Higher Order Differential Attack on Step-Reduced Variants of Luffa v1

In this paper, a higher order differential attack on the hash function Luffa v1 is discussed. We confirmed that the algebraic degree of the permutation Q(j) which is an important non-linear component of Luffa grows slower than an ideal case both by the theoretical and the experimental approaches. According to our estimate, we can construct a distinguisher for step-reduced variants of Luffa vi up to 7 out of 8 steps by using a block message. The attack for 7 steps requires 2(216) messages. As far as we know, this is the first report which investigates the algebraic property of Luffa v1. Besides, this attack does not pose any threat to the security of the full-step of Luffa vi nor Luffa v2.