Finding collisions for SHA-1
|
|
|
- Milton Stone
- 5 years ago
- Views:
Transcription
1 Finding collisions for SHA-1 Based on joint work with Ange Albertini, Elie Bursztein, Yarik Markov, Thomas Peyrin and Marc Stevens Université Grenoble Alpes Real World Crypto Zürich Finding collisions for SHA /38
2 The near-anniversary of not a birthday search On , the first (public?) SHA-1 collision was found... Coming after the first freestart collision in Oct Coming after the first theoretical attack in Coming after the first standardization of SHA-1 in 1995 Aim of this talk: What s a SHA-1 collision like? How do you compute one? How do you measure the complexity of such an attack? Finding collisions for SHA /38
3 Asimplecollision h 0 4e a c 87 6e d1 07 f0 fe c f5 bf 45 M 1 7f 46 dc 93 a6 b6 7e 01 3b 02 9a aa 1d b2 56 0b 45 ca 67 d6 88 c7 f8 4b 8c 4c 79 1f e0 2b 3d f6 14 f8 6d b c5 6b 45 c1 53 0a fe df b e f e7 ad 72 8f 0e e0 46 c2 h 1 8d 64 d6 17 ff ed eb c e c7 eb 34 f3 8a 5a 7b M f e9 d ab e1 2e f5 bc 94 2b e a4 80 2d 98 b5 d7 0f 2a 33 2e c3 7f ac e7 4d dc 0f 2c c1 a8 74 cd 0c a b d0 bf 3f 98 cd a a1 h 2 1e ac b2 5e d5 97 0d 10 f bc 3a 17 b4 8a c5 h 0 4e a c 87 6e d1 07 f0 fe c f5 bf 45 M dc b6 7e 11 8f 02 9a b6 21 b2 56 0f f9 ca 67 cc a8 c7 f8 5b a8 4c c 2b 3d e2 18 f8 6d b3 a d5 df 45 c1 4f 26 fe df b3 dc 38 e9 6a c2 2f e7 bd 72 8f 0e 45 bc e0 46 d2 h 1 8d 64 c8 21 ff ed 52 e2 eb c e c7 eb a 5a 7b M 2 2 3c 57 0f eb bb 55 2e f5 a0 a8 2b e3 31 fe a b8 b5 d7 1f 0e 33 2e df 93 ac eb 4d dc 0d ec c1 a c 78 2c dd d0 6b d0 af 3f 98 cd a4 bc b1 h 2 1e ac b2 5e d5 97 0d 10 f bc 3a 17 b4 8a c5 Finding collisions for SHA /38
4 Acomicapplication >sha1sum *.pdf 23aa25d9e0449e507a8b4c185fdc86c35bf609bc calvin.pdf 23aa25d9e0449e507a8b4c185fdc86c35bf609bc hobbes.pdf Finding collisions for SHA /38
5 SHA-1 collisions recap On the way to full practical attacks What complexity for an attack Conclusion & Future work Finding collisions for SHA /38
6 SHA-1 quick history Secure Hash Standard SHA-1 Standardized by NST in Apr Similar to MD4/5 Merkle-Damgård domain extender Compression function = ad hoc block cipher in Davies-Meyer mode Unbalanced Feistel network, 80 steps Quick fix of SHA-0 (May 1993) Hash size is 160 bits ) collision security should be 80 bits Finding collisions for SHA /38
7 That s nice, but we want to attack it! Finding collisions for SHA /38
8 Atwo-blockattackinapicture 0 M C M NL 1 NL 2 L -L C C C 0 Finding collisions for SHA /38
9 The result SHA-1 is not collision-resistant (Wang, Yin & Yu, 2005) Attack complexity 2 69 (theoretical) Eventually improved to 2 61 (ditto, Stevens, 2013) Finding collisions for SHA /38
10 The attack process 1 Pick a linear path 2 Find a non-linear path (first block) 3 Find accelerating techniques (first block) 4 Compute a near-collision (a solution for (0, M)! C )) Possible expected wall time estimation (first block) 5 Find a non-linear path (second block) 6 Find accelerating techniques (second block) 7 Compute a collision (a solution for ( C, M)! C )) Possible expected wall time estimation (full attack) Finding collisions for SHA /38
11 Wall time estimation Simple approach: mplement the attack Measure production rate #Axx /s Multiply by probability that a solution Axx extends to A 80 Early variant (crude): Partial solutions for the di erential path up to A16 are free For A17...??, count path conditions v. accelerating technique e ciency Estimate the critical step Axx & corresp. production rate Multiply by probability that a solution Axx extends to A 80 Finding collisions for SHA /38
12 SHA-1 collisions recap On the way to full practical attacks What complexity for an attack Conclusion & Future work Finding collisions for SHA /38
13 Best practical attack progress ( ) 2005 (Biham & al.): 40 steps (cost: within seconds ) 2005 (Wang & al.): 58 steps (cost: 2 33 SHA-1 computations) 2006 (De Cannière & Rechberger): 64 (cost: 2 35 ) 2007 (Rechberger & al.): 70 (cost: 2 44 ) 2007 (Joux & Peyrin): 70 (cost: 2 39 ) 2010 (Grechnikov): 73 (cost: ) 2011 (Grechnikov & Adinetz): 75 (cost: ) Finding collisions for SHA /38
14 2014: time to improve things again! ) Eventual objective: full practical collision?? Significant intermediate step: full practical freestart collision? Easier in principle, but is it the case? Search for a 76-step freestart collision (lowest # unattacked steps) Use the opportunity to develop a GPU framework Finding collisions for SHA /38
15 The point of freestart (in a picture) nternal state of SHA-1 (A i ) Wang-type attack Freestart i = 4 V 0 # o set Pr = Pr 1 Pr 1 Finding collisions for SHA /38
