DOCSLIB.ORG

Hash Functions and Gröbner Bases Cryptanalysis

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Hash Functions and Gröbner Bases Cryptanalysis Rune Steinsmo Ødegård Hash Functions and Gröbner Bases Cryptanalysis Thesis for the degree of Philosophiae Doctor Trondheim, April 2012 Norwegian University of Science and Technology Faculty of Information Technology, Mathematics and Electrical Engineering Department of Telematics NTNU Norwegian University of Science and Technology Thesis for the degree of Philosophiae Doctor Faculty of Information Technology, Mathematics and Electrical Engineering Department of Telematics © Rune Steinsmo Ødegård ISBN 978-82-471-3501-3 (printed ver.) ISBN 978-82-471-3502-0 (electronic ver.) ISSN 1503-8181 Doctoral theses at NTNU, 2012:111 Printed by NTNU-trykk Abstract Hash functions are being used as building blocks in such diverse primitives as commitment schemes, message authentication codes and digital signatures. These primitives have important applications by themselves, and they are also used in the construction of more complex protocols such as electronic voting systems, online auctions, public-key distribution, mutual authentication hand- shakes and more. Part of the work presented in this thesis has contributed to the \SHA-3 contest" for developing the new standard for hash functions orga- nized by the National Institute of Standards and Technology. We constructed the candidate Edon-R, which is a hash function based on quasigroup string transformation. Edon-R was designed to be much more efficient than SHA-2 cryptographic hash functions, while at the same time offering same or better security. Most notably Edon-R was the most efficient hash function submit- ted to the contest. Another contribution to the contest was our cryptanalysis of the second round SHA-3 candidate Hamsi. In our work we studied Hamsi's resistance to differential and higher-order differential cryptanalysis, with focus on the 256-bit version of Hamsi. Our main results are efficient distinguishers and near-collisions for its full (3-round) compression function, and distinguishers for its full (6-round) finalization function, indicating that Hamsi's building blocks do not behave ideally. Another important part of this thesis is the application of Gr¨obnerbases. In the last decade, Gr¨obnerbases have shown to be a valuable tool for algebraic cryptanalysis. The idea is to set up a system of multivariate equations such that the solution of the system reveals some secret information of the crypto- graphic primitive. The system is then solved with Gr¨obnerbases computation. Staying close to the topic of hash functions, we have applied this tool for crypt- analysis and construction of multivariate digital signature schemes, which is a major hash function application. The result of this is our cryptanalysis of the public-key cryptosystem MQQ, where we show exactly why the multivariate quadratic equation system is so easy to solve in practice. The knowledge we iv HASH FUNCTIONS AND GROBNER¨ BASES CRYPTANALYSIS gained from finding the underlying weakness of the MQQ scheme was used to construct a digital signature scheme. The resulting scheme, MQQ-SIG, is a provably CMA resistant multivariate quadratic digital signature scheme based on multivariate quadratic quasigroups. The scheme is designed to be very fast both in hardware and in software. Compared to some other multivari- ate quadratic digital signature schemes, MQQ-SIG is much better in signing and private key size, while worse in key generation, verification and public key size. This means that MQQ-SIG is a good alternative for protocols where the constrained environment is on the side of the signer. Preface This thesis is submitted in partial fulfillment of the requirements for the de- gree of philosophiae doctor (PhD) at the Norwegian University of Science and Technology (NTNU). The work was performed at the Centre for Quantifiable Quality of Service in Communication Systems (Q2S), Centre of Excellence (CoE), during 2007-2011, and has been supervised by Professor Svein Johan Knapskog and Professor Bjarne Emil Helvik. The document has been formatted in LATEX using a modified version of the document class kapproc.cls provided by Kluwer Academic Publishers. vi HASH FUNCTIONS AND GROBNER¨ BASES CRYPTANALYSIS Acknowledgements First, I would like to thank my supervisor Professor Svein Johan Knapskog for his support throughout my work on this thesis. A particular thanks also goes out to Professor Danilo Gligoroski who, in addition to have coauthored