The Experts below are selected from a list of 54540 Experts worldwide ranked by ideXlab platform

Martin Schlaffer - One of the best experts on this subject based on the ideXlab platform.

  • distinguishers for the Compression Function and output transformation of hamsi 256
    Australasian Conference on Information Security and Privacy, 2010
    Co-Authors: Jeanphilippe Aumasson, Krystian Matusiewicz, Thomas Peyrin, Emilia Kasper, Lars R Knudsen, Rune S Odegard, Martin Schlaffer
    Abstract:

    Hamsi is one of 14 remaining candidates in NIST's Hash Competition for the future hash standard SHA-3. Until now, little analysis has been published on its resistance to differential cryptanalysis, the main technique used to attack hash Functions. We present a study of Hamsi's resistance to differential and higher-order differential cryptanalysis, with focus on the 256-bit version of Hamsi. Our main results are efficient distinguishers and near-collisions for its full (3-round) Compression Function, and distinguishers for its full (6-round) finalization Function, indicating that Hamsi's building blocks do not behave ideally.

  • cryptanalysis of the 10 round hash and full Compression Function of shavite 3 512
    Lecture Notes in Computer Science, 2010
    Co-Authors: Praveen Gauravaram, Maria Nayaplasencia, Florian Mendel, Christian Rechberger, Gaetan Leurent, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we analyze the SHAvite-3-512 hash Function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash Function SHAvite-3-512, and on the full 14 round Compression Function of SHAvite-3-512. We show a second preimage attack on the hash Function reduced to 10 rounds with a complexity of 2497 Compression Function evaluations and 216 memory. For the full 14-round Compression Function, we give a chosen counter, chosen salt preimage attack with 2384 Compression Function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 Compression Function evaluations and 2128 memory.

  • rebound distinguishers results on the full whirlpool Compression Function
    International Conference on the Theory and Application of Cryptology and Information Security, 2009
    Co-Authors: Mario Lamberger, Florian Mendel, Christian Rechberger, Vincent Rijmen, Martin Schlaffer
    Abstract:

    Whirlpool is a hash Function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full Compression Function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the Compression Function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round Compression Function of Whirlpool. This is the first result on the full Whirlpool Compression Function.

  • improved cryptanalysis of the reduced grostl Compression Function echo permutation and aes block cipher
    Selected Areas in Cryptography, 2009
    Co-Authors: Florian Mendel, Christian Rechberger, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we propose two new ways to mount attacks on the SHA-3 candidates Grostl, and ECHO, and apply these attacks also to the AES. Our results improve upon and extend the rebound attack. Using the new techniques, we are able to extend the number of rounds in which available degrees of freedom can be used. As a result, we present the first attack on 7 rounds for the Grostl-256 output transformation and improve the semi-free-start collision attack on 6 rounds. Further, we present an improved known-key distinguisher for 7 rounds of the AES block cipher and the internal permutation used in ECHO.

  • the rebound attack cryptanalysis of reduced whirlpool and grostl
    Fast Software Encryption, 2009
    Co-Authors: Florian Mendel, Martin Schlaffer, Christian Rechberger, Soren S Thomsen
    Abstract:

    In this work, we propose the rebound attack, a new tool for the cryptanalysis of hash Functions. The idea of the rebound attack is to use the available degrees of freedom in a collision attack to efficiently bypass the low probability parts of a differential trail. The rebound attack consists of an inbound phase with a match-in-the-middle part to exploit the available degrees of freedom, and a subsequent probabilistic outbound phase. Especially on AES based hash Functions, the rebound attack leads to new attacks for a surprisingly high number of rounds. We use the rebound attack to construct collisions for 4.5 rounds of the 512-bit hash Function Whirlpool with a complexity of 2120 Compression Function evaluations and negligible memory requirements. The attack can be extended to a near-collision on 7.5 rounds of the Compression Function of Whirlpool and 8.5 rounds of the similar hash Function Maelstrom. Additionally, we apply the rebound attack to the SHA-3 submission Grostl, which leads to an attack on 6 rounds of the Grostl-256 Compression Function with a complexity of 2120 and memory requirements of about 264.

Florian Mendel - One of the best experts on this subject based on the ideXlab platform.