16 First results n Dec. 2014: a first 76-step freestart collision (with Peyrin & Stevens) Right on time for the ASACRYPT rump session :P Cost: 2 50 SHA-1 computations on a GTX-970 ) Freestart helps! ) About 4 days on a single GPU (what we did) ) About 1 day on a S$ GPU machine Finding collisions for SHA /38
17 Now what? Finding collisions for SHA /38
18 Objective: full compression function collision Early (optimistic?) estimates: full freestart 32 more expensive than 76-step (Hard to know for sure w/o implementing it) ) buy (a bit) more GPUs! + develop a new attack ( sadly necessary) Update path search tools Settle on a linear path Generate new attack parameters Program the attack again... Finding collisions for SHA /38
19 Let s do this! Figure: Part of a homemade cluster to be Finding collisions for SHA /38
20 Second results n Sep. 2015: a first 80-step (full) freestart collision (with Stevens &Peyrin) Right on time for EUROCRYPT submissions :P cost: SHA-1 computations on a GTX-970 Abitmorethanexpected ) About 680 days on a single GPU... or 10 days on a 64-GPU cluster (what we did)... or US$ 2000 of the cheapest Amazon EC2 instances Finding collisions for SHA /38
21 Some early impact SHA-1 TLS certificates are not extended through 2016 by CA/Browser forum actors Ballot 152 (Oct. 2015!) of the CA/Browser forum is withdrawn Some major browsers (Edge, Firefox) sped-up deprecation/security warnings But (some) continued use in Git, company-specific certificates (e.g. Facebook until Dec. 2016, Cloudflare), etc. Mostly because of legacy issues Finding collisions for SHA /38
22 Now what? Finding collisions for SHA /38
23 Objective: full hash function collision Early (optimistic?) estimates: full collision 50 more expensive than full freestart (Hard to know for sure w/o implementing it) ) buy a lot more GPUs? (No) ) get help from GPU-rich people/companies? (Yes) + develop a new attack + add some cool exploitation features! Finding collisions for SHA /38
24 Let s do this! A CW/Google collaboration 1 Prepare a prefix for future colliding PDFs 2 Compute a first (actually two) near-collision block(s) Done on CPU 3 Compute a second near-collision ) the final one!! Done on GPU 4 Profit! Enjoy! cost: 2 63 SHA-1 computations A bit more/less than expected ) about CPU-year GPU-year... or US$ 100K+ of the cheapest Amazon instances (second block only) Finding collisions for SHA /38
25 Some more impact Finally got Git planning to move away from SHA-1 Unwittingly broke SVN for a time Further deprecation of SHA-1 certificates Finding collisions for SHA /38
26 SHA-1 collisions recap On the way to full practical attacks What complexity for an attack Conclusion & Future work Finding collisions for SHA /38
27 Absolute cost v. complexity Determining the complexity of generic attacks is easy E.g. (2 n/2 ) for collisions on n-bit hash functions E ciently parallelizable (van Oorschot & Wiener, 1999) What about dedicated attacks? mplement and measure? A typical metric for cryptanalysis complexity: 1 Estimate the cost of an attack on some platform 2 Divide by the cost of computing the attacked function 3 Voilà Finding collisions for SHA /38
28 A 76complexityexample Example: 76-step freestart collision On a GTX-970: Expected time to collision = 4.4 days solution up to A56 /s SHA-1 compression function/s ) BUT on an Haswell Core i5: Expected time to collision = 606 core days solution up to A 56 /s SHA-1 compression function/s ) Yet much slower & less energy e cient!! Finding collisions for SHA /38
29 Afullhashexample Complexity for the full hash function (second block) collision: on K80, or on K20/40, or on GTX-970 Further code tuning/optimization may again change figures! Finding collisions for SHA /38
30 Some more issues Variation between CPU/GPU and optimized/unoptimized is not so large About 2 4 What about reconfigurable/dedicated hardware? FPGA/ASCs are fast and energy e cient ) Well-suited to generic attacks! But what about complex ones??? No reason for a generic attacker to use CPU/GPU over FPGA/ASC Potential increased development cost well worth it! What does a dedicated attack really improve on?? Finding collisions for SHA /38
31 GPU v. ASC brute force estimates One generic SHA-1 collision in one year 2 80 hash computations On GPU: 12.6 million 31.5 hashes/s 3.1 GW round the clock (just the 250 W each) A couple of dedicated nuclear powerplant needed On ASC (estimates courtesy of BTC mining hardware) hashes/s (Antminer S9-like) 4 MW round the clock (at 1400 W each) About a large wind turbine needed (with the wind) Finding collisions for SHA /38