most of my papers, has in practice been my co-supervisor for this thesis. I would also like to thank Research Director Jean-Charles Faug`ere,Assistant Professor Ludovic Perret and the rest of the SALSA-team for hosting me for 7 months. I learned a lot during my stay at the Pierre and Marie Curie University. I also learnt a lot from collaborating with all my coauthors. In addition to the four people mentioned so far I would like to thank Jean-Philippe Au- masson, AleˇsDr´apal,Rune Erlend Jensen, Emilia K¨asper, Vlastimil Klima, Lars Ramkilde Knudsen, Ljupco Kocarev, Smile Markovski, Marija Mihova and Thomas Peyrin for our joint papers. I have made good friends and met a lot of very interesting people during my four years at Q2S. I would like to thank my colleagues for making Q2S a very pleasant environment to work in. Finally, I would like to thank my friends and family. Their continued sup- port has meant a lot to me. viii HASH FUNCTIONS AND GROBNER¨ BASES CRYPTANALYSIS Contents Abstract iii Preface v Acknowledgements vii List of Papers xiii Abbreviations xv Part I Thesis Introduction 1 Introduction 3 2 Background 3 3 Research Goals 31 4 Research Methodology 33 5 Contributions 34 6 Results and Discussion 38 7 Summary and Conclusion 42 Part II Included Papers PAPER A: On Some Properties of Boolean Matrices from Latin Squares 49 Rune Steinsmo Ødeg˚ard, Marija Mihova, Danilo Gligoroski 1 Introduction 49 2 Preliminaries 50 3 Concrete example 52 4 Results 53 5 Open questions 55 6 Conclusion 55 References 55 PAPER B: Cryptographic Hash Function Edon-R 59 Danilo Gligoroski, Rune Steinsmo Ødeg˚ard, Marija Mihova, Svein Johan Knapskog, Ljupco Kocarev, AleˇsDr´apal, Vlastimil Klima 1 Algorithm Specifics 61 2 Description of the Hash Algorithm Edon-R 69 3 Design Rationale 82 4 Estimated Computational Efficiency and Memory Requirements 117 x HASH FUNCTIONS AND GROBNER¨ BASES CRYPTANALYSIS References 121 PAPER C: On the Randomness and Regularity of Reduced Edon-R Compression Function 127 Rune Steinsmo Ødeg˚ard, Danilo Gligoroski 1 Introduction 127 2 Background 128 3 Analysis of 8-bit Edon-R 130 4 Analysis of 16-bit Edon-R 134 5 Conclusion 136 References 136 PAPER D: Distinguishers for the Compression Function and Output Transforma- tion of Hamsi-256 141 Jean-Philippe Aumasson , Emilia K¨asper , Lars Ramkilde Knudsen, Krystian Ma- tusiewicz, Rune Steinsmo Ødeg˚ard, Thomas Peyrin, Martin Schl¨affer 1 Introduction 142 2 Description of Hamsi-256 143 3 Higher-order differential analysis 146 4 First order differential analysis 151 5 Non-randomness of the ouput transformation 155 6 Conclusion 158 7 Acknowledgements 159 References 159 Appendix: The Sbox of Hamsi 162 Appendix: Conforming Message Pairs 163 Appendix: Truncated differential path 164 PAPER E: Analysis of the MQQ Public Key Cryptosystem 167 Jean-Charles Faug`ere, Rune Steinsmo Ødeg˚ard, Ludovic Perret, Danilo Gligoroski 1 Introduction 168 2 Description of the MQQ public key cryptosystem 169 3 Gr¨obnerbases 172 4 Why MQQ is Susceptible to Algebraic Cryptanalysis 175 5 Weaknesses of MQQ 177 6 Conclusion 179 References 180 Appendix: Algorithm for generating random MQQ 184 PAPER F: MQQ-SIG An Ultra-fast and Provably CMA Resistant Digital Signature Scheme 187 Danilo Gligoroski , Rune Steinsmo Ødeg˚ard , Rune Erlend Jensen , Ludovic Perret , Jean-Charles Faug`ere, Svein Johan Knapskog, Smile Markovski 1 Introduction 188 2 Preliminaries - Quasigroups and Multivariate Quadratic Quasigroups 190 3 Description of the MQQ-SIG Digital Signature Scheme 192 4 Design Rationale 194 5 Security analysis of the algorithm 199 6 Operating characteristics 207 Contents xi 7 Conclusions 209 References 209 Bibliography 213 List of Papers Publications Included in the Thesis The following are the papers included in Part II of the thesis. All papers have been subjected to minor editorial changes before their inclusion. PAPER A: Rune Steinsmo Ødeg˚ard,Marija Mihova and Danilo Gligoroski. On Some Properties of Boolean Matrices from Latin Squares. In Proceed- ings of the 1st International Workshop on Security and Communication Networks (IWSCN 2009). Trondheim, Norway. May 20-22, 2009 PAPER B: Danilo Gligoroski, Rune Steinsmo Ødeg˚ard,Marija Mihova, Svein Jo- han Knapskog, Ljupco Kocarev, AleˇsDr`apal,Vlastimil Klima. Crypto- graphic Hash Function Edon-R. Submission to NIST 2008. PAPER C: Rune Steinsmo Ødeg˚ardand Danilo Gligoroski On the Randomness and Regularity of Reduced Edon-R Compression Function. In Proceedings of the 2009 International Conference on Security & Management (SAM 2009). Las