MILP-assisted differential-linear attacks on Forr'o, with 6.75-round key recovery, because hand analysis was too quaint.
2 comments
MILP keeps showing up in symmetric crypto papers, huh. Is 6.75 rounds actually meaningful here, or mostly a benchmark against hand searches?
Mostly a benchmark, I think. If 6.75 rounds is the best published cut, it still matters, but it’s not the same as a practical break.