Cryptanalysis of the Round Hash and Full Compression Function of SHAvite

Florian Mendel3

Description

Cryptanalysis of the 10-Round Hash and Full Compression Function of SHAvite-3-512? Praveen Gauravaram1, Gaeten Leurent2, Florian Mendel3, Marıa Naya-Plasencia4, Thomas Peyrin5, Christian Rechberger6, and Martin Schlaffer3 1 Department of Mathematics, DTU, Denmark 2 ENS, France 3 IAIK, TU Graz, Austria 4 FHNW Windisch, Switzerland 5 Ingenico, France 6 ESAT/COSIC, K.U.Leuven and IBBT, Belgium Abstract. In this paper, we analyze the SHAvite-3-512 hash function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash func- tion SHAvite-3-512, and on the full 14 round compression function of SHAvite-3-512. We show a second preimage attack on the hash function reduced to 10 rounds with a complexity of 2497 compression function evaluations and 216 memory. For the full 14-round compression function, we give a chosen counter, chosen salt preimage attack with 2384 compres- sion function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 compression function evalua- tions and 2128 memory. Keywords: hash function, cryptanalysis, collision, (second) preimage 1 Introduction With the advent of new cryptanalysis [6, 20] of the FIPS 180-2 standard hash function SHA-1 [14], NIST has initiated an open hash function competition [15].

• compression function


• bit


• message expansion


• functions based


• round


• collision attack


• nist has initiated


• hash function


• belgian state


• processed using

Sujets

• Bensoussan
• Ingenico
• Christopher Schläffer
• Collision attack

Informations

• Publié par: pefav
• Nombre de lectures: 32
• Langue: English

Extrait

Cryptanalysisofthe10-RoundHashandFull CompressionFunctionofSHAvite-3-512 ? PraveenGauravaram 1 ,Ga¨etenLeurent 2 ,FlorianMendel 3 , Marı´aNaya-Plasencia 4 ,ThomasPeyrin 5 , ChristianRechberger 6 ,andMartinSchla¨ffer 3 1 DepartmentofMathematics,DTU,Denmark 2 ENS,France 3 IAIK,TUGraz,Austria 4 FHNWWindisch,Switzerland 5 Ingenico,France 6 ESAT/COSIC,K.U.LeuvenandIBBT,Belgium [e-mail] Abstract.Inthispaper,weanalyzetheSHAvite-3-512hashfunction, asproposedandtweakedforround2oftheSHA-3competition.We presentcryptanalyticresultson10outof14roundsofthehashfunc- tionSHAvite-3-512,andonthefull14roundcompressionfunctionof SHAvite-3-512.Weshowasecondpreimageattackonthehashfunction reducedto10roundswithacomplexityof2 497 compressionfunction evaluationsand2 16 memory.Forthefull14-roundcompressionfunction, wegiveachosencounter,chosensaltpreimageattackwith2 384 compres- sionfunctionevaluationsand2 128 memory(orcomplexity2 448 without memory),andacollisionattackwith2 192 compressionfunctionevalua- tionsand2 128 memory. Keywords:hashfunction,cryptanalysis,collision,(second)preimage 1Introduction Withtheadventofnewcryptanalysis[6,20]oftheFIPS180-2standardhash functionSHA-1[14],NISThasinitiatedanopenhashfunctioncompetition[15]. SHAvite-3[3,4],ahashfunctiondesignedbyBihamdesignedbyBihamand Dunkelman,isasecondroundcandidateintheSHA-3hashfunctioncompe- tition[16].ItisaniteratedhashfunctionbasedontheHAIFAhashfunction framework[2].Inthisframework,thecompressionfunctionsalsoacceptsasalt ? ThisworkwassupportedbytheEuropeanCommissionthroughtheICTprogramme undercontractICT-2007-216676ECRYPTIIandbytheIAPProgrammeP6/26 BCRYPToftheBelgianState(BelgianSciencePolicy).Partsofthisworkwerecar- riedoutduringthetenureofanERCIM”AlainBensoussan”FellowshipProgramme, andwhileauthorswereparticipatingintheECRYPT2workshop“Hash 3 :Proofs, AnalysisandImplementation”inNovember2009.Thefirstauthorissupportedby theDanishCouncilforIndependentResearch(FTPandFNU)grant274-09-0096.