On Security Arguments of the Second Round SHA-3 Candidates

Transcription

1 On Security Arguments o the Second Round SA-3 Candidates Elena Andreeva Andrey Bogdanov Bart Mennink Bart Preneel Christian Rechberger March 19, 2012 Abstract In 2007, the US National Institute or Standards and Technology NIST) announced a call or the design o a new cryptographic hash algorithm in response to vulnerabilities like dierential attacks identiied in existing hash unctions, such as MD5 and SA-1. NIST received many submissions, 51 o which got accepted to the irst round. 14 candidates were let in the second round, out o which 5 candidates have been recently chosen or the inal round. An important criterion in the selection process is the SA-3 hash unction security. We identiy two important classes o security arguments or the new designs: 1) the possible reductions o the hash unction security to the security o its underlying building blocks, and 2) arguments against dierential attack on building blocks. In this paper, we compare the state o the art provable security reductions or the second round candidates, and review arguments and bounds against classes o dierential attacks. We discuss all the SA-3 candidates at a high unctional level, analyze and summarize the security reduction results and bounds against dierential attacks. Additionally, we generalize the wellknown proo o collision resistance preservation, such that all SA-3 candidates with a suix-ree padding are covered. Keywords SA-3 competition hash unctions classiication security reductions dierential attacks A preliminary version o this paper appeared at ISC 2010 [2]. E. Andreeva A. Bogdanov B. Mennink B. Preneel Dept. Electrical Engineering, ESAT/COSIC and IBBT Katholieke Universiteit Leuven, Belgium Tel.: Fax: bart.mennink@esat.kuleuven.be C. Rechberger Institut or Matematik Danmarks Tekniske Universitet, Denmark 1 Introduction ash unctions serve a crucial oundation o numerous cryptographic applications, ranging rom key derivation unctions over various security protocols to digital signatures. In 2004, a series o dierential attacks by Wang et al. [81, 82] have exposed security vulnerabilities in the design o the most widely adopted and deployed SA-1 hash unction. As a result, the US National Institute or Standards and Technology NIST) recommended the replacement o SA-1 by the SA-2 hash unction amily and announced a call or the design o a new SA-3 hashing algorithm. The SA-3 hash unction must allow or message digests o length 224,256,384 and 512 bits, it should be eicient, and most importantly it should provide an adequate level o security. In the second round, 14 candidate hash unctions were considered, 5 candidates remaining in the race or the selection o the SA-3 hash unction in the current third round. As a result o the perormed comparative analysis, several classiications o the SA-3 candidates, mostly ocused on hardware perormance, appeared in the literature [43,46, 59, 79]. A classiication based on the NIST-speciied security criteria is however still due. NIST Security Requirements. NIST speciies a number o security requirements [70] to be satisied by the uture SA-3 unction: i) at least one variant o the hash unction must securely support MAC and randomized hashing. Furthermore, or all n-bit digest values, the hash unction must provide ii) preimage resistance o approximately n bits, iii) second preimage resistance o approximately n L bits, where the irst preimage is o length at most 2 L blocks, iv) collision resistance o approximately n/2 bits, and v) all variants must be resistant to the length-extension attack. Finally, vi) or any m n, the hash unction speciied by

2 2 Elena Andreeva et al. taking a ixed subset o m bits o the unction s output is required to satisy properties ii)-v) with n replaced by m. Our Contribution. In this work we provide a survey o the 14 second round SA-3 candidates including the 5 inalists, in which we compare their security reductions, and their resistance against dierential attacks. Regarding security reductions, we consider preimage, second preimage and collision resistance security requirements ii)-iv)) or the n = 256 and n = 512 variants. Most o this security analysis is realized in the ideal model, where one or more o the underlying integral building blocks e.g., the underlying block cipher or permutations)) are assumed to be ideal, i.e. random primitives. To argue collision resistance we extend the standard proo o Merkle-Damgård collision resistance [38, 68] to cover all second round SA-3 candidate hash unction with a suix-ree padding App. B). Notice that the basic Merkle-Damgård proo does not suice in the presence o a inal transormation and/or a chopping. Additionally, we consider the indierentiability o the candidates. Inormally, indierentiability guarantees that a design has no structural design laws [32], and in particular as ormally proven in App. A) an indierentiability result renders upper bounds on the advantage o inding preimages, second preimages and collisions. The provable security analysis in this contribution extends to the indings o Andreeva et al. [2]. Recent substantial progress in the dierential attacks against SA-1 [81] is the main motivation or the SA-3 competition [29], and many o the irst round candidates ell victim to dierential attacks as well, due to their wellelaborated and advanced toolbox. ence we survey known bounds against classes o these attacks. Note that, to the best o current knowledge, inormative bounds exist only or a subset o relevant dierential properties. Also only a subset o all second round SA-3 candidates allow or such bounds by design, which excludes e.g. all ARX-based constructions rom the analysis. Thereore, in this work, we will be mainly considering upper bounds on the expected dierential trail probability EDTP) o hash unction building blocks such as underlying permutations and block ciphers which are based on substitution-permutation networks. Although EDTP proved to be highly inormative in predicting the power o dierential cryptanalysis or keyed block ciphers, or most attacks on hash unctions all inputs to the unction s building blocks are known and can oten even be chosen by the adversary. owever, at some point in most major attack techniques against hash unctions, the adversary cannot control the dierence propagation any more and relies on the dierential trails, EDTP becoming again a good predictor o the attack complexity. Thus, due to the lack o a better universal evaluation tool with respect to dierential attacks on the one hand, and because o the ability o the dierential trails to relect at least some important eatures o such attacks on the other, we have opted to use upper bounds on EDTP in our comparative analysis. Section 2 briely covers the notation, and the basic principles o hash unction design. In Sect. 3, we consider all candidates, both rom a provable security point o view, and rom a cryptanalysis view. We give a high level algorithmic description o each hash unction, and discuss the existing security results. All results are summarized in Table 1 and Table 2. We conclude the paper with Sect. 4 and give some inal remarks on the security comparison. 