Gimli 20190329
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
SHA-3 Update
SHA+3%update% %% % Quynh%Dang% Computer%Security%Division% ITL,%NIST% IETF%86% SHA-3 Competition 11/2/2007% SHA+3%CompeDDon%Began.% 10/2/2012% Keccak&announced&as&the&SHA13&winner.& IETF%86% Secure Hash Algorithms Outlook ► SHA-2 looks strong. ► We expect Keccak (SHA-3) to co-exist with SHA-2. ► Keccak complements SHA-2 in many ways. Keccak is good in different environments. Keccak is a sponge - a different design concept from SHA-2. IETF%86% Sponge Construction Sponge capacity corresponds to a security level: s = c/2. IETF%86% SHA-3 Selection ► We chose Keccak as the winner because of many different reasons and below are some of them: ► It has a high security margin. ► It received good amount of high-quality analyses. ► It has excellent hardware performance. ► It has good overall performance. ► It is very different from SHA-2. ► It provides a lot of flexibility. IETF%86% Keccak Features ► Keccak supports the same hash-output sizes as SHA-2 (i.e., SHA-224, -256, -384, -512). ► Keccak works fine with existing applications, such as DRBGs, KDFs, HMAC and digital signatures. ► Keccak offers flexibility in performance/security tradeoffs. ► Keccak supports tree hashing. ► Keccak supports variable-length output. IETF%86% Under Consideration for SHA-3 ► Support for variable-length hashes ► Considering options: ► One capacity: c = 512, with output size encoding, ► Two capacities: c = 256 and c = 512, with output size encoding, or ► Four capacities: c = 224, c = 256, c=384, and c = 512 without output size encoding (preferred by the Keccak team). ► Input format for SHA-3 hash function(s) will contain a padding scheme to support tree hashing in the future. -
Lecture9.Pdf
Merkle- Suppose H is a Damgaord hash function built from a secure compression function : several to build a function ways keyed : m : = H Ilm 1 . end FCK ) (k ) Prep key , " " ↳ - Insecure due to structure of Merkle : can mount an extension attack: H (KH m) can Barnyard given , compute ' Hlkllmllm ) by extending Merkle- Danged chain = : m : 2 . FCK ) 11k) Append key , Hlm ↳ - - to : Similar to hash then MAC construction and vulnerable same offline attack adversary finds a collision in the - - > Merkle and uses that to construct a for SHA I used PDF files Barnyard prefix forgery f , they ↳ - Structure in SHA I (can matches exploited collision demonstration generate arbitrary collisions once prefix ) ' = : FCK m - H on h 3. method , ) ( K HMH K) for reasonable randomness ( both Envelope pseudo assumptions e.g , : = - = i - - : F ( m m } : h K m h m k 4. nest ( ki ) H Ck H (k m ( , and m ( ) is a PRF both Two , kz , ) (ka HH , )) F- , ) ) Falk , ) , ) key , - of these constructions are secure PRFS on a variable size domain hash- based MAC ✓ a the - nest with correlated : HMAC is PRF / MAC based on two key (though keys) : = m H H ka m HMACCK ( K H ( , )) , ) , where k ← k ④ and kz ← k to , ipad opad and and are fixed ( in the HMAC standard) ipad opad strings specified I 0×36 repeated %x5C repeated : k . a Since , and ka are correlated need to make on h remains under Sety , stronger assumption security leg , pseudorandom related attack) Instantiations : denoted HMAC- H where H is the hash function Typically , HMAC- SHAI %" - - HMAC SHA256 -
GCM) for Confidentiality And
NIST Special Publication 800-38D Recommendation for Block DRAFT (April, 2006) Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication Morris Dworkin C O M P U T E R S E C U R I T Y Abstract This Recommendation specifies the Galois/Counter Mode (GCM), an authenticated encryption mode of operation for a symmetric key block cipher. KEY WORDS: authentication; block cipher; cryptography; information security; integrity; message authentication code; mode of operation. i Table of Contents 1 PURPOSE...........................................................................................................................................................1 2 