  • r1 r2 r3 r4 r5 r6 r7 r8 r9
    2016
    Co-Authors: Florian Mendel, Christian Rechberger, Round Round, Round Round Round
    Abstract:

    Abstract. In this paper, we present a pseudo-collision attack on the Compression Function of all Twister variants (224,256,384,512) with complexity of about 226.5 Compression Function evalua-tions. We show how the Compression Function attack can be extended to construct collisions for Twister-512 slightly faster than brute force search. Furthermore, we present a second-preimage at-tack for Twister-512 with complexity of about 2448 Compression Function evaluations and memory requirement of 264 1 Description of Twister The hash Function Twister is an iterated hash Function based on the Merkle-Damg̊ard design principle. It processes message blocks of 512 bits and produces a hash value of 224, 256, 384, or 512 bits. If the message length is not a multiple of 512, an unambiguous padding method is applied. For the description of the padding method we refer to [1]. Let m = m1‖m2 ‖ · · · ‖mt be a t-block message (after padding). The hash value h = H(m) is computed as follows: H0 = IV Hi = f(Hi−1,Mi) for 0 < i ≤ t Ht+1 = f(Ht, C) = h, where IV is a predefined initial value and C is the value of the checksum. It is computed from the intermediate values of the internal state after each Mini-Round. Note that while for Twister-224/256 the checksum is optional it is mandatory for Twister-384/512. The Compression Function of Twister basically consists of 3 Maxi-Rounds. Each Maxi-Rounds consist of 3 or 4 Mini-Rounds (depending on the output size of Twister) and is followed by a feed-forward XOR-operation

  • cryptanalysis of the 10 round hash and full Compression Function of shavite 3 512
    Lecture Notes in Computer Science, 2010
    Co-Authors: Praveen Gauravaram, Maria Nayaplasencia, Florian Mendel, Christian Rechberger, Gaetan Leurent, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we analyze the SHAvite-3-512 hash Function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash Function SHAvite-3-512, and on the full 14 round Compression Function of SHAvite-3-512. We show a second preimage attack on the hash Function reduced to 10 rounds with a complexity of 2497 Compression Function evaluations and 216 memory. For the full 14-round Compression Function, we give a chosen counter, chosen salt preimage attack with 2384 Compression Function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 Compression Function evaluations and 2128 memory.

  • rebound distinguishers results on the full whirlpool Compression Function
    International Conference on the Theory and Application of Cryptology and Information Security, 2009
    Co-Authors: Mario Lamberger, Florian Mendel, Christian Rechberger, Vincent Rijmen, Martin Schlaffer
    Abstract:

    Whirlpool is a hash Function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full Compression Function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the Compression Function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round Compression Function of Whirlpool. This is the first result on the full Whirlpool Compression Function.

  • improved cryptanalysis of the reduced grostl Compression Function echo permutation and aes block cipher
    Selected Areas in Cryptography, 2009
    Co-Authors: Florian Mendel, Christian Rechberger, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we propose two new ways to mount attacks on the SHA-3 candidates Grostl, and ECHO, and apply these attacks also to the AES. Our results improve upon and extend the rebound attack. Using the new techniques, we are able to extend the number of rounds in which available degrees of freedom can be used. As a result, we present the first attack on 7 rounds for the Grostl-256 output transformation and improve the semi-free-start collision attack on 6 rounds. Further, we present an improved known-key distinguisher for 7 rounds of the AES block cipher and the internal permutation used in ECHO.

  • the rebound attack cryptanalysis of reduced whirlpool and grostl
    Fast Software Encryption, 2009
    Co-Authors: Florian Mendel, Martin Schlaffer, Christian Rechberger, Soren S Thomsen
    Abstract:

    In this work, we propose the rebound attack, a new tool for the cryptanalysis of hash Functions. The idea of the rebound attack is to use the available degrees of freedom in a collision attack to efficiently bypass the low probability parts of a differential trail. The rebound attack consists of an inbound phase with a match-in-the-middle part to exploit the available degrees of freedom, and a subsequent probabilistic outbound phase. Especially on AES based hash Functions, the rebound attack leads to new attacks for a surprisingly high number of rounds. We use the rebound attack to construct collisions for 4.5 rounds of the 512-bit hash Function Whirlpool with a complexity of 2120 Compression Function evaluations and negligible memory requirements. The attack can be extended to a near-collision on 7.5 rounds of the Compression Function of Whirlpool and 8.5 rounds of the similar hash Function Maelstrom. Additionally, we apply the rebound attack to the SHA-3 submission Grostl, which leads to an attack on 6 rounds of the Grostl-256 Compression Function with a complexity of 2120 and memory requirements of about 264.

