JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1671
A Fast New Cryptographic Hash Function Based on Integer Tent Mapping System
Jiandong Liu Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing, China [email protected]
Xiahui Wang, Kai Yang, Chen Zhao Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing, China {Wnagxiahui, Yangkai0212, zhao_chen}@bipt.edu.cn
Abstract—This paper proposes a novel one-way Hash collisions by SHA-1” by Wang and Yu is another function which is based on the Coupled Integer Tent breakthrough in the hash functions history [11]. Mapping System and termed as THA (THA-160, THA-256). Based on the MD iteration structure [3], the The THA-160 compresses a message of arbitrary length into conventional Hash functions (MDx and SHA) have many a fingerprint of 160 bits, well the THA-256 compresses a common design guidelines. The designs of their mixed message of arbitrary length into a fingerprint of 256 bits. The algorithm adopts a piecewise message expansion operations for each round are very similar, and all of scheme. Compared with SHA-1 and SHA-256 message them adopt integer modulo addition and logic function; expansion, the message expansion scheme has enhanced the therefore, many Hash functions have been breached degree of nonlinear diffusion of the message expansion, and successively within a short period of time, which thus increased the computation efficiency. In addition, as indicates the defects in the design of the Hash functions. the major nonlinear component of compression function, the In recent years, in order to obtain more secure hash traditional logic functions are replaced by the integer tent functions, the research on constructing one-way hash map, and so the scheme has ideal properties of diffusion and function has been carried out and it has achieved progress confusion. Furthermore, the parallel iteration structure is by utilizing the sensitivity of the chaotic system to the adopted in the compression functions, which is advantageous to high speed parallel operation of software variation of the variables and parameters [12, 18, 17, 13, and hardware. Preliminary security testing indicates that, 8, 1, 2, 4, 7, 20]. But at present, the Hash function this Hash function has a high degree of security, and it can structure scheme, which is based on the Chaos Theory, is be realized easily with great rapidity. Therefore, it is an not acceptable to the world due to the degradation of ideal substitution for conventional Hash function. dynamic properties of digital chaotic system and the defects of the structure scheme itself [5, 14]. Index Terms—cryptography, Hash function, tent map, To work out the SHA-3, a new cryptographic Hash message expansion, diffusion algorithm standard, the analysis and assessment of the
Hash algorithm Competition, held by National Institute of Standards and Technology (NIST), is quite popular all I. INTRODUCTION around the world. Most of the schemes of SHA-3 Hash functions are essentially easy to compute algorithm, accepted by NIST, are improvements of the functions that produce a digital fingerprint of messages or conventional algorithm, which are filled with the data and they are ubiquitous in today’s IT systems and elements of old cryptographic algorithm. However, the have a wide range of applications in security protocols paper combines the research result of the chaotic hash and schemes, such as providing software integrity, digital function with the conventional hash function structure signatures and password protection. Furthermore, hash method, improves the design standard and the message function algorithms have been used for constructing expansion mode of conventional hash function and pseudo-random number generators, key derivation eventually proposes a coupled integer tent mapping algorithms, message authentication codes, as well as system-based cryptographic one-way hashing algorithm stream ciphers and block ciphers. termed as THA(Tent map-based hash algorithm). THA- In recent years, an extensive attention has been given 160 compresses a message of arbitrary length into a to the design and analysis of hash functions within the fingerprint of 160 bits; THA-256 compresses a message field of cryptology. The attacks used to find the of arbitrary length into a fingerprint of 256 bits. The “breakthrough” collisions presented at the rump session algorithm adopts a piece-wise message expansion scheme. of Crypto’04 by Wang et al.[10]. At that conference, Compared with SHA-1 and SHA-256 message expansion, Wang announced the presence of collisions within for the message expansion scheme has enhanced the degree MD4, MD5, HAVAL-128 and RIPEMD. “Finding of nonlinear diffusion of the message expansion, and thus