AUTHORITY.....................................................................................................................................................1 3 INTRODUCTION..............................................................................................................................................1 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 4.1 DEFINITIONS AND ABBREVIATIONS .............................................................................................................2 4.2 SYMBOLS ....................................................................................................................................................4 4.2.1 Variables................................................................................................................................................4 -
BLAKE2: Simpler, Smaller, Fast As MD5
BLAKE2: simpler, smaller, fast as MD5 Jean-Philippe Aumasson1, Samuel Neves2, Zooko Wilcox-O'Hearn3, and Christian Winnerlein4 1 Kudelski Security, Switzerland [email protected] 2 University of Coimbra, Portugal [email protected] 3 Least Authority Enterprises, USA [email protected] 4 Ludwig Maximilian University of Munich, Germany [email protected] Abstract. We present the hash function BLAKE2, an improved version of the SHA-3 finalist BLAKE optimized for speed in software. Target applications include cloud storage, intrusion detection, or version control systems. BLAKE2 comes in two main flavors: BLAKE2b is optimized for 64-bit platforms, and BLAKE2s for smaller architectures. On 64- bit platforms, BLAKE2 is often faster than MD5, yet provides security similar to that of SHA-3: up to 256-bit collision resistance, immunity to length extension, indifferentiability from a random oracle, etc. We specify parallel versions BLAKE2bp and BLAKE2sp that are up to 4 and 8 times faster, by taking advantage of SIMD and/or multiple cores. BLAKE2 reduces the RAM requirements of BLAKE down to 168 bytes, making it smaller than any of the five SHA-3 finalists, and 32% smaller than BLAKE. Finally, BLAKE2 provides a comprehensive support for tree-hashing as well as keyed hashing (be it in sequential or tree mode). 1 Introduction The SHA-3 Competition succeeded in selecting a hash function that comple- ments SHA-2 and is much faster than SHA-2 in hardware [1]. There is nev- ertheless a demand for fast software hashing for applications such as integrity checking and deduplication in filesystems and cloud storage, host-based intrusion detection, version control systems, or secure boot schemes. -
Security Analysis of BLAKE2's Modes of Operation
Security Analysis of BLAKE2's Modes of Operation Atul Luykx, Bart Mennink, Samuel Neves KU Leuven (Belgium) and Radboud University (The Netherlands) FSE 2017 March 7, 2017 1 / 14 BLAKE2 m1 m2 m3 m 0∗ `k IV PB F F F F H(m) ⊕ t1 f1 t2 f2 t3 f3 t` f` Cryptographic hash function • Aumasson, Neves, Wilcox-O'Hearn, Winnerlein (2013) • Simplication of SHA-3 nalist BLAKE • 2 / 14 BLAKE2 Use in Password Hashing Argon2 (Biryukov et al.) • Catena (Forler et al.) • Lyra (Almeida et al.) • Lyra2 (Simplício Jr. et al.) • Rig (Chang et al.) • Use in Authenticated Encryption AEZ (Hoang et al.) • Applications Noise Protocol Framework (Perrin) • Zcash Protocol (Hopwood et al.) • RAR 5.0 (Roshal) • 3 / 14 BLAKE2 Guo et al. 2014 Hao 2014 Khovratovich et al. 2015 Espitau et al. 2015 ??? Even slight modications may make a scheme insecure! Security Inheritance? BLAKE cryptanalysis Aumasson et al. 2010 Biryukov et al. 2011 Dunkelman&K. 2011 generic Andreeva et al. 2012 Chang et al. 2012 4 / 14 ??? Even slight modications may make a scheme insecure! Security Inheritance? BLAKE BLAKE2 cryptanalysis Aumasson et al. 2010 Guo et al. 2014 Biryukov et al. 2011 Hao 2014 Dunkelman&K. 2011 Khovratovich et al. 2015 Espitau et al. 2015 generic Andreeva et al. 2012 Chang et al. 2012 4 / 14 Even slight modications may make a scheme insecure! Security Inheritance? BLAKE BLAKE2 cryptanalysis Aumasson et al. 2010 Guo et al. 2014 Biryukov et al. 2011 Hao 2014 Dunkelman&K. 2011 Khovratovich et al. 2015 Espitau et al. 2015 generic Andreeva et al. -
