Cryptanalysis of the 10-Round Hash and Full Compression Function of - PowerPoint PPT Presentation

Cryptanalysis of the 10-Round Hash and Full Compression Function of SHAvite-3-512 Praveen Gauravaram 1 , Ga¨ eten Leurent 2 , Florian Mendel 3 , Mar´ ıa Naya-Plasencia 4 , Thomas Peyrin 5 , Christian Rechberger 6 , Martin Schl¨ affer 3 , 1 Department of Mathematics, DTU, Denmark, 2 ENS, France, 3 IAIK, TU Graz, Austria, 4 FHNW Windisch, Switzerland, 5 Ingenico, France, 6 ESAT/COSIC, K.U.Leuven and IBBT, Belgium Africacrypt 2010 (initially discussed at ECRYPT2 Hash3 workshop) Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 1 / 31

Outline Motivation 1 SHAvite-3 2 Basic Attack Strategy 3 Attack on Compression Function 4 Attack on Hash Function 5 6 Conclusion Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 2 / 31

Overview Motivation 1 SHAvite-3 2 Basic Attack Strategy 3 Attack on Compression Function 4 Attack on Hash Function 5 6 Conclusion Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 3 / 31

Cryptographic Hash Function n ∗ m h ( m ) h Hash function h maps arbitrary length input m to n -bit output h ( m ) Collision Resistance find m , m ′ with m � = m ′ and h ( m ) = h ( m ′ ) birthday attack applies (freedom to choose h ( m ) ) generic complexity: 2 n / 2 Second-Preimage Resistance given m , h ( m ) find m ′ with m � = m ′ and h ( m ) = h ( m ′ ) generic complexity: 2 n Preimage Resistance given h ( m ) find m generic complexity: 2 n Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 4 / 31

Hash Function Cryptanalysis Recent improvements in hash functions cryptanalysis last decade: major weaknesses in many hash functions especially in MD-family of hash functions NIST standard SHA-1 broken NIST SHA-3 competition [Nat07] (2008-2012) find a successor of SHA-1 and SHA-2 similar as AES competition (2000) Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 5 / 31

SHA-3 Candidates 64 submissions to NIST call (October 2008) 51 round 1 candidates (December 2008) many broken, too slow, not chosen, ... 14 round 2 candidates (August 2009) chosen by NIST, tweaks allowed 5 finalists (fall 2010) to focus analysis choose winner in 2011 standardize SHA-3 in 2012 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 6 / 31

How to Compare Attacks on SHA-3 Candidates? Attacks on Building Blocks very different requirements for different designs building blocks often not ideal sponge: trivial “compression function” collisions/preimages distinguishers on building blocks? when is an attack interesting? NIST: not anticipated by the designers if it extends to the hash function Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 7 / 31

How to Compare Attacks on SHA-3 Candidates? Attacks on Building Blocks very different requirements for different designs building blocks often not ideal sponge: trivial “compression function” collisions/preimages distinguishers on building blocks? when is an attack interesting? NIST: not anticipated by the designers if it extends to the hash function Attacks on Hash Function same requirements for all candidates a lot easier to compare attacks on reduced hash function? still hard to compare different security parameter(s) Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 7 / 31

How to Compare Attacks on SHA-3 Candidates? Attacks on Building Blocks very different requirements for different designs building blocks often not ideal sponge: trivial “compression function” collisions/preimages distinguishers on building blocks? when is an attack interesting? NIST: not anticipated by the designers if it extends to the hash function Attacks on Hash Function same requirements for all candidates a lot easier to compare attacks on reduced hash function? still hard to compare different security parameter(s) Collection of SHA-3 Attacks: http://ehash.iaik.tugraz.at/wiki/The SHA-3 Zoo Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 7 / 31

Overview Motivation 1 SHAvite-3 2 Basic Attack Strategy 3 Attack on Compression Function 4 Attack on Hash Function 5 6 Conclusion Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 8 / 31

Description of SHAvite-3-512 M 1 M 2 M 3 M t f f f f H ( m ) IV n n n n cnt salt cnt salt cnt salt cnt salt Designed by Orr Dunkelman and Eli Biham [BD08] Round 2 candidate tweaked Iterated hash function single-pipe construction Haifa design principle Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 9 / 31

SHAvite-3-512 Compression Function h i − 1 M i cnt salt state key update schedule h i block cipher in Davies-Meyer mode state update: 14-round Feistel network (F-function: 4 AES rounds) key schedule: parallel AES rounds with linear mixing layers Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 10 / 31

State Update A i B i C i D i F i F ′ i RK i RK ′ i A i + 1 B i + 1 C i + 1 D i + 1 F i ( x ) = AES ( AES ( AES ( AES ( x ⊕ k 0 0 , i ) ⊕ k 1 0 , i ) ⊕ k 2 0 , i ) ⊕ k 3 0 , i ) AES ( x ) = MixColumns ( ShiftRows ( SubBytes ( x ))) RK i = ( k 0 0 , i , k 1 0 , i , k 2 0 , i , k 3 0 , i ) Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 11 / 31

Key Schedule k 0 k 1 k 2 k 3 k 0 k 1 k 2 k 3 0 , 8 0 , 8 0 , 8 0 , 8 1 , 8 1 , 8 1 , 8 1 , 8 AES AES AES AES AES AES AES AES ( s 0 , s 1 , s 2 , s 3) ( s 4 , s 5 , s 6 , s 7) ( s 8 , s 9 , s 10 , s 11) ( s 12 , s 13 , s 14 , s 15) ( s 0 , s 1 , s 2 , s 3) ( s 4 , s 5 , s 6 , s 7) ( s 8 , s 9 , s 10 , s 11) ( s 12 , s 13 , s 14 , s 15) cnt [2] cnt [3] cnt [0] cnt [1] k 0 k 1 k 2 k 3 k 0 k 1 k 2 k 3 0 , 9 0 , 9 0 , 9 0 , 9 1 , 9 1 , 9 1 , 9 1 , 9 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 12 / 31

