DOCSLIB.ORG

Nasha Cryptographic Hash Function

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Nasha Cryptographic Hash Function NaSHA Cryptographic Hash Function 2.B Algorithm Speci¯cations and Supporting Documentations 2.B.1 Algorithm Speci¯cations Designers: Smile Markovski and Aleksandra Mileva Implementation Contributors: Simona Samardziska and Boro Jakimovski Skopje and Stip,· MACEDONIA, 2008 1 Abstract We propose the NaSHA-(m; k; r) family of cryptographic hash func- tions, based on quasigroup transformations. We use huge quasigroups de¯ned by extended Feistel networks from small bijections and a novel design principle: the quasigroup used in every iteration of the compres- sion function is di®erent and depends on the processed message block. We present in all details of the implementations of NaSHA-(m; 2; 6) where m 2 f224; 256; 384; 512g. 1 Introduction In this part we give the algorithm speci¯cation of our NaSHA hash function, consisting of 5 sections: 2. Mathematical background, 3. The NaSHA-(m; k; r) hash algorithm, 4. Implementation of NaSHA- (m; 2; 6) hash functions for m 2 f224; 256; 384; 512g, 5. Design ratio- nale and 6. Preliminary security analysis. 2 Mathematical background 2.1 Quasigroups A quasigroup (Q; ¤) is a groupoid, i.e., a set Q with a binary operation ¤, such that the equations a ¤ x = b and y ¤ a = b have unique solutions x and y in Q for each given a; b 2 Q. Note that when Q is ¯nite then the main body of the multiplication table of (Q; ¤) is a Latin square, i.e., the rows and the columns are permutations of Q. Given a quasigroup (Q; ¤), two adjoint operations = and n can be de¯ned by x=y = z () x = z ¤ y and xny = z () x ¤ z = y: Then the groupoids (Q; =) and (Q; n) are quasigroups too. By a quasigroup of a good cryptographic quality we mean a ¯nite quasigroup that is non-commutative, non-associative, non-idempotent, without right or left units and without a proper sub-quasigroups. That quasigroup (Q; ¤) should not be linear, in the sense that no output bit of a ¤ b is a linear combination of the input bits of a and b, for each a; b 2 Q. Also, the quasigroup should not satisfy identities of the kinds x(::: ¤ (x ¤y)) = y and y = ((y ¤ x) ¤ :::) ¤ x for some l < 2n, where n is | {z } | {z } l l 2 the order of the quasigroup. 2.2 Quasigroup transformation used in NaSHA For NaSHA hash family we use the following quasigroup transforma- tions. De¯nition 1 (Quasigroup additive string transformation Al : Qt ! Qt with leader l) Let t be a positive integer, let (Q; ¤) be a quasigroup, Q = Z2n , and l; xj; zj 2 Q. The transformation Al is de¯ned by ½ (l + x1) ¤ x1; j = 1 Al(x1; : : : ; xt) = (z1; : : : ; zt) , zj = (zj¡1 + xj) ¤ xj; 2 · j · t (1) where + is addition modulo 2n. The element l is said to be a leader of A. De¯nition 2 (Quasigroup reverse additive string transforma- t t tion RAl : Q ! Q with leader l) Let t be a positive integer, let (Q; ¤) be a quasigroup, Q = Z2n , and l; xj; zj 2 Q. The transformation RAl is de¯ned by ½ xj ¤ (xj + zj+1); 1 · j · t ¡ 1 RAl(x1; : : : ; xt) = (z1; : : : ; zt) , zj = xt ¤ (xt + l); j = t (2) where + is addition modulo 2n. The element l is said to be a leader of RA. n n n For an element z 2 Z2 denote by ½(z; b 2 c) the element in Z2 n obtained by rotating left for b 2 c bits the n-bit representation of z. t Given a string Z = (z1; : : : ; zt) 2 (Z2n ) , we denote by ½(Z) the string ¡ n n ¢ t ½(Z) = ½(z ; b c); : : : ; ½(z ; b c) 2 (Z n ) : 1 2 t 2 2 For a function f = f(Z) we de¯ne a new function ½(f) = ½(f)(Z) by ½(f)(Z) = f(½(Z)). 