Extending NIST's CAVP Testing of Cryptographic Hash Function
Extending NIST’s CAVP Testing of Cryptographic Hash Function Implementations Nicky Mouha and Christopher Celi National Institute of Standards and Technology, Gaithersburg, MD, USA [email protected],[email protected] Abstract. This paper describes a vulnerability in Apple’s CoreCrypto library, which affects 11 out of the 12 implemented hash functions: every implemented hash function except MD2 (Message Digest 2), as well as several higher-level operations such as the Hash-based Message Authen- tication Code (HMAC) and the Ed25519 signature scheme. The vulnera- bility is present in each of Apple’s CoreCrypto libraries that are currently validated under FIPS 140-2 (Federal Information Processing Standard). For inputs of about 232 bytes (4 GiB) or more, the implementations do not produce the correct output, but instead enter into an infinite loop. The vulnerability shows a limitation in the Cryptographic Algorithm Validation Program (CAVP) of the National Institute of Standards and Technology (NIST), which currently does not perform tests on hash func- tions for inputs larger than 65 535 bits. To overcome this limitation of NIST’s CAVP, we introduce a new test type called the Large Data Test (LDT). The LDT detects vulnerabilities similar to that in CoreCrypto in implementations submitted for validation under FIPS 140-2. Keywords: CVE-2019-8741, FIPS, CAVP, ACVP, Apple, CoreCrypto, hash function, vulnerability. 1 Introduction The security of cryptography in practice relies not only on the resistance of the algorithms against cryptanalytical attacks, but also on the correctness and robustness of their implementations. Software implementations are vulnerable to software faults, also known as bugs. -
Asymptotic Analysis of Plausible Tree Hash Modes for SHA-3
Asymptotic Analysis of Plausible Tree Hash Modes for SHA-3 Kevin Atighehchi1 and Alexis Bonnecaze2 1 Normandie Univ, UNICAEN, ENSICAEN, CNRS, GREYC, 14000 Caen, France [email protected] 2 Aix Marseille Univ, CNRS, Centrale Marseille, I2M, Marseille, France [email protected] Abstract. Discussions about the choice of a tree hash mode of operation for a standardization have recently been undertaken. It appears that a single tree mode cannot address adequately all possible uses and specifications of a system. In this paper, we review the tree modes which have been proposed, we discuss their problems and propose solutions. We make the reasonable assumption that communicating systems have different specifications and that software applications are of different types (securing stored content or live-streamed content). Finally, we propose new modes of operation that address the resource usage problem for three representative categories of devices and we analyse their asymptotic behavior. Keywords: SHA-3 · Hash functions · Sakura · Keccak · SHAKE · Parallel algorithms · Merkle trees · Live streaming 1 Introduction 1.1 Context In this article, we are interested in the parallelism of cryptographic hash functions. De- pending on the nature of the application, we seek to achieve either of the two alternative objectives: • Priority to memory usage. We first reduce the (asymptotic) parallel running time, and then the number of involved processors, while minimizing the required memory of an implementation using as few as one processor. • Priority to parallel time. We retain an asymptotically optimal parallel time while containing the other computational resources. Historically, a cryptographic hash function makes use of an underlying function, de- noted f, having a fixed input size, like a compression function, a block cipher or more recently, a permutation [BDPA13, BDPA11]. -
Nacl's Crypto Box in Hardware