Key Schedule k 0 k 1 k 2 k 3 k 0 k 1 k 2 k 3 0 , 9 0 , 9 0 , 9 0 , 9 1 , 9 1 , 9 1 , 9 1 , 9 k 0 k 1 k 2 k 3 k 0 k 1 k 2 k 3 0 , 10 0 , 10 0 , 10 0 , 10 1 , 10 1 , 10 1 , 10 1 , 10 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 12 / 31

Key Schedule (schematic) RK 0 RK ′ M = 1024 bit 0 AES ( k i , j ⊕ salt ) (8 × AES ) c 3 c 2 c 1 c 0 Linear Layer 1 RK 1 RK ′ 1 Linear Layer 2 RK 2 RK ′ 2 AES ( k i , j ⊕ salt ) c 2 c 3 c 0 c 1 Linear Layer 1 RK 3 RK ′ 3 Linear Layer 2 RK 4 RK ′ 4 AES ( k i , j ⊕ salt ) Linear Layer 1 RK 5 RK ′ 5 c 1 c 0 c 3 c 2 Linear Layer 2 RK 6 RK ′ 6 Round 1: plain counter words added: cnt = c 0 c 1 c 2 c 3 Round 2: inverted and shuffled counter words added Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 13 / 31

Overview Motivation 1 SHAvite-3 2 Basic Attack Strategy 3 Attack on Compression Function 4 Attack on Hash Function 5 6 Conclusion Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 14 / 31

Cancellation Property [BDLF09] A i B i C i D i F ′ F i i RK i RK ′ i A i + 1 B i + 1 C i + 1 D i + 1 F i + 1 F ′ i + 1 RK i + 1 RK ′ i + 1 B i ⊕ F ′ i + 1 ( D i + 1 ) A i + 2 B i + 2 C i + 2 D i + 2 F i + 2 F ′ i + 2 RK i + 2 RK ′ i + 2 B i ⊕ F ′ i + 1 ( D i + 1 ) A i + 3 B i + 3 C i + 3 D i + 3 F ′ F i + 3 i + 3 RK i + 3 RK ′ i + 3 A i + 4 B i + 4 C i + 4 D i + 4 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 15 / 31

Cancellation Property [BDLF09] A i B i C i D i F ′ F i i idea: keep B i unchanged RK i RK ′ i B i + 4 = B i A i + 1 B i + 1 B i C i + 1 D i + 1 F i + 1 F ′ i + 1 RK i + 1 RK ′ i + 1 B i ⊕ F ′ i + 1 ( D i + 1 ) A i + 2 B i + 2 C i + 2 D i + 2 F i + 2 F ′ i + 2 RK i + 2 RK ′ i + 2 B i ⊕ F ′ i + 1 ( D i + 1 ) A i + 3 B i + 3 C i + 3 D i + 3 F ′ F i + 3 i + 3 B i RK ′ RK i + 3 i + 3 A i + 4 B i + 4 C i + 4 D i + 4 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 15 / 31

Cancellation Property [BDLF09] A i B i C i D i F ′ F i i idea: keep B i unchanged RK i RK ′ i B i + 4 = B i A i + 1 B i + 1 B i C i + 1 D i + 1 when does this happen? F i + 1 F ′ i + 1 F i + 3 ( B i + 3 ) = F ′ i + 1 ( D i + 1 ) RK i + 1 RK ′ i + 1 B i ⊕ F ′ B i ⊕ F ′ i + 1 ( D i + 1 ) i + 1 ( D i + 1 ) A i + 2 B i + 2 C i + 2 D i + 2 F i + 2 F ′ i + 2 RK i + 2 RK ′ i + 2 B i ⊕ F ′ B i ⊕ F ′ i + 1 ( D i + 1 ) i + 1 ( D i + 1 ) A i + 3 B i + 3 C i + 3 D i + 3 F ′ F i + 3 i + 3 B i RK ′ RK i + 3 i + 3 A i + 4 B i + 4 C i + 4 D i + 4 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 15 / 31

Cancellation Property [BDLF09] A i B i C i D i F ′ F i i idea: keep B i unchanged RK i RK ′ i B i + 4 = B i A i + 1 B i + 1 B i C i + 1 D i + 1 when does this happen? F i + 1 F ′ i + 1 F i + 3 ( B i + 3 ) = F ′ i + 1 ( D i + 1 ) RK i + 1 RK ′ i + 1 or more specific: B i ⊕ F ′ B i ⊕ F ′ i + 1 ( D i + 1 ) i + 1 ( D i + 1 ) F i + 2 ( B i + 2 ) = 0 D i + 1 A i + 2 B i + 2 C i + 2 D i + 2 RK i + 3 = RK ′ 0 F i + 2 F ′ i + 1 i + 2 D i + 1 RK i + 2 RK ′ i + 2 second case: B i ⊕ F ′ B i ⊕ F ′ i + 1 ( D i + 1 ) i + 1 ( D i + 1 ) A i + 3 B i + 3 C i + 3 D i + 3 two 128-bit conditions F ′ F i + 3 i + 3 but easier to fulfill B i RK ′ RK i + 3 i + 3 conditions can be “interleaved” A i + 4 B i + 4 C i + 4 D i + 4 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 15 / 31

Interleaving interleave cancellation property with same value Z = B i = B i + 4 Z = B i + 2 = B i + 4 Martin Schl¨ affer Africacrypt 2010 Cryptanalysis of SHAvite-3-512 16 / 31