Gleeok is a family of low-latency keyed pseudorandom functions (PRF) including two variants called Gleeok-128 and Gleeok-256, which are based on three parallel SPN-based keyed permutations whose outputs are XORed to produce the final output. Both Gleeok-128 and Gleeok-256 employ a 256-bit key, with block sizes of 128 and 256 bits, respectively. Due to this multi-branch structure, evaluating its security margin and mounting valid key-recovery attacks present non-trivial challenges. In this paper, we present the first comprehensive third-party cryptanalysis of Gleeok-128, whose full version consists of 12 rounds. Our analysis includes a two-stage MILP-based framework for constructing branch-wise and full-cipher differential–linear (DL) distinguishers, and a dedicated key-recovery framework based on integral distinguishers for multi-branch designs. Our analysis yields 7-/7-/8-/4-round DL distinguishers for Branch1/Branch2/Branch3/Gleeok-128 with squared correlations \(2^{-88.12}\) / \(2^{-88.12}\) / \(2^{-36.04}\) / \(2^{-49.10}\) . All distinguishers except the one targeting the PRF outperform the best distinguishers given in the design document. Moreover, by tightening algebraic degree bounds, we obtain 9-/9-/7-round integral distinguishers for the three branches and a 7-round distinguisher for the full PRF, extending the existing ones proposed in the original design document by 3/3/2 rounds and 2 rounds, respectively. Furthermore, the newly explored integral distinguishers enable the key-recovery attacks on Gleeok-128: a 7-round attack in the non-full-codebook setting and an 8-round attack in the full-codebook setting. In addition, we uncover a flaw in the original linear security evaluation of Branch3, showing that it can be distinguished over all 12 rounds with data complexity \(2^{48}\) , and propose optimized linear-layer parameters that significantly strengthen its linear resistance without sacrificing diffusion. These results advance the understanding of Gleeok-128 ’s security and provide generalized methods for analyzing multi-branch cipher designs.