© 2012 ACADEMY PUBLISHER doi:10.4304/jcp.7.7.1671-1680
1672 JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012
increases the computation efficiency. In addition, the P(2k-ε/2-1 k+1 k+1 k A. The Standard Uniform Distribution Property of the P(xn+1<ε)= (ε-1)/2 +1-(1-(1+ε)/2 )= ε/2 Integer Tent Map Therefore, F obeys the standard uniform distribution The tent map is 1-D and piecewise-linear map as U[0, l]. Integer tent map has the nonlinear nature of follows [18]: rolled-out and folded-over, and its rolled-out characteristic will finally lead to the exponent separation x i1 of the adjacent points. While its folded-over characteristic , 0 xi1 , (1) keeps generating sequence with boundary, and makes the F : xi 1 x mapping irreversible. i1 , x 1. 1 i1 B. Realization approach of Integer Tent Map Suppose D =231, operator (? :) in C language could be This mapping is chaotic within the real number field 32 and one of its excellent characteristics is the uniform used in GF(2 ) to describe Eq.(2) as follows: distribution function. When the parameter α=0.5, real xn+1=xn © 2012 ACADEMY PUBLISHER JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1673 after 12000 iterative operations in the Eq. (5) when a set of initial values are selected randomly. ce en Ⅲ. PIECE-WISE MESSAGE EXPANSION A. SHA-1 Message Expansion single differ single bit The iterative hash functions can be divided into MDx A The affect bits in the expanded message and SHA family and the important feature that distinguishes SHA family from MDx is that the message Figure 2. SHA-1message expansion expansion of SHA family is conducted in the manner of 256 message expansion code itself is more involved and recursive expansion. The so-called message expansion possibly has better minimum distance. It is defined as refers to a process in which the current input message follows: block is expanded into a number of words. For SHA-1, the message block is represented by 32-bit words, denoted by Mt, with 0≤t≤15. In the message expansion, M , 0 t 15; t this input is expanded into 80 32-bit words W , also t (W ) W (W ) W , denoted as the 2560-bit expanded message row-vector. 1 t2 t7 0 t15 t16 (7) The words W are defined as follows [6]: Wt 16 t 63 t where M t , 0 t 15 0 (x) (x 7) (x 18) (x 3) W (6) t (x) (x 17) (x 19) (x 10) (Wt3 Wt8 Wt14 Wt16 ) 1, 16 t 79 1 We randomly select a message block (512bits), then In the message block space of SHA-1, the searching observe the effects on 1536(48*32) expansion bits in the space generated from 16 32-bits free variables could 512 subsequent recursive process after each change of one reach as high as 2 . However, as the message expansion single bit. The results are illustrated in Fig.3. adopted by SHA-1 is a kind of quasi-cyclic codeword As the modulo addition operation with nonlinear with linear features, the searching scope of minimum features is firstly adopted in SHA-256, the effect of message weight could be narrowed to 238. In the message 512 message expansion of SHA-256 is better than that of space of 2 , the minimum weight of SHA-1 is 44. To SHA-1. However, since too many circular shift operation describe the process of the message expansion, we and bitwise XOR operation (each recursive computation randomly select a message block (512bits), then observe needs four times of circular shift operations, twice of the effects on 2048(64*32) expansion bits in the right-shift operations, four times of bitwise XOR subsequent recursive process after each change of one operations, and three times of addition modulo operations) single bit. The results are illustrated in Fig.2. have been adopted in the message expansion of the SHA- B. SHA-256 Message Expansion 256, its computation efficiency is rather low. The It should be noted that SHA-256, unlike SHA-1, has message expansion modes of the other members of the only 64 steps. Two reasons can be used to explain the SHA-2 family (SHA-384, SHA-512) are very similar to safety of SHA-256: firstly, since SHA-256 produces a that of SHA-256. 256 bit output, its nonlinear block cipher has eight 32 bit The complexity of the differential cryptanalysis of registers instead of five possessed by SHA-1. This in turn Hash function is directly proportional to the differential means that any disturbance introduced using the diffusion degree of the message in compression functions (a useful heuristic, which is often used in the analysis of expanded message words Wi carries on for at least eight rounds(instead of five), and hence the probability of SHA-0 and SHA-1, is each bit difference in the key (in forcing local collisions goes down. Secondly, the SHA- the latter 64 rounds) lowers the probability of success on average by a factor of 22.5). The larger the minimum weight of the massage expansion