3 De¯nition 3 (Quasigroup main transformation MT : Qt ! Qt) Let Q = Z2n and let t and k be positive integers, where k is even. (k is called the complexity of MT .) The transformation MT is de¯ned as composition of transformations of kind Ali followed by ½(RAlj ), for suitable choices of the leaders li and lj as functions depending on vari- ables x1; x2; : : : ; xt, as follows. For every x¸ 2 Q MT (x1; : : : ; xt) = ½(RAl1 )(Al2 (::: (½(RAlk¡1 )(Alk (x1; : : : ; xt))) ::: )); (3) i.e., MT = ½(RAl1 ) ± Al2 ± ¢ ¢ ¢ ± ½(RAlk¡1 ) ± Alk , where ± denotes a composition of functions. 2.3 Left and right quasigroups A groupoid (G; ¢) is said to be a left (a right) quasigroup if the equation xa = b (ay = b) have a unique solution x (y) in G for every a; b 2 G. Proposition 1 Let (G; +) be a group and let (G; ¤) be a quasigroup. Then the operation ² de¯ned by x ² y = (x + y) ¤ y de¯nes a left quasigroup (G; ²). Proof The solution x = (b=a) ¡ a of the equation x ² a = b is unique, since x ² y = x0 ² y =) x = x0: ¤ Proposition 2 Let (G; +) be a group and let (G; ¤) be a quasigroup. Then the operation ¦ de¯ned by x ¦ y = x ¤ (x + y) de¯nes a right quasigroup (G; ¦). Proof The solution y = ¡a+(anb) of the equation a¦y = b is unique, since x ¦ y = x ¦ y0 =) y = y0: ¤ Given a groupoid (G; ¢), for each a 2 G the left and the right transla- tions La and Ra are de¯ned by La(x) = xa and Ra(x) = ax respectfully. If (G; ¢) is a left (right) quasigroup then its left (right) translation is a permutation, while the right (left) translation can be arbitrary map- ping. Considering the left and the right quasigroups de¯ned as in Propo- sition 1 and Proposition 2, the situation is quite di®erent in the case n when G = Z2n and the group operation is addition modulo 2 . Namely, 4 the right translation of (G; ²) and the left translation of (G; ¦) may not be permutations in that case either. However, the probability of that event is quite small, roughly speaking, around 2=jGj. To show the last statement we consider the problem of ¯nding solutions of the equation x ¦ a = b, i.e., x ¤ (x + a) = b (4) where a; b 2 G are given, and x is unknown. Proposition 3 Let G = Z2n be with group operation addition modulo 2n. Let a quasigroup operation ¤ on G be chosen randomly. Then the probability the right quasigroup (G; ¦) to have two di®erent solutions 2 x 6= x of the equation (4) is less or equal to : 1 2 2n ¡ 1 Proof Let x1 and x2 be two di®erent solutions of the equation x¤(x+ a) = b. Then ½ ½ x1 ¤ (x1 + a) = b x1 n b ¡ x1 = a ) ) x1nb¡x2nb = x1¡x2 6= 0: x2 ¤ (x2 + a) = b x2 n b ¡ x2 = a At ¯rst, we ¯nd the probability a random quasigroup to satisfy the event x1 n b ¡ x2 n b = x1 ¡ x2 6= 0: The di®erence x1 ¡ x2 can take any value r 2 G, where r 6= 0: ¡2n¢ Fix an r 6= 0. Then there are 2 pairs of di®erent elements of G, and n exactly 2 of them satisfy the equation x1 ¡x2 = r: Hence, we have this 2 probability for any ¯xed r 6= 0 : Prfx1; x2 2 G; x1 ¡ x2 = rg = 2n¡1 : Consider now the equation x1nb ¡ x2nb = s; where s 6= 0 2 G is given. Denote by K the set of all quasigroups on G and let ¯x a solution (x1; x2) of x1nb ¡ x2nb = s: Denote by Ks = Ks(x1; x2) the set of all quasigroups on G with the property x1nb ¡ x2nb = s: Then jKsj = jKtj for each s and t. Namely, if (G; n1) 2 Ks, then we can construct a quasigroup (G; n2) 2 Kt as follows. At ¯rst choose x1n2b and x2n2b such that x1n2b ¡ x2n2b = t and let ¼ be the permutation generated by the two transpositions (x1n1b; x1n2b); (x2n1b; x2n2b). Then de¯ne the operation n2 