Christian Rechberger - One of the best experts on this subject based on the ideXlab platform.

  • r1 r2 r3 r4 r5 r6 r7 r8 r9
    2016
    Co-Authors: Florian Mendel, Christian Rechberger, Round Round, Round Round Round
    Abstract:

    Abstract. In this paper, we present a pseudo-collision attack on the Compression Function of all Twister variants (224,256,384,512) with complexity of about 226.5 Compression Function evalua-tions. We show how the Compression Function attack can be extended to construct collisions for Twister-512 slightly faster than brute force search. Furthermore, we present a second-preimage at-tack for Twister-512 with complexity of about 2448 Compression Function evaluations and memory requirement of 264 1 Description of Twister The hash Function Twister is an iterated hash Function based on the Merkle-Damg̊ard design principle. It processes message blocks of 512 bits and produces a hash value of 224, 256, 384, or 512 bits. If the message length is not a multiple of 512, an unambiguous padding method is applied. For the description of the padding method we refer to [1]. Let m = m1‖m2 ‖ · · · ‖mt be a t-block message (after padding). The hash value h = H(m) is computed as follows: H0 = IV Hi = f(Hi−1,Mi) for 0 < i ≤ t Ht+1 = f(Ht, C) = h, where IV is a predefined initial value and C is the value of the checksum. It is computed from the intermediate values of the internal state after each Mini-Round. Note that while for Twister-224/256 the checksum is optional it is mandatory for Twister-384/512. The Compression Function of Twister basically consists of 3 Maxi-Rounds. Each Maxi-Rounds consist of 3 or 4 Mini-Rounds (depending on the output size of Twister) and is followed by a feed-forward XOR-operation

  • cryptanalysis of the 10 round hash and full Compression Function of shavite 3 512
    Lecture Notes in Computer Science, 2010
    Co-Authors: Praveen Gauravaram, Maria Nayaplasencia, Florian Mendel, Christian Rechberger, Gaetan Leurent, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we analyze the SHAvite-3-512 hash Function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash Function SHAvite-3-512, and on the full 14 round Compression Function of SHAvite-3-512. We show a second preimage attack on the hash Function reduced to 10 rounds with a complexity of 2497 Compression Function evaluations and 216 memory. For the full 14-round Compression Function, we give a chosen counter, chosen salt preimage attack with 2384 Compression Function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 Compression Function evaluations and 2128 memory.

  • rebound distinguishers results on the full whirlpool Compression Function
    International Conference on the Theory and Application of Cryptology and Information Security, 2009
    Co-Authors: Mario Lamberger, Florian Mendel, Christian Rechberger, Vincent Rijmen, Martin Schlaffer
    Abstract:

    Whirlpool is a hash Function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full Compression Function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the Compression Function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round Compression Function of Whirlpool. This is the first result on the full Whirlpool Compression Function.

  • improved cryptanalysis of the reduced grostl Compression Function echo permutation and aes block cipher
    Selected Areas in Cryptography, 2009
    Co-Authors: Florian Mendel, Christian Rechberger, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we propose two new ways to mount attacks on the SHA-3 candidates Grostl, and ECHO, and apply these attacks also to the AES. Our results improve upon and extend the rebound attack. Using the new techniques, we are able to extend the number of rounds in which available degrees of freedom can be used. As a result, we present the first attack on 7 rounds for the Grostl-256 output transformation and improve the semi-free-start collision attack on 6 rounds. Further, we present an improved known-key distinguisher for 7 rounds of the AES block cipher and the internal permutation used in ECHO.

  • the rebound attack cryptanalysis of reduced whirlpool and grostl
    Fast Software Encryption, 2009
    Co-Authors: Florian Mendel, Martin Schlaffer, Christian Rechberger, Soren S Thomsen
    Abstract:

    In this work, we propose the rebound attack, a new tool for the cryptanalysis of hash Functions. The idea of the rebound attack is to use the available degrees of freedom in a collision attack to efficiently bypass the low probability parts of a differential trail. The rebound attack consists of an inbound phase with a match-in-the-middle part to exploit the available degrees of freedom, and a subsequent probabilistic outbound phase. Especially on AES based hash Functions, the rebound attack leads to new attacks for a surprisingly high number of rounds. We use the rebound attack to construct collisions for 4.5 rounds of the 512-bit hash Function Whirlpool with a complexity of 2120 Compression Function evaluations and negligible memory requirements. The attack can be extended to a near-collision on 7.5 rounds of the Compression Function of Whirlpool and 8.5 rounds of the similar hash Function Maelstrom. Additionally, we apply the rebound attack to the SHA-3 submission Grostl, which leads to an attack on 6 rounds of the Grostl-256 Compression Function with a complexity of 2120 and memory requirements of about 264.