2 Preliminaries For a positive integer value n N, we denote by Z n 2 the set o bit strings o length n, and by Z n 2 ) the set o strings o length a positive multiple o n bits. We denote by Z 2 the set o bit strings o arbitrary length. I x,y are two bit strings, their concatenation is denoted by x y. By x we denote the length o a bit string x, and or m,n N we denote by m n the encoding o m as an n-bit string. The unction chop n x) chops o the n rightmost bits o a bit string x. Throughout, we use a uniied notation or all candidates. The value n denotes the output size o the hash unction, l the size o the chaining value, and m the number o message bits compressed in one iteration o the compression unction. A padded message is always parsed as a sequence o k 1 message blocks o length m bits: M 1,...,M k ). 2.1 Reductionist Security Notions In this section we investigate the reductionist security o hash unctions in the ideal model and the more classical generic security. Security in the ideal model. In the ideal model, a compressing unction F either on ixed or arbitrary input lengths) that uses one or more underlying building blocks is viewed insecure i there exists a successul inormation-theoretic adversary that has only query access to the idealized underlying primitives o F. The complexity o the attack is measured by the number o queries q to the primitive made by the adversary. In this work it is clear rom the context which o the underlying primitives is assumed to be ideal. The three main security properties required rom the SA-3 hash unction are preimage, second preimage and collision resistance. For each o these three notions, with Adv atk F, where atk {pre, sec, col}, we denote the maximum advantage o an adversary to break the unction F under the security notion atk. The advantage is the probability unction taken over all random choices o the underlying primitives, and the

3 On Security Arguments o the Second Round SA-3 Candidates 3 maximum is taken over all adversaries that make at most q queries to their oracles. Additionally, we consider the indierentiability o the SA-3 candidates. The indierentiability ramework introduced by Maurer et al. [67] is an extension o the classical notion o indistinguishability, and ensures that a hash unction has no structural deects. We denote the indierentiability security o a hash unction by Adv pro, maximized over all distinguishers making at most q queries o maximal length K 0 message blocks to their oracles. We reer to [32] or a ormal deinition. An indierentiability bound guarantees security o the hash unction against speciic attacks. In particular, one can obtain a bound on Adv atk, or any security notion atk: Adv atk Pr atk RO + Advpro, where Pr atk RO denotes the success probability o a generic attack against under atk. This bound is proven in Thm. 1 App. A). Generic security. The generic collision resistance security in the context o this work deals with analyzing the collision resistance o hash unctions in the standard model. A hash unction is called generically t, ε) collision resistant i no adversary running in time at most t can ind two dierent messages M,M such that M) = M ) with advantage the generic collision resistance security o the unction, maximized over all eicient adversaries. We reer the reader to [4,73,74] or a more ormal discussion. To argue generic collision resistance security o the hash unction as domain extenders o ixed input length compression unctions) we use the composition result o Merkle and Damgård [38,68] and extend it to a wider class o suixree hash unctions App. B). This result concludes the collision resistance o the hash unction assuming collision resistance security guarantees rom the underlying compression unctions. We then translate ideal model collision resistance security results on the compression unctions via the latter composition to ideal model collision results on more than ε. We denote by Adv gcol the hash unction expressed by Adv col ). A generic collision result, generally speaking, applies to a wider class o schemes or which no bounds on the collision resistance security o the underlying compression unctions is known, e.g. or BLAKE and BMW. I a compressing unction F outputs a bit string o length n, one expects to ind collisions with high probability ater approximately 2 n/2 queries due to the birthday attack). Similarly, second) preimages can be ound with high probability ater approximately 2 n queries 1. Moreover, inding 1 Kelsey and Schneier [56] describe a second preimage attack on the Merkle-Damgård hash unction that requires at most approximately 2 n L queries, where the irst preimage is o length at most 2 L blocks. second preimages is provably harder than inding collisions, and similar or preimages depending on the speciication o F) [74]. Formally, we have Ωq 2 /2 n ) = Adv col F = O1), Ωq/2 n ) = Adv sec F Adv col F, and Ωq/2 n ) = Adv pre F Adv col F + ε, where ε is negligible i F is a variable input length compressing unction. In the remainder, we will consider these bounds or granted, and only include security results that improve either o these bounds. A bound is called tight i the lower and upper bound are the same up to a constant actor, and optimal i the bound is tight with respect to the original lower bound. 2.2 Compression Function Design Strategies A common way to build compression unctions is to base it on a block cipher [25,72,77], or on a limited number o) permutations) [24, 75, 76]. Preneel et al. [72] analyzed and categorized 64 block cipher based compression unctions. Twelve o them were ormally proven secure by Black et al. [25]. These results have been recently generalized by Stam [77]. Interestingly, the latter result implies security bounds or some compression unctions that do not it in the PGV-model, like ECO, amsi and SIMD. In the ideal model, everywhere second preimage resistance o the compression unction can be proven similar as the preimage resistance, up to a constant the security analysis diers only in that we give the adversary one query or ree). Throughout, by PGVx we denote the x th type compression unction o [72]. We note that PGV1, PGV3 and PGV5 are better known as the Matyas-Meyer-Oseas, the Miyaguchi-Preneel and the Davies-Meyer compression unctions, respectively. In the context o permutation based compression unctions, Black et al. [24] analyzed 2l- to l-bit compression unctions based on one l-bit permutation, and proved them insecure. This result has been generalized by Rogaway and Steinberger [75], Stam [76] and Steinberger [78] to compression unctions with arbitrary input and output sizes, and an arbitrary number o underlying permutations. Their bounds indicate the number o queries required to ind collisions or preimages or permutation based compression unctions. 2.3 ash Function Design Strategies In order to allow the hashing o arbitrarily long strings, all SA-3 candidates employ a speciic mode o operation. Central to all designs is the iterated hash unction principle [62]: on input o an initialization vector IV, the iterated hash This attack does, however, not apply to all SA-3 candidates. In particular, the wide-pipe SA-3 candidates remain mostly unaected due to their increased internal state.