for each u; v 2 G by un2v = ¼(un1v): (Note that we have obtained (G; n2) from (G; n1) in such a way that we have only replaced in the multiplication table of (G; n1) all appearances of x1n1b (x2n1b) by x1n2b (x2n2b).) Now, for given x1; x2 2 G and randomly chosen 5 quasigroup (Q; n), we have the probability PsfQ 2 K; x1nb ¡ x2nb = jKsj 1 s is true in Qg = jKj = 2n¡1 : Consequently, the probability a random quasigroup (G; ¤) to satisfy the event x1 n b ¡ x2 n b = x1 ¡ x2 6= 0 is P fx1 ¡ x2 = r; x1nb ¡ x2nb = r; r > 0g = Xq¡1 P fx1 ¡ x2 = r; x1nb ¡ x2nb = rg = r=1 2Xn¡1 P fx1nb ¡ x2nb = rj x1 ¡ x2 = rgP fx1 ¡ x2 = rg = r=1 n 2X¡1 2 P fQ 2 K; x nb ¡ x nb = rgP fx ; x 2 G; x ¡ x = rg = : s 1 2 r 1 2 1 2 2n ¡ 1 r=1 Finally, if we additionally take the condition x1nb ¡ x1 = a, we conclude that the probability a right quasigroup (G; ¦) to have two 2 di®erent solutions x1 6= x2 of the equation (4) is less or equal to 2n¡1 : ¤ In similar way one can prove the same property for left quasigroup (G; ²). Proposition 4 Let G = Z2n be with group operation addition modulo 2n. Let a quasigroup operation ¤ on G be chosen randomly. Then the probability the left quasigroup (G; ²) to have two di®erent solutions x1 6= x2 of the equation (a + x) ¤ x = b (5) 2 is less or equal to : ¤ 2n ¡ 1 Remark 1 In the set of all 576 quasigroups of order 4, each equation of kind x ¤ (x + a) = b (or (a + x) ¤ x = b) has two (or more) solutions in exactly 168 quasigroups.
Load more

Recommended publications
  • Second Preimage Attacks on Dithered Hash Functions
    Second Preimage Attacks on Dithered Hash Functions Elena Andreeva1, Charles Bouillaguet2, Pierre-Alain Fouque2, Jonathan J. Hoch3, John Kelsey4, Adi Shamir2,3, and Sebastien Zimmer2 1 SCD-COSIC, Dept. of Electrical Engineering, Katholieke Universiteit Leuven, [email protected] 2 École normale supérieure (Département d’Informatique), CNRS, INRIA, {Charles.Bouillaguet,Pierre-Alain.Fouque,Sebastien.Zimmer}@ens.fr 3 Weizmann Institute of Science, {Adi.Shamir,Yaakov.Hoch}@weizmann.ac.il 4 National Institute of Standards and Technology, [email protected] Abstract. We develop a new generic long-message second preimage at- tack, based on combining the techniques in the second preimage attacks of Dean [8] and Kelsey and Schneier [16] with the herding attack of Kelsey and Kohno [15]. We show that these generic attacks apply to hash func- tions using the Merkle-Damgård construction with only slightly more work than the previously known attack, but allow enormously more con- trol of the contents of the second preimage found. Additionally, we show that our new attack applies to several hash function constructions which are not vulnerable to the previously known attack, including the dithered hash proposal of Rivest [25], Shoup’s UOWHF[26] and the ROX hash construction [2]. We analyze the properties of the dithering sequence used in [25], and develop a time-memory tradeoff which allows us to apply our second preimage attack to a wide range of dithering sequences, including sequences which are much stronger than those in Rivest’s proposals. Fi- nally, we show that both the existing second preimage attacks [8, 16] and our new attack can be applied even more efficiently to multiple target messages; in general, given a set of many target messages with a total of 2R message blocks, these second preimage attacks can find a second preimage for one of those target messages with no more work than would be necessary to find a second preimage for a single target message of 2R message blocks.
