DOCSLIB.ORG

Survey of Cryptographic Hashing Algorithms for Message Signing 1Ankit Kumar Jain, 2Rohit Jones, 3Puru Joshi 1,2,3Dept

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Survey of Cryptographic Hashing Algorithms for Message Signing 1Ankit Kumar Jain, 2Rohit Jones, 3Puru Joshi 1,2,3Dept IJCST VOL . 8, Iss UE 2, APR I L - JUNE 2017 ISSN : 0976-8491 (Online) | ISSN : 2229-4333 (Print) Survey of Cryptographic Hashing Algorithms for Message Signing 1Ankit Kumar Jain, 2Rohit Jones, 3Puru Joshi 1,2,3Dept. of Computer Engineering, NMIMS Shirpur, Maharashtra, India Abstract E. Hashing In the world of computing, there is always a need for unique values It is used to represent a digital file, message or any entity into to be generated for numerous applications. Various methods exist a shorter, fixed length and unique string of characters in such a with the most common being reliant on an instance of time. But manner that the hash computed for the digital entity will always when we need to generate a unique value, based on an input factor be the same and it is impossible to retrieve the original digital such that the exact same value is generated, every time the input entity from its hash string. factor is the same, cryptographic hashing functions get the job done. Cryptographic hashing functions have many uses like digital Cryptographic hash functions map strings (messages) of almost signatures, message authentication, checksum generation, digital arbitrary length to strings of a fixed, short length, typically fingerprinting and securing passwords in a database. In this paper, somewhere between 128 and 512 bits [1]. Many different terms we review and compare multiple hashing algorithms by different have been used for the output string. criteria with emphasis on message authentication. Among these are the hash, the hash value, and the message Keywords digest. A hash function is expected to be very efficient. Different Cryptography, Hash, SHA, MD, Keccak, BLAKE, Message applications expect different properties of the hash function, but Digest, Merkle–Damgård some properties are always expected [2]. I. Introduction 1. A hash function H is always expected to be one-way. This Cryptography is often defined as the enciphering and deciphering means that given a randomly chosen image y, it is difficult of messages in secret code or cipher. Usually, cryptography (i.e., impossible in practice) to find a message x such that F(x) is associated with security but it is just a facet of the overall = y. Attacks that attempt to break this property of a hash are security of a system. While, Cryptanalysis can be defined as termed as pre-image attacks. study, development and execution of tools and techniques that 2. The hash of a message obtained from a hash function, should are used to undermine or compromise the integrity, security or be equivalent to a digital fingerprint, such that two different effectiveness of a cryptographic system. The term Cryptology is messages also have different hash values. Attacks that attempt associated with the combination of both the above topics. that is, to break this property of a hash are termed as hash collision cryptography and cryptanalysis. The field of cryptography has attacks. many different applications, most of which can be deemed to be a 3. Theoretically, it is possible for two different messages to separate field. Some important and commons uses of cryptography generate the same hash, due to the nature of limited output are as follows: space, but the hash function should compute the hash in such a manner that it is practically infeasible to find such messages A. Encryption [3]. It is defined as the process of converting some information from one form to another, with the intent of hiding the original message A graphical representation of the above attacks is shown in Figure in such a way that, no-one other than the intended recipient of the 1 to help understand the concepts better. message can understand the meaning of the encrypted message. B. Decryption It can be defined as the reverse process of encryption, that is, the conversion of an encrypted message into its original meaning. C. Authentication It can be defined as the process that is used to prove that something is real, authentic, true or genuine. Authentication is used extensively on the internet to grant access to users who rightfully can have access and deny those who don’t. D. Digital Signatures Just like physically signing a document to prove its authenticity, digital signatures are used to achieve the same concept but for digital goods and services. Just like with physical signatures, it is very difficult to copy or forge digital signatures if not impossible. Fig. 1: Different Types of Attacks on Hashing Algorithms 18 INTERNATIONAL JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY www.ijcst.com ISSN : 0976-8491 (Online) | ISSN : 2229-4333 (Print) IJCST VOL . 