DOCSLIB.ORG

Collision Resistance of the JH Hash Function Jooyoung Lee and Deukjo Hong

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Collision Resistance of the JH Hash Function Jooyoung Lee and Deukjo Hong 1 Collision Resistance of the JH Hash Function Jooyoung Lee and Deukjo Hong Abstract—In this paper, we analyze collision resistance of the Merkle-Damgard˚ Transform: Let JH hash function in the ideal primitive model. The JH hash [1 function is one of the five SHA-3 candidates accepted for the ¤ mi final round of evaluation. The JH hash function uses a mode of pad : f0; 1g ! f0; 1g operation based on a permutation, while its security has been i=1 elusive even in the random permutation model. One can find a collision for the JH compression function only be an injective padding. With this padding scheme and a with two backward queries to the basing primitive. However, the predetermined constant IV 2 f0; 1g2n, the Merkle-Damgard˚ security is significantly enhanced in iteration. For c · n=2, we transform produces a variable-input-length function MD[F ]: prove that the JH hash function using an ideal n-bit permutation f0; 1g¤ ! f0; 1g2n from a fixed-input-length function F : and producing c-bit outputs by truncation is collision resistant 2n m 2n ¤ c=2 f0; 1g £ f0; 1g ! f0; 1g . For M 2 f0; 1g such that up to O(2 ) queries. jpad(M)j = lm, MD[F ](M) is computed as follows. Index Terms—hash function, collision resistance. Function MD[F ](M) I. INTRODUCTION u[0] à IV Break pad(M) = M[1]jj ::: jjM[l + 1] into m-bit blocks As many hash functions, including those most common in for i à 1 to l + 1 do practical applications, have started to exhibit serious security u[i] à F (u[i ¡ 1];M[i]) weaknesses [2]–[9], the US National Institute for Standards return u[l + 1] and Technology (NIST) has opened a public competition to develop a new cryptographic hash function. Currently, the Collision Resistance: We review the definition of collision final candidates to replace SHA-2 has been announced, which resistance in the information-theoretic model. Given a function are BLAKE, Grøstl, JH, Keccak and Skein. In this paper, H = H[P] and an information-theoretic adversary A both we analyze collision resistance for the JH hash function in with oracle access to an ideal primitive P, the collision the ideal primitive model. The JH compression function is resistance of H against A is estimated by the following illustrated in Fig. 1, where ¼ is a certain permutation. The experiment. JH hash function is obtained by feeding the compression Experiment Expcol function to the Merkle-Damgard˚ transform [10]. The only A known result for the security of the JH hash function is A updates Q by making oracle queries to P 0 0 its indifferentiability from a random oracle guaranteed up to if 9 M 6= M and u s.t. u = HQ(M) = HQ(M ) then 2n=6 query complexity [1]. This translates into the collision output 1 resistance of the JH hash function up to 2n=6 query complexity, else which is far from optimal. output 0 Even if ¼ is a truly random function, one can find a collision This experiment records every query-response pair that A for the JH compression function only with two backward obtains by oracle queries into a query history Q. We write queries to the basing primitive. In this paper, however, we u = HQ(M) if Q contains all the query-response pairs show that the security is significantly enhanced in iteration. required to compute u = H(M). At the end of the experiment, For c · n=2, we prove that the JH hash function using A would like to find two distinct evaluations yielding a an ideal n-bit permutation and producing c-bit outputs by collision. The collision-finding advantage of A is defined to truncation is collision resistant up to O(2c=2) queries. This be h i bound implies that the JH hash function provides the optimal Advcol(A) = Pr Expcol = 1 : collision resistance in the random permutation model. H A II. PRELIMINARIES The probability is taken over the random choice of