is, the more complex the differential cryptanalysis of the compression ce en single differ bit single A Iteration times n The affect bits in the expanded message Figure 1. Distribution Diagram of Series for Coupled Integer Tent Mapping System Figure 3. SHA-256 message expansions © 2012 ACADEMY PUBLISHER 1674 JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 functions will be. Therefore, in the next generation of Hash function design, it is necessary to design a better TABLE I. COMPARISON OF THE NUMBER OF AFFECTED BITS FOR A SINGLE BIT message expansion mode. DIFFERENCE IN MESSAGE EXPANSION C. Piece-wise Message Expansion Scheme of THA-160 SHA-1 SHA-256 Piece-wise Message Expansion The paper [9] improves the message expansion mode Min(36steps) 13 78 192 Max(36steps) 23 293 304 of SHA-1, which enhances the degree of differential Min(64steps) 67 503 612 diffusion and the quantity of computation. With reference Max(64steps) 102 735 777 to the design idea of the paper [9], we work out a piece- Min(80steps) 107 755 852 wise message expansion scheme. Firstly, ten times of Max(80steps) 174 963 1042 recursive expansion is conducted through circular shift compared with that of SHA-1, and by 48% with that of and addition modulo modes aiming to enhance the SHA-256. relevancy between each bit of expansion message and 512 bits message block. Then process codeword message D. Piece-wise-nonlinear Message Expansion Scheme of expansion by a simple addition modulo. The piece-wise THA-256 message expansion is defined as follows: From the realization process of integer tent map, we can conclude that integer tent map is extremely sensitive M 0 t 15; t, to the highest digit of the message. Therefore, ten times Wt3 Wt8 Wt14 Wt16 of recursive expansion is conducted through circular shift (W W W ) 13 and addition modulo modes before using integer tent t1 t2 t15 maps to make message expansion. The purpose of these (8) W t (Wt1 Wt4 Wt11) 23, operations is to enhance the relevancy between high bit 16 t 25; digit of expansion message and 512 bits message block. The piece-wise-nonlinear message expansion is defined Wt Wt1 Wt2 Wt9 Wt16 , as follows: 26 t 80. Mt, 0 t 15; The author tested the differential diffusion Wt 3 Wt 8 Wt 14 Wt 16 characteristics of the Eq. (8) and observed the influence (Wt 1 Wt 2 Wt 15) 13 of each change of one single bit upon 2048(64*32) (Wt 1 Wt 4 Wt 11) 23, (9) expansion bits in the subsequent recursive process. The W t results are illustrated in Fig.4. 16 t 25; We attempt to get an idea about the effect of all the W ((W ((W 31))) 1) | (!(W 31)), t 1 t 1 t 1 t 1 changes in the above message expansion schemes. For Wt Wt 2 Wt 3 Wt 9 Wt 16, the single bit differences, Table 1 illustrates the 26 t 63. comparison of the number of affected bits in message expansion when the variants are 36, 64, 80 steps. It must The author tested the differential diffusion be pointed out that, the expanded message code weight characteristics of the Eq. (9) and observed the influence acquired from the experiment is the result of a block of of each change of one single bit upon 1536(48*32) randomly selected message (512bit) and 1 bit change expansion bits in the subsequent recursive process. The each time. The experimental result given in table 1 results are illustrated in Fig.5. sufficiently indicates that the piece-wise message Table 2 illustrates the comparison of SHA-1, SHA-256 expansion can promote the diffusion degree of message and THA-256. Having adopted the modulo addition difference. In addition, under the condition of the main operation, with nonlinear features, Eq. (9) further frequency of P4, 2.0GHz, the author tested the introduces integer tent map and makes the message computation efficiency of SHA-1, SHA-256 and the diffusion and propagation very complex. The piece-wise expanded message. When the recursive experimental result given in table 2 sufficiently indicates process is 80 steps, the execution efficiency of the piece- that the piece-wise-nonlinear message expansion can wise message expansion mode is improved by 29% promote the diffusion degree of message difference. In ce en single differ single bit single bit difference bit single A A The affect bits in the expanded message The affect bits in the expanded message Figure 4. Piece-wise Message Expansion Figure 5. Piece-wise- nonlinear message expansion © 2012 ACADEMY PUBLISHER JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1675 (0) 3) Adding x … to x0… x4： TABLE II. 0 COMPARISON OF THE NUMBER OF AFFECTED BITS FOR A SINGLE BIT DIFFERENCE IN MESSAGE EXPANSIONS x 0=x0＋ , x1=x1＋ , x2=x2＋ , SHA-1 SHA-256 THA-256 ( 0 ) x3=x3＋ , x4 =x4＋ x4 ; Min 107 503 626 4) Repeating step 2) ~3) through to the last message Max 174 735 779 block. 