4 4 Elena Andreeva et al. unction based on the compression unction proceeds a padded message M 1,...,M k ) as ollows: IV;M 1,...,M k ) = h k, where: h 0 = IV, h i = h i 1,M i ) or i = 1,...,k. This principle is also called the plain Merkle-Damgård MD) design [38, 68]. Each o the 14 remaining candidates is based on this design, possibly ollowed by a inal transormation FT), and/or a chop-unction 2. The padding unction pad : Z 2 Zm 2 ) is an injective mapping that transorms a message o arbitrary length to a message o length a multiple o m bits the number o message bits compressed in one compression unction iteration). Most o the candidates employ a suiciently strong padding rule c. Fig. 2). Additionally, in some o the designs the message blocks are compressed along with speciic counters or tweaks, which may strengthen the padding rule. We distinguish between preix-ree and/or suix-ree padding. A padding rule is called suix-ree, i or any distinct M,M, there exists no bit string X such that padm ) = X padm). The plain MD design with any suix-ree padding also called MD-strengthening [62]) preserves collision resistance [38, 68]. We generalize this result in Thm. 2 App. B): inormally, this preservation result also holds i the iteration is inalized by a distinct compression unction and/or the chop-unction. Other security properties, like preimage resistance, are however not preserved in the MD design [4]. It is also proven that the MD design with a suixree padding need not necessarily be indierentiable [32]. owever, the MD construction is indierentiable i it ends with a chopping unction or a inal transormation, both when the underlying compression unction is ideal or when the hash unction is based on a PGV compression unction [32, 52, 66]. A padding rule is called preix-ree, i or any distinct M,M, there exists no bit string X such that padm ) = padm) X. It has been proved that the MD design, based on ideal compression unction or ideal PGV construction, with preix-ree padding is indierentiable rom a random oracle [30, 32, 52, 66]. Security notions like collision-resistance, are however not preserved in the MD design with preix-ree only padding. AIFA design. A concrete design based on the MD principle is the AIFA construction [21]. In AIFA the message is padded in a speciic way so as to solve some deiciencies 2 A unction g is a inal transormation i it diers rom, and is applied to the inal state, possibly with the injection o an additional message block. The chop-unction is not considered to be a part o) a inal transormation. o the original MD construction: in the iteration, each message block is accompanied with a ixed optional) salt o s bits and a mandatory) counter C i o t bits. The counter C i keeps track o the number o message bits hashed so ar, and equals 0 by deinition i the i th block does not contain any message bits. Partially due to the properties o this counter, the AIFA padding rule is suix- and preix-ree. As a consequence, the construction preserves collision resistance c. Thm. 2) and the indierentiability results o [32] carry over. For the AIFA design, these indierentiability results are improved in [19]. Furthermore, the AIFA construction is proven secure against second preimage attacks i the underlying compression unction is assumed to behave like an ideal primitive [27]. Wide-pipe design. In the wide-pipe design [65], the iterated state size is signiicantly larger than the inal hash output: at the end o the iteration, a raction o the output o a construction is discarded. As proved in [32], the MD construction with a distinct inal transormation and/or chopping at the end is indierentiable rom a random oracle. Sponge unctions. We do not explicitly consider sponge unctions [16] or their generalization [3] as a speciic type o construction: all SA-3 candidates known to be sponge- like) unctions, Cubeash, Fugue, J, Keccak and Lua, can be described in terms o the chop-md construction possibly with a inal transormation beore or instead o the chopping). 2.4 Concrete Security o ash Functions and Dierential Cryptanalysis All security notions and design approaches mentioned so ar substantially assume the underlying primitives o hash unctions such as compression unctions, permutations or block ciphers) to behave in an idealized way, where the primitive is randomly drawn rom the corresponding class o primitives. owever, any practical setting requires the primitives to be eiciently implementable, their representation being compact. As a matter o act, this does not comply to the random procedure o choice assumed, since it is extremely improbable to select a compactly implementable primitive at random. Thus, once the rule o domain extension has been proven sound assuming the idealness o the underlying primitive, the problem o evaluating the concrete primitive with respect to real-world attacks arises. In this paper, we choose to employ the toolbox o dierential cryptanalysis [23] to address the latter problem, particularly because this analysis approach is also responsible or the attacks on MD5 and SA-1, that are the main motivation or the SA-3 competition. The security o hash unctions with respect to such central requirements as second) preimage and collision resis-