Vegas, Nevada, USA. July 13-16, 2009. PAPER D: Jean-Philippe Aumasson, Emilia K¨asper, Lars Ramkilde Knudsen, Krys- tian Matusiewicz, Rune Steinsmo Ødeg˚ard,Thomas Peyrin and Mar- tin Schl¨affer. Distinguishers for the Compression Function and Output Transformation of Hamsi-256. In Proceedings of the 15th Australian Conference on Information Security and Privacy (ACISP 2010). Syd- ney, Australia. July 5-7, 2010. PAPER E: Jean-Charles Faug`ere, Rune Steinsmo Ødeg˚ard,Ludovic Perret and Danilo Gligoroski. Analysis of the MQQ Public Key Cryptosystem. In xiv HASH FUNCTIONS AND GROBNER¨ BASES CRYPTANALYSIS Proceedings of the 9th International Conference on Cryptology and Network Security (CANS 2010). Kuala Lumpur, Malaysia. December 12-14, 2010. PAPER F: Danilo Gligoroski, Rune Steinsmo Ødeg˚ard,Rune Erlend Jensen, Lu- dovic Perret, Jean-Charles Faug`ere,Svein Johan Knapskog and Smile Markovski. MQQ-SIG. An Ultra-fast and provably CMA Resistant Digi- tal Signature Scheme. In Proceedings of the 3rd International Conference on Trusted Systems, INTRUST 2011. Beijing, China. November 27-29, 2011. Other Papers by the Author The following papers were also prepared while working with this thesis.
Load more

Recommended publications
  • Cryptographic Hash Functions and Message Authentication Code
    Cryptographic Hash Functions and Message Authentication Code Thierry Sans Cryptographic hashing H m1 m2 x1 m3 x2 H(m) = x is a hash function if • H is one-way function • m is a message of any length • x is a message digest of a fixed length ➡ H is a lossy compression function necessarily there exists x, m1 and m2 | H(m1) = H(m2) = x Computational complexity m H x • Given H and m, computing x is easy (polynomial or linear) • Given H and x, computing m is hard (exponential) ➡ H is not invertible Preimage resistance and collision resistance m H x PR - Preimage Resistance (a.k.a One Way) ➡ given H and x, hard to find m e.g. password storage 2PR - Second Preimage Resistance (a.k.a Weak Collision Resistance) ➡ given H, m and x, hard to find m’ such that H(m) = H(m’) = x e.g. virus identification CR - Collision Resistance (a.k.a Strong Collision Resistance) ➡ given H, hard to find m and m’ such that H(m) = H(m’) = x e.g. digital signatures CR → 2PR and CR → PR Hash functions in practice IV n’ bits n bits n’ bits Common hash functions m H x Name SHA-2 SHA-3 MD5 SHA-1 Variant SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 Year 1992 1993 2001 2012 Guido Bertoni, Joan Daemen, Michaël Designer Rivest NSA NSA Peeters, and Gilles Van Assche Input 512 512 512 512 1024 1024 1152 1088 832 576 n bits Output 128 160 224 256 384 512 224 256 384 512 n’ bits Speed 6.8 11.4 15.8 17.7 12.5 cycle/byte Considered Broken yes yes no no How to hash long messages ? Merkle–Damgård construction m split m in blocks of n bits and add padding p n bits m1
    [Show full text]
  • Nasha, Cubehash, SWIFFTX, Skein
    6.857 Homework Problem Set 1 # 1-3 - Open Source Security Model Aleksandar Zlateski Ranko Sredojevic Sarah Cheng March 12, 2009 NaSHA NaSHA was a fairly well-documented submission. Too bad that a collision has already been found. Here are the security properties that they have addressed in their submission: • Pseudorandomness. The paper does not address pseudorandomness directly, though they did show proof of a fairly fast avalanching effect (page 19). Not quite sure if that is related to pseudorandomness, however. • First and second preimage resistance. On page 17, it references a separate document provided in the submission. The proofs are given in the file Part2B4.pdf. The proof that its main transfunction is one-way can be found on pages 5-6. • Collision resistance. Same as previous; noted on page 17 of the main document, proof given in Part2B4.pdf. • Resistance to linear and differential attacks. Not referenced in the main paper, but Part2B5.pdf attempts to provide some justification for this. • Resistance to length extension attacks. Proof of this is given on pages 4-5 of Part2B4.pdf. We should also note that a collision in the n = 384 and n = 512 versions of the hash function. It was claimed that the best attack would be a birthday attack, whereas a collision was able to be produced within 2128 steps. CubeHash According to the author, CubeHash is a very simple cryptographic hash function. The submission does not include almost any of the security details, and for the ones that are included the analysis is very poor. But, for the sake of making this PSet more interesting we will cite some of the authors comments on different security issues.
