Attacks on hash functions. Birthday attacks and Multicollisions

Size: px
Start display at page:

Download "Attacks on hash functions. Birthday attacks and Multicollisions"

Transcription

1 Attacks on hash functions Birthday attacks and Multicollisions

2 Birthday Attack Basics In a group of 23 people, the probability that there are at least two persons on the same day in the same month is greater than ½. Proof: The probability that none of the 23 people has the same birthday is: Thus, > 1/2.

3 Strong Collision Resistance Complexity Upper Bound Complexity upper bound of breaking strong collision resistance Let H be a cryptographic hash function with output length N. Then H will only have at most 2 N different outputs. Q: Is 2 N the complexity upper bound of breaking strong collision resistance? A: No. We can use birthday attack to reduce the complexity to 2 N/2 with a success rate of over 50%. Birthday attack for collisions for hash functions: From a basket of n balls of different colors, pick k (k<n) balls uniformly and independently at random and record their colors. The probability that least one ball that is picked more than once is The probability at least ½ if. Complexity upper bound of SHA-1: For the probability is at least ½ that there is a collision. In the case of SHA-1 k is approximately 2 160/2 = 2 80

4 Yuval s birthday attack Let H be n-bit hash function. Input: Legitimate message m 1 and forgery message m 2. Output: m 1, m 2 resulting from minor modifications of m 1 and m 2 with H(m 1 )=H(m 2 ). 1. Generate t = 2 n/2 minor modifications m 1 of m 1 2. Hash each such message and store the hash values. 3. Generate minor modifications m 2 of m 2, computing H(m 2 ) for each and checking for matches with any m 1 from the previous step; continue until match is found. A match can be expected after about t candidates of m 2

5 Multicollisions Basic facts about hash functions An iterated hash function H is built by iterating a basic compression function f. Figure 1. Compression function f in SHA-1

6 Basic facts about hash functions The hashing process works as follows: Pad the original message M and split it into blocks m 1,..., m t. Set H 0 to the initial value IV. For i from 1 to t, let H i = f(h i 1, m i ). Output H(M) = H t. Note: The initial value H 0 in SHA-1 is A B C D E.

7 Multicollisions A k-collision is a r-tuple of messages M (1),, M (k) such that H(M (1) ) = = H(M (k) ). Finding an k-collision could be done by hashing about 2 n (k 1)/k messages.

8 Constructing Multicollisions Assume that the size of the message blocks m i is bigger than the size of the hash values. Suppose that the output of the function H, has n bits. Use a birthday attack to find blocks m 0 and m 0 such that f(iv, m 0 )= f(iv, m 0 ). In approximately 2 n/2 steps one can find such m 0 and m 0.

9 Let h 1 = f(iv, m 0 ). Constructing Multicollisions (cont.) Use second birthday attack to find m 1 and m 1 with f(h 1, m 1 ) = f(h 1, m 1 ). In approximately another 2 n/2 steps one can find such m 1 and m 1. Let h i = f(h i-1,m i-1 ). Use a birthday attack to find m i and m i with f(h i, m i ) = f(h i, m i ). In approximately another 2 n/2 steps one can find such m i and m i. This process is continued until we have blocks m 0,m 0,m 1,m 1,...,m t 1,m t 1 where t is some integer.

10 Constructing Multicollisions (cont.) Construct the following messages: There are 2 t such messages. m 0 m 1 m t-1 m 0 m 1 m t-1 m 0 m 1 m t-1 m 0 m 1 m t-1.. m 0 m 1 m t-1 m 0 m 1 m t-1 m 0 m 1 m t-1

11 Multicollisions (cont.) Each of the 2 t messages has the same hash value. Proof: At each calculation h i = f(h i-1,m i-1 ) the same value h i is obtained whether m = m i 1 or m = m i 1. Therefore, the output of the function f during each step of the hash algorithm is independent of whether an m i 1 or an m i 1 is used. Therefore, the final output of the hash algorithm is the same for all messages. Therefore, we have have 2 t -collision. Note: After t2 n/2 steps there is a 2 t - collision.

12 Concatenation and Multicollisions Suppose we have two hash functions H 1 and H 2. Concatenate H(M) = H 1 (M) H 2 (M) Question: Is H(M) stronger hash function than either H 1 or H 2 individually? Answer: No.

13 Concatenation and Multicollisions Suppose the output of H i has n i bits. Assume that H 1 is calculated by an iterative algorithm. In n 2 n 1 2 n 1 /2 steps, we can find 2 n 2 /2 messages that all have the same hash value for H 1. Compute the value of H 2 for each of these 2 n 2 /2 messages. By the birthday attack there will be a match among these values of H 2. They all have the same H 1 value, so there will be collision for H 1 H 2.

Hash Functions. A hash function h takes as input a message of arbitrary length and produces as output a message digest of fixed length.