5 On Security Arguments o the Second Round SA-3 Candidates 5 tance can be reormulated in terms o the input and output dierences o the underlying primitives. A large proportion, though not all, o second-round SA-3 candidates ollow design approaches allowing one to eiciently argue the resistance o their primitives compression unctions, permutations, ciphers) to dierential cryptanalysis. These are mainly those candidates relying on the substitution-diusion networks oten similar to AES [44] or even reusing its components) which make proos o some relevant properties in the domain o dierential cryptanalysis possible [34]. Dierentials, DP, EDP. Strictly speaking, or some primitive φ mapping to n bits, we do not want the dierential probability DP) o any non-trivial dierential, ) over φ to signiicantly deviate rom 2 n see [35] or a comprehensive statistical study o this parameter or idealized permutations and unctions). The dierential, ) or primitive φ consists o input dierence and output dierence. Once the parameters o φ are ixed keys, salts, initial vectors, etc.), one speaks about the dierential probability DP as the probability or, ) to hold averaged over all inputs. The expected DP EDP) is the DP averaged over all sets o parameters or φ. Dierential trails, DTP, EDTP. For most practical constructions, however, it is oten impossible to derive any tight and, thus, inormative) upper bounds on DP or even EDP. That is why, to simpliy the analysis, one requently has to revert to dierential trails and their probabilities or the evaluation o designs with respect to dierential cryptanalysis [23,34]. A dierential can be seen as the set o all dierence propagation paths rom to through intermediate dierences corresponding to the iterations o an iterative construction. Each o these paths is called a dierential trail. The probability that a dierential trail holds is reerred to as dierential trail probability DTP). Similarly to dierentials, the expected DTP averaged over all parameters will be denoted as EDTP. For substitution-diusion networks, a common belie is that keeping the number o active S-boxes those involved into the dierence propagation) high is correlated with lower values o EDTPs and EDPs which gave rise to the wide trail design strategy [37] and resulted in the successul design o AES [34]. owever, ormally speaking, the number o active S-boxes and their local DPs do not directly translate to EDP over several rounds o primitives, being only adequate or deriving bounds on single-round EDP. Attempts have been made to compute inormative upper bounds on EDP over several rounds o AES: though it has been possible to compute the exact maximum EDP or two rounds o AES [55], the problem persists or 4 rounds [33]. owever, one can still prove some upper bounds on EDP over more than two rounds, which has been done e.g. to evaluate the security o SAvite-3 and ECO by their respective designers. As applied to SA-3 candidates, we will talk about EDTP whenever the results deal with more rounds than one could cover by a tight upper bound on EDP. Depending on a concrete hash unction among the second round SA-3 candidates, the respective designers deal with distinct deinitions o a dierential trail to derive a bound on EDTP or the building blocks. Such deinitions range rom the S-box level e.g. Fugue, Grøstl, and J) to several AES rounds e.g. ECO and SAvite-3). As a rule, going rom the S-box level to the level o several rounds results in bounds on EDTP closer to EDP. Throughout the paper, we reer to the upper bounds on EDP and EDTP attained or not attained) as MEDP and MEDTP, respectively. 3 SA-3 ash Function Candidates In this section, we analyze the security o the 14 remaining SA-3 candidates in more detail, rom a provable security perspective as well as with respect to the security against classes o dierential attacks. Each paragraph contains an inormal discussion or each candidate, its reductionist security results, and its security against dierential attacks. The mathematical descriptions o the abstracted) designs are given in Fig. 1, and the candidates padding unctions are summarized in Fig. 2. With respect to the reductionist security, or simplicity we only consider the proposals o the SA-3 candidates that output digests o 256 or 512 bits. Observe that in many candidate SA-3 hash unction amilies, the algorithms outputting 224 or 384 bits are the same as the 256- or 512-bits algorithms, except or an additional chopping at the end. Particularly, the results o [32] and Thm. 2 carry over in most o the cases. The same remark applies to requirement