P and col A’s coins (if any). For q > 0, we define AdvH (q) as the maximum of Advcol(A) over all adversaries A making at General Notation: For two bitstrings x and y, xjjy denotes H most q queries. the concatenation of x and y. Given x 2 f0; 1gn for an n even integer n, xL and xR denote 2 -bit strings such that x = xLjjxR. III. DESCRIPTION OF THE JH HASH FUNCTION J. Lee is with the Attached Institute of Electronics and Telecommunications Research Institute, Daejeon, Korea (e-mail: [email protected]). n D. Hong is with the Attached Institute of Electronics and Telecommunica- Let ¼ be a permutation on f0; 1g for an even integer n. tions Research Institute, Daejeon, Korea (e-mail: [email protected]). Then the JH compression function F = F [¼] is defined as 2 follows. birthday bound. The next step is to show that the probability of collision is small without the occurrence of Rcol . We begin n n=2 n q F : f0; 1g £ f0; 1g ¡! f0; 1g with the following proposition. (u; z) 7¡! v; Proposition 1: Without the occurrence of Rcoli, jUij · i+1 for i = 0; : : : ; q. where Proof: Note that U0 = fIV g. If jUij > i + 1 for some v = ¼ (u © (zjj0)) © (0jjz): i = 1; : : : ; q, then a certain query, say the j-th query, would produce two distinct orderly reachable nodes, say w and w0. The pictorial representation is given in Fig. 1. n c In this case, we have two paths For c · n=2, let chopc : f0; 1g ! f0; 1g be the function j1 j2 js¡1 js that chops off the (n ¡ c) leftmost bits of its input string, i.e., P1 : IV ! u[1] ! ¢ ¢ ¢ ! u[s ¡ 1] ! w n¡c chopc(x) = x2 if x = x1jjx2 for some x1 2 f0; 1g and c and x2 2 f0; 1g . Then the c-bit JH hash function is defined by 0 0 j0 0 j1 j2 t¡1 jt 0 JHc = chopc ± MD[F ]. In the original submission, n = 1024 P2 : IV ! v[1] ! ¢ ¢ ¢ ! v[t ¡ 1] ! w and c 2 f224; 256; 384; 512g. where the labels are strictly increasing and Since the padding is injective, we can simplify our collision j = j0 = j · i: analysisS by assuming that the domain of the JH hash function s t is 1 f0; 1gni=2 (and ignore the padding scheme). In the i=1 Since w 6= w0 and j = j0 = j · i, u[s ¡ 1] and v[t ¡ 1] are following section, we will prove collision resistance for the s t distinct orderly reachable nodes in U such that chop (u[s ¡ JH hash function assuming ¼ is an ideal random permutation. i c 1]) = chopc(v[t¡1]). This contradicts the condition of :Rcoli. z n/2 Proposition 2: Suppose that an adversary A makes q queries to a random permutation ¼ and its inverse ¼¡1. For u v n=2 L n/2 L N = 2 and q < N, 㼩 q(q + 1) u v Pr [Rcol ] · : R n/2 R q 2(N ¡ 1) Proof: Since Fig. 1. JH compression function. Xq Pr [Rcolq] · Pr [Rcoli ^ :Rcoli¡1] i=1 Xq IV. COLLISION RESISTANCE OF THE JH HASH FUNCTION · Pr [Rcolij:Rcoli¡1] ; (1) Suppose that an information-theoretic adversary A adap- i=1 tively makes q forward or backward queries to an ideal random (where Rcol = ;), we will focus on the estimation of i i 0 permutation ¼, and records a query history Q = f(x ; y ) 2 Pr [Rcol j:Rcol ] for i = 1; : : : ; q. Note that U contains n i i i i¡1 i¡1 f0; 1g : 1 · i · qg. Here ¼(x ) = y and A’s i-th query is at most i nodes without the occurrence of event Rcol by i ¡1 i i¡1 either ¼(x ) or ¼ (y ) for 1 · i · q. Proposition 1. We define a direct graph G on f0; 1gn where a direct edge ¤ ¤ Suppose that A makes a forward query ¼(xLjjxR) = from u to v labeled i is added to G when the i-th query- (y jjy ). Since there are at most one orderly reachable node i i L R response pair (x ; y ) determines an evaluation F [¼](u; z) = v u 2 U such that u = x¤ , the i-th query determines at i i¡1 R R for some z 2 f0; 1gn=2. We will denote such an edge by u ! ¤ most one orderly reachable node v = (yLjj(uL © xL © yR)). v. We note that each query ¼(x jjx ) = (y jjy ) generates ¤ L R L R The probability that uL © xL © yR = wR for some w 2 Ui¡1 n=2 2 edges from ((xL © z)jjxR) to (yLjj(yR © z)) where z 2 is at most iN=(N 2 ¡ q). When A makes a backward query f0; 1gn=2. ¡1 ¤ ¤ ¼ (yLjjyR) = (xLjjxR), the