32 An alternative cost measure: The fun calorie ntroduced by A. Lenstra, Kleinjung & Thomé (2013): How much energy is wasted needed by an attack? Energy unit: fun calorie What volume of standard water can you boil (instead)? Used to estimate e.g. RSA-768 security ) 2 olympic pool security (Kleinjung et al., 2010) Finding collisions for SHA /38
33 Some complexity figures SHA-0 collision (MP08) / teaspoon sec. ( L) SHA-1 76 fs. 4 shower sec. (320L) SHA-1 fs. 580 shower sec. ( L) SHA-1 2 nd block (ded, GPU) 1 pool sec. ( L) RSA-768 (K+10) 2 pool sec. ( L) SHA-1 1 st block (ded, CPU) 3 pool sec. ( L) DL-768 (K+17) 6 pool sec. ( L) SHA-0/1 (gen, ASC) rain sec. ( L) (gnoring CPU improvements between 2010 and today) :Estimate : dagelijkse neerslagverdampingenergiebehoeftezekerheid Finding collisions for SHA /38
34 n the end... Full-GPU dedicated SHA-1 attack: 1 pool sec. ) 100 better than dedicated hardware (conjectured) Quite less than Finding collisions for SHA /38
35 SHA-1 collisions recap On the way to full practical attacks What complexity for an attack Conclusion & Future work Finding collisions for SHA /38
36 Potential future work Computing a chosen-prefix collision More exploitation Computing a collision for the SHA-1 MD5 combiner Wouldn t break SVN? Designing a SHA-1-based crypto-currency Get shiny mining hardware! Finding collisions for SHA /38
37 For more details The papers: Eprints 2015/530, 2015/967, 2017/190 The attack code: sha1_gpu_nearcollisionattacks Marc s CRYPTO 17 Ange s BlackAlps 17 Finding collisions for SHA /38
38 C est fini! Finding collisions for SHA /38
Practical Free-Start Collision Attacks on full SHA-1
Practical Free-Start Collision Attacks on full SHA-1 Inria and École polytechnique, France Nanyang Technological University, Singapore Joint work with Thomas Peyrin and Marc Stevens Séminaire Cryptologie
Practical Free-Start Collision Attacks on 76-step SHA-1
Practical Free-Start Collision Attacks on 76-step SHA-1 Inria and École polytechnique, France Nanyang Technological University, Singapore Joint work with Thomas Peyrin and Marc Stevens CWI, Amsterdam 2015
Week 12: Hash Functions and MAC
Week 12: Hash Functions and MAC 1. Introduction Hash Functions vs. MAC 2 Hash Functions Any Message M Hash Function Generate a fixed length Fingerprint for an arbitrary length message. No Key involved.
Crypto Engineering (GBX9SY03) Hash functions
Crypto Engineering (GBX9SY03) Hash functions Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2017 10 18 Hash functions 2017 10 18 1/32 First
Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5
Full Attacks on HMAC/NMAC- and NMAC-MD5 Pierre-Alain Fouque, Gaëtan Leurent, Phong Nguyen Laboratoire d Informatique de l École Normale Supérieure CRYPTO 2007 1/26 WhatisaMACalgorithm? M Alice wants to
AURORA: A Cryptographic Hash Algorithm Family
AURORA: A Cryptographic Hash Algorithm Family Submitters: Sony Corporation 1 and Nagoya University 2 Algorithm Designers: Tetsu Iwata 2, Kyoji Shibutani 1, Taizo Shirai 1, Shiho Moriai 1, Toru Akishita
Beyond the MD5 Collisions
Beyond the MD5 Collisions Daniel Joščák Daniel.Joscak@i.cz S.ICZ a.s. Hvězdova 1689/2a, 140 00 Prague 4; Faculty of Mathematics and Physics, Charles University, Prague Abstract We summarize results and
Hash Functions. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 34
Hash Functions Ali El Kaafarani Mathematical Institute Oxford University 1 of 34 Outline 1 Definition and Notions of Security 2 The Merkle-damgård Transform 3 MAC using Hash Functions 4 Cryptanalysis:
Further progress in hashing cryptanalysis
Further progress in hashing cryptanalysis Arjen K. Lenstra Lucent Technologies, Bell Laboratories February 26, 2005 Abstract Until further notice all new designs should use SHA-256. Existing systems using
Avoiding collisions Cryptographic hash functions. Table of contents
Avoiding collisions Cryptographic hash functions Foundations of Cryptography Computer Science Department Wellesley College Fall 2016 Table of contents Introduction Davies-Meyer Hashes in Practice Hash
Analysis of SHA-1 in Encryption Mode
Analysis of SHA- in Encryption Mode [Published in D. Naccache, Ed., Topics in Cryptology CT-RSA 00, vol. 00 of Lecture Notes in Computer Science, pp. 70 83, Springer-Verlag, 00.] Helena Handschuh, Lars
Introduction. CSC/ECE 574 Computer and Network Security. Outline. Introductory Remarks Feistel Cipher DES AES
CSC/ECE 574 Computer and Network Security Topic 3.1 Secret Key Cryptography Algorithms CSC/ECE 574 Dr. Peng Ning 1 Outline Introductory Remarks Feistel Cipher DES AES CSC/ECE 574 Dr. Peng Ning 2 Introduction