NaCl’s crypto_box in hardware Michael Hutter1;, Jürgen Schilling2, Peter Schwabe3, and Wolfgang Wieser2 ? 1 Rambus Cryptography Research Division 425 Market Street, 11th Floor, San Francisco, CA 94105, USA [email protected] 2 Graz University of Technology, IAIK Inffeldgasse 16a, A-8010, Graz, Austria [email protected],[email protected] 3 Radboud University Digital Security Group, PO Box 9010, 6500GL Nijmegen, The Netherlands [email protected] Abstract. This paper presents a low-resource hardware implementation of the widely used crypto_box function of the Networking and Cryptog- raphy library (NaCl). It supports the X25519 Diffie-Hellman key ex- change using Curve25519, the Salsa20 stream cipher, and the Poly1305 message authenticator. Our targeted application is a secure communica- tion between devices in the Internet of Things (IoT) and Internet servers. Such devices are highly resource-constrained and require carefully op- timized hardware implementations. We propose the first solution that enables 128-bit-secure public-key authenticated encryption on passively- powered IoT devices like WISP nodes. From a cryptographic point of view we thus make a first step to turn these devices into fully-fledged participants of Internet communication. Our crypto processor needs a silicon area of 14.6 kGEs and less than 40 µW of power at 1 MHz for a 130 nm low-leakage CMOS process technology. Keywords: Internet of Things, ASIC, Salsa20, Poly1305, Curve25519. 1 Introduction We need to empower computers with their own means of gathering in- formation, so they can see, hear and smell the world for themselves, in all its random glory. RFID and sensor technology enable computers to observe, identify and understand the world—without the limitations of human-entered data. -
Comparing the Usability of Cryptographic Apis
Comparing the Usability of Cryptographic APIs Yasemin Acar, Michael Backes, Sascha Fahl, Simson Garfinkel∗, Doowon Kimy, Michelle L. Mazureky, and Christian Stransky CISPA, Saarland University; ∗National Institute of Standards and Technology; yUniversity of Maryland, College Park Abstract—Potentially dangerous cryptography errors are well- Many researchers have used static and dynamic analysis documented in many applications. Conventional wisdom suggests techniques to identify and investigate cryptographic errors in that many of these errors are caused by cryptographic Appli- source code or binaries [2]–[6]. This approach is extremely cation Programming Interfaces (APIs) that are too complicated, have insecure defaults, or are poorly documented. To address this valuable for illustrating the pervasiveness of cryptographic problem, researchers have created several cryptographic libraries errors, and for identifying the kinds of errors seen most that they claim are more usable; however, none of these libraries frequently in practice, but it cannot reveal root causes. Conven- have been empirically evaluated for their ability to promote tional wisdom in the security community suggests these errors more secure development. This paper is the first to examine proliferate in large part because cryptography is so difficult for both how and why the design and resulting usability of different cryptographic libraries affects the security of code written with non-experts to get right. In particular, libraries and Application them, with the goal of understanding how to build effective Programming Interfaces (APIs) are widely seen as being future libraries. We conducted a controlled experiment in which complex, with many confusing options and poorly chosen 256 Python developers recruited from GitHub attempt common defaults (e.g. -
The Subterranean 2.0 Cipher Suite Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella
