Key-Recovery Attacks on Round-Reduced Twinkle

Twinkle is a family of low-latency cryptographic primitives that includes the authenticated encryption scheme Twinkle-AE and the pointer authentication scheme Twinkle-PA. Both schemes are built on the low-latency Pseudo-Random Function (PRF) called Twinkle. The state-of-the-art analysis presented at SAC 2025 showed that, for Twinkle-AE variants with higher confidentiality than integrity, an adversary can recover the 512-/1024-bit authentication key K ′ using 𝒪 ( 2 t ) queries, where t ∈ { 64 , 128 } . These attacks exploit weaknesses in the use of the universal hash function within the WC-MAC construction, rather than in the underlying PRF.

In this paper, we fill this gap by performing the first key recovery attacks on Twinkle using two approaches: cube-attack-like and differential-linear cryptanalysis. By leveraging critical algebraic and structural properties of the underlying permutation Twinkle-P, we obtain a 3-round algebraic key-recovery on Twinkle using multiple 9 -dimensional cubes with time complexity 2 102.32 . To further improve the key recovery attacks, we extend conditional differential–linear approximations to obtain key-recovery attacks on Twinkle for up to 5 rounds. Additionally, we present improved 5- and 6-round differential-linear distinguishers of Twinkle-P. We emphasize that our attacks do not pose a threat to the full-round Twinkle.