vi) o NIST. Requirement i). All designers claim that their proposal can saely be used in MAC mode [12] or or randomized hashing [54], and we do not discuss it here; Requirements ii)-iv). Preimage, second preimage and collision resistance o each hash unction are discussed in this section. Additionally, we also consider the indierentiability o the candidates; Requirement v). All hash unction candidates are secure against the length extension attack, and thus we do not discuss it urther. The reductionist security results or all current candidate hash unctions are summarized in Table 1. With respect to the security against classes o dierential attacks, the primitives o all candidate hash unctions are analyzed. These security results are summarized in Table 2.

6 6 Elena Andreeva et al. BLAKE: n,l,m,s,t) {256,256,512,128,64), 512,512,1024,256,128)} E : Z 2l 2 Zm 2 Z2l 2 a block cipher L : Z l+s+t 2 Z 2l 2, L : Z 2l 2 Zl 2 linear unctions h,m,s,c) = L E M Lh,S,C))) h S S) BLAKEM) = h k, where: M 1,...,M k ) pad 1 M); h 0 IV S Z s 2 ; C i) k i=1 AIFA-counter h i h i 1,M i,s,c i ) or i = 1,...,k BMW: n,l,m) {256,512,512),512,1024,1024)} E : Z m 2 Zl 2 Zm 2 a block cipher L : Z l+m+l 2 Z l 2 a compressing unction h,m) = Lh,M,E h M)) gh) = IV,h) BMWM) = h, where: M 1,...,M k ) pad 2 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [gh k )] Cubeash: n,l,m) {256,1024,256),512,1024,256)} P : Z l 2 Zl 2 a permutation h,m) = Ph M 0 l m )) gh) = P 10 h )) CubeashM) = h, where: M 1,...,M k ) pad 3 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [gh k )] ECO: n,l,m,s,t) {256,512,1536,128,64/128), 512,1024,1024,256,64/128)} 2 a block cipher E : Z Z s+t 2 Z 2048 L : Z Z l 2 a linear unction h,m,s,c) = LE S,C h M) h M)) ECOM) = h, where: M 1,...,M k ) pad 4 M); h 0 IV S Z s 2 ; C i) k i=1 AIFA-counter h i h i 1,M i,s,c i ) or i = 1,...,k h chop l n [h k ] Fugue: n,l,m) {256,960,32),512,1152,32)} P, P : Z l 2 Zl 2 permutations L : Z l 2 Zm 2 Zl 2 a linear unction h,m) = PLh,M)) FugueM) = h, where: M 1,...,M k ) pad 5 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [ Ph k )] Grøstl: n,l,m) {256,512,512),512,1024,1024)} P,Q : Z l 2 Zl 2 permutations h,m) = Ph M) QM) h gh) = Ph) h GrøstlM) = h, where: M 1,...,M k ) pad 6 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [gh k )] amsi: n,l,m) {256,256,32),512,512,64)} P, P : Z 2n 2 Z2n 2 permutations Exp : Z m 2 Zn 2 a linear code h,m) = h chop n [PExpM) h)] gh,m) = h chop n [ PExpM) h)] amsim) = h, where: M 1,...,M k ) pad 7 M); h 0 IV h i h i 1,M i ) or i = 1,...,k 1 h gh k 1,M k ) J: n,l,m) {256,1024,512),512,1024,512)} P : Z l 2 Zl 2 a permutation h,m) = Ph 0 l m M)) M 0 l m ) JM) = h, where: M 1,...,M k ) pad 8 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [h k ] Keccak: n,l,m) {256,1600,1088),512,1600,576)} P : Z l 2 Zl 2 a permutation h,m) = Ph M 0 l m )) KeccakM) = h, where: M 1,...,M k ) pad 9 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop l n [h k ] Lua: n,l,m,w) {256,768,256,3),512,1278,256,5)} P i : Z m 2 Zm 2 i = 1,...,w) permutations L : Z wm+m 2 Z wm 2, L : Z wm 2 Z m 2 linear unctions h,m) = P 1 h 1 ) P wh w)) where h 1,...,h w) = Lh,M) gh) = L h) L h,0 m ))) LuaM) = h, where: M 1,...,M k ) pad 10 M); h 0 IV h i h i 1,M i ) or i = 1,...,k h chop 512 n [gh k )] Shabal: n,l,m) {256,1408,512),512,1408,512)} E : Z Z Z a block cipher h,c,m) = y 1,h 3 M,y 3 ) where h Z l 2 h = h 1,h 2,h 3 ) Z2 384+m+m and y 1,y 3 ) = E M,h3 h C),h 2 + M) ShabalM) = h, where: M 1,...,M k ) pad 11 M); h 0 IV h i h i 1, i 64,M i ) or i = 1,...,k h k+i h k+i 1, k 64,M k ) or i = 1,...,3 h chop l n [h k+3 ] SAvite-3: n,l,m,s,t) {256,256,512,256,64), 512,512,1024,512,128)} E : Z l 2 Zm+s+t 2 Z l 2 a block cipher h,m,s,c) = E M,S,C h) h SAvite-3M) = h k, where: M 1,...,M k ) pad 12 M); h 0 IV S Z s 2 ; C i) k i=1 AIFA-counter h i h i 1,M i,s,c i ) or i = 1,...,k SIMD: n,l,m) {256,512,512),512,1024,1024)} E,Ẽ : Z l 2 Zm 2 Zl 2 block ciphers h,m) = Lh,E M h M)) gh,m) = Lh,Ẽ M h M)) SIMDM) = h, where: M 1,...,M k ) pad 13 M); h 0 IV h i h i 1,M i ) or i = 1,...,k 1 h k gh k 1,M k ) h chop l n [h k ] Skein: n,l,m) {256,256,256),512,512,512)} E : Z m 2 Z128 2 Z l 2 Zm 2 a tweakable block cipher h,t,m) = E h,t M) M SkeinM) = h, where: M 1,...,M k ) pad 14 M); h 0 IV T i ) k i=1 round-speciic tweaks h i h i 1,T i,m i ) or i = 1,...,k h chop l n [h k ] SA-2: n,l,m) {256,256,512),512,512,1024)} E : Z l 2 Zm 2 Zl 2 a block cipher h,m) = E M h) + h SA-2M) = h k, where: M 1,...,M k ) pad 15 M); h 0 IV h i h i 1,M i ) or i = 1,...,k Fig. 1 The padding rules employed by the unctions are summarized in Fig. 2. In all algorithm descriptions, IV denotes an initialization vector, h denotes state values, M denotes message blocks, S denotes a ixed) salt, C denotes a counter and T denotes a tweak. The unctions L,L,Exp underlying BLAKE, BMW, ECO, Fugue, amsi and Lua, are explained in the corresponding section.

