Annex A.3: Skinny-64/192 example

What the clause requires

What the public text does not state

• The example values
• The exact form of the advantage bound
• Any amendment change to the example

What it means for you

The Skinny-64/192 example is the one that needs a second piece of evidence beside the test vector. Clause 5 does not ban the version, but it ties it to a data volume: the scheme built on it must carry an advantage bound that remains meaningful while the adversary processes fewer than 2^64 blocks. A passing vector says nothing about that bound.

The 64-bit block is the reason. A small block reaches the birthday bound sooner, so the same key can protect less data before the security argument weakens. In a constrained device that is often an acceptable trade, and in a high-volume link it usually is not. The record keeps the choice visible rather than treating the version as interchangeable with the 128-bit ones.

The evidence list therefore has four items, one more than the other annex pages: the vector, the build, the key and tweak split, and the data volume with its bound. If a supplier cannot produce the fourth, the claim is incomplete even when the first three are perfect.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
Known-answer test record for Skinny-64/192 with the five fields and the build	Engineering	The informative annex is the standard own check.
Configuration record showing the key and tweak lengths that sum to 192	Engineering	The key floor still applies to a 192-bit tweakey.
Data volume per key and the advantage bound for the 64-bit block	Engineering	Clause 5 ties this version to a bound below 2^64 blocks.
Design decision record showing why a 64-bit block was chosen	Security architecture	Shows the trade was considered, not inherited.

How to verify it

Ask for the vector and the data bound. A perfect vector with no bound does not satisfy clause 5.

Dates

The kit plan for annex A.3 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• A Annex A, Numerical examples
• 5 Requirements on the usage of tweakable block ciphers
• 7 Skinny
• 7.1 Skinny versions

Where this comes from