8, Iss UE 2, APR I L - JUNE 2017 Many popular cryptographic hashing algorithms like MD5, that it is weak to pre-image attacks. MD6, SHA1, SHA2 and BLAKE2 use the Merkle-Damgård [16] construction to achieve collision resistance. C. Message Digest 5 (MD5) The working of the Merkle-Damgård construction is as follows. MD-5 is a cryptographic hashing algorithm that was developed The input to the structure is a multiple of a fixed number (example: by Ronald Rivest in 1991, to produces a 128 bits fixed length 512 or 1024) which is achieved by padding the input message, hash value [12]. MD5 is the successor of the flawed MD4 and as the construction does not allow an arbitrary sized input. The was designed around the features and performance of 32-bit input message is then spit into multiple message blocks of a processors in mind but is in fact slower than MD4 but bears fixed size after which they are processed by the compression heavy resemblance to MD4. An emphasis on 32-bit processors function in a sequential fashion such that the output of the previous is done because, the four word buffers (A, B, C, D) that are used message block’s compression is combined with the input of the to compute the message digest are, each, a 32-bit register. The next message block’s compression. As a security measure, the main process of MD5 is very like MD4 and contains the same message’s original length is hidden by padding the message. The phases of appending padding bits followed but appending the first message block, does not have any previous message block length of the original message followed the initialization of the whose compression are to be combined to use as an input, hence, MD buffers followed by processing the message in 16-word blocks an initialization vector is used in its place. The final stage of the which consists of 64 operations, grouped in four rounds of 16 construction, implements a finalization function that is used for operations followed by the final output. In 2005 Xiaoyun Wang many purposes such as compressing a big internal state into a and Hongbo Yu demonstrated that it was possible to perform a smaller one, guarantying better mixing and obtaining a better modular differential attack and break the collision resistance of avalanche effect.\ MD5. MD-5 is broken regarding collisions, but not in regard of pre-images or second-pre-images. D. Secure Hash Algorithm 1 (SHA-1) SHA-1 is a cryptographic hashing algorithm that was developed by the NIST [4] in 1993 to produce a 160-bit message digest. SHA-1 bears a remarkable similarity to the MD5 cryptographic hashing algorithm. At one point of time, it was the most preferred Fig. 2: Standard Merkle-Damgård Construction hashing algorithms for integrity checking due to its time efficiency and versatility. Post 2010, It is no longer actively used as it was II. Study of hashing algorithms proved to be venerable to hash collisions by Marc Stevens, with This section gives a brief description of different hashing algorithms a complexity of 261 operations [5]. and their working. E. Secure Hash Algorithm (SHA-2) A. Message Digest 2 (MD2) SHA-2 is a cryptographic hashing algorithm that was developed MD2 is a cryptographic hashing algorithm that was published in by NSA. It has two variations namely SHA-256 and SHA-512 1989 and is used to generate message digests of 128 bits by using [13]. The primary difference between the two variants are the a compression function of 18 rounds [10]. Post 2004, MD2 is size of the words used. While SHA-256 uses 32-bit words, SHA- known to be susceptible to preimage attacks of time complexity 512 uses 64-bit words. Although, neither SHA-256 nor SHA-512 equivalent to 2104 applications of the compression function have been proved to be flawed, they are still not preferred for (Muller, 2004). Hence in the words of the MD2 author, “MD 2 integrity verification as they are not as efficient as SHA-1 in terms can no longer be considered a secure one-way hash function”. Post of time complexities. Also, as SHA-2 is derived from SHA-1 2008, MD2 was shown to be more vulnerable and exploitable than which in turn is based on the MerkleDamgård structure, that was it was initially thought out to be with successful preimage attacks exploited to break the SHA-1 cryptographic hashing algorithm, being carried out with a time complexity of 273 compression thus, theoretically SHA-2 can also be broken. function evaluations making it more feasible to exploit and more dangerous to use. MD2 is also proved to be susceptible to collision F. Secure Hash Algorithm 3 (SHA-3) attacks, in 2009, of time complexity of 263.3 compression function SHA-3 is a cryptographic hashing algorithm that was chosen by evaluations. the NSA in 2012 after a public competition among non-NSA designers [14]. The prior name of the SHA-3 hashing algorithm B.