    [Show full text]
  • A Full Key Recovery Attack on HMAC-AURORA-512
    A Full Key Recovery Attack on HMAC-AURORA-512 Yu Sasaki NTT Information Sharing Platform Laboratories, NTT Corporation 3-9-11 Midori-cho, Musashino-shi, Tokyo, 180-8585 Japan [email protected] Abstract. In this note, we present a full key recovery attack on HMAC- AURORA-512 when 512-bit secret keys are used and the MAC length is 512-bit long. Our attack requires 2257 queries and the off-line com- plexity is 2259 AURORA-512 operations, which is significantly less than the complexity of the exhaustive search for a 512-bit key. The attack can be carried out with a negligible amount of memory. Our attack can also recover the inner-key of HMAC-AURORA-384 with almost the same complexity as in HMAC-AURORA-512. This attack does not recover the outer-key of HMAC-AURORA-384, but universal forgery is possible by combining the inner-key recovery and 2nd-preimage attacks. Our attack exploits some weaknesses in the mode of operation. keywords: AURORA, DMMD, HMAC, Key recovery attack 1 Description 1.1 Mode of operation for AURORA-512 We briefly describe the specification of AURORA-512. Please refer to Ref. [2] for details. An input message is padded to be a multiple of 512 bits by the standard MD message padding, then, the padded message is divided into 512-bit message blocks (M0;M1;:::;MN¡1). 256 512 256 In AURORA-512, compression functions Fk : f0; 1g £f0; 1g ! f0; 1g 256 512 256 512 and Gk : f0; 1g £ f0; 1g ! f0; 1g , two functions MF : f0; 1g ! f0; 1g512 and MFF : f0; 1g512 ! f0; 1g512, and two initial 256-bit chaining U D 1 values H0 and H0 are defined .
    [Show full text]
  • TS 102 176-1 V2.1.1 (2011-07) Technical Specification
    ETSI TS 102 176-1 V2.1.1 (2011-07) Technical Specification Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms 2 ETSI TS 102 176-1 V2.1.1 (2011-07) Reference RTS/ESI-000080-1 Keywords e-commerce, electronic signature, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http://portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission.
    [Show full text]
  • Security of VSH in the Real World
    Security of VSH in the Real World Markku-Juhani O. Saarinen Information Security Group Royal Holloway, University of London Egham, Surrey TW20 0EX, UK. [email protected] Abstract. In Eurocrypt 2006, Contini, Lenstra, and Steinfeld proposed a new hash function primitive, VSH, very smooth hash. In this brief paper we offer com- mentary on the resistance of VSH against some standard cryptanalytic attacks, in- cluding preimage attacks and collision search for a truncated VSH. Although the authors of VSH claim only collision resistance, we show why one must be very careful when using VSH in cryptographic engineering, where additional security properties are often required. 1 Introduction Many existing cryptographic hash functions were originally designed to be message di- gests for use in digital signature schemes. However, they are also often used as building blocks for other cryptographic primitives, such as pseudorandom number generators (PRNGs), message authentication codes, password security schemes, and for deriving keying material in cryptographic protocols such as SSL, TLS, and IPSec. These applications may use truncated versions of the hashes with an implicit as- sumption that the security of such a variant against attacks is directly proportional to the amount of entropy (bits) used from the hash result. An example of this is the HMAC−n construction in IPSec [1]. Some signature schemes also use truncated hashes. Hence we are driven to the following slightly nonstandard definition of security goals for a hash function usable in practice: 1. Preimage resistance. For essentially all pre-specified outputs X, it is difficult to find a message Y such that H(Y ) = X.