Hash Functions. A hash function h takes as input a message of arbitrary length and produces as output a message digest of fixed length. Hash Functions 1 Hash Functions A hash function h takes as input a message of arbitrary length and produces as output a message digest of fixed length. 0 1 1 0 1 0 0 1 Long Message Hash Function 1 1 1

More information

CPSC 467: Cryptography and Computer Security

CPSC 467: Cryptography and Computer Security CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 16 October 30, 2017 CPSC 467, Lecture 16 1/52 Properties of Hash Functions Hash functions do not always look random Relations among

More information

CPSC 467: Cryptography and Computer Security

CPSC 467: Cryptography and Computer Security CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 15 October 20, 2014 CPSC 467, Lecture 15 1/37 Common Hash Functions SHA-2 MD5 Birthday Attack on Hash Functions Constructing New

More information

New Attacks on the Concatenation and XOR Hash Combiners

New Attacks on the Concatenation and XOR Hash Combiners New Attacks on the Concatenation and XOR Hash Combiners Itai Dinur Department of Computer Science, Ben-Gurion University, Israel Abstract. We study the security of the concatenation combiner H 1(M) H 2(M)

More information

Cryptographic Hash Functions

Cryptographic Hash Functions Cryptographic Hash Functions Çetin Kaya Koç koc@ece.orst.edu Electrical & Computer Engineering Oregon State University Corvallis, Oregon 97331 Technical Report December 9, 2002 Version 1.5 1 1 Introduction

More information

Introduction Description of MD5. Message Modification Generate Messages Summary

Introduction Description of MD5. Message Modification Generate Messages Summary How to Break MD5 and other hash functions Xiaoyun Wang and Hongbo Yu (China) Presented by: Saar Benodiz May 2012 Outline Introduction Description of MD5 Differential Attack for Hash Functions Message Modification

More information

Lecture 14: Cryptographic Hash Functions

Lecture 14: Cryptographic Hash Functions CSE 599b: Cryptography (Winter 2006) Lecture 14: Cryptographic Hash Functions 17 February 2006 Lecturer: Paul Beame Scribe: Paul Beame 1 Hash Function Properties A hash function family H = {H K } K K is

More information

CPSC 467: Cryptography and Computer Security

CPSC 467: Cryptography and Computer Security CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 14 October 16, 2013 CPSC 467, Lecture 14 1/45 Message Digest / Cryptographic Hash Functions Hash Function Constructions Extending

More information

Problem 1. k zero bits. n bits. Block Cipher. Block Cipher. Block Cipher. Block Cipher. removed

Problem 1. k zero bits. n bits. Block Cipher. Block Cipher. Block Cipher. Block Cipher. removed Problem 1 n bits k zero bits IV Block Block Block Block removed January 27, 2011 Practical Aspects of Modern Cryptography 2 Problem 1 IV Inverse Inverse Inverse Inverse Missing bits January 27, 2011 Practical

More information

Avoiding collisions Cryptographic hash functions. Table of contents

Avoiding collisions Cryptographic hash functions. Table of contents Avoiding collisions Cryptographic hash functions Foundations of Cryptography Computer Science Department Wellesley College Fall 2016 Table of contents Introduction Davies-Meyer Hashes in Practice Hash

More information

SIGNATURE SCHEMES & CRYPTOGRAPHIC HASH FUNCTIONS. CIS 400/628 Spring 2005 Introduction to Cryptography

SIGNATURE SCHEMES & CRYPTOGRAPHIC HASH FUNCTIONS. CIS 400/628 Spring 2005 Introduction to Cryptography SIGNATURE SCHEMES & CRYPTOGRAPHIC HASH FUNCTIONS CIS 400/628 Spring 2005 Introduction to Cryptography This is based on Chapter 8 of Trappe and Washington DIGITAL SIGNATURES message sig 1. How do we bind

More information

Notes for Lecture 9. 1 Combining Encryption and Authentication

Notes for Lecture 9. 1 Combining Encryption and Authentication U.C. Berkeley CS276: Cryptography Handout N9 Luca Trevisan February 17, 2009 Notes for Lecture 9 Notes scribed by Joel Weinberger, posted March 1, 2009 Summary Last time, we showed that combining a CPA-secure

More information

ENEE 459-C Computer Security. Message authentication (continue from previous lecture)

ENEE 459-C Computer Security. Message authentication (continue from previous lecture) ENEE 459-C Computer Security Message authentication (continue from previous lecture) Last lecture Hash function Cryptographic hash function Message authentication with hash function (attack?) with cryptographic

More information

Avoiding collisions Cryptographic hash functions. Table of contents

Avoiding collisions Cryptographic hash functions. Table of contents Avoiding collisions Cryptographic hash functions Foundations of Cryptography Computer Science Department Wellesley College Fall 2016 Table of contents Introduction Collision resistance Birthday attacks

More information

The Hash Function JH 1

The Hash Function JH 1 The Hash Function JH 1 16 January, 2011 Hongjun Wu 2,3 wuhongjun@gmail.com 1 The design of JH is tweaked in this report. The round number of JH is changed from 35.5 to 42. This new version may be referred