Cryptanalysis of the 10-Round Hash and Full Compression Function of SHAvite-3-512
Downloaded from orbit.dtu.dk on: Jan 8, 219 Cryptanalysis of the 1-Round Hash and Full Compression Function of SHAvite-3-512 Gauravaram, Praveen; Leurent, Gaëtan; Mendel, Florian; Plasencia, Maria Naya;
Preimage and Pseudo-Collision Attacks on Step-Reduced SM3 Hash Function
Preimage and Pseudo-Collision Attacks on Step-Reduced SM3 Hash Function Gaoli Wang 1 and Yanzhao Shen 1 1 School of Computer Science and Technology, Donghua University, Shanghai 201620, China wanggaoli@dhu.edu.cn,
Breaking H 2 -MAC Using Birthday Paradox
Breaking H 2 -MAC Using Birthday Paradox Fanbao Liu 1,2, Tao Xie 1 and Changxiang Shen 2 1 School of Computer, National University of Defense Technology, Changsha, 410073, Hunan, P. R. China 2 School of
Cryptographic Hash Functions Part II
Cryptographic Hash Functions Part II Cryptography 1 Andreas Hülsing, TU/e Some slides by Sebastiaan de Hoogh, TU/e Hash function design Create fixed input size building block Use building block to build
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 9: Encryption modes. AES
CS355: Cryptography Lecture 9: Encryption modes. AES Encryption modes: ECB } Message is broken into independent blocks of block_size bits; } Electronic Code Book (ECB): each block encrypted separately.
Weaknesses in the HAS-V Compression Function
Weaknesses in the HAS-V Compression Function Florian Mendel and Vincent Rijmen Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Inffeldgasse 16a, A-8010
New Preimage Attacks Against Reduced SHA-1
New Preimage Attacks Against Reduced SHA-1 Simon Knellwolf 1 and Dmitry Khovratovich 2 1 ETH Zurich and FHNW, Switzerland 2 Microsoft Research Redmond, USA Abstract. This paper shows preimage attacks against
New Attacks on the Concatenation and XOR Hash Combiners
New Attacks on the Concatenation and XOR Hash Combiners Itai Dinur Department of Computer Science, Ben-Gurion University, Israel Abstract. We study the security of the concatenation combiner H 1(M) H 2(M)
2: Iterated Cryptographic Hash Functions
2: Iterated ryptographic Hash Functions we want hash function H : ({0, 1} n ) {0, 1} n of potentially infinite input size instead we have compression function F : {0, 1} m {0, 1} n {0, 1} n and define
Attacks on hash functions: Cat 5 storm or a drizzle?
Attacks on hash functions: Cat 5 storm or a drizzle? Ilya Mironov Microsoft Research, Silicon Valley Campus September 15, 2005 1 Outline Hash functions: Definitions Constructions Attacks What to do 2 Outline
Cryptographic Hashes. Yan Huang. Credits: David Evans, CS588
Cryptographic Hashes Yan Huang Credits: David Evans, CS588 Recap: CPA 1. k KeyGen(1 n ). b {0,1}. Give Enc(k, ) to A. 2. A chooses as many plaintexts as he wants, and receives the corresponding ciphertexts
The Advanced Encryption Standard
Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 48 The Advanced Encryption Standard Successor of DES DES considered insecure; 3DES considered too slow. NIST competition in 1997 15
Distinguishers for the Compression Function and Output Transformation of Hamsi-256
Distinguishers for the Compression Function and Output Transformation of Hamsi-256 Jean-Philippe Aumasson Emilia Käsper Lars Ramkilde Knudsen Krystian Matusiewicz Rune Ødegård Thomas Peyrin Martin Schläffer
Some Attacks on Merkle-Damgård Hashes
Overview Some Attacks on Merkle-Damgård Hashes John Kelsey, NIST and KU Leuven May 8, 2018 m 0 m 1 m 2 m 3 10*L h 0 h 1 h 2 h final Introduction 1 / 63 Overview Cryptographic Hash unctions Thinking About
The Security of Abreast-DM in the Ideal Cipher Model
The Security of breast-dm in the Ideal Cipher Model Jooyoung Lee, Daesung Kwon The ttached Institute of Electronics and Telecommunications Research Institute Yuseong-gu, Daejeon, Korea 305-390 jlee05@ensec.re.kr,ds
Rebound Attack on Reduced-Round Versions of JH
Rebound Attack on Reduced-Round Versions of JH Vincent Rijmen 1,2, Deniz Toz 1 and Kerem Varıcı 1, 1 Katholieke Universiteit Leuven Department of Electronical Engineering ESAT SCD-COSIC, and Interdisciplinary
The Impact of Carries on the Complexity of Collision Attacks on SHA-1
The Impact o Carries on the Complexity o Collision Attacks on SHA-1 Florian Mendel, Norbert Pramstaller, Christian Rechberger and Vincent Rijmen Norbert.Pramstaller@iaik.tugraz.at Institute or Applied
Finding good differential patterns for attacks on SHA-1
