Sound Hashing Modes of Arbitrary Functions, Permutations, and Block - PowerPoint PPT Presentation

Sound Hashing Modes of Arbitrary Functions, Permutations, and Block Ciphers (SoK) Joan Daemen 1 Bart Mennink 1 Gilles Van Assche 2 Fast Software Encryption Paris, March 2019 1 Radboud University 2 STMicroelectronics 1

M 4 pad Hash function example 1: SHA-256 F Underlying primitive: block cipher with 256-bit block and 512-bit key 1 CV i data path mess. expans. M i CV i Compression function F from block cipher B with Davies-Meyer : digest CV Hash function h from compression function F with Merkle-Damgård : F CV M 3 F CV M 2 F M 1 IV 2

Hash function example 1: SHA-256 M 3 Underlying primitive: block cipher with 256-bit block and 512-bit key 1 CV i data path mess. expans. M i CV i Compression function F from block cipher B with Davies-Meyer : F CV F Hash function h from compression function F with Merkle-Damgård : CV 2 F CV IV M 1 F M 2 M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest

Hash function example 1: SHA-256 F Underlying primitive: block cipher with 256-bit block and 512-bit key data path mess. expans. M i CV i Compression function F from block cipher B with Davies-Meyer : F CV Hash function h from compression function F with Merkle-Damgård : F CV M 3 2 IV M 1 CV M 2 F M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest ❍❍❍❍❍❍❍ ❍ ✲ ✲ ✲ ✲ CV i + 1 ⊕ ✻

Hash function example 1: SHA-256 F Underlying primitive: block cipher with 256-bit block and 512-bit key data path mess. expans. M i CV i Compression function F from block cipher B with Davies-Meyer : F CV Hash function h from compression function F with Merkle-Damgård : F CV M 3 2 IV M 1 CV M 2 F M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest ❍❍❍❍❍❍❍ ❍ ✲ ✲ ✲ ✲ CV i + 1 ⊕ ✻

� � π π Example 2: MD6 [Rivest et al. 2008] Hash function h from CF F with dedicated tree hash mode: CF F from permutation P with dedicated construction: Underlying primitive: 5696-bit permutation 3

π π Example 2: MD6 [Rivest et al. 2008] Hash function h from CF F with dedicated tree hash mode: Underlying primitive: 5696-bit permutation CF F from permutation P with dedicated construction: 3 � � Location (level,index) input to each node level (2,0) (2,1) (2,2) (2,3) 3 2 1 0

Example 2: MD6 [Rivest et al. 2008] CF F from permutation P with dedicated construction: Underlying primitive: 5696-bit permutation Hash function h from CF F with dedicated tree hash mode: 3 � � Location (level,index) input to each node level (2,0) (2,1) (2,2) (2,3) 3 2 1 0 key+UV data const 15 8+2 64 89 words N Map 1-1 map π Prepend 89 words π ( N ) 16 words C Chop

Example 2: MD6 [Rivest et al. 2008] CF F from permutation P with dedicated construction: Underlying primitive: 5696-bit permutation Hash function h from CF F with dedicated tree hash mode: 3 � � Location (level,index) input to each node level (2,0) (2,1) (2,2) (2,3) 3 2 1 0 key+UV data const 15 8+2 64 89 words N Map 1-1 map π Prepend 89 words π ( N ) 16 words C Chop

Example 3: KangarooTwelve [Keccak Team 2016] Parallel XOF from XOF with Sakura-encoded [KT 2014] tree hash mode: XOF from permutation with sponge [KT 2008] : Underlying primitive: 1600-bit permutation Keccak- p 12 4

Example 3: KangarooTwelve [Keccak Team 2016] Parallel XOF from XOF with Sakura-encoded [KT 2014] tree hash mode: Underlying primitive: 1600-bit permutation Keccak- p 12 XOF from permutation with sponge [KT 2008] : 4 S 1 S 2 S 3 S n -2 S n -1 110 110 110 110 110 110 * S 0 CV CV CV … CV CV n -1 FFFF 01

Example 3: KangarooTwelve [Keccak Team 2016] Parallel XOF from XOF with Sakura-encoded [KT 2014] tree hash mode: Underlying primitive: 1600-bit permutation Keccak- p 12 XOF from permutation with sponge [KT 2008] : 4 S 1 S 2 S 3 S n -2 S n -1 110 110 110 110 110 110 * S 0 CV CV CV … CV CV n -1 FFFF 01 M pad trunc Z r 0 f f f f f f outer inner c 0 absorbing squeezing