5) The result 160-bits message digest of the message, addition, under the condition of the main frequency of P4, M, is x || x || x || x || x . 2.0GHz, the computation efficiency of the piece-wise- 0 1 2 3 4 nonlinear expanded message given by this paper is 10% B. THA-256 faster than that of the SHA-256 expanded message. (1) Padding the Message：Suppose that the length of the message, M, is l bits. Append the “1” to the end of the Ⅳ. THA CONSTRUCTING message, followed by k zero bits, where k is the smallest, The following notations are used：+ denotes addition non-negative solution to the equation l+1+k=960 mod 1024. Parse the padded message into N 1024-bit message modulo 232, ～ bitwise complement operation, ∨ bitwise blocks, M1… Mi… MN. OR, ⊕bitwise XOR, << and >> left-shift and right-shift (2) Parse the message block Mi into two groups, Each operation, <<< left bit-wise rotation. one is constituted by sixteen 32-bit message words， A. THA-160 respectively is m0,m1,…,m15 and , ,…, ． (1) Padding the Message：Suppose that the length of (3) Eight 32-bit initial Hash Value： the message, M, is l bits. Append the “1” to the end of the x( 0 ) =0x6a09e667, =0xbb67ae85, message, followed by k zero bits, where k is the smallest, 0 non-negative solution to the equation l+1+k=448 mod =0x3c6ef372, =0xa54ff53a, 512. Parse the padded message into N 512-bit message ( 0 ) =0x510e527f, x5 =0x9b05688c, blocks, M1… Mi… MN. ( 0 ) =0x1f83d9ab, ( 0 ) =0x5be0cd19． (2) Parse the message block Mi into sixteen 32-bit x6 x7 message words: m0, m1… m15. (3) Five 32-bit initial Hash Value： (4) Eight 32-bit initial parameter: =0x01234567, =0x89abcdef, k0=0x5a827999, k1=0x6ed9eba1, k =0x8f1bbcdc, k =0xca62c1d6, =0x3210fedc, =0xba987654, 2 3 k4=0x999728a5a,k5=0x1abe9de6, =0x02468ace. k =0xcdcbb1f8, k =0x6d1c26ac． (4) Five 32-bit initial parameter： 6 7 (5) Piece-wise- nonlinear message expansion scheme k0=0x5a827999, k1=0x6ed9eba1, (Eq. (9)) is adopted in the message expansion for m0, m1, …, m15 and , ,…, , which obtain message k2=0x8f1bbcdc, k3=0xca62c1d6, words sequences W0, W1…, W63 and , ,…, k4=0x5793c62a. respectively. (5) Piece-wise message expansion scheme (Eq. (8)) is (6) Parallel iterated processing based on Coupled adopted in the message expansion. Integer Tent Mapping System (Eq. (5)). (6) Parallel iterated processing based on Coupled 1) x0= , x1= , x2= , x3= , Integer Tent Mapping System (Eq. (5)). ( 0 ) (0) (0) (0) (0) x4= ，x5= , x6= , x7= ; 1) x0= x0 , x1= x1 , x2= x2 , x3= x3 , x4= x4 ; 2) For t=0 to 12 2) For t=0 to 11 { k=t*5+16; Gi= ((( xi⊕(-(xi>>31)))<<1) {When t is even， ∨ (!(xi >>31)))+Wi+k i=0,…,4 k=(t/2)*8+16; xi= Gi + ((Gi-1 mod 5⊕Gi+2 mod 5) <<<21) Gi= ((( xi⊕(-(xi>>31)))<<1) +((Gi+1 mod 5⊕Gi+3 mod 5) <<<11)+ki i=0,…,4 } ∨(!(xi >>31)))+Wi+k i=0,…,7 © 2012 ACADEMY PUBLISHER 1676 JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 or carrying to affect other bits. THA still has logic x = G + ((G ⊕G ⊕G i i i+1 mod 8 i+2 mod 8 i+3 mod 8 shifting and diffusion mechanism of addition modulo 232. ⊕Gi+4 mod 8)<<<11)+((Gi-1 mod 8⊕(Gi-2 mod 8 For THA, the important thing is that, whenever the mappings are transformed, besides moving the state ∨ ～ ( Gi-3 mod 8))) <<< 21)+ ki i=0,…,7 variable 1 bit to the left, the difference characteristics of When t is odd， the highest bit could also lead this state variable to generate the maximum extended codeword weight. k=((t-1)/2)*8+16; Furthermore, each message bit difference has chance to trigger dynamic differential diffusion through circular Gi= ((( xi⊕(-(xi>>31)))<<1) shift operation and coupling diffusion of coupled integer ∨(!(xi >>31)))+Wi′+k i=0,…,7 tent mapping system. (2) Message expansion mode has been improved, and x = G + ((G ⊕(G i i i+1 mod 8 i+2 mod 8 the diffusion and confusion of message in mixed ∨(～Gi+3 mod 8))) <<<21)+ ((Gi-1 mod 8⊕Gi-2 mod 8 operation is accelerated in mixed function. (3) The operation steps of conventional Hash functions ⊕ ⊕ Gi-3 mod 8 Gi-4 mod 8) <<<11)+ ki i=0,…,7 can only be realized by serial mode. The iteration } structure of internal compression function of THA is different from MD5 and SHA, etc. Its realization is 3) Adding x(0) … x ( 0 ) to x … x ： suitable to the parallel operation, and can avoid the 0 7 0 7 problem of local collision existing in the Hash functions of SHA family [11]. ＋ ＋ (0) ＋ (0) x0=x0 , x1=x1 x1 , x2=x2 x2 , (4) THA algorithm inherits the design idea of the (0) ( 0 ) ( 0 ) conventional Hash algorithm featured by simple x =x ＋ x ,x =x ＋ x x =x ＋ x , 3 3 3 4 4 4 5 5 5 description and easy realization, borrows and improves ( 0 ) the tent map model which is widely applied in the x6=x6＋ x , x7=x7＋ ; 6 research of chaotic cryptography. With these merits, it 4) Repeating step 2) ~3) through to the last message transforms the