    [Show full text]
  • Grostl-Comment-April28.Pdf
    Some notes on Grøstl John Kelsey, NIST, April 2009 These are some quick notes on some properties and observations of Grøstl. Nothing in this note threatens the hash function; instead, I'm pointing out some properties that are a bit surprising, and some broad approaches someone might take to get attacks to work. I've discussed these with the Grøstl team, and gotten quite a bit of useful feedback. I'm pretty sure they agree that my observations are correct, but obviously, any errors here are mine alone. 1 Grøstl Compression Function The Grøstl compression function is built from two different fixed permutations, P and Q, on 2n bits, where n is the final hash output size. The design is quite interesting; among other things, this (like LANE and Luffa, among others) takes away the key schedule as a way of affecting things inside P and Q. Here is a picture of the Grøstl compression function: M Q v u w Y + P + Z In this diagram, I've labeled the input hash chaining value Y, the output Z, and the message M. Similarly, I have introduced variables for the internal values inside the compression function--u, v, and w. I'll use this notation a lot in the next few pages to simplify discussion. To write this in terms of equations: u = Y xor M v = Q(M) w = P(u) Z = v xor w xor Y or, in a shorter form: Z = Q(M) xor P(Y xor M) xor Y It's important to remember here that all variables are 2n bits, so for a 256-bit hash, they're 512 bits each.
    [Show full text]
  • Methods and Tools for Analysis of Symmetric Cryptographic Primitives
    METHODSANDTOOLS FOR ANALYSIS OF SYMMETRICCRYPTOGRAPHIC PRIMITIVES Oleksandr Kazymyrov dissertation for the degree of philosophiae doctor the selmer center department of informatics university of bergen norway DECEMBER 1, 2014 A CKNOWLEDGMENTS It is impossible to thank all those who have, directly or indirectly, helped me with this thesis, giving of their time and experience. I wish to use this opportunity to thank some of them. Foremost, I would like to express my very great appreciation to my main supervisor Tor Helleseth, who has shared his extensive knowledge and expe- rience, and made warm conditions for the comfortable research in one of the rainiest cities in the world. I owe a great deal to Lilya Budaghyan, who was always ready to offer assistance and suggestions during my research. Advice given by Alexander Kholosha has been a great help in the early stages of my work on the thesis. My grateful thanks are also extended to all my friends and colleagues at the Selmer Center for creating such a pleasant environment to work in. I am particularly grateful to Kjell Jørgen Hole, Matthew G. Parker and Håvard Raddum for the shared teaching experience they provided. Moreover, I am very grateful for the comments and propositions given by everyone who proofread my thesis. In addition, I would like to thank the administrative staff at the Department of Informatics for their immediate and exhaustive solutions of practical issues. I wish to acknowledge the staff at the Department of Information Tech- nologies Security, Kharkiv National University of Radioelectronics, Ukraine, especially Roman Oliynykov, Ivan Gorbenko, Viktor Dolgov and Oleksandr Kuznetsov for their patient guidance, enthusiastic encouragement and useful critiques.