More information

Hashes and Message Digests Alex X. Liu & Haipeng Dai

Hashes and Message Digests Alex X. Liu & Haipeng Dai Hashes and Message Digests Alex X. Liu & Haipeng Dai haipengdai@nju.edu.cn 313 CS Building Department of Computer Science and Technology Nanjing University Integrity vs. Secrecy Integrity: attacker cannot

More information

Leftovers from Lecture 3

Leftovers from Lecture 3 Leftovers from Lecture 3 Implementing GF(2^k) Multiplication: Polynomial multiplication, and then remainder modulo the defining polynomial f(x): (1,1,0,1,1) *(0,1,0,1,1) = (1,1,0,0,1) For small size finite

More information

MESSAGE AUTHENTICATION CODES and PRF DOMAIN EXTENSION. Mihir Bellare UCSD 1

MESSAGE AUTHENTICATION CODES and PRF DOMAIN EXTENSION. Mihir Bellare UCSD 1 MESSAGE AUTHENTICATION CODES and PRF DOMAIN EXTENSION Mihir Bellare UCSD 1 Integrity and authenticity The goal is to ensure that M really originates with Alice and not someone else M has not been modified

More information

Functional Graph Revisited: Updates on (Second) Preimage Attacks on Hash Combiners

Functional Graph Revisited: Updates on (Second) Preimage Attacks on Hash Combiners Functional Graph Revisited: Updates on (Second) Preimage Attacks on Hash Combiners Zhenzhen Bao 1,2, Lei Wang 1,3, Jian Guo 2, and Dawu Gu 1 1 Shanghai Jiao Tong University, Shanghai, China 2 Nanyang Technological

More information

3C - A Provably Secure Pseudorandom Function and Message Authentication Code. A New mode of operation for Cryptographic Hash Function

3C - A Provably Secure Pseudorandom Function and Message Authentication Code. A New mode of operation for Cryptographic Hash Function 3C - A Provably Secure Pseudorandom Function and Message Authentication Code. A New mode of operation for Cryptographic Hash Function Praveen Gauravaram 1, William Millan 1, Juanma Gonzalez Neito 1, Edward

More information

Cryptography and Security Final Exam

Cryptography and Security Final Exam Cryptography and Security Final Exam Serge Vaudenay 29.1.2018 duration: 3h no documents allowed, except one 2-sided sheet of handwritten notes a pocket calculator is allowed communication devices are not

More information

General Distinguishing Attacks on NMAC and HMAC with Birthday Attack Complexity

General Distinguishing Attacks on NMAC and HMAC with Birthday Attack Complexity General Distinguishing Attacks on MAC and HMAC with Birthday Attack Complexity Donghoon Chang 1 and Mridul andi 2 1 Center or Inormation Security Technologies(CIST), Korea University, Korea dhchang@cist.korea.ac.kr

More information

Authentication. Chapter Message Authentication

Authentication. Chapter Message Authentication Chapter 5 Authentication 5.1 Message Authentication Suppose Bob receives a message addressed from Alice. How does Bob ensure that the message received is the same as the message sent by Alice? For example,

More information

H Definition - hash function. Cryptographic Hash Functions - Introduction. Cryptographic hash functions. Lars R. Knudsen.

H Definition - hash function. Cryptographic Hash Functions - Introduction. Cryptographic hash functions. Lars R. Knudsen. Definition - hash function Cryptographic Hash Functions - Introduction Lars R. Knudsen April 21, 2008 Located in the southernmost part of Europe with an artic climate, Hotel Finse 1222 provides the perfect

More information

Foundations of Network and Computer Security

Foundations of Network and Computer Security Foundations of Network and Computer Security John Black Lecture #5 Sep 7 th 2004 CSCI 6268/TLEN 5831, Fall 2004 Announcements Please sign up for class mailing list by end of today Quiz #1 will be on Thursday,

More information

Preimage and Pseudo-Collision Attacks on Step-Reduced SM3 Hash Function

Preimage and Pseudo-Collision Attacks on Step-Reduced SM3 Hash Function Preimage and Pseudo-Collision Attacks on Step-Reduced SM3 Hash Function Gaoli Wang 1 and Yanzhao Shen 1 1 School of Computer Science and Technology, Donghua University, Shanghai 201620, China wanggaoli@dhu.edu.cn,

More information

Cryptography and Security Final Exam

Cryptography and Security Final Exam Cryptography and Security Final Exam Solution Serge Vaudenay 29.1.2018 duration: 3h no documents allowed, except one 2-sided sheet of handwritten notes a pocket calculator is allowed communication devices

More information

Introduction to Information Security

Introduction to Information Security Introduction to Information Security Lecture 4: Hash Functions and MAC 2007. 6. Prof. Byoungcheon Lee sultan (at) joongbu. ac. kr Information and Communications University Contents 1. Introduction - Hash

More information

Beyond the MD5 Collisions

Beyond the MD5 Collisions Beyond the MD5 Collisions Daniel Joščák Daniel.Joscak@i.cz S.ICZ a.s. Hvězdova 1689/2a, 140 00 Prague 4; Faculty of Mathematics and Physics, Charles University, Prague Abstract We summarize results and