Load more

Recommended publications
  • GPU-Based Password Cracking on the Security of Password Hashing Schemes Regarding Advances in Graphics Processing Units
    Radboud University Nijmegen Faculty of Science Kerckhoffs Institute Master of Science Thesis GPU-based Password Cracking On the Security of Password Hashing Schemes regarding Advances in Graphics Processing Units by Martijn Sprengers [email protected] Supervisors: Dr. L. Batina (Radboud University Nijmegen) Ir. S. Hegt (KPMG IT Advisory) Ir. P. Ceelen (KPMG IT Advisory) Thesis number: 646 Final Version Abstract Since users rely on passwords to authenticate themselves to computer systems, ad- versaries attempt to recover those passwords. To prevent such a recovery, various password hashing schemes can be used to store passwords securely. However, recent advances in the graphics processing unit (GPU) hardware challenge the way we have to look at secure password storage. GPU's have proven to be suitable for crypto- graphic operations and provide a significant speedup in performance compared to traditional central processing units (CPU's). This research focuses on the security requirements and properties of prevalent pass- word hashing schemes. Moreover, we present a proof of concept that launches an exhaustive search attack on the MD5-crypt password hashing scheme using modern GPU's. We show that it is possible to achieve a performance of 880 000 hashes per second, using different optimization techniques. Therefore our implementation, executed on a typical GPU, is more than 30 times faster than equally priced CPU hardware. With this performance increase, `complex' passwords with a length of 8 characters are now becoming feasible to crack. In addition, we show that between 50% and 80% of the passwords in a leaked database could be recovered within 2 months of computation time on one Nvidia GeForce 295 GTX.
    [Show full text]
  • MD5 Collisions the Effect on Computer Forensics April 2006
    Paper MD5 Collisions The Effect on Computer Forensics April 2006 ACCESS DATA , ON YOUR RADAR MD5 Collisions: The Impact on Computer Forensics Hash functions are one of the basic building blocks of modern cryptography. They are used for everything from password verification to digital signatures. A hash function has three fundamental properties: • It must be able to easily convert digital information (i.e. a message) into a fixed length hash value. • It must be computationally impossible to derive any information about the input message from just the hash. • It must be computationally impossible to find two files to have the same hash. A collision is when you find two files to have the same hash. The research published by Wang, Feng, Lai and Yu demonstrated that MD5 fails this third requirement since they were able to generate two different messages that have the same hash. In computer forensics hash functions are important because they provide a means of identifying and classifying electronic evidence. Because hash functions play a critical role in evidence authentication, a judge and jury must be able trust the hash values to uniquely identify electronic evidence. A hash function is unreliable when you can find any two messages that have the same hash. Birthday Paradox The easiest method explaining a hash collision is through what is frequently referred to as the Birthday Paradox. How many people one the street would you have to ask before there is greater than 50% probability that one of those people will share your birthday (same day not the same year)? The answer is 183 (i.e.
    [Show full text]
  • FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS
    FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS Cryptographic Module FIPS 140-2 Level 1 Validation Software Version: R7-4.0.0 Date: January 22nd, 2020 Document Version 2.3 © Oracle Corporation This document may be reproduced whole and intact including the Copyright notice. Title: Oracle Linux 7 NSS Cryptographic Module Security Policy Date: January 22nd, 2020 Author: Oracle Security Evaluations – Global Product Security Contributing Authors: Oracle Linux Engineering Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 oracle.com Copyright © 2020, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. Oracle specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may reproduced or distributed whole and intact including this copyright notice. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Oracle Linux 7 NSS Cryptographic Module Security Policy i TABLE OF CONTENTS Section Title
    [Show full text]
  • BLAKE2: Simpler, Smaller, Fast As MD5
    BLAKE2: simpler, smaller, fast as MD5 Jean-Philippe Aumasson1, Samuel Neves2, Zooko Wilcox-O'Hearn3, and Christian Winnerlein4 1 Kudelski Security, Switzerland [email protected] 2 University of Coimbra, Portugal [email protected] 3 Least Authority Enterprises, USA [email protected] 4 Ludwig Maximilian University of Munich, Germany [email protected] Abstract. We present the hash function BLAKE2, an improved version of the SHA-3 finalist BLAKE optimized for speed in software. Target applications include cloud storage, intrusion detection, or version control systems. BLAKE2 comes in two main flavors: BLAKE2b is optimized for 64-bit platforms, and BLAKE2s for smaller architectures. On 64- bit platforms, BLAKE2 is often faster than MD5, yet provides security similar to that of SHA-3: up to 256-bit collision resistance, immunity to length extension, indifferentiability from a random oracle, etc. We specify parallel versions BLAKE2bp and BLAKE2sp that are up to 4 and 8 times faster, by taking advantage of SIMD and/or multiple cores. BLAKE2 reduces the RAM requirements of BLAKE down to 168 bytes, making it smaller than any of the five SHA-3 finalists, and 32% smaller than BLAKE. Finally, BLAKE2 provides a comprehensive support for tree-hashing as well as keyed hashing (be it in sequential or tree mode). 1 Introduction The SHA-3 Competition succeeded in selecting a hash function that comple- ments SHA-2 and is much faster than SHA-2 in hardware [1]. There is nev- ertheless a demand for fast software hashing for applications such as integrity checking and deduplication in filesystems and cloud storage, host-based intrusion detection, version control systems, or secure boot schemes.