    [Show full text]
  • Rebound Attack
    Rebound Attack Florian Mendel Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria http://www.iaik.tugraz.at/ Outline 1 Motivation 2 Whirlpool Hash Function 3 Application of the Rebound Attack 4 Summary SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt The Rebound Attack [MRST09] Tool in the differential cryptanalysis of hash functions Invented during the design of Grøstl AES-based designs allow a simple application of the idea Has been applied to a wide range of hash functions Echo, Grøstl, JH, Lane, Luffa, Maelstrom, Skein, Twister, Whirlpool, ... The Rebound Attack Ebw Ein Efw inbound outbound outbound Applies to block cipher and permutation based
    [Show full text]
  • Modes of Operation for Compressed Sensing Based Encryption
    Modes of Operation for Compressed Sensing based Encryption DISSERTATION zur Erlangung des Grades eines Doktors der Naturwissenschaften Dr. rer. nat. vorgelegt von Robin Fay, M. Sc. eingereicht bei der Naturwissenschaftlich-Technischen Fakultät der Universität Siegen Siegen 2017 1. Gutachter: Prof. Dr. rer. nat. Christoph Ruland 2. Gutachter: Prof. Dr.-Ing. Robert Fischer Tag der mündlichen Prüfung: 14.06.2017 To Verena ... s7+OZThMeDz6/wjq29ACJxERLMATbFdP2jZ7I6tpyLJDYa/yjCz6OYmBOK548fer 76 zoelzF8dNf /0k8H1KgTuMdPQg4ukQNmadG8vSnHGOVpXNEPWX7sBOTpn3CJzei d3hbFD/cOgYP4N5wFs8auDaUaycgRicPAWGowa18aYbTkbjNfswk4zPvRIF++EGH UbdBMdOWWQp4Gf44ZbMiMTlzzm6xLa5gRQ65eSUgnOoZLyt3qEY+DIZW5+N s B C A j GBttjsJtaS6XheB7mIOphMZUTj5lJM0CDMNVJiL39bq/TQLocvV/4inFUNhfa8ZM 7kazoz5tqjxCZocBi153PSsFae0BksynaA9ZIvPZM9N4++oAkBiFeZxRRdGLUQ6H e5A6HFyxsMELs8WN65SCDpQNd2FwdkzuiTZ4RkDCiJ1Dl9vXICuZVx05StDmYrgx S6mWzcg1aAsEm2k+Skhayux4a+qtl9sDJ5JcDLECo8acz+RL7/ ovnzuExZ3trm+O 6GN9c7mJBgCfEDkeror5Af4VHUtZbD4vALyqWCr42u4yxVjSj5fWIC9k4aJy6XzQ cRKGnsNrV0ZcGokFRO+IAcuWBIp4o3m3Amst8MyayKU+b94VgnrJAo02Fp0873wa hyJlqVF9fYyRX+couaIvi5dW/e15YX/xPd9hdTYd7S5mCmpoLo7cqYHCVuKWyOGw ZLu1ziPXKIYNEegeAP8iyeaJLnPInI1+z4447IsovnbgZxM3ktWO6k07IOH7zTy9 w+0UzbXdD/qdJI1rENyriAO986J4bUib+9sY/2/kLlL7nPy5Kxg3 Et0Fi3I9/+c/ IYOwNYaCotW+hPtHlw46dcDO1Jz0rMQMf1XCdn0kDQ61nHe5MGTz2uNtR3bty+7U CLgNPkv17hFPu/lX3YtlKvw04p6AZJTyktsSPjubqrE9PG00L5np1V3B/x+CCe2p niojR2m01TK17/oT1p0enFvDV8C351BRnjC86Z2OlbadnB9DnQSP3XH4JdQfbtN8 BXhOglfobjt5T9SHVZpBbzhDzeXAF1dmoZQ8JhdZ03EEDHjzYsXD1KUA6Xey03wU uwnrpTPzD99cdQM7vwCBdJnIPYaD2fT9NwAHICXdlp0pVy5NH20biAADH6GQr4Vc
    [Show full text]
  • The Hitchhiker's Guide to the SHA-3 Competition
    History First Second Third The Hitchhiker’s Guide to the SHA-3 Competition Orr Dunkelman Computer Science Department 20 June, 2012 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 1/ 33 History First Second Third Outline 1 History of Hash Functions A(n Extremely) Short History of Hash Functions The Sad News about the MD/SHA Family 2 The First Phase of the SHA-3 Competition Timeline The SHA-3 First Round Candidates 3 The Second Round The Second Round Candidates The Second Round Process 4 The Third Round The Finalists Current Performance Estimates The Outcome of SHA-3 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 2/ 33 History First Second Third History Sad Outline 1 History of Hash Functions A(n Extremely) Short History of Hash Functions The Sad News about the MD/SHA Family 2 The First Phase of the SHA-3 Competition Timeline The SHA-3 First Round Candidates 3 The Second Round The Second Round Candidates The Second Round Process 4 The Third Round The Finalists Current Performance Estimates The Outcome of SHA-3 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 3/ 33 History First Second Third History Sad A(n Extremely) Short History of Hash Functions 1976 Diffie and Hellman suggest to use hash functions to make digital signatures shorter. 1979 Salted passwords for UNIX (Morris and Thompson). 1983/4 Davies/Meyer introduce Davies-Meyer. 1986 Fiat and Shamir use random oracles. 1989 Merkle and Damg˚ard present the Merkle-Damg˚ard hash function.
