Arenberg Doctoral School of Science, Engineering & Technology Faculty of Engineering Department of Electrical Engineering (ESAT) Automated Techniques for Hash Function and Block Cipher Cryptanalysis Nicky MOUHA Dissertation presented in partial fulfillment of the requirements for the degree of Doctor of Engineering June 2012 Automated Techniques for Hash Function and Block Cipher Cryptanalysis Nicky MOUHA Jury: Dissertation presented in partial Prof. em. dr. ir. Yves D. Willems, chair fulfillment of the requirements for Prof. dr. ir. Bart Preneel, supervisor the degree of Doctor of Engineering Prof. dr. ir. Vincent Rijmen, secretary Prof. dr. ir. Frank Piessens Dr. Svetla Petkova-Nikova Dr. Matt Robshaw (Applied Cryptography Group, Orange Labs, France) June 2012 Our greatest glory is not in never falling, but in rising every time we fall. Confucius c 2012 Nicky Mouha � D/2012/7515/71 ISBN 978-94-6018-535-9 If I have seen further it is only by standing on the shoulders of giants. Isaac Newton Acknowledgments Every research paper is a puzzle piece, linking other pieces together to reveal a bigger picture. As such, research can’t be done in isolation. In the past few years, I’ve been extremely fortunate to meet the world’s best and brightest in thefield of symmetric-key cryptography. Many times, I’ve found myself to be the stupidest and most ignorant person in the room. To me, such experiences have been exciting and humbling, but most of all a great opportunity to learn. Therefore, I would like to personally thank everyone who contributed in one way or another to this thesis. Unfortunately, this will not be possible. I have been inspired by far too many brilliant people at conferences, workshops and seminars throughout the world. Thanks to everyone who is not explicitly mentioned in these acknowledgments. Often, your simple insights completely changed my view of the world. Most of all, I would like to thank my supervisor, prof. dr. ir. Bart Preneel. He has given me the freedom to work independently, yet was always there for me when I needed his advice. I’ve been assigned a low workload in teaching, supervising and administration. To compensate for this, I’ve frequently volunteered to organize conferences, guide newcomers and perform computer-related tasks. I’ve been very fortunate to travel the world many times over. This has been a lot of fun for me, but also a great cultural enrichment. For all of these reasons and more, I consider myself to be one of the luckiest Ph.D. students. I can’t thank my supervisor enough for this. Special thanks go to the the members of the jury: prof. em. dr. ir. Yves D. Willems, prof. dr. ir. Bart Preneel, prof. dr. ir. Vincent Rijmen, prof. dr. ir. Frank Piessens, dr. Svetla Petkova-Nikova and dr. Matt Robshaw. Their detailed com- ments and suggestions have greatly improved the text of this Ph.D. thesis. I faced a setback before I even started working on my Ph.D., when my appli- cation for an FWO-Vlaanderen scholarship was rejected. However, my supervisor continued to encourage me, and helped me through a successful application for an IWT-Vlaanderen scholarship. I would like to thank the jury composed by IWT, and diligent jury member Joan Daemen in particular, for their positive evaluation. Thanks to IWT for thefinancial support, and to scholarship coordinators Marc Pollet and Michèle Oleo for the administrative support. The invaluable input of my co-authors should be acknowledged: Jean-Philippe Aumasson, Tor E. Bjørstad, Andrey Bogdanov, Christophe De Cannière, Dawu Gu, I II ACKNOWLEDGMENTS Sebastiaan Indesteege, Özgül Küçük, Gaëtan Leurent, Willi Meier, Florian Mendel, Thomas Peyrin, Raphael C.-W. Phan, Bart Preneel, Vincent Rijmen, Yu Sasaki, Gautham Sekar, Yue Sun, Petr Susil, Søren S. Thomsen, Elmar Tischhauser, Deniz Toz, Meltem Sönmez Turan, Markus Ullrich, Kerem Varıcı, Vesselin Velichkov, Meiqin Wang and Qingju Wang. I’ve always tried to involve other people as early as possible in the scientific process of writing a paper. I know that this slows down the research, but I do believe that the resulting papers have a much higher quality than I could achieve on my own. I would also like to thank all the other members of the symmetric-key crypto- graphy subgroup at COSIC, for providing a very pleasant working environment: Mohamed Ahmed Abdelraheem, Elena Andreeva, Begül Bilgin, Jiazhe Chen, Yoni De Mulder, Orr Dunkelman, Barış Ege, Emilia Käsper, Kota Ideguchi, Bart Men- nink, Svetla Nikova, Christian Rechberger, Kyoji Shibutani, Fatih Sulak, Vasin Suttichaya, Gauthier Van Damme and Hirotaka Yoshida. Special thanks go to prof. dr. ir. Vincent Rijmen for leading our subgroup, and advising us along the way. I’d especially like to thank secretary Péla Noë, European projects coordina- tor Saartje Verheyen and accountants Elvira Wouters, Elsy Vermoesen and