Mridul Nandi - One of the best experts on this subject based on the ideXlab platform.

  • characterizing padding rules of md hash Functions preserving collision security
    Australasian Conference on Information Security and Privacy, 2009
    Co-Authors: Mridul Nandi
    Abstract:

    This paper characterizes collision preserving padding rules and provides variants of Merkle-Damgard (MD) which are having less or no overhead costs due to length. We first show that suffix-free property of padding rule is necessary as well as sufficient to preserve the collision security of MD hash Function for an arbitrary domain {0,1}*. Knowing this, we propose a simple suffix-free padding rule padding only log|M | bits for a message M , which is less than that of Damgard's and Sarkar's padding rules. We also prove that the length-padding is not absolutely necessary. We show that a simple variant of MD with 10 d -padding (or any injective padding) is collision resistant provided that the underlying Compression Function is collision resistant after chopping the last-bit. Finally, we design another variant of MD hash Function preserving all three basic security notions of hash Functions, namely collision and (2nd) preimage, which is an improvement over a recently designed (SAC-08) three-property preserving hash Function.

  • improved indifferentiability security analysis of chopmd hash Function
    Fast Software Encryption, 2008
    Co-Authors: Donghoon Chang, Mridul Nandi
    Abstract:

    The classical design principle Merkle-Damgard [13,6] is scrutinized by many ways such as Joux's multicollision attack, Kelsey-Schneier second preimage attack etc. In TCC'04, Maurer et al. introduced a strong security notion called as "indifferentiability" for a hash Function based on a Compression Function. The classical design principle is also insecure against this strong security notion whereas chopMD hash is secure with the security bound roughly i¾?2/2swhere sis the number of chopped bits and i¾?is the total number of message blocks queried by a distinguisher. In case of n= 2swhere nis the output size of a Compression Function, the value i¾?to get a significant bound is 2s/2which is the birthday complexity, where the hash output size is s-bit. In this paper, we present an improved security bound for chopMD. The improved bound shown in this paper is (3(ni¾? s) + 1)q/2s+ q/2ni¾? si¾? 1+ i¾?2/2n+ 1where qis the total number of queries. In case of n= 2s, chopMD is indifferentiably-secure if q= O(2s/(3s+ 1)) and i¾?= O(2n/2) which are beyond the birthday complexity. We also present a design principle for an n-bit hash Function based on a Compression Function $f : {0,1}^{2n+b} {\Rightarrow} {0,1}^n$ and show that the indifferentiability security bound for this hash Function is roughly (3n+ 1)i¾?/2n. So, the new design of hash Function is second-preimage and r-multicollision secure as long as the query complexity (the number of message blocks queried) of an attacker is less than 2n/(3n+ 1) or 2n(ri¾? 1)/rrespectively.

  • general distinguishing attacks on nmac and hmac with birthday attack complexity
    IACR Cryptology ePrint Archive, 2006
    Co-Authors: Donghoon Chang, Mridul Nandi
    Abstract:

    Kim et al. [4] and Contini et al. [3] studied on the security of HMAC and NMAC based on HAVAL, MD4, MD5, SHA-0 and SHA-1. Especially, they considered the distinguishing attacks. However, they did not describe generic distinguishing attacks on NMAC and HMAC. In this paper, we describe the generic distinguishers to distinguish NMAC and HMAC with the birthday attack complexity and we prove the security bound when the underlying Compression Function is the random oracle.

  • security analysis of a 2 3 rate double length Compression Function in the black box model
    Fast Software Encryption, 2005
    Co-Authors: Mridul Nandi, Kouichi Sakurai
    Abstract:

    In this paper, we propose a 2/3-rate double length Compression Function and study its security in the black-box model. We prove that to get a collision attack for the Compression Function requires Ω(22 n/3) queries, where n is the single length output size. Thus, it has better security than a most secure single length Compression Function. This construction is more efficient than the construction given in [8]. Also the three computations of underlying Compression Functions can be done in parallel. The proof idea uses a concept of computable message which can be helpful to study security of other constructions like [8],[14],[16] etc.