probability that xR = wR for n 2 Definition 1: u 2 f0; 1g is called an orderly reachable some w 2 Ui¡1 is also at most iN=(N ¡ q). Therefore we node if there exists a direct path conclude that i i it¡1 i iN IV !1 u[1] !2 ¢ ¢ ¢ ! u[t ¡ 1] !t u; Pr [Rcol j:Rcol ] · ; i i¡1 N 2 ¡ q such that i1 < i2 < : : : < it¡1 < it. By convention, IV is an and by (1), orderly reachable node. Xq For i = 1; : : : ; q, let Ui be the set of orderly reachable nodes iN q(q + 1) Pr [Rcolq] · · : determined by the first i queries, and let Rcol be the event N 2 ¡ q 2(N ¡ 1) i i=1 that Ui contains a collision in the right-half bits.
Load more

Recommended publications
  • Permutation-Based Encryption, Authentication and Authenticated Encryption
    Permutation-based encryption, authentication and authenticated encryption Permutation-based encryption, authentication and authenticated encryption Joan Daemen1 Joint work with Guido Bertoni1, Michaël Peeters2 and Gilles Van Assche1 1STMicroelectronics 2NXP Semiconductors DIAC 2012, Stockholm, July 6 . Permutation-based encryption, authentication and authenticated encryption Modern-day cryptography is block-cipher centric Modern-day cryptography is block-cipher centric (Standard) hash functions make use of block ciphers SHA-1, SHA-256, SHA-512, Whirlpool, RIPEMD-160, … So HMAC, MGF1, etc. are in practice also block-cipher based Block encryption: ECB, CBC, … Stream encryption: synchronous: counter mode, OFB, … self-synchronizing: CFB MAC computation: CBC-MAC, C-MAC, … Authenticated encryption: OCB, GCM, CCM … . Permutation-based encryption, authentication and authenticated encryption Modern-day cryptography is block-cipher centric Structure of a block cipher . Permutation-based encryption, authentication and authenticated encryption Modern-day cryptography is block-cipher centric Structure of a block cipher (inverse operation) . Permutation-based encryption, authentication and authenticated encryption Modern-day cryptography is block-cipher centric When is the inverse block cipher needed? Indicated in red: Hashing and its modes HMAC, MGF1, … Block encryption: ECB, CBC, … Stream encryption: synchronous: counter mode, OFB, … self-synchronizing: CFB MAC computation: CBC-MAC, C-MAC, … Authenticated encryption: OCB, GCM, CCM … So a block cipher
    [Show full text]
  • The Missing Difference Problem, and Its Applications to Counter Mode
    The Missing Difference Problem, and its Applications to Counter Mode Encryption? Ga¨etanLeurent and Ferdinand Sibleyras Inria, France fgaetan.leurent,[email protected] Abstract. The counter mode (CTR) is a simple, efficient and widely used encryption mode using a block cipher. It comes with a security proof that guarantees no attacks up to the birthday bound (i.e. as long as the number of encrypted blocks σ satisfies σ 2n=2), and a matching attack that can distinguish plaintext/ciphertext pairs from random using about 2n=2 blocks of data. The main goal of this paper is to study attacks against the counter mode beyond this simple distinguisher. We focus on message recovery attacks, with realistic assumptions about the capabilities of an adversary, and evaluate the full time complexity of the attacks rather than just the query complexity. Our main result is an attack to recover a block of message with complexity O~(2n=2). This shows that the actual security of CTR is similar to that of CBC, where collision attacks are well known to reveal information about the message. To achieve this result, we study a simple algorithmic problem related to the security of the CTR mode: the missing difference problem. We give efficient algorithms for this problem in two practically relevant cases: where the missing difference is known to be in some linear subspace, and when the amount of data is higher than strictly required. As a further application, we show that the second algorithm can also be used to break some polynomial MACs such as GMAC and Poly1305, with a universal forgery attack with complexity O~(22n=3).