Finding good differential patterns for attacks on SHA-1 Krystian Matusiewicz and Josef Pieprzyk Centre for Advanced Computing - Algorithms and Cryptography, Department of Computing, Macquarie University,
Lecture 14: Cryptographic Hash Functions
CSE 599b: Cryptography (Winter 2006) Lecture 14: Cryptographic Hash Functions 17 February 2006 Lecturer: Paul Beame Scribe: Paul Beame 1 Hash Function Properties A hash function family H = {H K } K K is
Preimage Attacks on Reduced Tiger and SHA-2
Preimage Attacks on Reduced Tiger and SHA-2 Takanori Isobe and Kyoji Shibutani Sony Corporation 1-7-1 Konan, Minato-ku, Tokyo 108-0075, Japan {Takanori.Isobe,Kyoji.Shibutani}@jp.sony.com Abstract. This
MD5 is Weaker than Weak: Attacks on Concatenated Combiners
MD5 is Weaker than Weak: Attacks on Concatenated Combiners Florian Mendel, Christian Rechberger, and Martin Schläffer Institute for Applied Information Processing and Communications (IAIK) Graz University
The Hash Function Fugue
The Hash Function Fugue Shai Halevi William E. Hall Charanjit S. Jutla IBM T.J. Watson Research Center October 6, 2009 Abstract We describe Fugue, a hash function supporting inputs of length upto 2 64
ENEE 457: Computer Systems Security 09/19/16. Lecture 6 Message Authentication Codes and Hash Functions
ENEE 457: Computer Systems Security 09/19/16 Lecture 6 Message Authentication Codes and Hash Functions Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,
How (not) to efficiently dither blockcipher-based hash functions?
How (not) to efficiently dither blockcipher-based hash functions? Jean-Philippe Aumasson, Raphael C.-W. Phan FHNW, Switzerland Loughborough University, UK 1 / 29 CONTENT OF THE TALK Dithered hashing Blockcipher-based
TheImpactofCarriesontheComplexityof Collision Attacks on SHA-1
TheImpactoCarriesontheComplexityo Collision Attacks on SHA-1 Florian Mendel, Norbert Pramstaller, Christian Rechberger, and Vincent Rijmen Institute or Applied Inormation Processing and Communications
Martin Cochran. August 24, 2008
Notes on the Wang et al. 2 63 SHA-1 Differential Path Martin Cochran August 24, 2008 Abstract Although advances in SHA-1 cryptanalysis have been made since the 2005 announcement of a2 63 attack by Wang
Improved Collision Search for SHA-0
Improved Collision Search for SHA-0 Yusuke Naito 1, Yu Sasaki 1, Takeshi Shimoyama 2, Jun Yajima 2, Noboru Kunihiro 1, and Kazuo Ohta 1 1 The University of Electro-Communications, Japan {tolucky,yu339,kunihiro,ota}@ice.uec.ac.jp
The SHA Family of Hash Functions: Recent Results
The SHA Family of Hash Functions: Recent Results Christian Rechberger Vincent Rijmen {Christian.Rechberger,Vincent.Rijmen}@iaik.tugraz.at Institute for Applied Information Processing and Communications
Practical pseudo-collisions for hash functions ARIRANG-224/384
Practical pseudo-collisions for hash functions ARIRANG-224/384 Jian Guo 1, Krystian Matusiewicz 2, Lars R. Knudsen 2, San Ling 1, and Huaxiong Wang 1 1 School of Physical and Mathematical Sciences, Nanyang
Impact of Rotations in SHA-1 and Related Hash Functions
Impact of Rotations in SHA-1 and Related Hash Functions Norbert Pramstaller, Christian Rechberger, and Vincent Rijmen Institute for Applied Information Processing and Communications (IAIK), Graz University
ENEE 459-C Computer Security. Message authentication (continue from previous lecture)
ENEE 459-C Computer Security Message authentication (continue from previous lecture) Last lecture Hash function Cryptographic hash function Message authentication with hash function (attack?) with cryptographic
A (Second) Preimage Attack on the GOST Hash Function
A (Second) Preimage Attack on the GOST Hash Function Florian Mendel, Norbert Pramstaller, and Christian Rechberger Institute for Applied Information Processing and Communications (IAIK), Graz University
The Hash Function JH 1
The Hash Function JH 1 16 January, 2011 Hongjun Wu 2,3 wuhongjun@gmail.com 1 The design of JH is tweaked in this report. The round number of JH is changed from 35.5 to 42. This new version may be referred
Title of Presentation
The First 30 Years of Cryptographic Hash Functions and the NIST SHA-3 Competition Title of Presentation Bart Preneel COSIC/Kath. Univ. Leuven (Belgium) Session ID: CRYP-202 Session Classification: Hash
Practical pseudo-collisions for hash functions ARIRANG-224/384
Practical pseudo-collisions for hash functions ARIRANG-224/384 Jian Guo 1, Krystian Matusiewicz 2, Lars R. Knudsen 2, San Ling 1, and Huaxiong Wang 1 1 School of Physical and Mathematical Sciences, Nanyang
Low-weight Pseudo Collision Attack on Shabal and Preimage Attack on Reduced Shabal-512