Thomas Peyrin - One of the best experts on this subject based on the ideXlab platform.

  • practical free start collision attacks on 76 step sha 1
    International Cryptology Conference, 2015
    Co-Authors: Pierre Karpman, Thomas Peyrin, Marc Stevens
    Abstract:

    In this paper we analyze the security of the Compression Function of SHA-1 against collision attacks, or equivalently free-start collisions on the hash Function. While a lot of work has been dedicated to the analysis of SHA-1 in the past decade, this is the first time that free-start collisions have been considered for this Function. We exploit the additional freedom provided by this model by using a new start-from-the-middle approach in combination with improvements on the cryptanalysis tools that have been developed for SHA-1 in the recent years. This results in particular in better differential paths than the ones used for hash Function collisions so far. Overall, our attack requires about \(2^{50}\) evaluations of the Compression Function in order to compute a one-block free-start collision for a 76-step reduced version, which is so far the highest number of steps reached for a collision on the SHA-1 Compression Function. We have developed an efficient GPU framework for the highly branching code typical of a cryptanalytic collision attack and used it in an optimized implementation of our attack on recent GTX 970 GPUs. We report that a single cheap US$ 350 GTX 970 is sufficient to find the collision in less than 5 days. This showcases how recent mainstream GPUs seem to be a good platform for expensive and even highly-branching cryptanalysis computations. Finally, our work should be taken as a reminder that cryptanalysis on SHA-1 continues to improve. This is yet another proof that the industry should quickly move away from using this Function.

  • distinguishers for the Compression Function and output transformation of hamsi 256
    Australasian Conference on Information Security and Privacy, 2010
    Co-Authors: Jeanphilippe Aumasson, Krystian Matusiewicz, Thomas Peyrin, Emilia Kasper, Lars R Knudsen, Rune S Odegard, Martin Schlaffer
    Abstract:

    Hamsi is one of 14 remaining candidates in NIST's Hash Competition for the future hash standard SHA-3. Until now, little analysis has been published on its resistance to differential cryptanalysis, the main technique used to attack hash Functions. We present a study of Hamsi's resistance to differential and higher-order differential cryptanalysis, with focus on the 256-bit version of Hamsi. Our main results are efficient distinguishers and near-collisions for its full (3-round) Compression Function, and distinguishers for its full (6-round) finalization Function, indicating that Hamsi's building blocks do not behave ideally.

  • cryptanalysis of the 10 round hash and full Compression Function of shavite 3 512
    Lecture Notes in Computer Science, 2010
    Co-Authors: Praveen Gauravaram, Maria Nayaplasencia, Florian Mendel, Christian Rechberger, Gaetan Leurent, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we analyze the SHAvite-3-512 hash Function, as proposed and tweaked for round 2 of the SHA-3 competition. We present cryptanalytic results on 10 out of 14 rounds of the hash Function SHAvite-3-512, and on the full 14 round Compression Function of SHAvite-3-512. We show a second preimage attack on the hash Function reduced to 10 rounds with a complexity of 2497 Compression Function evaluations and 216 memory. For the full 14-round Compression Function, we give a chosen counter, chosen salt preimage attack with 2384 Compression Function evaluations and 2128 memory (or complexity 2448 without memory), and a collision attack with 2192 Compression Function evaluations and 2128 memory.

  • improved cryptanalysis of the reduced grostl Compression Function echo permutation and aes block cipher
    Selected Areas in Cryptography, 2009
    Co-Authors: Florian Mendel, Christian Rechberger, Thomas Peyrin, Martin Schlaffer
    Abstract:

    In this paper, we propose two new ways to mount attacks on the SHA-3 candidates Grostl, and ECHO, and apply these attacks also to the AES. Our results improve upon and extend the rebound attack. Using the new techniques, we are able to extend the number of rounds in which available degrees of freedom can be used. As a result, we present the first attack on 7 rounds for the Grostl-256 output transformation and improve the semi-free-start collision attack on 6 rounds. Further, we present an improved known-key distinguisher for 7 rounds of the AES block cipher and the internal permutation used in ECHO.