Example 3: KangarooTwelve [Keccak Team 2016] Parallel XOF from XOF with Sakura-encoded [KT 2014] tree hash mode: XOF from permutation with sponge [KT 2008] : 4 S 1 S 2 S 3 S n -2 S n -1 110 110 110 110 110 110 * S 0 CV CV CV … CV CV n -1 FFFF 01 M pad trunc Z r 0 f f f f f f outer inner c 0 absorbing squeezing Underlying primitive: 1600-bit permutation Keccak- p [ 12 ]

Basis for security of hash functions Trust in security based on public scrutiny and cryptanalysis But we can prove security of idealized version of the function … is h with underlying primitive replaced by random one Ideal hash function: random oracle Upper bound on advantage of distinguishing from this bound says something about the mode only better attacks must exploit specific properties of primitive In other words, they bound the success probability of generic attacks 5 ▶ We cannot prove a hash function h is secure

Basis for security of hash functions But we can prove security of idealized version of the function … is h with underlying primitive replaced by random one Ideal hash function: random oracle Upper bound on advantage of distinguishing from this bound says something about the mode only better attacks must exploit specific properties of primitive In other words, they bound the success probability of generic attacks 5 ▶ We cannot prove a hash function h is secure ▶ Trust in security based on public scrutiny and cryptanalysis

Basis for security of hash functions Ideal hash function: random oracle Upper bound on advantage of distinguishing from this bound says something about the mode only better attacks must exploit specific properties of primitive In other words, they bound the success probability of generic attacks 5 ▶ We cannot prove a hash function h is secure ▶ Trust in security based on public scrutiny and cryptanalysis ▶ But we can prove security of idealized version H of the function • … H is h with underlying primitive replaced by random one

Basis for security of hash functions In other words, they bound the success probability of generic attacks 5 ▶ We cannot prove a hash function h is secure ▶ Trust in security based on public scrutiny and cryptanalysis ▶ But we can prove security of idealized version H of the function • … H is h with underlying primitive replaced by random one ▶ Ideal hash function: random oracle RO ▶ Upper bound on advantage of distinguishing H from RO • this bound says something about the mode only • better attacks must exploit specific properties of primitive

attacks Basis for security of hash functions 5 ▶ We cannot prove a hash function h is secure ▶ Trust in security based on public scrutiny and cryptanalysis ▶ But we can prove security of idealized version H of the function • … H is h with underlying primitive replaced by random one ▶ Ideal hash function: random oracle RO ▶ Upper bound on advantage of distinguishing H from RO • this bound says something about the mode only • better attacks must exploit specific properties of primitive ▶ In other words, they bound the success probability of generic

M 4 pad What can happen if you don’t have a good bound? digest Affect all old-style hash standards: MD5, SHA-1 and all SHA-2 herding attack, … multi-collisions 2nd pre-image for long messages Attacks with less complexity than expected fixing requires adding expensive construction: HMAC MAC function h K M not secure against forgery Length extension property CV F IV F CV M 3 F CV M 2 F M 1 6

What can happen if you don’t have a good bound? CV Affect all old-style hash standards: MD5, SHA-1 and all SHA-2 herding attack, … multi-collisions 2nd pre-image for long messages Attacks with less complexity than expected fixing requires adding expensive construction: HMAC MAC function h K M not secure against forgery Length extension property F CV F IV 6 M 3 CV F M 1 F M 2 M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest

What can happen if you don’t have a good bound? M 3 Affect all old-style hash standards: MD5, SHA-1 and all SHA-2 herding attack, … multi-collisions 2nd pre-image for long messages Attacks with less complexity than expected fixing requires adding expensive construction: HMAC MAC function h K M not secure against forgery F CV F IV CV 6 F CV M 1 F M 2 M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest ▶ Length extension property

What can happen if you don’t have a good bound? M 3 Affect all old-style hash standards: MD5, SHA-1 and all SHA-2 herding attack, … multi-collisions 2nd pre-image for long messages Attacks with less complexity than expected fixing requires adding expensive construction: HMAC F CV F IV CV 6 F M 1 F M 2 CV M 4 pad ❍❍❍ ❍❍❍ ❍❍❍ ❍❍❍ ✲ ✲ ✲ ✲ ❍ ❍ ❍ ❍ ✲ ✲ ✲ ✲ ✲ digest ▶ Length extension property • MAC function h ( K | M ) not secure against forgery