Wim Devroye. Without their help, it would be impossible to get anything done at all. Thanks to Sebastiaan Indesteege, who saved me countless hours by providing me with a template to write this thesis. Unfortunately, COSIC has grown too large to thank all other members individually. In 2011, I’ve enjoyed a brief stay at Tsinghua University under the supervision of prof. dr. Xiaoyun Wang. I am extremely grateful for this opportunity. Thanks to secretary Qi Shi for sorting out all the administrative and technical issues. I’d like to say xièxie to all my colleagues: Jingguo Bi, Kuan Cheng, Jiazhe Chen, Dan Ding, Lianzhi Fu, Lidong Han, Changhui Hu, Keting Jia, Jianwei Li, Leibo Li, Mingjie Liu, Xichen Mu, Yongchuan Niu, Yue Sun, Chengliang Tian, An Wang, Maoning Wang, Zhongyue Wang, Wei Wei, Hongbo Yu, Yanyan Yu, Jingyuan Zhao, Xuexin Zheng and Guizhen Zhu. Non-Chinese readers may struggle to read the list of names, but they are very familiar names to me. I can talk for hours about the exciting time I’ve spent with each and every one of them. Thanks for providing me with a home away from home. During the last two years of my Ph.D., I volunteered as a resident assistant at Studentenwijk Arenberg, the largest group of KU Leuven-owned buildings for student housing. I’d to thank Els Bruyninckx and Steven Timmermans for their continuous support, as well as for selecting me in thefirst place. Thanks to all the other resident assistants of the Heverlee Area Residences: Alexander, Andreas, Bram, Charlotte, Gladys, Harm, Lies, Liesbeth, Lode, Lotte, Michiel, Olivier, Pascale, Rebecca, Romina, Stefaan, Stefanie, Stein, Vincent and Wim. I’ve learned a lot from you. Teaming up with you to organize parties, quizzes, barbecues and much more made my job an amazing experience. Thanks as well to all the 110 inhabitants, in particular those who didn’t make too much noise, kept the kitchens clean and didn’t forget their keys too often. ACKNOWLEDGMENTS III Last but not least, I would like to thank my parents and grandparents, as well as my brothers Yannick and Dylan. They never knew exactly what I was doing — which is understandable: most of the time, I didn’t even know it myself. I know that I’ve caused many sleepless nights after saying things such as “Hey mom, dad, I’m going to China for a few months.” Still, my family always loved and supported me. For that, I’ll be forever grateful. Nicky Mouha Heverlee, June 2012 IV ACKNOWLEDGMENTS The main purpose of science is simplicity, and as we under- stand more things, everything is becoming simpler. Edward Teller Abstract Cryptography is the study of mathematical techniques that ensure the confi- dentiality and integrity of information. This relatively newfield started out as classified military technology, but has now become commonplace in our daily lives. Cryptography is not only used in banking cards, secure websites and electronic signatures, but also in public transport cards, car keys and garage door openers. Two building blocks in the domain of cryptography are block ciphers and (cryp- tographic) hash functions. Block ciphers use a secret key to transform a plaintext into a ciphertext, in such a way that this secret key is needed to recover the original plaintext. Hash functions transform an arbitrary-length message into a fixed-length hash value. These hash values can serve as “fingerprints” for the ori- ginal messages: it should be infeasible tofind two distinct messages with the same hash value (a collision). Yet, Wang et al. recently showed thatfinding collisions is feasible for MD5 and SHA-1, two of the most commonly used hash functions today. Although the SHA-2 family currently remains unbroken, its design is very similar. For this reason, the United States National Institute of Standards and Technology (NIST) launched an international competition for a new hash function standard: SHA-3. The research performed in this Ph.D. thesis closely follows the evaluation pe- riod of the SHA-3 competition. Results were obtained for hash functions ARI- RANG, BLAKE, ESSENCE, Hamsi, Khichidi-1, LUX, Sarmal, Skein and TIB3. Outside of the competition, results were also obtained for a simplified version of the hash function HAS-V. In the area of cryptographic theory, observations were made on the resistance of regular hash functions against the birthday attack. The most commonly used hash functions: MD5, SHA-1 and SHA-2, as well two out of thefive SHA-3finalists (BLAKE and Skein) use operations such as addition modulo 2n, exclusive OR, bitwise Boolean functions, bit shifts and bit rotations. Dissatisfied with commonly used ad hoc techniques to analyze such constructions, we introduced the framework of S-functions to allow for a simple and automated analysis. Recently, meet-in-the-middle attacks became a very popular way to analyze block ciphers and hash functions.