Abstract:
We propose two methods to obtain lower bounds on the weights of differential trails in the Bash-f sponge function. Our bounds restrict the probabilities of the trails from above and can be used to justify the security of cryptographic algorithms based on Bash-f against differential attacks. For the full $24$-round trails, our best bound on the probabilities is $2^{-386}$.