    [Show full text]
  • A (Second) Preimage Attack on the GOST Hash Function
    A (Second) Preimage Attack on the GOST Hash Function Florian Mendel, Norbert Pramstaller, and Christian Rechberger Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Inffeldgasse 16a, A-8010 Graz, Austria [email protected] Abstract. In this article, we analyze the security of the GOST hash function with respect to (second) preimage resistance. The GOST hash function, defined in the Russian standard GOST-R 34.11-94, is an iter- ated hash function producing a 256-bit hash value. As opposed to most commonly used hash functions such as MD5 and SHA-1, the GOST hash function defines, in addition to the common iterated structure, a check- sum computed over all input message blocks. This checksum is then part of the final hash value computation. For this hash function, we show how to construct second preimages and preimages with a complexity of about 2225 compression function evaluations and a memory requirement of about 238 bytes. First, we show how to construct a pseudo-preimage for the compression function of GOST based on its structural properties. Second, this pseudo- preimage attack on the compression function is extended to a (second) preimage attack on the GOST hash function. The extension is possible by combining a multicollision attack and a meet-in-the-middle attack on the checksum. Keywords: cryptanalysis, hash functions, preimage attack 1 Introduction A cryptographic hash function H maps a message M of arbitrary length to a fixed-length hash value h. A cryptographic hash function has to fulfill the following security requirements: – Collision resistance: it is practically infeasible to find two messages M and M ∗, with M ∗ 6= M, such that H(M) = H(M ∗).
    [Show full text]
  • The Hitchhiker's Guide to the SHA-3 Competition
    History First Second Third The Hitchhiker’s Guide to the SHA-3 Competition Orr Dunkelman Computer Science Department 20 June, 2012 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 1/ 33 History First Second Third Outline 1 History of Hash Functions A(n Extremely) Short History of Hash Functions The Sad News about the MD/SHA Family 2 The First Phase of the SHA-3 Competition Timeline The SHA-3 First Round Candidates 3 The Second Round The Second Round Candidates The Second Round Process 4 The Third Round The Finalists Current Performance Estimates The Outcome of SHA-3 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 2/ 33 History First Second Third History Sad Outline 1 History of Hash Functions A(n Extremely) Short History of Hash Functions The Sad News about the MD/SHA Family 2 The First Phase of the SHA-3 Competition Timeline The SHA-3 First Round Candidates 3 The Second Round The Second Round Candidates The Second Round Process 4 The Third Round The Finalists Current Performance Estimates The Outcome of SHA-3 Orr Dunkelman The Hitchhiker’s Guide to the SHA-3 Competition 3/ 33 History First Second Third History Sad A(n Extremely) Short History of Hash Functions 1976 Diffie and Hellman suggest to use hash functions to make digital signatures shorter. 1979 Salted passwords for UNIX (Morris and Thompson). 1983/4 Davies/Meyer introduce Davies-Meyer. 1986 Fiat and Shamir use random oracles. 1989 Merkle and Damg˚ard present the Merkle-Damg˚ard hash function.
    [Show full text]
  • Cryptography Knowledge Area (Draft for Comment)
    CRYPTOGRAPHY KNOWLEDGE AREA (DRAFT FOR COMMENT) AUTHOR: Nigel Smart – KU Leuven EDITOR: George Danezis – University College London REVIEWERS: Dan Bogdanov - Cybernetica Kenny Patterson – Royal Holloway, University of London Liqun Chen – University of Surrey Cryptography Nigel P. Smart April 2018 INTRODUCTION The purpose of this chapter is to explain the various aspects of cryptography which we feel should be known to an expert in cyber-security. The presentation is at a level needed for an instructor in a module in cryptography; so they can select the depth needed in each topic. Whilst not all experts in cyber-security need be aware of all the technical aspects mentioned below, we feel they should be aware of all the overall topics and have an intuitive grasp as to what they mean, and what services they can provide. Our focus is mainly on primitives, schemes and protocols which are widely used, or which are suitably well studied that they could be used (or are currently being used) in specific application domains. Cryptography by its very nature is one of the more mathematical aspects of cyber-security; thus this chapter contains a lot more mathematics than one has in some of the other chapters. The overall presentation assumes a basic knowledge of either first-year undergraduate mathematics, or that found in a discrete mathematics course of an undergraduate Computer Science degree. The chapter is structured as follows: After a quick recap on some basic mathematical notation (Sec- tion 1), we then give an introduction to how security is defined in modern cryptography. This section (Section 2) forms the basis of our discussions in the other sections.