    [Show full text]
  • NISTIR 7620 Status Report on the First Round of the SHA-3
    NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director NISTIR 7620: Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Abstract The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as “SHA-3” and will complement the SHA-2 hash algorithms currently specified in FIPS 180-3, Secure Hash Standard. In October, 2008, 64 candidate algorithms were submitted to NIST for consideration. Among these, 51 met the minimum acceptance criteria and were accepted as First-Round Candidates on Dec. 10, 2008, marking the beginning of the First Round of the SHA-3 cryptographic hash algorithm competition. This report describes the evaluation criteria and selection process, based on public feedback and internal review of the first-round candidates, and summarizes the 14 candidate algorithms announced on July 24, 2009 for moving forward to the second round of the competition. The 14 Second-Round Candidates are BLAKE, BLUE MIDNIGHT WISH, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein.
    [Show full text]
  • High-Speed Hardware Implementations of BLAKE, Blue
    High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein Version 2.0, November 11, 2009 Stefan Tillich, Martin Feldhofer, Mario Kirschbaum, Thomas Plos, J¨orn-Marc Schmidt, and Alexander Szekely Graz University of Technology, Institute for Applied Information Processing and Communications, Inffeldgasse 16a, A{8010 Graz, Austria {Stefan.Tillich,Martin.Feldhofer,Mario.Kirschbaum, Thomas.Plos,Joern-Marc.Schmidt,Alexander.Szekely}@iaik.tugraz.at Abstract. In this paper we describe our high-speed hardware imple- mentations of the 14 candidates of the second evaluation round of the SHA-3 hash function competition. We synthesized all implementations using a uniform tool chain, standard-cell library, target technology, and optimization heuristic. This work provides the fairest comparison of all second-round candidates to date. Keywords: SHA-3, round 2, hardware, ASIC, standard-cell implemen- tation, high speed, high throughput, BLAKE, Blue Midnight Wish, Cube- Hash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, Skein. 1 About Paper Version 2.0 This version of the paper contains improved performance results for Blue Mid- night Wish and SHAvite-3, which have been achieved with additional imple- mentation variants. Furthermore, we include the performance results of a simple SHA-256 implementation as a point of reference. As of now, the implementations of 13 of the candidates include eventual round-two tweaks. Our implementation of SIMD realizes the specification from round one. 2 Introduction Following the weakening of the widely-used SHA-1 hash algorithm and concerns over the similarly-structured algorithms of the SHA-2 family, the US NIST has initiated the SHA-3 contest in order to select a suitable drop-in replacement [27].
    [Show full text]
  • Performance Analysis of Cryptographic Hash Functions Suitable for Use in Blockchain
    I. J. Computer Network and Information Security, 2021, 2, 1-15 Published Online April 2021 in MECS (http://www.mecs-press.org/) DOI: 10.5815/ijcnis.2021.02.01 Performance Analysis of Cryptographic Hash Functions Suitable for Use in Blockchain Alexandr Kuznetsov1 , Inna Oleshko2, Vladyslav Tymchenko3, Konstantin Lisitsky4, Mariia Rodinko5 and Andrii Kolhatin6 1,3,4,5,6 V. N. Karazin Kharkiv National University, Svobody sq., 4, Kharkiv, 61022, Ukraine E-mail: [email protected], [email protected], [email protected], [email protected], [email protected] 2 Kharkiv National University of Radio Electronics, Nauky Ave. 14, Kharkiv, 61166, Ukraine E-mail: [email protected] Received: 30 June 2020; Accepted: 21 October 2020; Published: 08 April 2021 Abstract: A blockchain, or in other words a chain of transaction blocks, is a distributed database that maintains an ordered chain of blocks that reliably connect the information contained in them. Copies of chain blocks are usually stored on multiple computers and synchronized in accordance with the rules of building a chain of blocks, which provides secure and change-resistant storage of information. To build linked lists of blocks hashing is used. Hashing is a special cryptographic primitive that provides one-way, resistance to collisions and search for prototypes computation of hash value (hash or message digest). In this paper a comparative analysis of the performance of hashing algorithms that can be used in modern decentralized blockchain networks are conducted. Specifically, the hash performance on different desktop systems, the number of cycles per byte (Cycles/byte), the amount of hashed message per second (MB/s) and the hash rate (KHash/s) are investigated.