More information

On High-Rate Cryptographic Compression Functions

On High-Rate Cryptographic Compression Functions On High-Rate Cryptographic Compression Functions Richard Ostertág and Martin Stanek Department o Computer Science Faculty o Mathematics, Physics and Inormatics Comenius University Mlynská dolina, 842 48

More information

Introduction to Cryptography

Introduction to Cryptography B504 / I538: Introduction to Cryptography Spring 2017 Lecture 12 Recall: MAC existential forgery game 1 n Challenger (C) k Gen(1 n ) Forger (A) 1 n m 1 m 1 M {m} t 1 MAC k (m 1 ) t 1 m 2 m 2 M {m} t 2

More information

Further progress in hashing cryptanalysis

Further progress in hashing cryptanalysis Further progress in hashing cryptanalysis Arjen K. Lenstra Lucent Technologies, Bell Laboratories February 26, 2005 Abstract Until further notice all new designs should use SHA-256. Existing systems using

More information

2: Iterated Cryptographic Hash Functions

2: Iterated Cryptographic Hash Functions 2: Iterated ryptographic Hash Functions we want hash function H : ({0, 1} n ) {0, 1} n of potentially infinite input size instead we have compression function F : {0, 1} m {0, 1} n {0, 1} n and define

More information

Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5

Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5 Full Attacks on HMAC/NMAC- and NMAC-MD5 Pierre-Alain Fouque, Gaëtan Leurent, Phong Nguyen Laboratoire d Informatique de l École Normale Supérieure CRYPTO 2007 1/26 WhatisaMACalgorithm? M Alice wants to

More information

Foundations of Network and Computer Security

Foundations of Network and Computer Security Foundations of Network and Computer Security John Black Lecture #6 Sep 8 th 2005 CSCI 6268/TLEN 5831, Fall 2005 Announcements Quiz #1 later today Still some have not signed up for class mailing list Perhaps

More information

Provable Seconde Preimage Resistance Revisited

Provable Seconde Preimage Resistance Revisited Provable Seconde Preimage Resistance Revisited Charles Bouillaguet 1 Bastien Vayssiere 2 1 LIFL University o Lille, France 2 PRISM University o Versailles, France SAC 2013 1 / 29 Cryptographic Hash Functions

More information

Cryptanalysis of Tweaked Versions of SMASH and Reparation

Cryptanalysis of Tweaked Versions of SMASH and Reparation Cryptanalysis of Tweaked Versions of SMASH and Reparation Pierre-Alain Fouque, Jacques Stern, and Sébastien Zimmer CNRS-École normale supérieure-inria Paris, France {Pierre-Alain.Fouque,Jacques.Stern,Sebastien.Zimmer}@ens.fr

More information

ENEE 457: Computer Systems Security 09/19/16. Lecture 6 Message Authentication Codes and Hash Functions

ENEE 457: Computer Systems Security 09/19/16. Lecture 6 Message Authentication Codes and Hash Functions ENEE 457: Computer Systems Security 09/19/16 Lecture 6 Message Authentication Codes and Hash Functions Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,

More information

Cryptographic Hashes. Yan Huang. Credits: David Evans, CS588

Cryptographic Hashes. Yan Huang. Credits: David Evans, CS588 Cryptographic Hashes Yan Huang Credits: David Evans, CS588 Recap: CPA 1. k KeyGen(1 n ). b {0,1}. Give Enc(k, ) to A. 2. A chooses as many plaintexts as he wants, and receives the corresponding ciphertexts

More information

Distinguishing Attacks on MAC/HMAC Based on A New Dedicated Compression Function Framework

Distinguishing Attacks on MAC/HMAC Based on A New Dedicated Compression Function Framework Distinguishing Attacks on MAC/HMAC Based on A New Dedicated Compression Function Framework Zheng Yuan 1,2,3, Haixia Liu 1, Xiaoqiu Ren 1 1 Beijing Electronic Science and Technology Institute, Beijing 100070,China

More information

b = 10 a, is the logarithm of b to the base 10. Changing the base to e we obtain natural logarithms, so a = ln b means that b = e a.

b = 10 a, is the logarithm of b to the base 10. Changing the base to e we obtain natural logarithms, so a = ln b means that b = e a. INTRODUCTION TO CRYPTOGRAPHY 5. Discrete Logarithms Recall the classical logarithm for real numbers: If we write b = 10 a, then a = log 10 b is the logarithm of b to the base 10. Changing the base to e

More information

An introduction to Hash functions

An introduction to Hash functions An introduction to Hash functions Anna Rimoldi eriscs - Universitée de la Méditerranée, Marseille Secondo Workshop di Crittografia BunnyTN 2011 A. Rimoldi (eriscs) Hash function 12 September 2011 1 / 27

More information

Linearization and Message Modification Techniques for Hash Function Cryptanalysis

Linearization and Message Modification Techniques for Hash Function Cryptanalysis Linearization and Message Modification Techniques for Hash Function Cryptanalysis Jian Guo Institute for Infocomm Research, Singapore. ASK 2011, 30 August 2011 Jian Guo Linearization and Message Modification