7 On Security Arguments o the Second Round SA-3 Candidates 7 BLAKE : pad 1 M) = M 1 0 M t 2 mod m 1 M t, BMW : pad 2 M) = M 1 0 M 65 mod m M 64, Cubeash : pad 3 M) = M 1 0 M 1 mod m, ECO : pad 4 M) = M 1 0 m 1 M +144 mod m) n 16 M 128, Fugue : pad 5 M) = M 0 M mod m M 64, Grøstl : pad 6 M) = M 1 0 M 65 mod l M + 65)/l 64, amsi : pad 7 M) = M 1 0 M 1 mod m M 64, J : pad 8 M) = M M mod m) M 128, Keccak : pad 9 M) = M 1 0 M 2 mod m 1, Lua : pad 10 M) = M 1 0 M 1 mod m)+256, Shabal : pad 11 M) = M 1 0 M 1 mod m, SAvite-3 : pad 12 M) = M 1 0 M t 17 mod m M t n 16, SIMD : pad 13 M) = M 0 M mod m M m, { Skein : pad 14 M) = M 0 M mod m)+m,where M = M i M 0 mod 8, SA-2 : pad 15 M) = { M 1 0 M 65 mod m M 64, or n = 224,256, M 1 0 M 1 mod 8 otherwise. M 1 0 M 129 mod m M 128, or n = 384,512. Fig. 2 The padding rules o all SA-3 hash unction candidates and SA-2 are summarized. All padding unctions output bit strings parsed as sequences o m-bit blocks, where m is the message block length o the corresponding unction. For the hash unctions BLAKE, ECO, Shabal, SAvite-3 and Skein, the complete padding rule o the corresponding hash unction is additionally deined by a counter or tweak as explained in Sect. 3). Particularly, all hash unctions employ an injective padding rule The BLAKE hash unction [8] is a AIFA construction. The message blocks are accompanied with a AIFAcounter, and more generally, the unction employs a suixand preix-ree padding rule. The compression unction is block cipher based 3. It moreover employs an injective linear unction L, and a linear unction L that XORs the irst and second halves o the input. Reductionist security o BLAKE. The compression unction o BLAKE is proven optimally collision, second preimage and preimage resistant [5]. As the mode o operation o BLAKE is based on the AIFA structure, all security properties regarding this type c. Sect. 2.3) hold [21], provided the compression unction is assumed to be ideal. owever, as independently shown by Andreeva et al. [5] and Chang et al. [31], the BLAKE compression unction shows nonrandom behavior: it is dierentiable rom a random compression unction in about 2 n/4 queries, making the abovementioned security properties invalid. Still, Thm. 2 applies to BLAKE, and as a consequence we obtain Adv col =. Additionally, a preimage or BLAKE implies a preimage or its inal transormation, and we obtain Adv pre = Θq/2n ). The hash unction is moreover proven optimally second preimage resistant in the ideal cipher model by Andreeva et al. [5], which gives Adv sec =. Furthermore, the BLAKE hash unction is proven indierentiable rom a random oracle i the underlying block cipher is ideal [5,31]. 3 As observed in [8, Sect. 5], the core part o the compression unction can be seen as a permutation keyed by the message, which we view here as a block cipher. Bounds on DTP or BLAKE. No inormative bounds on DTP are known or BLAKE The Blue Midnight Wish BMW) hash unction [51] is a chop-md construction, with a inal transormation beore chopping. The hash unction employs a suix-ree padding rule. The compression unction is block cipher based 4, and the inal transormation g consists o the same compression unction with the chaining value processed as a message, and with an initial value as chaining input. The compression unction employs a unction L which consists o two compression unctions with speciic properties as speciied in [51]. Reductionist security o BMW. The compression unction o BMW shows similarities with the PGV3 compression unction [25], but no security results are known or this variant. Theorem 2 applies to BMW, where the inal transormation has no message block as input, and as a consequence we obtain Adv col = i is assumed ideal). Additionally, a preimage or BMW implies a preimage or its inal transormation, and we obtain Adv pre = Θq/2n ). Furthermore, albeit no indierentiability proo or the BMW hash unction is known, we note that BMW can be seen as a combination o the MAC- and the chop-construction, both proven indierentiable rom a random oracle [32]. We remark that a distinguisher or the compression unction o BMW is derived in [7]. 4 As observed in [51], the compression unction can be seen as a generalized PGV3 construction, where the unction 0 o [51] deines the block cipher keyed with the chaining value.

8 8 Elena Andreeva et al. Bounds on DTP or BMW. No inormative bounds on DTP are known or BMW The Cubeash hash unction [15] is a chop-md construction, with a inal transormation beore chopping. The compression unction is permutation based, and the inal transormation g consists o lipping a certain bit in the state and applying 10 more compression unction rounds on zeromessages. Reductionist security o Cubeash. The compression unction o Cubeash is based on one permutation 5, and collisions and preimages or the compression unction can be ound in one query to the permutation [24]. The Cube- ash hash unction is as parazoa design proven indierentiable rom a random oracle i the underlying permutation is assumed to be ideal [3]. Using Thm. 1, this indierentiability bound additionally renders an optimal collision resistance bound or Cubeash, Adv col = Θq ) 2 /2 n ), as well as an improved upper bound O q 2 n + q2 on the preimage 2 l n and second preimage resistance. Note that these bounds are optimal or the n = 256 variant. Bounds on DTP or Cubeash. No inormative bounds on DTP are known or Cubeash The ECO hash unction [14] is a chop-aifa construction. The message blocks are accompanied with a AIFA-counter, and more generally, the unction employs a suix- and preix-ree padding rule. The compression unction is block cipher based 6. It moreover employs a linear unction L that chops the state in blocks o length l bits, and XORs these. Reductionist security o ECO. The compression unction o ECO is a chopped single call Type-I compression unction in the categorization o [77]. Thereore, the results o [77, Thm. 15] carry over, yielding optimal security bounds or the compression unction. Observe that these results can easily be adjusted to obtain bound Adv col chop =. ECO is a combination o AIFA and chop- MD, but it is unclear whether all AIFA security properties hold ater chopping. Still, Thm. 2 applies to ECO, and as a consequence we obtain Adv col =. Additionally, a preimage or ECO implies a preimage or its last compression unction, and we obtain Adv pre = Θq/2n ). Furthermore, the ECO hash unction would be indierentiable rom a random oracle i the underlying compression unction is assumed to be ideal, due to the chopping unction at the end [32]. owever, the compression unction o ECO 5 Eectively, this permutation consists o one simpler permutation executed 16 times iteratively. 