    [Show full text]
  • Security Analysis of BLAKE2's Modes of Operation
    Security Analysis of BLAKE2's Modes of Operation Atul Luykx, Bart Mennink, Samuel Neves KU Leuven (Belgium) and Radboud University (The Netherlands) FSE 2017 March 7, 2017 1 / 14 BLAKE2 m1 m2 m3 m 0∗ `k IV PB F F F F H(m) ⊕ t1 f1 t2 f2 t3 f3 t` f` Cryptographic hash function • Aumasson, Neves, Wilcox-O'Hearn, Winnerlein (2013) • Simplication of SHA-3 nalist BLAKE • 2 / 14 BLAKE2 Use in Password Hashing Argon2 (Biryukov et al.) • Catena (Forler et al.) • Lyra (Almeida et al.) • Lyra2 (Simplício Jr. et al.) • Rig (Chang et al.) • Use in Authenticated Encryption AEZ (Hoang et al.) • Applications Noise Protocol Framework (Perrin) • Zcash Protocol (Hopwood et al.) • RAR 5.0 (Roshal) • 3 / 14 BLAKE2 Guo et al. 2014 Hao 2014 Khovratovich et al. 2015 Espitau et al. 2015 ??? Even slight modications may make a scheme insecure! Security Inheritance? BLAKE cryptanalysis Aumasson et al. 2010 Biryukov et al. 2011 Dunkelman&K. 2011 generic Andreeva et al. 2012 Chang et al. 2012 4 / 14 ??? Even slight modications may make a scheme insecure! Security Inheritance? BLAKE BLAKE2 cryptanalysis Aumasson et al. 2010 Guo et al. 2014 Biryukov et al. 2011 Hao 2014 Dunkelman&K. 2011 Khovratovich et al. 2015 Espitau et al. 2015 generic Andreeva et al. 2012 Chang et al. 2012 4 / 14 Even slight modications may make a scheme insecure! Security Inheritance? BLAKE BLAKE2 cryptanalysis Aumasson et al. 2010 Guo et al. 2014 Biryukov et al. 2011 Hao 2014 Dunkelman&K. 2011 Khovratovich et al. 2015 Espitau et al. 2015 generic Andreeva et al.
    [Show full text]
  • Extending NIST's CAVP Testing of Cryptographic Hash Function
    Extending NIST’s CAVP Testing of Cryptographic Hash Function Implementations Nicky Mouha and Christopher Celi National Institute of Standards and Technology, Gaithersburg, MD, USA [email protected],[email protected] Abstract. This paper describes a vulnerability in Apple’s CoreCrypto library, which affects 11 out of the 12 implemented hash functions: every implemented hash function except MD2 (Message Digest 2), as well as several higher-level operations such as the Hash-based Message Authen- tication Code (HMAC) and the Ed25519 signature scheme. The vulnera- bility is present in each of Apple’s CoreCrypto libraries that are currently validated under FIPS 140-2 (Federal Information Processing Standard). For inputs of about 232 bytes (4 GiB) or more, the implementations do not produce the correct output, but instead enter into an infinite loop. The vulnerability shows a limitation in the Cryptographic Algorithm Validation Program (CAVP) of the National Institute of Standards and Technology (NIST), which currently does not perform tests on hash func- tions for inputs larger than 65 535 bits. To overcome this limitation of NIST’s CAVP, we introduce a new test type called the Large Data Test (LDT). The LDT detects vulnerabilities similar to that in CoreCrypto in implementations submitted for validation under FIPS 140-2. Keywords: CVE-2019-8741, FIPS, CAVP, ACVP, Apple, CoreCrypto, hash function, vulnerability. 1 Introduction The security of cryptography in practice relies not only on the resistance of the algorithms against cryptanalytical attacks, but also on the correctness and robustness of their implementations. Software implementations are vulnerable to software faults, also known as bugs.