More information

Hash Functions. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 34

Hash Functions. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 34 Hash Functions Ali El Kaafarani Mathematical Institute Oxford University 1 of 34 Outline 1 Definition and Notions of Security 2 The Merkle-damgård Transform 3 MAC using Hash Functions 4 Cryptanalysis:

More information

Lecture 10 - MAC s continued, hash & MAC

Lecture 10 - MAC s continued, hash & MAC Lecture 10 - MAC s continued, hash & MAC Boaz Barak March 3, 2010 Reading: Boneh-Shoup chapters 7,8 The field GF(2 n ). A field F is a set with a multiplication ( ) and addition operations that satisfy

More information

CIS 6930/4930 Computer and Network Security. Topic 4. Cryptographic Hash Functions

CIS 6930/4930 Computer and Network Security. Topic 4. Cryptographic Hash Functions CIS 6930/4930 Computer and Network Security Topic 4. Cryptographic Hash Functions 1 The SHA-1 Hash Function 2 Secure Hash Algorithm (SHA) Developed by NIST, specified in the Secure Hash Standard, 1993

More information

From Fixed-Length Messages to Arbitrary-Length Messages Practical RSA Signature Padding Schemes

From Fixed-Length Messages to Arbitrary-Length Messages Practical RSA Signature Padding Schemes From Fixed-Length Messages to Arbitrary-Length Messages Practical RSA Signature Padding Schemes [Published in D. Naccache, Ed., Topics in Cryptology CT-RSA 2001, vol. 2020 of Lecture Notes in Computer

More information

Provable Chosen-Target-Forced-Midx Preimage Resistance

Provable Chosen-Target-Forced-Midx Preimage Resistance Provable Chosen-Target-Forced-Midx Preimage Resistance Elena Andreeva and Bart Mennink (K.U.Leuven) Selected Areas in Cryptography Toronto, Canada August 11, 2011 1 / 15 Introduction Hash Functions 2 /

More information

Cryptographic Hash Functions Part II

Cryptographic Hash Functions Part II Cryptographic Hash Functions Part II Cryptography 1 Andreas Hülsing, TU/e Some slides by Sebastiaan de Hoogh, TU/e Hash function design Create fixed input size building block Use building block to build

More information

Practical Free-Start Collision Attacks on 76-step SHA-1

Practical Free-Start Collision Attacks on 76-step SHA-1 Practical Free-Start Collision Attacks on 76-step SHA-1 Inria and École polytechnique, France Nanyang Technological University, Singapore Joint work with Thomas Peyrin and Marc Stevens CWI, Amsterdam 2015

More information

Digital Signature Schemes and the Random Oracle Model. A. Hülsing

Digital Signature Schemes and the Random Oracle Model. A. Hülsing Digital Signature Schemes and the Random Oracle Model A. Hülsing Today s goal Review provable security of in use signature schemes. (PKCS #1 v2.x) PAGE 1 Digital Signature Source: http://hari-cio-8a.blog.ugm.ac.id/files/2013/03/dsa.jpg

More information

The Near-miss Birthday Problem. Gregory Quenell Plattsburgh State

The Near-miss Birthday Problem. Gregory Quenell Plattsburgh State The Near-miss Birthday Problem Gregory Quenell Plattsburgh State 1 The Classic Birthday Problem Assuming birthdays are uniformly distributed over 365 days, find P (at least one shared birthday) in a random

More information

Practical Free-Start Collision Attacks on full SHA-1

Practical Free-Start Collision Attacks on full SHA-1 Practical Free-Start Collision Attacks on full SHA-1 Inria and École polytechnique, France Nanyang Technological University, Singapore Joint work with Thomas Peyrin and Marc Stevens Séminaire Cryptologie

More information

Cryptanalysis of a Message Authentication Code due to Cary and Venkatesan

Cryptanalysis of a Message Authentication Code due to Cary and Venkatesan Cryptanalysis of a Message Authentication Code due to Cary and Venkatesan Simon R. Blackburn and Kenneth G. Paterson Department of Mathematics Royal Holloway, University of London Egham, Surrey, TW20 0EX,

More information

1 Cryptographic hash functions

1 Cryptographic hash functions CSCI 5440: Cryptography Lecture 6 The Chinese University of Hong Kong 23 February 2011 1 Cryptographic hash functions Last time we saw a construction of message authentication codes (MACs) for fixed-length

More information

Lecture 24: MAC for Arbitrary Length Messages. MAC Long Messages

Lecture 24: MAC for Arbitrary Length Messages. MAC Long Messages Lecture 24: MAC for Arbitrary Length Messages Recall Previous lecture, we constructed MACs for fixed length messages The GGM Pseudo-random Function (PRF) Construction Given. Pseudo-random Generator (PRG)

More information

New Proofs for NMAC and HMAC: Security without Collision-Resistance

New Proofs for NMAC and HMAC: Security without Collision-Resistance A preliminary version of this paper appears in Advances in Cryptology CRYPTO 06, Lecture Notes in Computer Science Vol. 4117, C. Dwork ed., Springer-Verlag, 2006. This is the full version. New Proofs for