tent map model from real number field to block. integer set and realizes the diffusion and confusion of 5) The result 256-bit message digest of the message, M, message by adopting rolled-out and folded-over nonlinear is x0|| x1|| x2|| x3|| x4|| x5|| x6|| x7. nature of the tent map as well as its feature of uniform distribution. All of the algorithms adopt simple operations C. Characteristics Analysis of THA based on 32 bit operands, which is helpful to achieve the (1) Substitute Integer Tent Map for conventional logic high speed operation of both software and hardware. functions. In the conventional Hash functions design, logic function (round function) is taken as the major Ⅴ. STATISTIC ANALYSIS ON DIFFUSION AND CONFUSION nonlinear component of mixed operation. HAVAL adopts logical functions that have high non-linearity, and, is 0-1 A dependence test method is introduced in the balance and satisfy the Strict Avalanche Criterion [19]. statistical analysis of the security of block cipher [16]. In However, adopting modular differential method could this paper, the author adopted the test method to analyze find one collision of HAVAL-128 within the period of 27 statistically the security of Hash algorithm on diffusion times of HAVAL-128 operations [15]. It indicates that the and confusion. selection of ideal logic function does not make the Hash For H is a Hash of n input bits and m output bits, the n (i) n functions safe enough. In logic function, various inputs input vector x=(x1,…,xn)∈(0,1) , the vector x ∈(0,1) could generate the same outputs, which we call as value denotes the vector obtained by complementing the i-th bit collision of logic function. Due to the value collision of of x(for i=1,…,n). The output vector is H(x), H(x(i))∈ logic function, the interior of compress function could (0,1)m corresponding to the input vector x, x(i). generate differential convergence. Wang et al. just use The Hamming weight w(x) of x is defined as the this feature of logic function to control differential number of nonzero components of x. convergence, and find the collision of the MD5 and A Hash function H of n input bits and m output bits is HAVAL-128 by combining the technologies such as said to be complete, if each output bit depends on each diversity of formula of integer mode reduction difference, input bit. transfer characteristics of left shift difference, and bit A Hash function H has the avalanche effect, if an modification, etc. average of 1/2 of the output bits changes whenever a Integer tent maps are uniformly distributed and have single input bit is complemented. good nonlinear features, and they are easily realized with A Hash function H satisfies the strict avalanche fast computation speed, but they are 1-1 mapping criterion, if each output bit changes with a probability of between the single variables and have no value collision 1/2 whenever a single input bit is complemented. problems. Diffusion mechanisms of conventional Hash For X is a set of input bits of Hash function. aij= #{x∈ functions (MD5, SHA-1, etc) are realized by the mixed (i) X|(H(x))j≠(H(x ))j}(for i=1,2,…,n and j=1,2,…,m) operation of modular 32 addition, and bitwise Boolean denotes the number of inputs for which complementing Operation. The change of each bit is realized by shifting © 2012 ACADEMY PUBLISHER JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1677 the i-th input bit results in a change of the j-th output bit; approximated as (0.998577, 0.998601). (i) bij=#{x∈X| w(H(x )－H(x)) =j}(for i=1,2, …,n and j=1, We randomly select 320000 blocks of 512bit (taken 2, …,m) denotes the number of inputs for which Rand( ) from Visual C) sample set X as input message complementing the i-th input bit results in a change of j words of THA-160. The actual test results are shown in output bits. Table 3. The degree of completeness is defined as: The same test on SHA-1 has been carried out and the actual test results are shown in Table 4. #{(i, j)aij = 0 } It can be seen from Table 3 that, under the significance dc = 1- nm level of α=0.05, the values of dc, da, and dsa remain The degree of avalanche effect is defined as: surprisingly stable, and fall into their own confidence interval after iterative 1 step, and the basic requirements n 1 m ∑ ∑ 2jb -m of nonlinear diffusion are satisfied, which is notably i=1 # X j=1 ij da = 1- better than the experimental results of SHA-1 given in nm Table 4 (Since the THA-160 algorithm adopts parallel And the degree of strict avalanche criterion is defined iteration structure, and its iterative 1 step could roughly as: be corresponding to the iterative 5 steps of SHA-1, successively, iterative 2 steps of THA-160 could be n m 2aij ∑ ∑ - 1 corresponding to the iterative 10 steps of