    [Show full text]
  • NISTIR 7620 Status Report on the First Round of the SHA-3
    NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul NISTIR 7620 Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Andrew Regenscheid Ray Perlner Shu-jen Chang John Kelsey Mridul Nandi Souradyuti Paul Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director NISTIR 7620: Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition Abstract The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as “SHA-3” and will complement the SHA-2 hash algorithms currently specified in FIPS 180-3, Secure Hash Standard. In October, 2008, 64 candidate algorithms were submitted to NIST for consideration. Among these, 51 met the minimum acceptance criteria and were accepted as First-Round Candidates on Dec. 10, 2008, marking the beginning of the First Round of the SHA-3 cryptographic hash algorithm competition. This report describes the evaluation criteria and selection process, based on public feedback and internal review of the first-round candidates, and summarizes the 14 candidate algorithms announced on July 24, 2009 for moving forward to the second round of the competition. The 14 Second-Round Candidates are BLAKE, BLUE MIDNIGHT WISH, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein.
    [Show full text]
  • MD4 Is Not One-Way
    MD4 is Not One-Way Gaëtan Leurent École Normale Supérieure – Département d’Informatique, 45 rue d’Ulm, 75230 Paris Cedex 05, France [email protected] Abstract. MD4 is a hash function introduced by Rivest in 1990. It is still used in some contexts, and the most commonly used hash func- tions (MD5, SHA-1, SHA-2) are based on the design principles of MD4. MD4 has been extensively studied and very efficient collision attacks are known, but it is still believed to be a one-way function. In this paper we show a partial pseudo-preimage attack on the com- pression function of MD4, using some ideas from previous cryptanalysis of MD4. We can choose 64 bits of the output for the cost of 232 compres- sion function computations (the remaining bits are randomly chosen by the preimage algorithm). This gives a preimage attack on the compression function of MD4 with complexity 296, and we extend it to an attack on the full MD4 with complexity 2102. As far as we know this is the first preimage attack on a member of the MD4 family. Keywords: MD4, hash function, cryptanalysis, preimage, one-way. 1 Introduction Hash functions are fundamental cryptographic primitives used in many con- structions and protocols. A hash function takes a bitstring of arbitrary length as input, and outputs a digest, a small bitstring of fixed length n. F : {0, 1}∗ →{0, 1}n When used in a cryptographic context, we expect a hash function to behave somewhat like a random oracle. The digest is used as a kind of fingerprint: it can be used to test whether two documents are equal, but should neither reveal any other information about the input nor be malleable.
    [Show full text]
  • New Second-Preimage Attacks on Hash Functions
    New Second-Preimage Attacks on Hash Functions Elena Andreeva, Charles Bouillaguet, Orr Dunkelman, Pierre-Alain Fouque, Jonathan Hoch, John Kelsey, Adi Shamir, Sebastien Zimmer To cite this version: Elena Andreeva, Charles Bouillaguet, Orr Dunkelman, Pierre-Alain Fouque, Jonathan Hoch, et al.. New Second-Preimage Attacks on Hash Functions. Journal of Cryptology, Springer Verlag, 2016, 29 (4), pp.657 - 696. 10.1007/s00145-015-9206-4. hal-01654410 HAL Id: hal-01654410 https://hal.archives-ouvertes.fr/hal-01654410 Submitted on 1 Mar 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. New Second-Preimage Attacks on Hash Functions? Elena Andreeva1, Charles Bouillaguet2, Orr Dunkelman3;4, Pierre-Alain Fouque2, Jonathan J. Hoch3, John Kelsey5, Adi Shamir2;3 and Sebastien Zimmer2 1 SCD-COSIC, Dept. of Electrical Engineering, Katholieke Universiteit Leuven, [email protected] 2 École normale supérieure (Département d’Informatique), CNRS, INRIA, {Charles.Bouillaguet,Pierre-Alain.Fouque,Sebastien.Zimmer}@ens.fr 3 Faculty of Mathematics and Computer Science, Weizmann Institute of Science, {Adi.Shamir,Yaakov.Hoch}@weizmann.ac.il 4 Department of Computer Science, University of Haifa, [email protected] 5 National Institute of Standards and Technology, [email protected] Abstract.
