Meet-in-the-Middle Preimage Attacks with Multi-match on ASCON-XOF

Ascon was selected as the standard for lightweight cryptography by NIST in 2023. At EUROCRYPT 2023, Qin et al. introduced the meet-in-the-middle (MitM) preimage attack with a single match on sponge-based hashing. We further propose a Multi-Match technique to reduce the time complexity of the MitM preimage attack. When the neutral sets of the initial state are fixed, different MitM characteristics correspond to different matches. Multi-Match technique is the use of different matches to filter all values of the fixed neutral sets. For each candidate pair that satisfies the multi matches, a full-state match is performed. Using the Multi-Match technique, we present the improved preimage attacks on 3-round and 4-round Ascon-XOF.