    [Show full text]
  • A (Second) Preimage Attack on the GOST Hash Function
    A (Second) Preimage Attack on the GOST Hash Function Florian Mendel, Norbert Pramstaller, and Christian Rechberger Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Inffeldgasse 16a, A-8010 Graz, Austria [email protected] Abstract. In this article, we analyze the security of the GOST hash function with respect to (second) preimage resistance. The GOST hash function, defined in the Russian standard GOST-R 34.11-94, is an iter- ated hash function producing a 256-bit hash value. As opposed to most commonly used hash functions such as MD5 and SHA-1, the GOST hash function defines, in addition to the common iterated structure, a check- sum computed over all input message blocks. This checksum is then part of the final hash value computation. For this hash function, we show how to construct second preimages and preimages with a complexity of about 2225 compression function evaluations and a memory requirement of about 238 bytes. First, we show how to construct a pseudo-preimage for the compression function of GOST based on its structural properties. Second, this pseudo- preimage attack on the compression function is extended to a (second) preimage attack on the GOST hash function. The extension is possible by combining a multicollision attack and a meet-in-the-middle attack on the checksum. Keywords: cryptanalysis, hash functions, preimage attack 1 Introduction A cryptographic hash function H maps a message M of arbitrary length to a fixed-length hash value h. A cryptographic hash function has to fulfill the following security requirements: – Collision resistance: it is practically infeasible to find two messages M and M ∗, with M ∗ 6= M, such that H(M) = H(M ∗).
    [Show full text]
  • Exploiting Hash Collisions, (The Weakest Ones, W/ Identical Prefix) Via Manipulating File Formats
    Exploitingidentical hash prefix collisions Ange Albertini BlackAlps 2017 Switzerland All opinions expressed during this presentation are mine and not endorsed by any of my employers, present or past. DISCLAIMERS This is not a crypto talk. It’s about exploiting hash collisions, (the weakest ones, w/ identical prefix) via manipulating file formats. You may want to watch Marc Stevens’ talk at CRYPTO17. TL;DR Nothing groundbreaking. No new vulnerability. Just a look behind the scenes of Shattered-like research (format-wise) OTOH there are very few talks on the topic AFAIK. This talk is about... MalSha1 2014: Malicious SHA1 - modified SHA1 2017: PoC||GTFO 0x14 - MD5 2015-2017: Shattered - SHA1 MD5:1992-2004 SHA1: 1995-2005 SHA2: 2001-? SHA3: 2015-? Types of collision first, weakest, overlooked ● Identical prefix ○ 2 files starting with same data ● Chosen prefix Sh*t's broken, yo! ○ 2 files starting with different (chosen) data Unicorns ● Second preimage attack ○ Find data to match another data's hash Dragons ● Preimage attack ○ Find data to match hash From here on, hash collision = IPC = Identical Prefix Collision Formal way to present IPCs Collisions for Hash Functions MD4, MD5, HAVAL-128 and RIPEMD. X Wang, D Feng, X Lai, H Yu 2004 Not very “visual”! Determine file structure I play no role Computationin this (exact shape unknown in advance) Craft valid and meaningful files Collisions blocks Impact Better than random-looking blocks? Will it convince anyone to deprecate anything? FTR Shattered took 6500 CPU-Yr and 110 GPU-Yr. (that's a lot
    [Show full text]
  • MD5 Is Weaker Than Weak: Attacks on Concatenated Combiners
    MD5 is Weaker than Weak: Attacks on Concatenated Combiners Florian Mendel, Christian Rechberger, and Martin Schl¨affer Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology, Inffeldgasse 16a, A-8010 Graz, Austria. [email protected] Abstract. We consider a long standing problem in cryptanalysis: at- tacks on hash function combiners. In this paper, we propose the first attack that allows collision attacks on combiners with a runtime below the birthday-bound of the smaller compression function. This answers an open question by Joux posed in 2004. As a concrete example we give such an attack on combiners with the widely used hash function MD5. The cryptanalytic technique we use combines a partial birthday phase with a differential inside-out tech- nique, and may be of independent interest. This potentially reduces the effort for a collision attack on a combiner like MD5jjSHA-1 for the first time. Keywords: hash functions, cryptanalysis, MD5, combiner, differential 1 Introduction The recent spur of cryptanalytic results on popular hash functions like MD5 and SHA-1 [28,30,31] suggests that they are (much) weaker than originally an- ticipated, especially with respect to collision resistance. It seems non-trivial to propose a concrete hash function which inspires long term confidence. Even more so as we seem unable to construct collision resistant primitives from potentially simpler primitives [27]. Hence constructions that allow to hedge bets, like con- catenated combiners, are of great interest. Before we give a preview of our results in the following, we will first review work on combiners. Review of work on combiners.
