1) after previous χ, then before χ (2 active rows):
X....  |  .....
...XX  |  .....
X.+.X  |  .X+XX
XX..X  |  ...X.
X...X  |  .....
-O-O-
Round 6 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
.....  |  ..X..
.....  |  .....
..+X.  |  ..+..
...X.  |  .X...
.....  |  .....
-----

8-round differential trail of total weight 51
* Profile related to χ:
Propagation weights:    4   4   9   7   8  10   5   4
Active rows:            2   2   4   3   3   4   2   2
* Profile related to θ:
Gaps:      1   0   0   0   0   0   1   0
Kernel:    N   k   N   k   N   k   N   k
Previous round would have weight at least 11
Round 0 (weight 4, θ-gap 1) after previous χ, then before χ (2 active rows):
.X..X  |  ..X..
.X..X  |  .....
.XXXX  |  ..X..
.X..X  |  .....
.X..X  |  .....
-OOOO
Round 1 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
..X..  |  .....
.....  |  ....X
..X..  |  ..X..
.....  |  .....
.....  |  .....
-----
Round 2 (weight 9, θ-gap 0) after previous χ, then before χ (4 active rows):
.....  |  ...X.
...XX  |  ..X..
XXX..  |  ..XX.
.....  |  .....
.....  |  ..X..
OOOOO
Round 3 (weight 7, θ-gap 0) after previous χ, then before χ (3 active rows):
...X.  |  ..X..
..X..  |  .....
..+X.  |  ..+..
.....  |  X....
..X..  |  ...XX
-----
Round 4 (weight 8, θ-gap 0) after previous χ, then before χ (3 active rows):
.XX..  |  .....
.....  |  ....X
..+..  |  ..+..
X..X.  |  .X..X
....X  |  XX...
OOOOO
Round 5 (weight 10, θ-gap 0) after previous χ, then before χ (4 active rows):
.....  |  X..X.
....X  |  XX...
..+..  |  .X+..
.X.XX  |  .X...
.X.X.  |  .....
-----
Round 6 (weight 5, θ-gap 1) after previous χ, then before χ (2 active rows):
XX..X  |  X...X
.X..X  |  .....
.X+.X  |  ..+..
.X..X  |  .....
.....  |  X....
O----
Round 7 (weight 4, θ-gap 0) after previous χ, then before χ (2 active rows):
X....  |  ....X
.....  |  .....
..+..  |  X.+..
.....  |  .....
X....  |  .....
-----