    [Show full text]
  • Broad View of Cryptographic Hash Functions
    IJCSI International Journal of Computer Science Issues, Vol. 10, Issue 4, No 1, July 2013 ISSN (Print): 1694-0814 | ISSN (Online): 1694-0784 www.IJCSI.org 239 Broad View of Cryptographic Hash Functions 1 2 Mohammad A. AlAhmad , Imad Fakhri Alshaikhli 1 Department of Computer Science, International Islamic University of Malaysia, 53100 Jalan Gombak Kuala Lumpur, Malaysia, 2 Department of Computer Science, International Islamic University of Malaysia, 53100 Jalan Gombak Kuala Lumpur, Malaysia Abstract Cryptographic hash function is a function that takes an arbitrary length as an input and produces a fixed size of an output. The viability of using cryptographic hash function is to verify data integrity and sender identity or source of information. This paper provides a detailed overview of cryptographic hash functions. It includes the properties, classification, constructions, attacks, applications and an overview of a selected dedicated cryptographic hash functions. Keywords-cryptographic hash function, construction, attack, classification, SHA-1, SHA-2, SHA-3. Figure 1. Classification of cryptographic hash function 1. INTRODUCTION CRHF usually deals with longer length hash values. An A cryptographic hash function H is an algorithm that takes an unkeyed hash function is a function for a fixed positive integer n * arbitrary length of message as an input {0, 1} and produce a which has, as a minimum, the following two properties: n fixed length of an output called message digest {0, 1} 1) Compression: h maps an input x of arbitrary finite bit (sometimes called an imprint, digital fingerprint, hash code, hash length, to an output h(x) of fixed bit length n.
    [Show full text]
  • NISTIR 7620 Status Report on the First Round of the SHA-3
    NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director NISTIR 7620: Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Abstract The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as “SHA-3” and will complement the SHA-2 hash algorithms currently specified in FIPS 180-3, Secure Hash Standard. In October, 2008, 64 candidate algorithms were submitted to NIST for consideration. Among these, 51 met the minimum acceptance criteria and were accepted as First-Round Candidates on Dec. 10, 2008, marking the beginning of the First Round of the SHA-3 cryptographic hash algorithm competition. This report describes the evaluation criteria and selection process, based on public feedback and internal review of the first-round candidates, and summarizes the 14 candidate algorithms announced on July 24, 2009 for moving forward to the second round of the competition. The 14 Second-Round Candidates are BLAKE, BLUE MIDNIGHT WISH, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein.