The subterranean 2.0 cipher suite Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella To cite this version: Joan Daemen, Pedro Maat Costa Massolino, Alireza Mehrdad, Yann Rotella. The subterranean 2.0 cipher suite. IACR Transactions on Symmetric Cryptology, Ruhr Universität Bochum, 2020, 2020 (Special Issue 1), pp.262-294. 10.13154/tosc.v2020.iS1.262-294. hal-02889985 HAL Id: hal-02889985 https://hal.archives-ouvertes.fr/hal-02889985 Submitted on 15 Jul 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Distributed under a Creative Commons Attribution| 4.0 International License IACR Transactions on Symmetric Cryptology ISSN 2519-173X, Vol. 2020, No. S1, pp. 262–294. DOI:10.13154/tosc.v2020.iS1.262-294 The Subterranean 2.0 Cipher Suite Joan Daemen1, Pedro Maat Costa Massolino1, Alireza Mehrdad1 and Yann Rotella2 1 Digital Security Group, Radboud University, Nijmegen, The Netherlands 2 Laboratoire de Mathématiques de Versailles, University of Versailles Saint-Quentin-en-Yvelines (UVSQ), The French National Centre for Scientific Research (CNRS), Paris-Saclay University, Versailles, France [email protected], [email protected], [email protected], [email protected] Abstract. -
Speeding up OMD Instantiations in Hardware
Speeding Up OMD Instantiations in Hardware Diana Maimuţ1[0000−0002−9541−5705] and Alexandru Ştefan Mega1,2[0000−0002−9541−1114] 1 Advanced Technologies Institute 10 Dinu Vintilă, Bucharest, Romania {diana.maimut,ati}@dcti.ro 2 Politehnica University of Bucharest Bucharest, Romania [email protected] Abstract. Particular instantiations of the Offset Merkle Damgård au- thenticated encryption scheme (OMD) represent highly secure alterna- tives for AES-GCM. It is already a fact that OMD can be efficiently implemented in software. Given this, in our paper we focus on speeding- up OMD in hardware, more precisely on FPGA platforms. Thus, we propose a new OMD instantiation based on the compression function of BLAKE2b. Moreover, to the best of our knowledge, we present the first FPGA implementation results for the SHA-512 instantiation of OMD as well as the first architecture of an online authenticated encryption system based on OMD. Keywords: Authenticated encryption, pseudorandom function, compression function, provable security, FPGA, hardware optimization, nonce respecting ad- versaries. 1 Introduction Authenticated encryption (AE) primitives ensure both message confidentiality and authenticity. Initially, AE algorithms achieved confidentiality and integrity by combining two distinct cryptographic primitives (one for each of the two goals). Around two decades ago the perspective of having a unique primitive for confidentiality and integrity started to appear. Rogaway [16] extended AE schemes by adding a new type of input for associated data (AD) and, thus, AEAD (authenticated encryption with associated data) was the next step. Such a model is helpful in real world scenario in which part of the message (e.g. a header) needs only to be authenticated. -
Hashes, Macs & Authenticated Encryption Today's Lecture Hashes
Today’s Lecture • Hashes and Message Authentication Codes Hashes, MACs & • Properties of Hashes and MACs Authenticated Encryption • CBC-MAC, MAC -> HASH (slow), • SHA1, SHA2, SHA3 Tom Chothia • HASH -> MAC, HMAC ICS Lecture 4 • Authenticated Encryption – CCM Hashes Signatures l A hash of any message is a short string • Using RSA Epub(Dpriv(M)) = M generated from that message. • This can be used to sign messages. l The hash of a message is always the same. l Any small change makes the hash totally • Sign a message with the private key and this can be different. verified with the public key. l It is very hard to go from the hash to the message. • Any real crypto suite will not use the same key for encryption and signing. l It is very unlikely that any two different messages have the same hash. – as this can be used to trick people into decrypting. Signatures Uses of Hashing Alice has a signing key Ks • Download/Message verification and wants to sign message M Plain Text • Tying parts of a message together (hash the whole message) Detached Signature: Dks(#(M)) RSA decrypt with key ks SHA hash • Hash message, then sign the hash. • Protect Passwords Signed: M,Dks(#(M)) – Store the hash, not the password 1 Attacks on hashes Birthday Paradox • Preimage Attack: Find a message for a • How many people do you need to ask given hash: very hard. before you find 2 that have the same birthday? • Prefix Collision Attack: a collision attack where the attacker can pick a prefix for • 23 people, gives (23*22)/2 = 253 pairs.