axis-1
AXIS-1024 claims more second-preimage resistance than its state allows
Minor break · Argued · Cause: parameter size
Property: second-preimage resistance
Cost against claim: meet-in-the-middle ≈2768 against a claimed 21024
Absorption applies an invertible permutation of the 1536-bit state per message beat. A second preimage can therefore meet in the middle: go 768 beats forward from the IV and 768 beats backward from an intermediate state of the target, and match on 1536 bits. The cost is about 2768, below the claimed 21024; AXIS-768 sits exactly at its claim, and AXIS-512 is unaffected.
| Parameter set | Claim | Attack cost | Verdict |
|---|---|---|---|
| AXIS-1024 | second preimage 21024 | ≈2768 | Minor break |
| AXIS-768 | second preimage 2768 | ≈2768 (no margin) | Holds |
Evidence
Cause in the specification, traced to the specification text.
Limits
Generic and far from practical; memoryless claw-finding variants exist.
Credit
Found by PQC-X.