    [Show full text]
  • JHAE: an Authenticated Encryption Mode Based on JH
    JHAE: An Authenticated Encryption Mode Based on JH Javad Alizadeh1, Mohammad Reza Aref1, Nasour Bagheri2 1 Information Systems and Security Lab. (ISSL), Electrical Eng. Department, Sharif University of Technology, Tehran, Iran, Alizadja@gmail, [email protected] 2 Electrical Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran, [email protected] Abstract. In this paper we present JHAE, an authenticated encryption (AE) mode based on the JH hash mode. JHAE is a dedicated AE mode based on permutation. We prove that this mode, based on ideal permutation, is provably secure. Keywords: Dedicated Authenticated Encryption, Provable Security, Privacy, Integrity 1 Introduction Privacy and authentication are two main goals in the information security. In many ap- plications this security parameters must be established simultaneously. An cryptographic scheme that provide both privacy and authentication is called authenticated encryption (AE) scheme. Traditional approach for AE is using of generic compositions. In this approach one uses two algorithms that one provides confidentiality and the other one provides authen- ticity. However, this approach is not efficient for many applications because it requires two different algorithms with two different keys as well as separate passes over the message [2]. Another approach to design an AE is using a block cipher in a special mode that the block cipher is treated as a black box in the mode [10, 12, 14]. The most problem of these modes is the necessity for implementation of the whole block cipher to process each message block which is time/resource consuming. Dedicated AE schemes resolve the problems of the generic compositions and block cipher based modes.
    [Show full text]
  • Farfalle: Parallel Permutation-Based Cryptography
    Farfalle: parallel permutation-based cryptography Guido Bertoni3, Joan Daemen1,2, Seth Hoffert, Michaël Peeters1, Gilles Van Assche1 and Ronny Van Keer1 1 STMicroelectronics 2 Radboud University 3 Security Pattern Abstract. In this paper, we introduce Farfalle, a new permutation-based construction for building a pseudorandom function (PRF). The PRF takes as input a key and a sequence of arbitrary-length data strings, and returns an arbitrary-length output. It has a compression layer and an expansion layer, each involving the parallel application of a permutation. The construction also makes use of LFSR-like rolling functions for generating input and output masks and for updating the inner state during expansion. On top of the inherent parallelism, Farfalle instances can be very efficient because the construction imposes less requirements on the underlying primitive than, e.g., the duplex construction or typical block cipher modes. Farfalle has an incremental property: compression of common prefixes of inputs can be factored out. Thanks to its input-output characteristics, Farfalle is really versatile. We specify simple modes on top of it for authentication, encryption and authenticated encryption, as well as a wide block cipher mode. As a showcase, we present KRAVATTE, a very efficient instance of Farfalle based on KECCAK-p[1600, nr] permutations and formulate concrete security claims against classical and quantum adversaries. The permutations in the compression and expansion layers of KRAVATTE have only 6 rounds apiece and the rolling functions are lightweight. We provide a rationale for our choices and report on software performance. Keywords: pseudorandom function · permutation-based cryptography · KECCAK 1 Introduction Until recently, symmetric cryptography was dominated by block ciphers.