6 As observed in [14], the core part o the compression unction can be seen as a permutation keyed by the salt and counter, which we view here as a block cipher. This cipher is AES-based. is easily dierentiable rom a random oracle [48], and we cannot directly apply the results o [32]. Bounds on DTP or ECO. The primitive or all versions o ECO is ECO.AES with a 2048-bit block size, having 8 and 10 rounds or hash sizes up to 256 and 512 bit, respectively. One underlying unction o ECO.AES is given by the application o two AES rounds. The exact value o the MEDP or two rounds o AES is about One round o ECO.AES provides one active unction. Two rounds provide an upper bound on MEDP o about , an equivalent o our active unctions. Similarly, the bound on the MEDP over 4 rounds yields an equivalent o 16 active unctions. MEDP or ECO is considered averaged over salt and counter. Combining the above results, one obtains upper bounds on the dierential trail probability over up to 10 rounds, outlined in Table 2. Note that a dierential trail in this case is deined as a concatenation o either 1, 2 or 4 rounds o ECO.AES. Correspondingly, the MEDTP is computed under the consideration o the above MEDP values or 1, 2 or 4 rounds o ECO.AES The Fugue hash unction [53] is a chop-md construction, with a inal transormation beore chopping. The hash unction employs a suix-ree padding rule. The compression unction is permutation based, and the inal transormation consists o a permutation P which diers rom P in the parametrization. The compression unction employs a linear unction L or message injection TIX o [53]). Reductionist security o Fugue. The compression unction o Fugue is based on one permutation, and collisions and preimages or the compression unction can be ound in one query to the permutation [24]. As a consequence, the result o Thm. 2 is irrelevant, even though the padding rule o Fugue is suix-ree. The Fugue hash unction is as parazoa design proven indierentiable rom a random oracle i the underlying permutations P and P are assumed to be ideal [3]. Using Thm. 1, this indierentiability bound additionally renders an optimal collision resistance bound or Fugue, Adv col = Θq 2 )/2 n ), as well as an improved upper bound O q 2 n + q2 on the preimage and second preimage resistance. Note that these bounds are optimal or the n = l m n variant. We remark that a distinguisher or the inal round o Fugue is derived in [9,49]. Bounds on DTP or Fugue. For Fugue a number o arguments against dierential attacks exist that are, compared to all other bounds or candidates discussed in this paper, rather dierent in nature. The main statement or Fugue is a theorem, that assumes that the adversary is given a random pair o states satisying any dierence o his choice. It then investigates whether the adversary would be able to ind a pair o message inputs that converts these states into a ull internal collision ater exactly our round transormations. The theorem proves, under some independence assumption, that

9 On Security Arguments o the Second Round SA-3 Candidates 9 the probability that such message inputs exist is bounded by For a lower number o rounds, the probability will be higher though, while it is not clear how the probability o a higher number o rounds will be The Grøstl hash unction [50] is a chop-md construction, with a inal transormation beore chopping. The hash unction employs a suix-ree padding rule. The compression unction is permutation based, and the inal transormation g is deined as gh) = Ph) h. Reductionist security o Grøstl. The compression unction o Grøstl is permutation based, and the results o [75, 76] apply. Furthermore, the preimage resistance o the compression unction is analyzed in [47], and an upper bound or collision resistance can be obtained easily. As a consequence, we obtain tight security bounds on the compression unction, Adv pre = Θq 2 /2 l ) and Adv col = Θq 4 /2 l ). In the ideal model, everywhere second preimage resistance o the compression unction can be proven similar as the preimage resistance, up to a constant the security analysis diers only in that we give the adversary one query or ree). Theorem 2 applies to Grøstl, where the inal transormation has no message block as input. Observe that we also have Adv col chop g = Θq2 /2 n ), and as a consequence we obtain Adv col =. Additionally, a preimage or Grøstl implies a preimage or its inal transormation, and we obtain Adv pre = Θq/2n ). The hash unction is moreover proven optimally second preimage resistant in the ideal permutations model [6], which gives Adv sec = Θq/2 n L ), where the irst preimage is o length at most 2 L blocks. Furthermore, the Grøstl hash unction is proven indierentiable rom a random oracle i the underlying permutations are ideal [1]. Bounds on DTP or Grøstl. The compression unction o Grøstl is based on two permutations o size 512 or Grøstl- 224 and Grøstl-256, and is based on two permutations o size 1024 or Grøstl-384 and Grøstl-512. Those permutations are designed according to the wide trail design strategy [37], hence known bounds on the MEDTP carry over as ollows. For 2 rounds, at least 9 S-boxes, or 4 rounds, at least 81 S-boxes are active. A lower bound on the DP o the employed AES S-box is 2 6. From this, the 4-round MEDTP is For the 10-round 512-bit permutation the MEDTP is hence , and or the 14-round 1024-bit permutation the MEDTP is hence The amsi hash unction [60] is a MD construction, with a inal transormation beore chopping. The hash unction employs a suix-ree padding rule. The compression unction is permutation based, but the last round is executed with a compression unction g based on a permutation P which diers rom P in the parametrization. The compression unctions employ a linear code Exp or message injection [60]. Reductionist security o amsi. The compression unction o amsi is a chopped single call Type-I compression unction in the categorization o [77]. Thereore, the results o [77, Thm. 15] carry over, yielding optimal security bounds or the compression unction. Observe that these bounds also apply to the unction g. Theorem 2 applies to amsi, and as a consequence we obtain Adv col =. Additionally, a preimage or amsi implies a preimage or its last compression unction, and we obtain Adv pre = Θq/2n ). Furthermore, the amsi hash unction is proven indierentiable rom a random oracle i the underlying permutations are ideal [61]. Bounds on DTP or amsi. No inormative bounds on DTP are known or amsi The J hash unction [83] is a chop-md construction. The hash unction employs a suix-ree padding rule. The compression unction is permutation based. Reductionist security o J. The compression unction o J is based on one permutation, and collisions and preimages or the compression unction can be ound in one query to the permutation [24]. As a consequence, the result o Thm. 2 is irrelevant, even though the padding rule o J is suix-ree. The J hash unction is proven optimally collision resistant [63], and proven preimage) and second preimage resistant up to