Rebound Attack Florian Mendel Institute for Applied Information - PowerPoint PPT Presentation

Rebound Attack Florian Mendel Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria http://www.iaik.tugraz.at/

Outline Motivation 1 2 Whirlpool Hash Function Application of the Rebound Attack 3 Summary 4

SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt

SHA-3 competition Abacus ECHO Lesamnta SHAMATA ARIRANG ECOH Luffa SHAvite-3 AURORA Edon-R LUX SIMD BLAKE EnRUPT Maraca Skein Blender ESSENCE MCSSHA-3 Spectral Hash Blue Midnight Wish FSB MD6 StreamHash Boole Fugue MeshHash SWIFFTX Cheetah Grøstl NaSHA Tangle CHI Hamsi NKS2D TIB3 CRUNCH HASH 2X Ponic Twister CubeHash JH SANDstorm Vortex DCH Keccak Sarmal WaMM Dynamic SHA Khichidi-1 Sgàil Waterfall Dynamic SHA2 LANE Shabal ZK-Crypt

The Rebound Attack [MRST09] Tool in the differential cryptanalysis of hash functions Invented during the design of Grøstl AES-based designs allow a simple application of the idea Has been applied to a wide range of hash functions Echo, Grøstl, JH, Lane, Luffa, Maelstrom, Skein, Twister, Whirlpool, . . .

The Rebound Attack E bw E in E fw inbound outbound outbound Applies to block cipher and permutation based designs: E = E fw ◦ E in ◦ E bw P = P fw ◦ P in ◦ P bw

The Rebound Attack E bw E in E fw inbound outbound outbound Inbound phase efficient meet-in-the-middle phase in E in using available degrees of freedom Outbound phase probabilistic part in E bw and E fw repeat inbound phase if needed

The Whirlpool Hash Function M 1 M 2 M 3 M t f f f f H ( m ) IV designed by Barretto and Rijmen [BR00] evaluated by NESSIE standardized by ISO/IEC 10118-3:2003 iterative, based on the Merkle-Damg˚ ard design principle message block, chaining values, hash size: 512 bit

The Whirlpool Compression Function key schedule H j − 1 SB SC MR AC state update M j H j SB SC MR AK 512-bit hash value and using 512-bit message blocks Block-cipher based design (similar to AES) Miyaguchi-Preneel mode with conservative key schedule

The Whirlpool Round Transformations SubBytes ShiftColumns MixRows AddRoundKey K i S(x) + The state update and the key schedule update an 8 × 8 state S and K of 64 bytes 10 rounds each AES like round transformation r i = AK ◦ MR ◦ SC ◦ SB

Notations Round i C i K SB K SC K MR K i − 1 K i i i i SB SC MR AC S SB S SC S MR S i − 1 S i i i i SB SC MR AK

Collision Attack on Whirlpool key schedule H j − 1 SB SC MR AC state update M j H j SB SC MR AK 1-block collision: fixed H j − 1 (to IV ) f ( M j , H j − 1 ) = f ( M ∗ j , H j − 1 ) , M j � = M ∗ j generic complexity 2 256 ( n = 512)

Collision Attack on Whirlpool key schedule H j − 1 SB SC MR AC state update ∆ M j H j SB SC MR AK 1-block collision: fixed H j − 1 (to IV ) f ( M j , H j − 1 ) = f ( M ∗ j , H j − 1 ) , M j � = M ∗ j generic complexity 2 256 ( n = 512)

Collision Attack on 4 Rounds K 0 K 1 K 2 K 3 K 4 SB SB SB SB IV SC SC SC SC MR MR MR MR AC AC AC AC S 0 S 3 S 1 S 2 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK Differential trail with minimum number of active S-boxes 81 for any 4-round trail (1 → 8 → 64 → 8) maximum differential probability: ( 2 − 5 ) 81 = 2 − 405

Collision Attack on 4 Rounds K 0 K 1 K 2 K 3 K 4 constant SB SB SB SB IV SC SC SC SC MR MR MR MR AC AC AC AC S 0 S 3 S 1 S 2 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK Differential trail with minimum number of active S-boxes 81 for any 4-round trail (1 → 8 → 64 → 8) maximum differential probability: ( 2 − 5 ) 81 = 2 − 405

Collision Attack on 4 Rounds K 0 K 1 K 2 K 3 K 4 constant SB SB SB SB IV SC SC SC SC MR MR MR MR AC AC AC AC S 0 S 3 S 1 S 2 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK Differential trail with minimum number of active S-boxes 81 for any 4-round trail (1 → 8 → 64 → 8) maximum differential probability: ( 2 − 5 ) 81 = 2 − 405 How to find a message pair following the differential trail?

First: Use Truncated Differences S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK byte-wise truncated differences: active / not active we do not mind about actual differences single active byte at input and output is enough probabilistic in MixRows: 2 − 56 for 8 → 1 we can remove many restrictions (more freedom) hopefully less complexity of message search

How to Find a Message Pair? S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK message modification?

