Analysis of the Authenticated Cipher MORUS (v1)

We present several new observations on the CAESAR candidate MORUS (v1). First, we report a collision on its \(\mathrm {StateUpdate}(S, M)\) function. Second, we describe a distinguisher in a nonce-reuse scenario with probability 1. Finally, we observe that the differences in some words of the state after the initialization have probabilities significantly higher than the random case. We note that the presented results do not threaten the security of the scheme. This is the first external analysis of the authenticated cipher MORUS.