bound O q 2 n + q2 [6]. Furthermore, 2 l m the J hash unction is proven indierentiable rom a random oracle i the underlying permutation is ideal [20]. Bounds on DTP or J. The J permutation consists o 42 rounds o a generalized AES-like structure. Note the number o rounds has been increased in the 3rd round submission documents or J. The maximum DP o the 4-bit S-box used is 2 2. The speciication document suggests that 17 rounds o the underlying permutation yield at least 296 active S- boxes. Since no ormal treatment o the dierential eect has been conducted, we consider the dierential trails on the S-box level in this work. So the MEDTP or the 2 17 = 34 rounds is at most , which is also the MEDTP value we take or all 42 rounds, as no lower bounds are provided on the number o active S-boxes or less than 17 rounds The Keccak hash unction [18] is a chop-md construction. The compression unction is permutation based. The hash unction output is obtained by chopping o l n bits o the state. Notice that the parameters o Keccak satisy l = 2n + m. Reductionist security o Keccak. The compression unction o Keccak is based on one permutation, and collisions and preimages or the compression unction can be ound in one query to the permutation [24]. The Keccak hash unction is proven indierentiable rom a random oracle i the underlying permutation is assumed to be ideal [17]. Using Thm. 1, this indierentiability bound additionally renders an optimal

10 10 Elena Andreeva et al. collision resistance bound or Keccak, Adv col =, as well as an optimal preimage second preimage resistance bound. Bounds on DTP or Keccak. The Keccak permutation consists o 24 rounds. In [36] or the MEDTP a value o 2 32 is proven or 3 rounds, 2 74 or 6 rounds, and or the ull 24 rounds The Lua hash unction [39] is a chop-md construction, with a inal transormation beore chopping. The compression unction is permutation based, and the inal transormation g is built on this compression unction and a linear unction L that chops the state in blocks o length m bits, and XORs these. The compression unction employs a linear unction L or message injection MI o [39]) 7. Notice that the state size o Lua satisies l = w m. Reductionist security o Lua. The compression unction o Lua is based on w permutations executed independently. As a consequence, collisions and preimages or the compression unction can be ound in at most 5 queries to the permutations [24]. The Lua hash unction borrows characteristics rom the sponge design and is similar to the parazoa design, i the permutation P consisting o the w permutations P i is considered ideal, and ideas rom the indierentiability proos o [3,17] may carry over. owever, or the case o w dierent permutations P i this is not immediately clear. We remark that a distinguisher or the permutation o Lua is derived in [57]. Bounds on DTP or Lua. The Lua permutations consist o 8 rounds. Using an exhaustive search, designers report a minimal number o active S-boxes or 4 rounds o 31. A lower bound on the DP o the employed AES S-box is 2 2, hence the MEDTP or the ull 8-round permutation is The Shabal hash unction [28] is a chop-md construction. The message blocks are accompanied with a counter, and the last block is iterated three times. In particular, the unction employs a suix- and preix-ree padding rule. The compression unction is block cipher based. Notice that the parameters o Shabal satisy l = m. Reductionist security o Shabal. A bound on the collision resistance o the compression unction o Shabal is derived in [28]. Concretely, it is proven that the Shabal compression unction is collision resistant up to q = 2 l m)/2 queries. Theorem 2 applies to Shabal. Collision and preimage resistance o Shabal are studied in [28], yielding optimal bounds =. Furthermore, the same authors prove the Shabal hash unction to be indierentiable rom a random oracle i the underlying block Adv pre = Θq/2n ) and Adv col 7 We deined the output transormation in a slightly more complicated but uniied way. Essentially, Lua 256 simply outputs L h). Observe that we implicitly captured the extra compression unction call in the adjusted padding. cipher is assumed to be ideal [28]. Using Thm. 1, this indierentiability bound additionally ) renders an improved upper bound O q 2 n + q2 on the second preimage resistance. 2 l m Note that this bound is optimal or the n = 256 variant. We remark that a distinguisher or the block cipher o Shabal is derived in [10, 11, 58, 71, 80]. Bounds on DTP or Shabal. No inormative bounds on DTP are known or Shabal The SAvite-3 hash unction [22] is a AIFA construction. The message blocks are accompanied with a AIFA-counter, and more generally, the unction employs a suix- and preix-ree padding rule. The compression unction is block cipher based. Reductionist security o SAvite-3. The compression unction o SAvite-3 is the PGV5 compression unction, and the security results o [25] carry over. As a consequence, we obtain optimal security bounds on the compression unction. The mode o operation o SAvite-3 is based on the AIFA structure, and as a consequence all security properties regarding this type hold [21]. In particular, the design preserves collision resistance, and as a consequence we obtain Adv col =. Also, the design is secure against second preimage attacks. Additionally, a preimage or SAvite-3 implies a preimage or its last compression unction, and we obtain Adv pre = Θq/2n ). Finally, the SAvite-3 hash unction is indierentiable rom a random oracle i the underlying block cipher is assumed to be ideal, due to the preix-ree padding [32]. This result has been improved under the assumption that the underlying compression unction is ideal [19]. owever, the compression unction o SAvite-3 is easily dierentiable rom a random oracle due to the presence o ixed-points. Bounds on DTP or SAvite-3. The underlying cipher or SAvite and SAvite is E 256 which operates on two block halves o 128 bit each using the balanced Feistel construction. Every two or three rounds o balanced Feistel add at least one or two active unctions, respectively. The dierential probability o one unction 3 AES rounds) in E 256 is shown to be upper bounded by 2 49 [22]. This leads to at least 8 unctions active within 12 rounds and a dierential trail probability o at most ater 12 rounds o E 256. While the lower bounds o [22] on the number o dierentially active unctions appear to be tight or E 256, this is not the case or E 512, the block cipher underlying SAvite and SAvite which is based on a 4-line type-ii generalized Feistel network structure. One can prove that 2, 3, 4, 5 and 6 rounds o E 512 yield at least 1, 2, 3, 4 and 6 dierentially active unctions, respectively. This result combined with the proven upper bound o on the dierential probability o one unction 4 AES rounds) [22] gives the upper bound o on the dierential trail probability