    [Show full text]
  • Internet Engineering Task Force (IETF) A. Langley Request for Comments: 7905 W
    Internet Engineering Task Force (IETF) A. Langley Request for Comments: 7905 W. Chang Updates: 5246, 6347 Google, Inc. Category: Standards Track N. Mavrogiannopoulos ISSN: 2070-1721 Red Hat J. Strombergson Secworks Sweden AB S. Josefsson SJD AB June 2016 ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS) Abstract This document describes the use of the ChaCha stream cipher and Poly1305 authenticator in the Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) protocols. This document updates RFCs 5246 and 6347. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7905. Langley, et al. Standards Track [Page 1] RFC 7905 ChaCha-Poly1305 for TLS June 2016 Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
    [Show full text]
  • High-Speed Hardware Implementations of BLAKE, Blue
    High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein Version 2.0, November 11, 2009 Stefan Tillich, Martin Feldhofer, Mario Kirschbaum, Thomas Plos, J¨orn-Marc Schmidt, and Alexander Szekely Graz University of Technology, Institute for Applied Information Processing and Communications, Inffeldgasse 16a, A{8010 Graz, Austria {Stefan.Tillich,Martin.Feldhofer,Mario.Kirschbaum, Thomas.Plos,Joern-Marc.Schmidt,Alexander.Szekely}@iaik.tugraz.at Abstract. In this paper we describe our high-speed hardware imple- mentations of the 14 candidates of the second evaluation round of the SHA-3 hash function competition. We synthesized all implementations using a uniform tool chain, standard-cell library, target technology, and optimization heuristic. This work provides the fairest comparison of all second-round candidates to date. Keywords: SHA-3, round 2, hardware, ASIC, standard-cell implemen- tation, high speed, high throughput, BLAKE, Blue Midnight Wish, Cube- Hash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, Skein. 1 About Paper Version 2.0 This version of the paper contains improved performance results for Blue Mid- night Wish and SHAvite-3, which have been achieved with additional imple- mentation variants. Furthermore, we include the performance results of a simple SHA-256 implementation as a point of reference. As of now, the implementations of 13 of the candidates include eventual round-two tweaks. Our implementation of SIMD realizes the specification from round one. 2 Introduction Following the weakening of the widely-used SHA-1 hash algorithm and concerns over the similarly-structured algorithms of the SHA-2 family, the US NIST has initiated the SHA-3 contest in order to select a suitable drop-in replacement [27].
    [Show full text]
  • Advanced Meet-In-The-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2
    Advanced Meet-in-the-Middle Preimage Attacks: First Results on Full Tiger, and Improved Results on MD4 and SHA-2 Jian Guo1, San Ling1, Christian Rechberger2, and Huaxiong Wang1 1 Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore 2 Dept. of Electrical Engineering ESAT/COSIC, K.U.Leuven, and Interdisciplinary Institute for BroadBand Technology (IBBT), Kasteelpark Arenberg 10, B–3001 Heverlee, Belgium. [email protected] Abstract. We revisit narrow-pipe designs that are in practical use, and their security against preimage attacks. Our results are the best known preimage attacks on Tiger, MD4, and reduced SHA-2, with the result on Tiger being the first cryptanalytic shortcut attack on the full hash function. Our attacks runs in time 2188.8 for finding preimages, and 2188.2 for second-preimages. Both have memory requirement of order 28, which is much less than in any other recent preimage attacks on reduced Tiger. Using pre-computation techniques, the time complexity for finding a new preimage or second-preimage for MD4 can now be as low as 278.4 and 269.4 MD4 computations, respectively. The second-preimage attack works for all messages longer than 2 blocks. To obtain these results, we extend the meet-in-the-middle framework recently developed by Aoki and Sasaki in a series of papers. In addition to various algorithm-specific techniques, we use a number of conceptually new ideas that are applicable to a larger class of constructions. Among them are (1) incorporating multi-target scenarios into the MITM framework, leading to faster preimages from pseudo-preimages, (2) a simple precomputation technique that allows for finding new preimages at the cost of a single pseudo-preimage, and (3) probabilistic initial structures, to reduce the attack time complexity.
    [Show full text]