The Experts below are selected from a list of 3381 Experts worldwide ranked by ideXlab platform
Henri Gilbert - One of the best experts on this subject based on the ideXlab platform.
-
Security analysis of SHA-256 and sisters
Selected Areas in Cryptography, 2004Co-Authors: Henri Gilbert, Helena HandschuhAbstract:This paper studies the security of SHA-256, SHA-384 and SHA-512 against collision attacks and provides some insight into the security properties of the basic building blocks of the structure. It is concluded that neither Chabaud and Joux's attack, nor Dobbertin-style attacks apply. Differential and linear attacks also don't apply on the underlying structure. However we show that slightly simplified versions of the hash functions are surprisingly weak : whenever symmetric constants and initialization values are used throughout the computations, and modular additions are replaced by exclusive or operations, symmetric messages hash to symmetric digests. Therefore the complexity of collision search on these modified hash functions potentially becomes as low as one wishes.
-
Selected Areas in Cryptography - Security Analysis of SHA-256 and Sisters
Selected Areas in Cryptography, 2004Co-Authors: Henri Gilbert, Helena HandschuhAbstract:This paper studies the security of SHA-256, SHA-384 and SHA-512 against collision attacks and provides some insight into the security properties of the basic building blocks of the structure. It is concluded that neither Chabaud and Joux’s attack, nor Dobbertin-style attacks apply. Differential and linear attacks also don’t apply on the underlying structure. However we show that slightly simplified versions of the hash functions are surprisingly weak : whenever symmetric constants and initialization values are used throughout the computations, and modular additions are replaced by exclusive or operations, symmetric messages hash to symmetric digests. Therefore the complexity of collision search on these modified hash functions potentially becomes as low as one wishes.
-
FSE - The RIPEMD and RIPEMD Improved Variants of MD4 Are Not Collision Free
Fast Software Encryption, 2002Co-Authors: Christophe Debaert, Henri GilbertAbstract:In 1992, the cryptographic hash function RIPEMD, a European proposal, was introduced as an improved variant of the MD4 hash function. RIPEMD involves two parallel lines of modified versions of the MD4 compression function. Three years later, an attack against a reduced version of RIPEMD in which the first or the last round of the RIPEMD compression function is omitted was described by Hans Dobbertin, who also published in 1998 a cryptanalysis of MD4. In this paper, we present a method for finding collisions in each of the parallel lines of RIPEMD. The collision search procedure requires only a few seconds computing time. We show that although the modifications of the MD4 compression function Used in RIPEMD introduce additional constraints in the cryptanalysis as Compared with Dobbertin's attack of MD4, these modifications do not result in an increase of the collision search computation time. It is still an open question whether collisions can be found for the full RIPEMD function.
-
The RIPEMDL and RIPEMDR improved variants of MD4 are not collision free
Lecture Notes in Computer Science, 2002Co-Authors: Christophe Debaert, Henri GilbertAbstract:In 1992, the cryptographic hash function RIPEMD, a European proposal, was introduced as an improved variant of the MD4 hash function. RIPEMD involves two parallel lines of modified versions of the MD4 compression function. Three years later, an attack against a reduced version of RIPEMD in which the first or the last round of the RIPEMD compression function is omitted was described by Hans Dobbertin, who also published in 1998 a cryptanalysis of MD4. In this paper, we present a method for finding collisions in each of the parallel lines of RIPEMD. The collision search procedure requires only a few seconds computing time. We show that although the modifications of the MD4 compression function Used in RIPEMD introduce additional constraints in the cryptanalysis as Compared with Dobbertin's attack of MD4, these modifications do not result in an increase of the collision search computation time. It is still an open question whether collisions can be found for the full RIPEMD function.
Helena Handschuh - One of the best experts on this subject based on the ideXlab platform.
-
Security analysis of SHA-256 and sisters
Selected Areas in Cryptography, 2004Co-Authors: Henri Gilbert, Helena HandschuhAbstract:This paper studies the security of SHA-256, SHA-384 and SHA-512 against collision attacks and provides some insight into the security properties of the basic building blocks of the structure. It is concluded that neither Chabaud and Joux's attack, nor Dobbertin-style attacks apply. Differential and linear attacks also don't apply on the underlying structure. However we show that slightly simplified versions of the hash functions are surprisingly weak : whenever symmetric constants and initialization values are used throughout the computations, and modular additions are replaced by exclusive or operations, symmetric messages hash to symmetric digests. Therefore the complexity of collision search on these modified hash functions potentially becomes as low as one wishes.