More information

1 Cryptographic hash functions

1 Cryptographic hash functions CSCI 5440: Cryptography Lecture 6 The Chinese University of Hong Kong 24 October 2012 1 Cryptographic hash functions Last time we saw a construction of message authentication codes (MACs) for fixed-length

More information

Weaknesses in the HAS-V Compression Function

Weaknesses in the HAS-V Compression Function Weaknesses in the HAS-V Compression Function Florian Mendel and Vincent Rijmen Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Inffeldgasse 16a, A-8010

More information

Introduction to Cybersecurity Cryptography (Part 4)

Introduction to Cybersecurity Cryptography (Part 4) Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message

More information

Title. Birthday Problem. Yukang Shen. University of California, Santa Barbara. May 7, 2014

Title. Birthday Problem. Yukang Shen. University of California, Santa Barbara. May 7, 2014 Title Birthday Problem Yukang Shen University of California, Santa Barbara May 7, 2014 Question Start with a question In a room of n people, How many people do we need to make sure that at least two of

More information

Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC

Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC Xiaoyun Wang 1,2, Hongbo Yu 1, Wei Wang 2, Haina Zhang 2, and Tao Zhan 3 1 Center for Advanced Study, Tsinghua University, Beijing 100084, China {xiaoyunwang,

More information

New attacks on Keccak-224 and Keccak-256

New attacks on Keccak-224 and Keccak-256 New attacks on Keccak-224 and Keccak-256 Itai Dinur 1, Orr Dunkelman 1,2 and Adi Shamir 1 1 Computer Science department, The Weizmann Institute, Rehovot, Israel 2 Computer Science Department, University

More information

AURORA: A Cryptographic Hash Algorithm Family

AURORA: A Cryptographic Hash Algorithm Family AURORA: A Cryptographic Hash Algorithm Family Submitters: Sony Corporation 1 and Nagoya University 2 Algorithm Designers: Tetsu Iwata 2, Kyoji Shibutani 1, Taizo Shirai 1, Shiho Moriai 1, Toru Akishita

More information

Week 12: Hash Functions and MAC

Week 12: Hash Functions and MAC Week 12: Hash Functions and MAC 1. Introduction Hash Functions vs. MAC 2 Hash Functions Any Message M Hash Function Generate a fixed length Fingerprint for an arbitrary length message. No Key involved.

More information

Cryptanalysis of EnRUPT

Cryptanalysis of EnRUPT Cryptanalysis of EnRUPT Dmitry Khovratovich and Ivica Nikolić University of Luxembourg Abstract. In this paper we present a preimage attack on EnRUPT- 512. We exploit the fact that the internal state is

More information

Introduction to Cybersecurity Cryptography (Part 4)

Introduction to Cybersecurity Cryptography (Part 4) Introduction to Cybersecurity Cryptography (Part 4) Review of Last Lecture Blockciphers Review of DES Attacks on Blockciphers Advanced Encryption Standard (AES) Modes of Operation MACs and Hashes Message

More information

Intro to Public Key Cryptography Diffie & Hellman Key Exchange

Intro to Public Key Cryptography Diffie & Hellman Key Exchange Introduction to Modern Cryptography Lecture 5 Number Theory: 1. Quadratic residues. 2. The discrete log problem. Intro to Public Key Cryptography Diffie & Hellman Key Exchange Course Summary - Math Part

More information

Processing with Block Ciphers. CSC/ECE 574 Computer and Network Security. Issues (Cont d) Issues for Block Chaining Modes. Electronic Code Book (ECB)

Processing with Block Ciphers. CSC/ECE 574 Computer and Network Security. Issues (Cont d) Issues for Block Chaining Modes. Electronic Code Book (ECB) rocessing with Block iphers S/ 574 omputer and Network Security Topic 3.2 Secret ryptography Modes of Operation Most ciphers work on blocks of fixed (small) size How to encrypt long messages? Modes of

More information

Introduction to Cryptography Lecture 4

Introduction to Cryptography Lecture 4 Data Integrity, Message Authentication Introduction to Cryptography Lecture 4 Message authentication Hash functions Benny Pinas Ris: an active adversary might change messages exchanged between and M M

More information

A (Second) Preimage Attack on the GOST Hash Function

A (Second) Preimage Attack on the GOST Hash Function A (Second) Preimage Attack on the GOST Hash Function Florian Mendel, Norbert Pramstaller, and Christian Rechberger Institute for Applied Information Processing and Communications (IAIK), Graz University

More information

Public-key Cryptography: Theory and Practice

Public-key Cryptography: Theory and Practice Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Appendix A: Symmetric Techniques Block Ciphers A block cipher f of block-size

More information

Lecture 11: Hash Functions, Merkle-Damgaard, Random Oracle

Lecture 11: Hash Functions, Merkle-Damgaard, Random Oracle CS 7880 Graduate Cryptography October 20, 2015 Lecture 11: Hash Functions, Merkle-Damgaard, Random Oracle Lecturer: Daniel Wichs Scribe: Tanay Mehta 1 Topics Covered Review Collision-Resistant Hash Functions