    [Show full text]
  • A Second Preimage Attack on the Merkle-Damgard Scheme with a Permutation for Hash Functions
    A SECOND PREIMAGE ATTACK ON THE MERKLE-DAMGARD SCHEME WITH A PERMUTATION FOR HASH FUNCTIONS Shiwei Chen and Chenhui Jin Institute of Information Science and Technology, Zhengzhou 450004, China Keywords: Hash functions, MD construction, MDP, Multicollisions, Second preimage attack, Computational complexity. Abstract: Using one kind of multicollsions of the Merkle-Damgard(MD) construction for hash functions proposed by Kelsey and Schneier, this paper presents a second preimage attack on MDP construction which is a simple variant of MD scheme with a permutation for hash functions. Then we prove that the computational complexity of our second preimage attack is k × 2n/2+1 + 2n−k less than 2n where n is the size of the hash value and 2k + k + 1 is the length of the target message. 1 INTRODUCTION into two kinds: - Cryptanalytic attacks: Mainly apply to the com- A cryptographic hash function H maps a message M pression functions of the hash functions. Using the with arbitrary length to a fixed-length hash value h. internal properties of the compression functions, an It has to satisfy the following three security require- adversary can attack the hash functions. For exam- ments: ple, the collision attacks on MD-family proposed in - Preimage resistance: For a given hash value h, (Xiaoyun and Hongbo, 2005); it is computationally infeasible to find a message M - Generic attacks: Apply to the domain extension such that h = H(M); transforms directly with some assumptions on the - Second preimage resistance: For a given mes- compression functions. Examples are long-message sage M, it is computationally infeasible to find a sec- second preimage attack(Kelsey and Schneier, 2005), ′ ′ ond message M 6= M such that H(M ) = H(M); herding attack(Kelsey and Kohno, 2006) and the at- - Collision resistance: It is computationally infea- tack on the MD with XOR-linear/additive checksum ′ sible to find two different messages M and M such in (Gauravaram and Kelsey, 2007).
    [Show full text]
  • Year 2010 Issues on Cryptographic Algorithms
    Year 2010 Issues on Cryptographic Algorithms Masashi Une and Masayuki Kanda In the financial sector, cryptographic algorithms are used as fundamental techniques for assuring confidentiality and integrity of data used in financial transactions and for authenticating entities involved in the transactions. Currently, the most widely used algorithms appear to be two-key triple DES and RC4 for symmetric ciphers, RSA with a 1024-bit key for an asymmetric cipher and a digital signature, and SHA-1 for a hash function according to international standards and guidelines related to the financial transactions. However, according to academic papers and reports regarding the security evaluation for such algorithms, it is difficult to ensure enough security by using the algorithms for a long time period, such as 10 or 15 years, due to advances in cryptanalysis techniques, improvement of computing power, and so on. To enhance the transition to more secure ones, National Institute of Standards and Technology (NIST) of the United States describes in various guidelines that NIST will no longer approve two-key triple DES, RSA with a 1024-bit key, and SHA-1 as the algorithms suitable for IT systems of the U.S. Federal Government after 2010. It is an important issue how to advance the transition of the algorithms in the financial sector. This paper refers to issues regarding the transition as Year 2010 issues in cryptographic algorithms. To successfully complete the transition by 2010, the deadline set by NIST, it is necessary for financial institutions to begin discussing the issues at the earliest possible date. This paper summarizes security evaluation results of the current algorithms, and describes Year 2010 issues, their impact on the financial industry, and the transition plan announced by NIST.
    [Show full text]