    [Show full text]
  • On the Security of CTR + CBC-MAC NIST Modes of Operation – Additional CCM Documentation
    On the Security of CTR + CBC-MAC NIST Modes of Operation { Additional CCM Documentation Jakob Jonsson? jakob [email protected] Abstract. We analyze the security of the CTR + CBC-MAC (CCM) encryption mode. This mode, proposed by Doug Whiting, Russ Housley, and Niels Ferguson, combines the CTR (“counter”) encryption mode with CBC-MAC message authentication and is based on a block cipher such as AES. We present concrete lower bounds for the security of CCM in terms of the security of the underlying block cipher. The conclusion is that CCM provides a level of privacy and authenticity that is in line with other proposed modes such as OCB. Keywords: AES, authenticated encryption, modes of operation. Note: A slightly different version of this paper will appear in the Proceedings from Selected Areas of Cryptography (SAC) 2002. 1 Introduction Background. Block ciphers are popular building blocks in cryptographic algo­ rithms intended to provide information services such as privacy and authenticity. Such block-cipher based algorithms are referred to as modes of operation. Exam­ ples of encryption modes of operation are Cipher Block Chaining Mode (CBC) [23], Electronic Codebook Mode (ECB) [23], and Counter Mode (CTR) [9]. Since each of these modes provides privacy only and not authenticity, most applica­ tions require that the mode be combined with an authentication mechanism, typically a MAC algorithm [21] based on a hash function such as SHA-1 [24]. For example, a popular cipher suite in SSL/TLS [8] combines CBC mode based on Triple-DES [22] with the MAC algorithm HMAC [26] based on SHA-1.
    [Show full text]
  • PAGE—Practical AES-GCM Encryption for Low-End Microcontrollers
    applied sciences Article PAGE—Practical AES-GCM Encryption for Low-End Microcontrollers Kyungho Kim 1, Seungju Choi 1, Hyeokdong Kwon 1, Hyunjun Kim 1 and Zhe Liu 2 and Hwajeong Seo 1,* 1 Division of IT Convergence Engineering, Hansung University, Seoul 02876, Korea; [email protected] (K.K); [email protected] (S.C.); [email protected] (H.K.); [email protected] (H.K.) 2 Nanjing University of Aeronautics and Astronautics, Nanjing 210016, China; [email protected] * Correspondence: [email protected]; Tel.: +82-2-760-8033 Received: 25 March 2020; Accepted: 28 April 2020; Published: 30 April 2020 Abstract: An optimized AES (Advanced Encryption Standard) implementation of Galois Counter Mode of operation (GCM) on low-end microcontrollers is presented in this paper. Two optimization methods are applied to proposed implementations. First, the AES counter (CTR) mode of operation is speed-optimized and ensures constant timing. The main idea is replacing expensive AES operations, including AddRound Key, SubBytes, ShiftRows, and MixColumns, into simple look-up table access. Unlike previous works, the look-up table does not require look-up table updates during the entire encryption life-cycle. Second, the core operation of Galois Counter Mode (GCM) is optimized further by using Karatsuba algorithm, compact register utilization, and pre-computed operands. With above optimization techniques, proposed AES-GCM on 8-bit AVR (Alf and Vegard’s RISC processor) architecture from short-term, middle-term to long-term security levels achieved 415, 466, and 477 clock cycles per byte, respectively. Keywords: AES; fast software encryption; Galois Counter Mode of operation; low-end microcontrollers; side channel attack countermeasure 1.
    [Show full text]
  • Permutation-Based Encryption, Authentication and Authenticated Encryption
    Permutation-based encryption, authentication and authenticated encryption Guido Bertoni1, Joan Daemen1, Michaël Peeters2, and Gilles Van Assche1 1 STMicroelectronics 2 NXP Semiconductors Abstract. While mainstream symmetric cryptography has been dominated by block ciphers, we have proposed an alternative based on fixed-width permutations with modes built on top of the sponge and duplex construction, and our concrete proposal K. Our permutation- based approach is scalable and suitable for high-end CPUs as well as resource-constrained platforms. The laer is illustrated by the small K instances and the sponge functions Quark, Photon and Spongent, all addressing lightweight applications. We have proven that the sponge and duplex construction resist against generic aacks with complexity up to 2c/2, where c is the capacity. This provides a lower bound on the width of the underlying permuta- tion. However, for keyed modes and bounded data complexity, a security strength level above c/2 can be proven. For MAC computation, encryption and even authenticated encryption with a passive adversary, a security strength level of almost c against generic aacks can be aained. This increase in security allows reducing the capacity leading to a beer efficiency. We argue that for keyed modes of the sponge and duplex constructions the requirements on the under- lying permutation can be relaxed, allowing to significantly reduce its number of rounds. Fi- nally, we present two generalizations of the sponge and duplex constructions that allow more freedom in tuning the parameters leading to even higher efficiency. We illustrate our generic constructions with proposals for concrete instantiations calling reduced-round versions of the K- f [1600] and K- f [200] permutations.
