Cryptanalysis of Hash Functions with Structures

Cryptanalysis of Hash Functions with Structures Dmitry Khovratovich University of Luxembourg [email protected] Abstract. Hash function cryptanalysis has acquired many methods, tools and tricks from other areas, mostly block ciphers. In this paper another trick from block cipher cryptanalysis, the structures, is used for speeding up the collision search. We investigate the memory and the time complexities of this approach under different assumptions on the round functions. The power of the new attack is illustrated with the cryptanalysis of the hash functions Grindahl and the analysis of the SHA-3 candidate Fugue (both functions as 256 and 512 bit versions). The collision attack on Grindahl-512 is the first collision attack on this function. Keywords: cryptanalysis, hash functions, SHA-3, truncated differentials, Grindahl, Fugue, structures. 1 Introduction Since 1990 the MD family of hash functions and its successor SHA family have been most widely used data integrity primitives. In contrast with few cryptanalytic results in 90s recent attacks on MD5 [19], SHA-0 [14], and SHA-1 [5] encouraged the cryptographic community to look for more reliable components and then motivated the recent SHA-3 competition [16]. The Merkle-Damg˚ard approach [8,15] to build hash functions from compression functions, has lost a part of credit due to such generic attacks as multicollisions [11] and second-preimage search with expandable messages [12]. In contrast to generic attacks like multicollisions, which are applicable to hash functions with Merkle-Damgard strengthening, attacks on lower level compression functions are highly dependent on a particular proposal and can rarely be extended to other functions. Common ideas are mostly related to the notion of differentials since the fact that two different messages produce the same hash value (a collision) can be expressed as a zero difference in the output. The idea of differentials comes from block cipher cryptanalysis and pioneering papers by Biham and Shamir [3]. As high probability differential characteris- tics were exploited in attacks on block ciphers as high probability zero-ending differential trails are used to find collisions for compression functions. Since block cipher cryptanalysis is a highly developed topic, many cryptana- lysts try to use the most efficient methods and tools in attacks on hash functions. However, due to stronger requirements on the results of an attack only few of them were applied. The use of truncated differentials [17] is an example. M.J. Jacobson Jr., V. Rijmen, and R. Safavi-Naini (Eds.): SAC 2009, LNCS 5867, pp. 108–125, 2009. c Springer-Verlag Berlin Heidelberg 2009 Cryptanalysis of Hash Functions with Structures 109 In this paper we investigate another tool from block cipher cryptanalysis: structures. A structure is originally a set of plaintexts that pairwise have some property (e.g., zero difference in particular bytes). Since the number of pairs with desired properties in a structure is much larger than the structure size, such constructions are widely used in order to save memory and time in attacks on block ciphers [4,6]. Intuitively, structures might have been used in attacks on the hash functions built on block ciphers [18]. However, the authors are aware of only one such attack: a recent attack on Snefru [2], though Snefru does not directly fit the constructions from [18]. We have found that structures are especially useful in attacks on stream- based hash functions, where parts of a message can independently be controlled. We analyze the hash functions Grindahl and Fugue.ForGrindahl-256, we improve the best known attack by Peyrin [17], while for Grindahl-512 this paper presents the first known collision attack. The hash function Fugue [10] is a strengthened successor to Grindahl, so we did not manage to break its security claims. However, our attack is substantially faster than a trivial internal-collision attack. This paper is organized as follows. First we briefly explain how the use of structures reduce the cost of collision search. Then we investigate how structures follow the differential trail and collapse to pairs in some step (Section 3) so that the standard differential approach can be applied afterwards. We also derive the memory complexity of the attack. Then we attack Grindahl and Fugue with structures (Section 4). The number of computations required ro find a collision for Grindahl-256 is reduced compared to the attack by Peyrin [17]. We also present the first collision attack on Grindahl-512 and the first external analysis of Fugue . In the Appendix the time complexity of the attack is estimated under different assumptions. 2IdeainBrief In many attacks on compression functions a cryptanalyst deals with a set of pairs that are to follow a particular differential trail. Here the trail is a sequence of differences in the internal state of the hash function. (see [1] for a more formal approach). At some steps an adversary may vary a message part to be injected thus increasing the number of pairs that follow the trail (the attack by De Canniére and Rechberger on SHA-1 [5] is an example). If there is not enough freedom to satisfy round conditions, the number of candidate pairs tends to decrease. We show that this effect can be postponed if a differential trail allows to incorporate pairs into structures. In order to distinguish the approach when a cryptanalytic deals with pairs from our approach we call the former one the standard differential attack.Itis also known as the trail backtracking [1]. Our attack is later called the structural approach,orthestructural attack. Now assume that the trail deals with truncated differentials, and the possible differences form a linear space R of differences. Then if a pair of states (S1,S2) 110 D. Khovratovich Fig. 1. Comparative view on the structural and the differential approaches. F is a round function. In the first case the number of states remains stable till structures collapse to pairs (middle round). fits the trail, and a pair (S2,S3) fits the trail, then the pair (S1,S3) fits the trail too. Such a group of states is called a structure. Suppose at some step a structure of size Q enters the round with probability P .TheneverystateSi will have a desired difference with PQ other states thus composing a smaller structure. Therefore the initial structure splits into 1/P smaller structures. If the structure collapses into separate pairs then the differential attack is launched. Suppose there is now freedom from the message injection, i.e., for a pair of messages (M,M)thereareV possibilities for M and D more possibilities for M (VDpairs at all). So if a round differential has probability P then of T pairs about V · D · P · T pairs survive. See Figure 1 for the outline of the situation. When we work with structures, the value of the injected message can be chosen freely only for the first state of a new structure, or the leader state;the messages injected to the other states should have a desired difference with a first one. Consequently, the message freedom results in structures of size ≈ D · P · Q. The number of states remains the same; however, it can be increased if we take other states as leading ones. 3 Analysis of Structure Fission In order to benefit from the number of pairs in a structure an adversary should keep the size of the structure as big as possible. Let us estimate the size as a function of the round probability and the freedom given by message injections. Denote by ∼ the desired binary relation between two states, which can be also interpreted as the fact that the difference in the state satisfies the trail conditions. Cryptanalysis of Hash Functions with Structures 111 The particular relation is usually clear from the context. Then a structure is a set of internal states such that any two states of the set satisfy the binary relation ∼. In our attacks on Grindahl and Fugue (Section 4) the relation is of form “bytes (respectively, words) i1,i2,...,ik are equal”. No freedom in the message injection. Suppose a structure of size Q =2q states enters a round with probability 2−p. First consider the case where there is no freedom in message injection due to the differential trail or the message schedule. After the application of the round function any state has a desired difference with 2q−p other states, which form a structure of size 2q−p. Therefore, the initial structure splits into about 2p smaller structures of average size 2q−p. It is easy to prove that the partition of a structure into structures of equal size gives a lower bound on the overall number of pairs. If p is high enough then the structure collapses to separate pairs. Since there were 22q−1 pairs in the structure, about 22q−1−p pairs come out of one round. Then the pairs are processed by the standard differential attack. Value freedom in the message injection. Suppose now there is some freedom in message injections but the differential trail does not allow to introduce a difference, or the value of the difference is fixed. Then every state can be transformed to at most one element of a new structure, so the structures do not grow in this case. However, one may increase the number of structures and thus the number of considered states. The latter approach increase the memory complexity so we do not use it except for the round when all structures collapse to pairs. Given V =2v possibilities for an injected message we get 22q−1+v−p pairs after the round. Difference freedom in the message injection.

Load more