Sycon is an authenticated encryption algorithm with associated data submitted to NIST’s recently finalized lightweight cryptography competition. Ascon won the competition, while Sycon was eliminated in the first round. Subsequently, the designers proposed an improved version of Sycon that closely resembles Ascon. In this work, we optimize the latest Sycon permutation for GPUs using CUDA, achieving a processing rate of \(2^{34.89}\) full 12-round Sycon permutations per second on an RTX 4090 GPU. This optimization enables us to experimentally derive differential-linear (DL) distinguishers, which combine differential and linear characteristics to enhance their effectiveness. We present several 2-round and 3-round probability-one truncated differential characteristics, along with 2-round, 3-round, and 4-round linear characteristics. Using these characteristics, we introduce the first 5-round DL distinguishers for Sycon with a bias of \(2^{-8.55}\) . We also improve the reported \(2^{-2.8}\) bias for the 4-round DL distinguisher to \(2^{-2.57}\) . Furthermore, we present 5-round practical key recovery DL biases for Sycon when used in Ascon-mode: \(2^{-15.25}\) for key recovery, \(2^{-15.22}\) for related key scenarios, and \(2^{-12.75}\) for IV misuse. Our observations indicate that Sycon’s permutation, though marginally slower in software due to additional rotation operations within its linear layer, might offer better resistance to DL cryptanalysis compared to Ascon. We also address the issue of misreported test vectors for Sycon and provide corrected vectors to aid accurate analyses. Our code is available for future analyses and verification.
