Abstract Whirlpool is a hash function that has been standardized by ISO/IEC. In this paper, we develop a new type of distinguishing property for its underlying permutation $ W $. Division property proposed by Todo at EUROCRYPT 2015 was initially used in the integral cryptanalysis of symmetric-key algorithms. This work for the first time utilizes the MILP method to search for the integral distinguishers of $ W $ in both the forward and backward directions while concentrating on word-based division property. Under the known-key model, the fact that the permutation used in the hash function does not depend on any secret parameters allows the previous properties to be exploited from the middle, i.e. from an intermediate internal state. Therefore, we apply the inside-out strategy which is the essential step in the zero-sum property to connect the trails in opposite directions. Consequently, we obtain new distinguishers up to full rounds for the $ W $. To further reduce the complexity of the integral distinguishers, we add one round in the middle with the help of subspace trails. Finally, we succeed in extending the length and improving the complexity of the integral distinguishers. To the best of our knowledge, all the results in this paper are competitive with the previous work in both computational cost and memory complexity. It is worth mentioning that the methods presented in this paper are applicable to a broad class of hash functions.

With the rapid advancement of the Internet of Things (IoT), many innovative lightweight block ciphers have been introduced to meet the stringent security demands of IoT devices. Among these, the Shadow cipher stands out for its compactness, making it particularly well-suited for deployment in resource-constrained IoT nodes (IEEE Internet of Things Journal, 2021). This paper demonstrates two real-time attacks on Shadow for the first time: real-time plaintext recovery and key recovery. Firstly, numerous properties of Shadow are discussed, illustrating an equivalent representation of the two-round Shadow and the relationship between the round keys. Secondly, we introduce multiple two-round iterative linear approximations. Employing these approximations enables the derivation of full-round linear distinguishers. Moreover, we have uncovered numerous linear relationships between plaintext and ciphertext. Real-time plaintext recovery is achievable based on these established relationships. On average, it takes 5 seconds to recover the plaintext for a fixed ciphertext of Shadow-32. Thirdly, many properties of the propagation of difference through SIMON-like function are illustrated. According to these properties, various differential distinguishers up to full rounds are presented, allowing real-time key recovery. Specifically, the 64-bit master key of Shadow-32 can be retrieved in around two days on average. Experiments verify all our results.