This paper describes saturation attacks on reduced-round versions of Skipjack. To begin with, we will show how to construct
a 16-round distinguisher which distinguishes 16 rounds of Skipjack from a random permutation. The distinguisher is used to
attack on 18(5∼22) and 23(5∼27) rounds of Skipjack. We can also construct a 20-round distinguisher based on the 16-round distinguisher.
This distinguisher is used to attack on 22(1∼22) and 27(1∼27) rounds of Skipjack. The 80-bit user key of 27 rounds of Skipjack
can be recovered with 250 chosen plaintexts and 3 · 275 encryption times.