SHA-1, ……). i=1 j=1 # X B. Statistic Analysis of THA-256 dsa = 1 - nm In order to compare with SHA-256, given input length If H (.) is stochastic transformation, the paper gives the n=512 bits, output length m=256 bits, under the following conclusion [21]: significance level of α=0.05, we can get the following 1) The tested sample amount X should be at least nm× result theoretically: 2 (zα/2) ; -#X 2) p(dc)=1-2 ≈1.0; TABLE III. THE DEGREES OF COMPLETENESS, OF AVALANCHE EFFECT, AND OF 3) E{da}=1.0- 2 /(×m×# X ) , confidence interval: STRICT AVALANCHE CRITERION FOR THA-160 WITH INCREASED NUMBER OF ITERATIONS (E{da}-zα/2 1 /(n×m×# X ) ,E{ da }+zα/2 ); number of Iterations dc da dsa 1 0.982336 0.860203 0.796704 4) E{dsa}=1.0- 2 /(×# X ) , confidence interval: 2 1.000000 0.999884 0.998579 3 1.000000 0.999891 0.998586 (E{dsa}-zα/2 1/(n m# X ) ,E{ dsa }+zα/2 ). 4 1.000000 0.999887 0.998587 5 1.000000 0.999888 0.998584 Where zα/2 is the z-value with an area α/2 in the right tail of a standard normal distribution. 6 1.000000 0.999889 0.998586 It is necessary to point out that the ideal Hash 7 1.000000 0.999894 0.998587 functions should be a random mapping from all possible 8 1.000000 0.999881 0.998587 input values to limited possible output values. Strictly 9 1.000000 0.999885 0.998589 speaking, the Hash function like random mapping does 10 1.000000 0.999884 0.998587 not exist, because Hash function is deterministic, and the 11 1.000000 0.999890 0.998596 certainty and uniform output characteristics mean that the 12 1.000000 0.999888 0.998587 entropy of the output is larger than the input entropy. 13 1.000000 0.999900 0.998585 However, according to the Shannon Entropy Theory, it is impossible that a deterministic function could amplify TABLE IV. entropy. Our design aims at making it impossible to THE DEGREES OF COMPLETENESS, OF AVALANCHE EFFECT, AND OF distinguish the probability distribution of Hash functions STRICT AVALANCHE CRITERION FOR SHA-1 and random mapping from each other. If the tested values number of Iterations dc da dsa of dc, da, dsa of a real hash function fall into the confidence interval, it indicates that the Hash algorithm 1 0.006396 0.001559 0.000574 3 0.051648 0.009894 0.004823 satisfies the basic requirements of nonlinear diffusion. 5 0.145032 0.036693 0.024572 A. Statistic Analysis of THA-160 7 0.267920 0.092986 0.073287 Given input length n=512 bits, output length m=160 10 0.456213 0.237795 0.212311 bits, under the significance level of α=0.05, we can get 15 0.768115 0.544870 0.518823 20 0.987427 0.845407 0.823081 the following result theoretically: 25 1.000000 0.993809 0.989917 1) z =1.96, sample capacity X is 320000; α/2 30 1.000000 0.999892 0.998594 2) dc=1.000000; 40 1.000000 0.999885 0.998594 3)E{da}=0.999888, the confidence interval is 60 1.000000 0.999887 0.998587 approximated as (0.999876, 0.999900); 80 1.000000 0.999896 0.998589 4)E{dsa}=0.998589, the confidence interval is © 2012 ACADEMY PUBLISHER 1678 JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1) zα/2=1.96, sample capacity X is 503526; same Hash results. In this paper, the author intends to test 2) dc=1.000000; the collision resistance ability of the algorithm 3)E{da}=0.999930, the confidence interval is quantitatively. First, randomly select a section of plaintext approximated as (0.9999221, 0.9999373); is in the plaintext space, and work out its Hash value 4)E{dsa}=0.998876, the confidence interval is which will be expressed in single byte character. Then approximated as (0.9988679, 0.9988831). another new Hash result will be available by randomly We randomly select 503526 blocks of 512-bit (taken selecting and changing the value of one-bit in the Rand( ) from Visual C) sample set X as input message plaintext. The distance between the two Hash values is words of THA-256. The actual test results are shown in defined as: Table 5. S The same test on SHA-256 has been carried out and d ∑t(ei ) t(ei ) the actual test results are shown in Table 6. i1 Among which, ei and e ′i stand for the i-th character of Ⅵ. ANALYSIS OF COLLISION RESISTANCE the initial and the new Hash values respectively. S stands Collision attack refers to the process of finding out for the number of single byte character expressed in Hash two different messages and making them produce the value. The function t(·) transform ei and into corresponding numbers in decimal system. If the two Hash values are respectively formed by two independent TABLE V. THE DEGREES OF COMPLETENESS, OF AVALANCHE EFFECT, AND OF and uniformly distributed random sequences, STRICT AVALANCHE CRITERION FOR THA-256 theoretically, the average distance of per character between the two Hash values should be 85.33[8]. number of Iterations d d d c a sa To THA-160, the average distance per character of the 1 1.000000 0.994594 0.987220 Hash values is tested through random selecting of input 2 1.000000 0.999930 0.998876 samples with an input length of n=512 bits. After 3 1.000000 0.999931 0.998875 statistical tests of 100,000 times, the actual test results are 4 1.000000 0.999928 0.998872 shown in Table 7. 