Improved Rebound Attack on the Finalist Grøstl

María Naya - Plasencia2

Description

Improved Rebound Attack on the Finalist Grøstl Jérémy Jean1 María Naya-Plasencia2 Thomas Peyrin3 1École Normale Supérieure, France 2University of Versailles, France 3Nanyang Technological University, Singapore FSE'2012 – March 19, 2012

• compression function


• grøstl


• grøstl-v0


• round


• has been tweaked


• finalist grostl


• ecole normale

Sujets

• Nanyang Technological University
• Grøstl
• École normale

Informations

• Publié par: pefav
• Nombre de lectures: 30
• Langue: English
• Poids de l'ouvrage: 1 Mo

Extrait

Improved Rebound Attack on the FinalistGstrøl

Jérémy Jean 1 María Naya-Plasencia 2 Thomas Peyrin 3

3

1

École Normale Supérieure, France

2

University of Versailles, France

Nanyang Technological University, Singapore

FSE’2012 – March 19, 2012

thoncktaisalineF2ltsorGt

In December 2010, the NIST chose the 5 finalists of the SHA-3competition: • BLAKE • Grøstl • JH • Keccak • Skein

I

I

This year, the winner will be chosen.

72/a,T.enciin–IPeyrevRdpmordntAbeuo sørGS&lt3-AHpyrCeuGsørts-l52G6ørtanalysisTechniq oC3-AHS n oititepm 2C51l-stiousclon alisnFints Plasaya-,M.NJean–2.J2’10FES

Gtsør5-ltsørG652-ltsø øsGr onsiluncCo12nalayrtp-AC3&lHSesGrniquTechysis seisnouFltC:morpF)nction(C pmorevRdbeuodntAencia,T.Peyrin–InaeJN.M,-ayasalPSEF01’2J.2–

Grøstl-v0 08][Knudsen et al.has been tweaked for the final: I Grøstl-256:|h|=|m|=512 bits. I Grøstl-512:|h|=|m|=1024 bits.

7/2l3strotGsilaniFehtnokcat

stionmuta chniquesalysisTe65rGsøltrGsølt2-silu Gr on12-5ncCo anrerePlltsøtnI: obeRdevorpmI–nirey.P,Tiancsela-P/472solttsrGanilheFikontttacundA,n.MaNay21J–J.aeFSE’20

AddRoundConstant

Permutations P and Q apply the wide-trail strategy from theAES. I Grøstl-256: 10 rounds on state a 8×8. I Grøstl-512: 14 rounds on state a 8×16.

Tweak: constants inARKandShchanged to introduce asymmetry between P and Q

MixBytes

ShiftBytes

SubBytes

3Cryptanstl&SHA-Gør

FS20E’.M,nayaNJ–21aeJ. RoontizalinaFil:dnu l-51røst256Gstl- ørts oi G nlcsuC2no

Once all blocks of message have been treated: truncation.

P

h

h i−1

cattAdnuiFehtnokGrstlina275/tlosescnP-alP.yeaiT,Imprrin–Rebooved tløsGrechnsisTsGrøique3-rCS&AHanylpyat

M s , ø N r . G y S a & - l a t l 3 P - s A a H n p e y i r c Cn F a S t E a ’ s 2 i 0 l 1 y 2 e – c J s . T J i e q a h n n RdevuobetAdnkcatT.a,yrPe–Iinromp2/7ts6l

I

Grøstl-512 • [Schläffer 2011] collision on the CF.: 6-round

Grøstl-256: • [Sasaki et al A10] permutation distinguisher.: 8-round

I

•  FSE11][Boura et al.: 10-round zero-sum.

• [Gilbert et al. FSE10]: 8-round CF distinguisher.

eFinonthtGroalis kwTaetrehfAetsysiAnalBeststl: n Grø oisulcnoC215-ltsrø6G25l-strøsGue

ecsTiqhnnatasily3-AHpyrCsørGS&ltusiooncl512Cstl-G6ør-l52ørtseuGs 2/1stluseRweNruO n 02’EJ–21SFyaNala-Pea.JM.n,P.yeir–nescnaiT,ReboundAImprovedilaniFehtnokcatt

Based on the rebound technique[Mendel et al. FSE09].

I

I

277/tlosGrst

I

Based on a way of finding solutions forthreeconsecutive full active rounds:new.

They apply both to 256 and 512 versions.