Low-weight Pseudo Collision Attack on Shabal and Preimage Attack on Reduced Shabal-512 Takanori Isobe and Taizo Shirai Sony Corporation 1-7-1 Konan, Minato-ku, Tokyo 108-0075, Japan {Takanori.Isobe,Taizo.Shirai}@jp.sony.com
Improved characteristics for differential cryptanalysis of hash functions based on block ciphers
1 Improved characteristics for differential cryptanalysis of hash functions based on block ciphers Vincent Rijmen Bart Preneel Katholieke Universiteit Leuven ESAT-COSIC K. Mercierlaan 94, B-3001 Heverlee,
Forgery and Partial Key-Recovery Attacks on HMAC and NMAC Using Hash Collisions
Forgery and Partial Key-Recovery Attacks on HMAC and NMAC Using Hash Collisions Scott Contini 1 and Yiqun Lisa Yin 2 1 Macquarie University, Centre for Advanced Computing ACAC, NSW 2109, Australia scontini@comp.mq.edu.au
Quantum Preimage and Collision Attacks on CubeHash
Quantum Preimage and Collision Attacks on CubeHash Gaëtan Leurent University of Luxembourg, Gaetan.Leurent@uni.lu Abstract. In this paper we show a quantum preimage attack on CubeHash-512-normal with complexity
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 15 October 20, 2014 CPSC 467, Lecture 15 1/37 Common Hash Functions SHA-2 MD5 Birthday Attack on Hash Functions Constructing New
Invariant Subspace Attack Against Full Midori64
Invariant Subspace Attack Against Full Midori64 Jian Guo 1, Jérémy Jean 1, Ivica Nikolić 1, Kexin Qiao 1,2, Yu Sasaki 1,3, and Siang Meng Sim 1 1 Nanyang Technological University, Singapore 2 Institute
Cover Page. The handle holds various files of this Leiden University dissertation.
Cover Page The handle http://hdl.handle.net/1887/19093 holds various files of this Leiden University dissertation. Author: Stevens, Marc Martinus Jacobus Title: Attacks on hash functions and applications
Cryptanalysis of the Hash Functions MD4 and RIPEMD
Cryptanalysis of the Hash Functions MD4 and RIPEMD Xiaoyun Wang 1, Xuejia Lai 2, Dengguo Feng 3, Hui Chen 1, and Xiuyuan Yu 4 1 Shandong University, Jinan250100, China xywang@sdu.edu.cn 2 Shanghai Jiaotong
How to Find the Sufficient Collision Conditions for Haval-128 Pass 3 by Backward Analysis
University of Wollongong Research Online Faculty of Informatics - Papers (Archive) Faculty of Engineering and Information Sciences 2007 How to Find the Sufficient Collision Conditions for Haval-128 Pass
Simple Pseudorandom Number Generator with Strengthened Double Encryption (Cilia)
Simple Pseudorandom Number Generator with Strengthened Double Encryption (Cilia) Henry Ng Henry.Ng.a@gmail.com Abstract. A new cryptographic pseudorandom number generator Cilia is presented. It hashes
Cryptanalysis of Tweaked Versions of SMASH and Reparation
Cryptanalysis of Tweaked Versions of SMASH and Reparation Pierre-Alain Fouque, Jacques Stern, and Sébastien Zimmer CNRS-École normale supérieure-inria Paris, France {Pierre-Alain.Fouque,Jacques.Stern,Sebastien.Zimmer}@ens.fr
SMASH - A Cryptographic Hash Function
SMASH - A Cryptographic Hash Function Lars R. Knudsen Department of Mathematics, Technical University of Denmark Abstract. 1 This paper presents a new hash function design, which is different from the
Improved S-Box Construction from Binomial Power Functions
Malaysian Journal of Mathematical Sciences 9(S) June: 21-35 (2015) Special Issue: The 4 th International Cryptology and Information Security Conference 2014 (Cryptology 2014) MALAYSIAN JOURNAL OF MATHEMATICAL
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128 Pierre-Alain Fouque 1 Jérémy Jean 2 Thomas Peyrin 3 1 Université de Rennes 1, France 2 École Normale Supérieure, France 3 Nanyang
New Preimage Attack on MDC-4
New Preimage Attack on MDC-4 Deukjo Hong and Daesung Kwon Abstract In this paper, we provide some cryptanalytic results for double-blocklength (DBL) hash modes of block ciphers, MDC-4. Our preimage attacks
Introduction to Information Security
Introduction to Information Security Lecture 4: Hash Functions and MAC 2007. 6. Prof. Byoungcheon Lee sultan (at) joongbu. ac. kr Information and Communications University Contents 1. Introduction - Hash
Foundations of Network and Computer Security
Foundations of Network and Computer Security John Black Lecture #5 Sep 7 th 2004 CSCI 6268/TLEN 5831, Fall 2004 Announcements Please sign up for class mailing list by end of today Quiz #1 will be on Thursday,
How to Improve Rebound Attacks. María Naya-Plasencia FHNW - Switzerland
How to Improve Rebound Attacks María Naya-Plasencia FHNW - Switzerland Outline 1 Hash Functions and the SHA-3 Competition 2 The Rebound Attack and Motivation 3 Merging Lists with Respect to t Problem 1
