Detectable correlations in Edon-R.
Peter Novotney, Niels Ferguson · 2009
The Edon-R compression function has a large set of useful differentials that produce easily detectable output bit biases. We show how to construct such differentials, and use them to create a distinguisher for Edon-R-512 that requires around 2 54 compression function evaluations (or 2 28 evaluations after a pre-computation of 2 66 evaluations). The differentials can also be used to attack a variety of MAC and KDF constructions when they use Edon-R-512. 1