More information

A Composition Theorem for Universal One-Way Hash Functions

A Composition Theorem for Universal One-Way Hash Functions A Composition Theorem for Universal One-Way Hash Functions Victor Shoup IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland sho@zurich.ibm.com Abstract. In this paper we present a new scheme

More information

Katz, Lindell Introduction to Modern Cryptrography

Katz, Lindell Introduction to Modern Cryptrography Katz, Lindell Introduction to Modern Cryptrography Slides Chapter 12 Markus Bläser, Saarland University Digital signature schemes Goal: integrity of messages Signer signs a message using a private key

More information

Understanding Cryptography A Textbook for Students and Practitioners by Christof Paar and Jan Pelzl. Chapter 11 Hash Functions ver.

Understanding Cryptography A Textbook for Students and Practitioners by Christof Paar and Jan Pelzl. Chapter 11 Hash Functions ver. Understanding Cryptography A Textbook for Students and Practitioners by Christof Paar and Jan Pelzl www.crypto-textbook.com Chapter 11 Hash Functions ver. October 29, 2009 These slides were prepared by

More information

5199/IOC5063 Theory of Cryptology, 2014 Fall

5199/IOC5063 Theory of Cryptology, 2014 Fall 5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.

More information

On the Big Gap Between p and q in DSA

On the Big Gap Between p and q in DSA On the Big Gap Between p and in DSA Zhengjun Cao Department of Mathematics, Shanghai University, Shanghai, China, 200444. caozhj@shu.edu.cn Abstract We introduce a message attack against DSA and show that

More information

Cryptographic Hashing

Cryptographic Hashing Innovation and Cryptoventures Cryptographic Hashing Campbell R. Harvey Duke University, NBER and Investment Strategy Advisor, Man Group, plc January 30, 2017 Campbell R. Harvey 2017 2 Overview Cryptographic

More information

Some Attacks on Merkle-Damgård Hashes

Some Attacks on Merkle-Damgård Hashes Overview Some Attacks on Merkle-Damgård Hashes John Kelsey, NIST and KU Leuven May 8, 2018 m 0 m 1 m 2 m 3 10*L h 0 h 1 h 2 h final Introduction 1 / 63 Overview Cryptographic Hash unctions Thinking About

More information

Preimage Attacks on Reduced Tiger and SHA-2

Preimage Attacks on Reduced Tiger and SHA-2 Preimage Attacks on Reduced Tiger and SHA-2 Takanori Isobe and Kyoji Shibutani Sony Corporation 1-7-1 Konan, Minato-ku, Tokyo 108-0075, Japan {Takanori.Isobe,Kyoji.Shibutani}@jp.sony.com Abstract. This

More information

SMASH - A Cryptographic Hash Function

SMASH - A Cryptographic Hash Function SMASH - A Cryptographic Hash Function Lars R. Knudsen Department of Mathematics, Technical University of Denmark Abstract. 1 This paper presents a new hash function design, which is different from the

More information

Security without Collision-Resistance

Security without Collision-Resistance A preliminary version of this paper appears in Advances in Cryptology CRYPTO 06, Lecture Notes in Computer Science Vol. 4117, C. Dwork ed., Springer-Verlag, 2006. This is the full version. New Proofs for

More information

Breaking H 2 -MAC Using Birthday Paradox

Breaking H 2 -MAC Using Birthday Paradox Breaking H 2 -MAC Using Birthday Paradox Fanbao Liu 1,2, Tao Xie 1 and Changxiang Shen 2 1 School of Computer, National University of Defense Technology, Changsha, 410073, Hunan, P. R. China 2 School of

More information

Multicollision Attacks on a Class of Hash Functions

Multicollision Attacks on a Class of Hash Functions Multicollision Attacks on a Class of Hash Functions M. Nandi Applied Statistics Unit Indian Statistical Institute Calcutta, India mridul r@isical.ac.in D. R. Stinson School of Computer Science University

More information

Cryptographic Hash Function. Norwegian University of Science and Technology. Trondheim, Norway

Cryptographic Hash Function. Norwegian University of Science and Technology. Trondheim, Norway Cryptographic Hash Function BLUE MIDNIGHT WISH Norwegian University of Science and Technology Trondheim, Norway Danilo Gligoroski Vlastimil Klima Svein Johan Knapskog Mohamed El-Hadedy Jørn Amundsen Stig

More information

Winter 2008 Introduction to Modern Cryptography Benny Chor and Rani Hod. Assignment #2

Winter 2008 Introduction to Modern Cryptography Benny Chor and Rani Hod. Assignment #2 0368.3049.01 Winter 2008 Introduction to Modern Cryptography Benny Chor and Rani Hod Assignment #2 Published Sunday, February 17, 2008 and very slightly revised Feb. 18. Due Tues., March 4, in Rani Hod

More information

Security Analysis of the Mode of JH Hash Function

Security Analysis of the Mode of JH Hash Function Security Analysis of the Mode of JH Hash Function Rishiraj Bhattacharyya, Avradip Mandal 2, and Mridul Nandi 3, Indian Statistical Institute, Kolkata, India rishi r@isical.ac.in 2 Université du Luxembourg,

More information

Cryptanalysis of MDC-2

Cryptanalysis of MDC-2 Cryptanalysis of MDC-2 Lars R. Knudsen 1, Florian Mendel 2, Christian Rechberger 2, and Søren S. Thomsen 1 1 Department of Mathematics, Technical University of Denmark Matematiktorvet 303S, DK-2800 Kgs.