Foundations of Network and Computer Security
Foundations of Network and Computer Security John Black Lecture #6 Sep 8 th 2005 CSCI 6268/TLEN 5831, Fall 2005 Announcements Quiz #1 later today Still some have not signed up for class mailing list Perhaps
Information Security
SE 4472 / ECE 9064 Information Security Week 12: Random Number Generators and Picking Appropriate Key Lengths Fall 2015 Prof. Aleksander Essex Random Number Generation Where do keys come from? So far we
Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC
Cryptanalysis on HMAC/NMAC-MD5 and MD5-MAC Xiaoyun Wang 1,2, Hongbo Yu 1, Wei Wang 2, Haina Zhang 2, and Tao Zhan 3 1 Center for Advanced Study, Tsinghua University, Beijing 100084, China {xiaoyunwang,
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 16 October 30, 2017 CPSC 467, Lecture 16 1/52 Properties of Hash Functions Hash functions do not always look random Relations among
Linearization and Message Modification Techniques for Hash Function Cryptanalysis
Linearization and Message Modification Techniques for Hash Function Cryptanalysis Jian Guo Institute for Infocomm Research, Singapore. ASK 2011, 30 August 2011 Jian Guo Linearization and Message Modification
CHAPTER 5 A BLOCK CIPHER INVOLVING A KEY APPLIED ON BOTH THE SIDES OF THE PLAINTEXT
82 CHAPTER 5 A BLOCK CIPHER INVOLVING A KEY APPLIED ON BOTH THE SIDES OF THE PLAINTEXT 83 5.1 Introduction In a pioneering paper, Hill [5] developed a block cipher by using the modular arithmetic inverse
Introduction Description of MD5. Message Modification Generate Messages Summary
How to Break MD5 and other hash functions Xiaoyun Wang and Hongbo Yu (China) Presented by: Saar Benodiz May 2012 Outline Introduction Description of MD5 Differential Attack for Hash Functions Message Modification
Efficient Collision Search Attacks on SHA-0
Efficient Collision Search Attacks on SHA-0 Xiaoyun Wang 1,, Hongbo Yu 2, and Yiqun Lisa Yin 3 1 Shandong University, China xywang@sdu.edu.cn 2 Shandong University, China yhb@mail.sdu.edu.cn 3 Independent
An introduction to Hash functions
An introduction to Hash functions Anna Rimoldi eriscs - Universitée de la Méditerranée, Marseille Secondo Workshop di Crittografia BunnyTN 2011 A. Rimoldi (eriscs) Hash function 12 September 2011 1 / 27
Optimal Covering Codes for Finding Near-Collisions
Optimal Covering Codes for Finding Near-Collisions Mario Lamberger 1 and Vincent Rijmen 1,2 1 Institute for Applied Information Processing and Communications Graz University of Technology, Inffeldgasse
Nanyang Technological University, Singapore École normale supérieure de Rennes, France
Analysis of BLAKE2 Jian Guo Pierre Karpman Ivica Nikolić Lei Wang Shuang Wu Nanyang Technological University, Singapore École normale supérieure de Rennes, France The Cryptographer s Track at the RSA Conference,
Introduction to Symmetric Cryptography
Introduction to Symmetric Cryptography COST Training School on Symmetric Cryptography and Blockchain Stefan Kölbl February 19th, 2018 DTU Compute, Technical University of Denmark Practical Information
Algebraic properties of SHA-3 and notable cryptanalysis results
Algebraic properties of SHA-3 and notable cryptanalysis results Christina Boura University of Versailles, France ICMC 2015, January 9, 2014 1 / 51 Cryptographic Hash Functions H : {0,1} {0,1} n m H h =
SMASH - A Cryptographic Hash Function
SMASH - A Cryptographic Hash Function Lars R. Knudsen Department of Mathematics, Technical University of Denmark Abstract. 1 This paper presents a new hash function design, which is different from the
Lecture 4: DES and block ciphers
Lecture 4: DES and block ciphers Johan Håstad, transcribed by Ernir Erlingsson 2006-01-25 1 DES DES is a 64 bit block cipher with a 56 bit key. It selects a 64 bit block and modifies it depending on the
Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5
Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5 Pierre-Alain Fouque, Gaëtan Leurent, Phong Q. Nguyen École Normale Supérieure Département d Informatique, 45 rue d Ulm, 75230 Paris Cedex 05, France
Gröbner Basis Based Cryptanalysis of SHA-1
Gröbner Basis Based Cryptanalysis of SHA-1 Makoto Sugita IPA Security Center Joint work with Mitsuru Kawazoe (Osaka Prefecture university) and Hideki Imai (Chuo University and RCIS, AIST) 1 Outline Introduction
Hash Function Balance and its Impact on Birthday Attacks
Hash Function Balance and its Impact on Birthday Attacks Mihir Bellare 1 and Tadayoshi Kohno 1 Dept. of Computer Science & Engineering, University of California, San Diego 9500 Gilman Drive, La Jolla,