5 1.000000 0.999932 0.998876 It can be seen from Table 4 that after iterative one-step 6 1.000000 0.999930 0.998873 the average distance per character of Hash values of the 7 1.000000 0.999928 0.998881 THA-160 algorithm tends to be steady and much closer to 8 1.000000 0.999928 0.998870 its theoretical value. The test result indicates that the two 9 1.000000 0.999926 0.998880 Hash values derived from two plaintexts that only have a 10 1.000000 0.999930 0.998875 difference of one-bit are statistically equal to two 11 1.000000 0.999933 0.998874 independent, uniform and random sequences. In this 12 1.000000 0.999930 0.998875 sense, it is impossible to distinguish the THA-160 from random mapping through this probability model. For comparison, Table 8 illustrates the test results of TABLE VI. SHA-1 collision resistance. It can be seen that just after THE DEGREES OF COMPLETENESS, OF AVALANCHE EFFECT, AND OF iterative 30 steps the average distance of per character of STRICT AVALANCHE CRITERION FOR SHA-256 the Hash values of SHA-1 algorithm tends to be steady. number of Iterations dc da dsa To THA-256, the average distance of per character of 5 0.1904602 0.1404253 0.1190314 the Hash values is tested by random selecting of input 10 0.5031509 0.4521524 0.4298077 samples with an input length of n=1024 bits. After 15 0.8159256 0.7646300 0.7419542 100,000 times of statistical tests, the actual test results are 20 1.0000000 0.9956154 0.9890846 shown in Table 9. It can be seen that after iterative two- 25 1.0000000 0.9999270 0.9988740 step the average distance per character of Hash values of 30 1.000000 0.9999302 0.9988722 THA-256 tends to be steady and much close to its 35 1.0000000 0.9999284 0.9988763 theoretical value. 40 1.0000000 0.9999263 0.9988766 For easy comparison, Table 10 illustrates the test results of SHA-256 collision resistance. It can be seen 45 1.0000000 0.9999290 0.9988762 that just after iterative 24 steps the average distance per 50 1.0000000 0.9999309 0.9988752 character of the Hash values of SHA-256 tends to be 55 1.0000000 0.9999307 0.9988745 steady. 64 1.0000000 0.9999287 0.9988738 TABLE VII. ANALYSIS ON COLLISION RESISTANCE FOR THA-160 number of Iterations 1 2 3 4 5 6 7 8 9 10 11 12 13 Average distances 73.06 85.30 85.27 85.29 85.30 85.38 85.36 85.37 85.34 85.28 85.29 85.29 85.32 /character © 2012 ACADEMY PUBLISHER JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 1679 TABLE VIII. ANALYSIS ON COLLISION RESISTANCE FOR SHA-1 number of Iterations 1 3 5 7 10 15 20 25 30 40 60 80 Average distances 0.006 0.244 0.714 3.885 21.22 47.33 73.22 85.14 85.34 85.40 85.35 85.36 /character TABLE IX. ANALYSIS ON COLLISION RESISTANCE FOR THA-256 number of Iterations 1 2 3 4 5 6 7 8 9 10 11 12 Average distances /character 42.25 84.90 85.33 85.31 85.29 85.32 85.29 85.37 85.35 85.29 85.35 85.33 TABLE X. ANALYSIS ON COLLISION RESISTANCE FOR SHA-256 number of Iterations 1 4 8 16 20 24 32 40 48 56 64 Average distances /character 0.01 7.09 28.05 70.71 84.92 85.37 85.33 85.43 85.31 85.27 85.27 in execution efficiency. We will optimize this algorithm Ⅶ. SPEED OF THA in future advanced version, introduce message diffusion mechanism and increase round times to further improve Table 11 demonstrates the speed test results of three the security of this algorithm. kinds of Hash Functions (THA-160, THA-256, SHA-256, SHA-1), which are realized by C Language, under P4, ACKNOWLEDGMENT 2.0GHz condition. It can be seen from Table 11 that THA is obviously faster than conventional Hash algorithm. This work described in this paper was supported by the Moreover, its internal iteration structure makes it easy to Beijing Natural Science Foundation Project, China realize the parallel operation of THA and provides a (No.4112018) and by the National Natural Science larger space to improve its time performance. Foundation of China (41101311/D0106). Ⅷ. CONCLUSION REFERENCES Considering the severe threat to the current security of [1] A Akhshani, S. Behnia, A. Akhavan, M.A. Jafarizadeh, H. the conventional Hash functions, this paper inherits the Abu Hassan, Z. Hassan, Hash function based on hierarchy of 2D piecewise nonlinear chaotic maps, Chaos, Solitons advantages of the conventional Hash functions and & Fractals, 42(2009) 2405-2412. designs a new Hash algorithm by improving message [2] A Akhavan, A. Samsudin, A. Akhshani, Hash function expansion, introducing new nonlinear components and based on