Cryptanalysis of the Round Hash and Full Compression Function of SHAvite

pages

English

Documents

Écrit par
Florian Mendel3

Publié par
pefav

Lire un extrait

Obtenez un accès à la bibliothèque pour le consulter en ligne En savoir plus

Découvre YouScribe en t'inscrivant gratuitement

Je m'inscris

Découvre YouScribe en t'inscrivant gratuitement

Je m'inscris

pages

English

Ebook

Lire un extrait

Obtenez un accès à la bibliothèque pour le consulter en ligne En savoir plus

Publié par

pefav

Nombre de lectures

Langue

English

Cryptanalysis of the 10-Round Hash and Full Compression Function of SHAvite-3-512? Praveen Gauravaram1, Gaeten Leurent2, Florian Mendel3, Marıa Naya-Plasencia4, Thomas Peyrin5, Christian Rechberger6, and Martin Schlaffer3 1 Department of Mathematics, DTU, Denmark 2 ENS, France 3 IAIK, TU Graz, Austria 4 FHNW Windisch, Switzerland 5 Ingenico, France 6 ESAT/COSIC, K.U.Leuven and IBBT, Belgium Abstract. In this paper, we analyze the SHAvite-3-512 hash function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash func- tion SHAvite-3-512, and on the full 14 round compression function of SHAvite-3-512. We show a second preimage attack on the hash function reduced to 10 rounds with a complexity of 2497 compression function evaluations and 216 memory. For the full 14-round compression function, we give a chosen counter, chosen salt preimage attack with 2384 compres- sion function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 compression function evalua- tions and 2128 memory. Keywords: hash function, cryptanalysis, collision, (second) preimage 1 Introduction With the advent of new cryptanalysis [6, 20] of the FIPS 180-2 standard hash function SHA-1 [14], NIST has initiated an open hash function competition [15].

compression function

message expansion

functions based

round

collision attack

nist has initiated

hash function

belgian state

processed using

Voir

Publié par

pefav

Nombre de lectures

Langue

English

Cryptanalysisofthe10-RoundHashandFullCompressionFunctionofSHAvite-3-512?PraveenGauravaram1,Ga¨etenLeurent2,FlorianMendel3,Marı´aNaya-Plasencia4,ThomasPeyrin5,ChristianRechberger6,andMartinSchla¨ﬀer31DepartmentofMathematics,DTU,Denmark2ENS,France3IAIK,TUGraz,Austria4FHNWWindisch,Switzerland5Ingenico,France6ESAT/COSIC,K.U.LeuvenandIBBT,Belgiummartin.schlaeffer@iaik.tugraz.atAbstract.Inthispaper,weanalyzetheSHAvite-3-512hashfunction,asproposedandtweakedforround2oftheSHA-3competition.Wepresentcryptanalyticresultson10outof14roundsofthehashfunc-tionSHAvite-3-512,andonthefull14roundcompressionfunctionofSHAvite-3-512.Weshowasecondpreimageattackonthehashfunctionreducedto10roundswithacomplexityof2497compressionfunctionevaluationsand216memory.Forthefull14-roundcompressionfunction,wegiveachosencounter,chosensaltpreimageattackwith2384compres-sionfunctionevaluationsand2128memory(orcomplexity2448withoutmemory),andacollisionattackwith2192compressionfunctionevalua-tionsand2128memory.Keywords:hashfunction,cryptanalysis,collision,(second)preimage1IntroductionWiththeadventofnewcryptanalysis[6,20]oftheFIPS180-2standardhashfunctionSHA-1[14],NISThasinitiatedanopenhashfunctioncompetition[15].SHAvite-3[3,4],ahashfunctiondesignedbyBihamdesignedbyBihamandDunkelman,isasecondroundcandidateintheSHA-3hashfunctioncompe-tition[16].ItisaniteratedhashfunctionbasedontheHAIFAhashfunctionframework[2].Inthisframework,thecompressionfunctionsalsoacceptsasalt?ThisworkwassupportedbytheEuropeanCommissionthroughtheICTprogrammeundercontractICT-2007-216676ECRYPTIIandbytheIAPProgrammeP6/26BCRYPToftheBelgianState(BelgianSciencePolicy).Partsofthisworkwerecar-riedoutduringthetenureofanERCIM”AlainBensoussan”FellowshipProgramme,andwhileauthorswereparticipatingintheECRYPT2workshop“Hash3:Proofs,AnalysisandImplementation”inNovember2009.TheﬁrstauthorissupportedbytheDanishCouncilforIndependentResearch(FTPandFNU)grant274-09-0096.

Voir