    [Show full text]
  • Resource Efficient Implementation of the Keccak, Skein & JH Algorithms on a Reconfigurable Platform
    Çankaya University Journal of Science and Engineering Volume 13, No. 1 (2016) 040-057 Resource Efficient Implementation of the Keccak, Skein & JH Algorithms on a Reconfigurable Platform Dur-e-Shahwar Kundi, Arshad Aziz, Kashif Latif Department of Electrical Engineering (PNEC), National University of Sciences and Technology (NUST), H-12 Islamabad, Pakistan e-mail: [email protected], [email protected], [email protected] Abstract: In this work, we present a compact hardware implementation of cryptographic hash algorithms; [Keccak, Skein & JH] on Field Programmable Gate Array (FPGA) by using an efficient primitive level programming approach. All the logic is not only mapped onto Look-Up-Table (LUT) but also effectively utilizes FPGAs internal dedicated logical resource, such as Fast Carry Chain logic with MUXCY and XORCY to reduce overall hardware resources. This approach results in the usage of a minimized chip area with a good balance between resources and speed for selected hash algorithms. All the implementation has been done on the latest Xilinx FPGAs and their results comparisons are presented in the form of chip area consumption, throughput and throughput per area with previous up-to-date implementations. The results show a substantial improvement as compared to all the previously reported works. Keywords: Cryptographic Hash Functions, FPGA, JH, Keccak, Skein, SHA-3. 1. Introduction Cryptographic hash functions are an essential component in many information security applications such as digital signatures, message authentication codes (MACs) that require authentication, and data integrity. A secure cryptographic hash function must have two important properties: it should be irreversible and it should be collision free.
    [Show full text]
  • SHA-3 Final Round Candidate Algorithms on ARM Cortex A8 Processor
    International Journal of Security and Its Applications Vol.9, No.12 (2015), pp.367-384 http://dx.doi.org/10.14257/ijsia.2015.9.12.34 Performance Comparison of Keccak, Skein, Grøstl, Blake and JH: SHA-3 Final Round Candidate Algorithms on ARM Cortex A8 Processor Rajeev Sobti1* and G. Geetha2 1*School of Computer Science and Engineering, Lovely Professional University, Phagwara, Punjab, 144411, India 2Divison of Research and Development, Lovely Professional University, Phagwara, Punjab, 144411, India 1*[email protected], [email protected] Abstract Taking cognizance of various attacks on MDx family of Hash function including SHA- 0 and SHA-1, National Institute of Standards and Technology came up with a public competition for new Hash standard SHA-3 to augment or replace the current Hash standard SHA-2. NIST provided a reference platform (Wintel machines) and compiler (Microsoft Visual Studio) on which the submitted algorithms were to be evaluated. The five algorithms that reached the final round of SHA-3 public competition were evaluated by us on ARM Cortex A8 architecture (architecture other than the reference platform). Performance evaluation of these final round candidate algorithms were done on Cortex- A8 based OpenBoard AM335x from PHYTEC running Linux 3.2.0. The results in Cycles consumed per byte are shared in this paper. Keywords: Hash Functions, SHA-3, Performance Evaluation, Cortex A8, Cycles per Byte 1. Introduction A cryptographic hash algorithm, also known as hash function, provides a random mapping from an arbitrary length input message to fixed size message string known as message digest. Hash functions have a number of security applications like achieving integrity and authentication, implementing digital signatures and digital time stamping, generating pseudo random numbers and session keys, constructing block ciphers, indexing data in hash tables, detecting accidental data corruption as checksums etc.
    [Show full text]