How to Find a Message Pair? S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK message modification? meet in the middle?

How to Find a Message Pair? S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK message modification? meet in the middle? inside out?

How to Find a Message Pair? S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK message modification? meet in the middle? inside out? rebound!

Rebound Attack on 4 Rounds [MRST09] S 0 S 1 S 2 S 3 S 4 SB SB SB SB M 1 SC SC SC SC H 1 MR MR MR MR AK AK AK AK outbound phase inbound phase outbound phase Inbound phase (1) start with differences in round 2 and 3 (2) match-in-the-middle at S-box using values of the state Outbound phase (3) probabilistic propagation in MixRows in round 1 and 4 (4) match one-byte difference of feed-forward

Inbound Phase S SB S SC S MR S 2 2 3 3 3a c0 e6 MR SC b9 SB 5a AK MR 8c 08 c0 get values (1) Start with arbitrary differences in state S MR 3

Inbound Phase S SB S SC S MR S 2 2 3 3 e8 f4 90 d4 75 1b 5e cd 3a 85 50 cc 6d 9a 49 43 c5 c0 0d cc 01 0a 70 43 e9 27 e6 MR a2 b1 63 11 96 1e 4d 04 SC b9 SB b1 60 20 f4 1e cd bf 10 5a AK MR f8 ed 85 b7 43 5a d5 fc 8c 16 27 51 43 15 de 2b f8 08 4d 34 96 90 f1 f8 07 5e c0 differences get values (1) Start with arbitrary differences in state S MR 3 linearly propagate all differences backward to S SB 3

Inbound Phase S SB S SC S MR S 2 2 3 3 ee ee ee 9f ee 23 71 c1 cd e8 f4 90 d4 75 1b 5e cd 3a 85 50 cc 6d 9a 49 43 c5 c0 0d cc 01 0a 70 43 e9 27 e6 MR a2 b1 63 11 96 1e 4d 04 SC b9 SB b1 60 20 f4 1e cd bf 10 5a AK MR f8 ed 85 b7 43 5a d5 fc 8c 16 27 51 43 15 de 2b f8 08 4d 34 96 90 f1 f8 07 5e c0 differences differences get values (1) Start with arbitrary differences in state S MR 3 linearly propagate all differences backward to S SB 3 linearly propagate row-wise forward from S SC to S 2 2

Inbound Phase S SB S SC S MR S 2 2 3 3 ee ee ee 9f ee 23 71 c1 cd e8 f4 90 d4 75 1b 5e cd 3a 85 50 cc 6d 9a 49 43 c5 c0 0d cc 01 0a 70 43 e9 27 e6 ? MR a2 b1 63 11 96 1e 4d 04 SC b9 SB b1 60 20 f4 1e cd bf 10 5a AK MR f8 ed 85 b7 43 5a d5 fc 8c 16 27 51 43 15 de 2b f8 08 4d 34 96 90 f1 f8 07 5e c0 differences match differences differences get values get values (1) Start with arbitrary differences in state S MR 3 linearly propagate all differences backward to S SB 3 linearly propagate row-wise forward from S SC to S 2 2 (2) Match-in-the-middle at SubBytes layer check if differences can be connected (for each S-box) with probability 2 − xx we get 2 xx solutions for each row

Match-in-the-Middle for Single S-box ∆ a Sbox ∆ b Check for matching input/output differences Sbox ( x ) ⊕ Sbox ( x ⊕ ∆ a ) = ∆ b Use Difference Distribution Table (DDT)

Difference Distribution Table (Whirlpool) in \ out 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 01 0 6 2 0 0 6 2 0 0 0 4 0 0 0 0 0 02 0 0 0 0 0 0 0 2 0 0 0 0 4 0 0 0 03 0 2 2 0 2 2 0 0 2 0 0 0 0 0 0 2 04 0 0 2 2 0 4 0 0 0 2 2 2 2 0 2 0 05 0 0 0 0 0 2 0 2 0 0 0 0 0 0 4 2 06 . 4 0 2 0 0 2 0 0 2 6 2 4 0 2 2 0 . 07 . 0 2 2 0 0 2 0 0 4 0 2 0 2 0 2 0 . 08 . 0 0 0 0 2 2 2 0 0 0 0 2 2 4 4 0 . 09 8 0 0 0 2 4 2 2 0 0 0 0 0 2 0 2 0a 0 0 0 0 2 0 2 0 2 0 2 0 0 0 0 0 0b 8 2 2 2 2 0 0 0 0 2 2 2 2 2 0 4 0c 0 2 2 0 0 0 0 4 0 2 2 0 0 2 4 2 0d 0 2 2 0 0 2 4 4 0 0 2 2 0 0 0 2 0e 4 0 4 2 0 0 0 0 2 0 2 0 4 2 0 0 0f 0 2 0 0 0 2 0 0 0 0 0 0 2 0 2 2 . . . Differences can be connected if there is a non-zero entry in the table