    [Show full text]
  • HCAHF: a New Family of CA-Based Hash Functions
    (IJACSA) International Journal of Advanced Computer Science and Applications, Vol. 10, No. 12, 2019 HCAHF: A New Family of CA-based Hash Functions Anas Sadak1, Fatima Ezzahra Ziani2, Bouchra Echandouri3, Charifa Hanin4, Fouzia Omary5 Faculty of Science, Mohammed V University Rabat, Morocco Abstract—Cryptographic hash functions (CHF) represent a The article is organized as follows: in Section 2, a core cryptographic primitive. They have application in digital background on cellular automata and hash functions is signature and message authentication protocols. Their main included. In Section 3, some related works are presented. building block are Boolean functions. Those functions provide Section 4 details the hashing scheme proposed. In Section 5, pseudo-randomness and sensitivity to the input. They also help the result of the different statistical tests and the cryptographic prevent and lower the risk of attacks targeted at CHF. Cellular properties of cellular automata are provided. Next, in Section 6 automata (CA) are a class of Boolean functions that exhibit good a security analysis is performed. Finally, Section 7 summarizes cryptographic properties and display a chaotic behavior. In this the article. article, a new hash function based on CA is proposed. A description of the algorithm and the security measures to II. BACKGROUND increase the robustness of the construction are presented. A security analysis against generic and dedicated attacks is A. Cryptographic Hash Functions (CHF) included. It shows that the hashing algorithm has good security Cryptographic hash functions with good security properties features and meet the security requirements of a good hashing represent a significant part of cryptography. They are the basis scheme.
    [Show full text]
  • Finding Bugs in Cryptographic Hash Function Implementations Nicky Mouha, Mohammad S Raunak, D
    1 Finding Bugs in Cryptographic Hash Function Implementations Nicky Mouha, Mohammad S Raunak, D. Richard Kuhn, and Raghu Kacker Abstract—Cryptographic hash functions are security-critical on the SHA-2 family, these hash functions are in the same algorithms with many practical applications, notably in digital general family, and could potentially be attacked with similar signatures. Developing an approach to test them can be par- techniques. ticularly diffcult, and bugs can remain unnoticed for many years. We revisit the NIST hash function competition, which was In 2007, the National Institute of Standards and Technology used to develop the SHA-3 standard, and apply a new testing (NIST) released a Call for Submissions [4] to develop the new strategy to all available reference implementations. Motivated SHA-3 standard through a public competition. The intention by the cryptographic properties that a hash function should was to specify an unclassifed, publicly disclosed algorithm, to satisfy, we develop four tests. The Bit-Contribution Test checks be available worldwide without royalties or other intellectual if changes in the message affect the hash value, and the Bit- Exclusion Test checks that changes beyond the last message bit property restrictions. To allow the direct substitution of the leave the hash value unchanged. We develop the Update Test SHA-2 family of algorithms, the SHA-3 submissions were to verify that messages are processed correctly in chunks, and required to provide the same four message digest lengths. then use combinatorial testing methods to reduce the test set size Chosen through a rigorous open process that spanned eight by several orders of magnitude while retaining the same fault- years, SHA-3 became the frst hash function standard that detection capability.
    [Show full text]
  • Grøstl – a SHA-3 Candidate
    Cryptographic hash functions NIST SHA-3 Competition Grøstl Grøstl – a SHA-3 candidate Krystian Matusiewicz Wroclaw University of Technology CECC 2010, June 12, 2010 Krystian Matusiewicz Grøstl – a SHA-3 candidate 1 / 26 Cryptographic hash functions NIST SHA-3 Competition Grøstl Talk outline ◮ Cryptographic hash functions ◮ NIST SHA-3 Competition ◮ Grøstl Krystian Matusiewicz Grøstl – a SHA-3 candidate 2 / 26 Cryptographic hash functions NIST SHA-3 Competition Grøstl Cryptographic hash functions Krystian Matusiewicz Grøstl – a SHA-3 candidate 3 / 26 Cryptographic hash functions NIST SHA-3 Competition Grøstl Cryptographic hash functions: why? ◮ We want to have a short, fixed length “fingerprint” of any piece of data ◮ Different fingerprints – certainly different data ◮ Identical fingerprints – most likely the same data ◮ No one can get any information about the data from the fingerprint Krystian Matusiewicz Grøstl – a SHA-3 candidate 4 / 26 Cryptographic hash functions NIST SHA-3 Competition Grøstl Random Oracle Construction: ◮ Box with memory ◮ On a new query: pick randomly and uniformly the answer, remember it and return the result ◮ On a repeating query, repeat the answer (function) Krystian Matusiewicz Grøstl – a SHA-3 candidate 5 / 26 Cryptographic hash functions NIST SHA-3 Competition Grøstl Random Oracle Construction: ◮ Box with memory ◮ On a new query: pick randomly and uniformly the answer, remember it and return the result ◮ On a repeating query, repeat the answer (function) Properties: ◮ No information about the data ◮ To find a preimage:
    [Show full text]