-
Selected Areas in Cryptography - Security Analysis of SHA-256 and Sisters
Selected Areas in Cryptography, 2004Co-Authors: Henri Gilbert, Helena HandschuhAbstract:This paper studies the security of SHA-256, SHA-384 and SHA-512 against collision attacks and provides some insight into the security properties of the basic building blocks of the structure. It is concluded that neither Chabaud and Joux’s attack, nor Dobbertin-style attacks apply. Differential and linear attacks also don’t apply on the underlying structure. However we show that slightly simplified versions of the hash functions are surprisingly weak : whenever symmetric constants and initialization values are used throughout the computations, and modular additions are replaced by exclusive or operations, symmetric messages hash to symmetric digests. Therefore the complexity of collision search on these modified hash functions potentially becomes as low as one wishes.
Gregor Leander - One of the best experts on this subject based on the ideXlab platform.
-
A new construction of bent functions based on $${\mathbb{Z}}$$ -bent functions
Designs Codes and Cryptography, 2012Co-Authors: Sugata Gangopadhyay, Gregor Leander, Anand S. Joshi, Rajendra K. SharmaAbstract:Dobbertin has embedded the problem of construction of bent functions in a recursive framework by using a generalization of bent functions called $${\mathbb{Z}}$$ -bent functions. Following his ideas, we generalize the construction of partial spreads bent functions to partial spreads $${\mathbb{Z}}$$ -bent functions of arbitrary level. Furthermore, we show how these partial spreads $${\mathbb{Z}}$$ -bent functions give rise to a new construction of (classical) bent functions. Further, we construct a bent function on 8 variables which is inequivalent to all Maiorana---McFarland as well as PS ap type bents. It is also shown that all bent functions on 6 variables, up to equivalence, can be obtained by our construction.
-
a highly nonlinear differentially 4 uniform power mapping that permutes fields of even degree
Finite Fields and Their Applications, 2010Co-Authors: Carl Bracken, Gregor LeanderAbstract:Functions with low differential uniformity can be used as the s-boxes of symmetric cryptosystems as they have good resistance to differential attacks. The AES (Advanced Encryption Standard) uses a differentially 4 uniform function called the inverse function. Any function used in a symmetric cryptosystem should be a permutation. Also, it is required that the function is highly nonlinear so that it is resistant to Matsui's linear attack. In this article we demonstrate that the highly nonlinear permutation f(x)=x^2^^^2^^^k^+^2^^^k^+^1 on the field F"2"^"4"^"k, discovered by Hans Dobbertin (1998) [1], has differential uniformity of four and hence, with respect to differential and linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem as the inverse function. Its suitability with respect to other attacks remains to be seen.
-
a highly nonlinear differentially 4 uniform power mapping that permutes fields of even degree
arXiv: Information Theory, 2009Co-Authors: Carl Bracken, Gregor LeanderAbstract:Functions with low differential uniformity can be used as the s-boxes of symmetric cryptosystems as they have good resistance to differential attacks. The AES (Advanced Encryption Standard) uses a differentially-4 uniform function called the inverse function. Any function used in a symmetric cryptosystem should be a permutation. Also, it is required that the function is highly nonlinear so that it is resistant to Matsui's linear attack. In this article we demonstrate that a highly nonlinear permutation discovered by Hans Dobbertin has differential uniformity of four and hence, with respect to differential and linear cryptanalysis, is just as suitable for use in a symmetric cryptosystem as the inverse function.
-
Two Classes of Quadratic APN Binomials Inequivalent to Power Functions
IEEE Transactions on Information Theory, 2008Co-Authors: Lilya Budaghyan, Claude Carlet, Gregor LeanderAbstract:This paper introduces the first found infinite classes of almost perfect nonlinear (APN) polynomials which are not Carlet-Charpin-Zinoviev (CCZ)-equivalent to power functions (at least for some values of the number of variables). These are two classes of APN binomials from F2n to F2n (for n divisible by 3, resp., 4). We prove that these functions are extended affine (EA)-inequivalent to any power function and that they are CCZ-inequivalent to the Gold, Kasami, inverse, and Dobbertin functions when n ges 12. This means that for n even they are CCZ-inequivalent to any known APN function. In particular, for n = 12,20,24, they are therefore CCZ-inequivalent to any power function.
-
Monomial bent functions and Stickelberger's theorem
Finite Fields and Their Applications, 2008Co-Authors: Philippe Langevin, Gregor LeanderAbstract:In this paper we use certain results on the divisibility of Gauss sums, mainly Stickelberger's theorem, to study monomial bent functions. This approach turns out to be especially nice in the Kasami, Gold and Dillon case. As one of our main results we give an alternative proof of bentness in the case of the Kasami exponent. Using the techniques developed here, this proof turns out to be very short and generalizes the previous results by Dillon and Dobbertin to the case where n is divisible by 3. Furthermore, our approach can also be used to deduce properties of the dual function. More precisely, we show that the dual of the Kasami function is not a monomial Boolean function.