More information

CHAPTER 6: OTHER CRYPTOSYSTEMS, PSEUDO-RANDOM NUMBER GENERATORS and HASH FUNCTIONS. Part VI

CHAPTER 6: OTHER CRYPTOSYSTEMS, PSEUDO-RANDOM NUMBER GENERATORS and HASH FUNCTIONS. Part VI CHAPTER 6: OTHER CRYPTOSYSTEMS, PSEUDO-RANDOM NUMER GENERATORS and HASH FUNCTIONS Part VI Public-key cryptosystems, II. Other cryptosystems, security, PRG, hash functions A large number of interesting

More information

Lattice Cryptography

Lattice Cryptography CSE 06A: Lattice Algorithms and Applications Winter 01 Instructor: Daniele Micciancio Lattice Cryptography UCSD CSE Many problems on point lattices are computationally hard. One of the most important hard

More information

Symmetric Ciphers. Mahalingam Ramkumar (Sections 3.2, 3.3, 3.7 and 6.5)

Symmetric Ciphers. Mahalingam Ramkumar (Sections 3.2, 3.3, 3.7 and 6.5) Symmetric Ciphers Mahalingam Ramkumar (Sections 3.2, 3.3, 3.7 and 6.5) Symmetric Cryptography C = E(P,K) P = D(C,K) Requirements Given C, the only way to obtain P should be with the knowledge of K Any

More information

Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family

Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family Somitra Kr. Sanadhya and Palash Sarkar Cryptology Research Group Applied Statistics Unit Indian Statistical Institute, Kolkata

More information

Hash Function Balance and its Impact on Birthday Attacks

Hash Function Balance and its Impact on Birthday Attacks Hash Function Balance and its Impact on Birthday Attacks Mihir Bellare 1 and Tadayoshi Kohno 1 Dept. of Computer Science & Engineering, University of California, San Diego 9500 Gilman Drive, La Jolla,

More information

Domain Extender for Collision Resistant Hash Functions: Improving Upon Merkle-Damgård Iteration

Domain Extender for Collision Resistant Hash Functions: Improving Upon Merkle-Damgård Iteration Domain Extender for Collision Resistant Hash Functions: Improving Upon Merkle-Damgård Iteration Palash Sarkar Cryptology Research Group Applied Statistics Unit Indian Statistical Institute 203, B.T. Road,

More information

From Fixed-Length to Arbitrary-Length RSA Encoding Schemes Revisited

From Fixed-Length to Arbitrary-Length RSA Encoding Schemes Revisited From Fixed-Length to Arbitrary-Length RSA Encoding Schemes Revisited Julien Cathalo 1, Jean-Sébastien Coron 2, and David Naccache 2,3 1 UCL Crypto Group Place du Levant 3, Louvain-la-Neuve, B-1348, Belgium

More information

A New Paradigm for Collision-free Hashing: Incrementality at Reduced Cost

A New Paradigm for Collision-free Hashing: Incrementality at Reduced Cost A New Paradigm for Collision-free Hashing: Incrementality at Reduced Cost Mihir Bellare University of California, San Diego Daniele Micciancio Laboratory for Computer Science Massachusetts Institute of

More information

Second Preimages for Iterated Hash Functions and their Implications on MACs

Second Preimages for Iterated Hash Functions and their Implications on MACs Second Preimages for Iterated Hash Functions and their Implications on MACs Mario Lamberger, Norbert Pramstaller, and Vincent Rijmen Institute for Applied Information Processing and Communications (IAIK)

More information

Introduction to Cryptography k. Lecture 5. Benny Pinkas k. Requirements. Data Integrity, Message Authentication

Introduction to Cryptography k. Lecture 5. Benny Pinkas k. Requirements. Data Integrity, Message Authentication Common Usage of MACs for message authentication Introduction to Cryptography k Alice α m, MAC k (m) Isα= MAC k (m)? Bob k Lecture 5 Benny Pinkas k Alice m, MAC k (m) m,α Got you! α MAC k (m )! Bob k Eve

More information

DTTF/NB479: Dszquphsbqiz Day 26

DTTF/NB479: Dszquphsbqiz Day 26 DTTF/NB479: Dszquphsbqiz Day 26 Announceents:. HW6 due now 2. HW7 posted 3. Will pick pres dates Friday Questions? This week: Discrete Logs, Diffie-Hellan, ElGaal Hash Functions, SHA, Birthday attacks

More information