piecewise nonlinear chaotic map , Chaos, adopting the structure of parallel iteration. The THA Hash Solitons & Fractals, 42(2009)1046-1053. function divides this process into two steps: the first step [3] I Damgard, A design principle for Hash functions. In realizes the self-diffusion of message codeword by Gilles Brassard, editor, Advances in Cryptology: adopting recursive mode; the second step accomplishes CRYPTO89,volume 435 of Lecture Notes in Computer the confusion and diffusion of message code words and Science. Springer-Verlag.1989:416-427. link variables. The analyses of nonlinear diffusion and [4] S. Deng, Y. Li, D. Xiao, Analysis and improvement of a chaos-basedHash function construction, Communications collision resistance show that THA (THA-160,THA-256) in Nonlinear Science and Numerical Simulation, provided in this paper has a high degree of security. 15(2010)1338-1347. Statistical method cannot distinguish the THA from the [5] S. Li, X. Mou, et al., On the security of a chaotic actual random function. And if necessary, its security can encryption scheme :problems with computerized chaos in be further enhanced by simply adding variants. The THA finite computing precision, Computer Physics can be easily realized, and thus it has evident advantages Communications 153 (2003) 52-58. [6] National Institute of Standards and technology Secure TABLE XI. Hash Standard, Federal Information Processing COMPARISON OF SPEED FOR THA-256, SHA-256, THA-160 AND Standards(FIPS) Publication 180-2, 2004. SHA-1 [7] H. Ren, Y. Wang, Q. Xie, H. Yang, A novel method for one-way hash function construction based on Data Length (B) THA - 256 SHA-256 THA-160 SHA - 1 spatiotemporal chaos, Chaos, Solitons & Fractals, 240 233.53 136.09 265.63 158.79 42(2009)2014-2022. [8] L. Sheng , G. Li , Z. Li, One-way Hash function 2048 286.65 165.96 321.58 180.84 construction based on tangent-delay ellipse reflecting © 2012 ACADEMY PUBLISHER 1680 JOURNAL OF COMPUTERS, VOL. 7, NO. 7, JULY 2012 cavity-map system, Acta Physica Sinica 55 (2006) 5700- length of output. Advances in Cryptology AUSCRYPT’92 5706 (in Chinese). Proceedings, Springer-Verlag,1993,83-104. [9] C S. Jutla and A. C. PatTHAk, A Simple and Provably [20] Q. Zhou, X. Liao, K Wong, et al., true random number Good Code for SHA Message Expansion, Cryptology generator based on mouse movement and chaotic hash ePrint Archive, Report 2005/247, 2005. function, Information Sciences 179(2009) 3442-3450. http://eprint.iacr.org/. [21] M. Zhu, B. Zhang, S. Lv, A statistical method of [10] X. Wang, D. Feng, X. Lai, et al., Collisions for hash blockcipher on diffusion & propagation, Journal of china functions MD4, KD5, HAVAL-128 and RIPEMD, institute of communications 23 (2002) 122-128 (in In:Advances in Cryptology － CRYPTO 2004:The 24rd Chinese) Annual International Cryptology Conference. Berlin: Springer-Verlag, 2004. [11] X. Wang, Y. Yin, H. Yu, Finding collisions on the Full SHA-1, Advances in Cryptology--Crypto’05,LNCS Jiandong LIU, born in 1966. He has been professor of 3621,pp.17-36, 2005. Beijing Institute of Petro-chemical Technology since 2008. His [12] K.Wong, A combined chaotic cryptographic and hashing main research interests are chaos cryptography and information scheme, Phys Lett A 307 (2003) 292-298. hiding. [13] Y. Wang, X. Liao, D. Xiao, et al., One-way Hash function construction based on 2D coupled map lattices,Information Sciences 178(2008) 1391-1406. [14] J. Wang, M. Wang, Y. Wang , The collision of one keyed Xiahui WANG, born in 1988. He has been postgraduate hash function based on chaotic map and analysis, Acta student of Beijing University of Chemical Technology since Physica Sinica 57 (2008) 2737-2742 (in Chinese). 2010.His main research interest is hash function. [15] X. Wang , D. Feng , X. Yu, An attack on hash function HAVAL-128, Science in china(Information sciences) 48 (2005) 545-556. [16] A.F. Weister, S.E.Tavares, On the design of S-boxes[A], Kai YANG, born in 1985. He has been postgraduate student Dvances in Cryptology-CRYPTO’85[C], Berlin:Springer of Beijing University of Chemical Technology since 2009. His -Verlag, 1986.523-533. main research interest is chaos cryptography. [17] D Xiao, X. Liao, S. Deng, One-way Hash function construction based on the chaotic map with changeable- parameter, Chaos Solitons & Fractals 24 (2005) 65-71. [18] X.Yi, Hash function based on chaotic tent maps, IEEE Chen ZHAO, born in 1989. He has been postgraduate transactions on circuits and systems-Ⅱ:Express briefs 52 student of Beijing University of Chemical Technology since (2005) 354-357. 2011.9.His main research interest is hash function. [19] Y. Zheng, Josef Pieprzyk and Jennifer Seberry, HAVAL——A one-way Hashing algorithm with variable © 2012 ACADEMY PUBLISHER