Semenov Alexander - One of the best experts on this subject based on the ideXlab platform.
-
Using Automatic Generation of Relaxation Constraints to Improve the Preimage Attack on 39-step MD4
arXiv: Artificial Intelligence, 2018Co-Authors: Gribanova Irina, Semenov AlexanderAbstract:In this paper we construct preimage attack on the truncated variant of the MD4 hash function. Specifically, we study the MD4-39 function defined by the first 39 steps of the MD4 algorithm. We suggest a new attack on MD4-39, which develops the ideas proposed by H. Dobbertin in 1998. Namely, the special relaxation constraints are introduced in order to simplify the equations corresponding to the problem of finding a preimage for an arbitrary MD4-39 hash value. The equations supplemented with the relaxation constraints are then reduced to the Boolean Satisfiability Problem (SAT) and solved using the state-of-the-art SAT solvers. We show that the effectiveness of a set of relaxation constraints can be evaluated using the black-box function of a special kind. Thus, we suggest automatic method of relaxation constraints generation by applying the black-box optimization to this function. The proposed method made it possible to find new relaxation constraints that contribute to a SAT-based preimage attack on MD4-39 which significantly outperforms the competition.
Valentin Suder - One of the best experts on this subject based on the ideXlab platform.
-
Project-Team SECRET
2016Co-Authors: Gohar M. Kyureghyan, Valentin Suder, Le Chesnay CedexAbstract:Abstract—In this extended abstract we present results on the inverses modulo 2n − 1 of the known APN exponents. In particular, we describe explicitly the inverses of the Welch and Dobbertin exponents and give the main ideas of their proofs. Further, we observe that the inverse of the Dobbertin exponent defines an APN function on F2n of algebraic degree n+32, which is the first example of such a function. I
-
On inversion in Z 2n-1
Finite Fields and Their Applications, 2014Co-Authors: Gohar M. Kyureghyan, Valentin SuderAbstract:In this paper we determined explicitly the multiplicative inverses of the Dobbertin and Welch APN exponents in Z"2"^"n"-"1, and we described the binary weights of the inverses of the Gold and Kasami exponents. We studied the function Inv"d(n), which for a fixed positive integer d maps integers n>=1 to the least positive residue of the inverse of d modulo 2^n-1, if it exists. In particular, we showed that the function Inv"d is completely determined by its values for 1=
-
Finite Fields and Their Applications
2014Co-Authors: Gohar M. Kyureghyan, Valentin SuderAbstract:Article history: In this paper we determined explicitly the multiplicative inverses of the Dobbertin and Welch APN exponents in Z2n−1 ,a nd we described the binary weights of the inverses of the Gold and Kasami exponents. We studied the function Invd(n) ,w hich for a fixed positive integer d maps integers n 1t o the least positive residue of the inverse of d modulo 2 n − 1, if it exists. In particular, we showed that the function Invd is completely determined by its values for 1 n θd ,w hereθd is the order of 2 modulo the largest odd divisor of d.1
-
On Inversion in Z_{2^n-1}
2013Co-Authors: Valentin Suder, Gohar KyureghyanAbstract:In this paper we determined explicitly the multiplicative inverses of the Dobbertin and Welch APN exponents in Z_{2^n−1}, and we described the binary weights of the inverses of the Gold and Kasami exponents. We studied the function Inv_d(n), which for a fixed positive integer d maps integers n⩾1 to the least positive residue of the inverse of d modulo 2^n−1, if it exists. In particular, we showed that the function Inv_d is completely determined by its values for 1⩽n⩽θ_d, where θ_d is the order of 2 modulo the largest odd divisor of d.
-
On Inversion in Z_{2^n-1}
arXiv: Number Theory, 2013Co-Authors: Gohar M. Kyureghyan, Valentin SuderAbstract:In this paper we determined explicitly the multiplicative inverses of the Dobbertin and Welch APN exponents in Z_{2^n-1}, and we described the binary weights of the inverses of the Gold and Kasami exponents. We studied the function \de(n), which for a fixed positive integer d maps integers n\geq 1 to the least positive residue of the inverse of d modulo 2^n-1, if it exists. In particular, we showed that the function \de is completely determined by its values for 1 \leq n \leq \ordb, where \ordb is the order of 2 modulo the largest odd divisor of d.