Improved Generic Attacks Against Hash-based MACs and HAIFA
Improved Generic Attacks Against Hash-based MACs and HAIFA Itai Dinur 1 and Gaëtan Leurent 2 1 Département d Informatique, École Normale Supérieure, Paris, France Itai.Dinur@ens.fr 2 Inria, EPI SECRET,
Full Key-Recovery Attacks on HMAC/NMAC-MD4 and NMAC-MD5
Author manuscript, published in "Advances in Cryptology - CRYPTO 2007, 27th Annual International Cryptology Conference 4622 (2007) 13-30" DOI : 10.1007/978-3-540-74143-5_2 Full Key-Recovery Attacks on
Analysis of Differential Attacks in ARX Constructions
.. Analysis of Differential Attacks in ARX Constructions Gaëtan Leurent UCL Crypto Group University of Luxembourg Asiacrypt 2012 G. Leurent (UCL & uni.lu) Analysis of Differential Attacks in ARX Constructions
Provable Security in Symmetric Key Cryptography
Provable Security in Symmetric Key Cryptography Jooyoung Lee Faculty of Mathematics and Statistics, Sejong University July 5, 2012 Outline 1. Security Proof of Blockcipher-based Hash Functions K i E X
Notes for Lecture 9. 1 Combining Encryption and Authentication
U.C. Berkeley CS276: Cryptography Handout N9 Luca Trevisan February 17, 2009 Notes for Lecture 9 Notes scribed by Joel Weinberger, posted March 1, 2009 Summary Last time, we showed that combining a CPA-secure
Secret Key Systems (block encoding) Encrypting a small block of text (say 64 bits) General considerations for cipher design:
Secret Key Systems (block encoding) Encrypting a small block of text (say 64 bits) General considerations for cipher design: Secret Key Systems Encrypting a small block of text (say 64 bits) General considerations
A Composition Theorem for Universal One-Way Hash Functions
A Composition Theorem for Universal One-Way Hash Functions Victor Shoup IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland sho@zurich.ibm.com Abstract. In this paper we present a new scheme
Analysis of Message Injection in Stream Cipher-based Hash Functions
Analysis o Message Injection in Stream Cipher-based Hash Functions Yuto Nakano 1, Carlos Cid 2, Kazuhide Fukushima 1, and Shinsaku Kiyomoto 1 1 KDDI R&D Laboratories Inc. 2 Royal Holloway, University o
Provable Security of Cryptographic Hash Functions
Provable Security of Cryptographic Hash Functions Mohammad Reza Reyhanitabar Centre for Computer and Information Security Research University of Wollongong Australia Outline Introduction Security Properties
General Distinguishing Attacks on NMAC and HMAC with Birthday Attack Complexity
General Distinguishing Attacks on MAC and HMAC with Birthday Attack Complexity Donghoon Chang 1 and Mridul andi 2 1 Center or Inormation Security Technologies(CIST), Korea University, Korea dhchang@cist.korea.ac.kr
Attacks on Hash Functions based on Generalized Feistel Application to Reduced-Round Lesamnta and SHAvite-3 512
Attacks on Hash Functions based on Generalized Feistel Application to Reduced-Round Lesamnta and SHAvite-3 512 Charles Bouillaguet 1, Orr Dunkelman 2, Gaëtan Leurent 1, and Pierre-Alain Fouque 1 1 Département
Preimages for Step-Reduced SHA-2
Preimages for Step-Reduced SHA-2 Jian Guo 1 and Krystian Matusiewicz 2 1 Division of Mathematical Sciences School of Physical and Mathematical Sciences Nanyang Technological University, Singapore guojian@ntu.edu.sg
Benes and Butterfly schemes revisited
Benes and Butterfly schemes revisited Jacques Patarin, Audrey Montreuil Université de Versailles 45 avenue des Etats-Unis 78035 Versailles Cedex - France Abstract In [1], W. Aiello and R. Venkatesan have
Rebound Distinguishers: Results on the Full Whirlpool Compression Function
Rebound Distinguishers: Results on the Full Whirlpool Compression Function Mario Lamberger 1, Florian Mendel 1, Christian Rechberger 1, Vincent Rijmen 1,2,3, and Martin Schläffer 1 1 Institute for Applied
Time-memory Trade-offs for Near-collisions
Time-memory Trade-offs for Near-collisions Gaëtan Leurent UCL Crypto Group Gaetan.Leurent@uclouvain.be Abstract. In this work we consider generic algorithms to find nearcollisions for a hash function.
Universal Security; From bits and mips to pools, lakes - and beyond
Universal Security; From bits and mips to pools, lakes - and beyond Arjen Lenstra, Thorsten Kleinjung, Emmanuel Thomé To cite this version: Arjen Lenstra, Thorsten Kleinjung, Emmanuel Thomé. Universal
Preimages for Reduced SHA-0 and SHA-1
Preimages for Reduced SHA-0 and SHA-1 Christophe De Cannière 1,2 and Christian Rechberger 3 1 Département d Informatique École Normale Supérieure, christophe.decanniere@ens.fr 2 Katholieke Universiteit