Advanced hash function design: inside Keccak Advanced hash function design: inside Keccak Guido Bertoni 1 Joan Daemen 1 Michaël Peeters 2 Gilles Van Assche 1 Ecrypt II summer school, Albena June 2, 2011 1 / 46 1 STMicroelectronics 2 NXP Semiconductors
Advanced hash function design: inside Keccak Outline 1 Advancing hash function design 2 Advancing the mode 3 Advancing the inner function 4 Motivating the design of Keccak - f 5 Keccak resources 2 / 46
Advanced hash function design: inside Keccak Advancing hash function design Outline 1 Advancing hash function design 2 Advancing the mode 3 Advancing the inner function 4 Motivating the design of Keccak - f 5 Keccak resources 3 / 46
Advanced hash function design: inside Keccak Advancing hash function design What is advanced hash function design? Design principles of MD4 and descendents: Mode: Merkle-Damgård with Davies-Meyer collision-resistance preservation is central coding of message length in the padding block cipher with a feedforward Inner function: block cipher data path for CV: generalized Feistel network ARX based nonlinearity Separate message expansion for message block Advanced design: anything that improves upon this 4 / 46
Advanced hash function design: inside Keccak Advancing the mode Outline 1 Advancing hash function design 2 Advancing the mode 3 Advancing the inner function 4 Motivating the design of Keccak - f 5 Keccak resources 5 / 46
Advanced hash function design: inside Keccak Examples: Panama, Grindahl, RadioGatún , Fugue Requires a strong inner function resisting specific attacks Proof bounds success probability of all generic attacks Replace by random oracle (RO) indifferentiability Abandon property-preserving paradigm Anther approach: get the criteria for the mode right Promising but hard to obtain assurance AKA streaming-based hashing Advancing the mode One approach: don’t separate mode and inner function etc. etc. etc. 2nd pre-image attacks more efficient than expected length extension Problems of Merkle-Damgård Advancing the mode 6 / 46
Advanced hash function design: inside Keccak Advancing the mode Building a sound mode Building a sound mode Patching Merkle-Damgård by adding complexity Enveloped Merkle-Damgård (EMD): treat last block differently Haifa: extend Merkle-Damgård by adding in inner function: dedicated input for salt dedicated input for counter does not address the compression function design problem Tabula rasa: sponge construction simplification message bits and chaining bits are treated the same way no feedforward, no length coding in padding uses a permutation, known how to design 7 / 46
Advanced hash function design: inside Keccak Advancing the mode The sponge construction The sponge construction More general than hash function: arbitrary-length output stream encryption, MGF, … duplex mode: authenticated encryption, reseedable PRG, … r bits of rate c bits of capacity (security parameter) 8 / 46 Calls a b -bit permutation f , with b = r + c
Advanced hash function design: inside Keccak Advancing the mode The sponge construction Generic security of the sponge construction N is number of calls to f Bounds success probability of all generic attacks Bound assumes f is random permutation it covers generic attacks …but not attacks that exploit specific properties of f 9 / 46 RO-differentiating advantage ≤ N 2 / 2 c + 1
Advanced hash function design: inside Keccak Advancing the mode The Hermetic sponge strategy Design approach Hermetic sponge strategy instantiate a sponge function Mission Design permutation f without exploitable properties 10 / 46 claim a security level of 2 c / 2
Advanced hash function design: inside Keccak Advancing the inner function Outline 1 Advancing hash function design 2 Advancing the mode 3 Advancing the inner function 4 Motivating the design of Keccak - f 5 Keccak resources 11 / 46
Advanced hash function design: inside Keccak absence of large input-output correlations … slide and symmetry-exploiting attacks algebraic attacks integral cryptanalysis Immunity to infeasibility of the CICO problem absence of large differential propagation probabilities Advancing the inner function Classical LC/DC criteria …on a wide range of CPU platforms and in hardware fast and compact, straight and hardened Efficiency and flexibility Desired properties of f Criteria 12 / 46
Advanced hash function design: inside Keccak Advancing the inner function Criteria The CICO problem Given partial input and output, determine remaining parts Important in many attacks Pre-image generation in hashing 13 / 46
Advanced hash function design: inside Keccak Advancing the inner function Criteria The CICO problem Given partial input and output, determine remaining parts Important in many attacks State recovery in stream encryption 14 / 46
Advanced hash function design: inside Keccak Advancing the inner function absence of systematic clustering of trails Ambition is to assure: active S-boxes 15 / 46 Goal: prevent control over difference propagation Criteria Differential ( A , B ) is composed of trails Q from A to B : ∑ # pairs ( A , B ) = # pairs ( Q ) Q ∈ ( A , B ) w r ( Q ) : number of conditions Q imposes on its pairs: ∑ w r ( Q ) = w r ( q i , q o ) If w r ( Q ) < b : # pairs ( Q ) ≈ 2 b − w r ( Q ) , else few or no pairs ∀ Q : w r ( Q ) > b : wide trail strategy
Advanced hash function design: inside Keccak Advancing the inner function absence of systematic clustering of trails Ambition is to assure: active S-boxes 16 / 46 Criteria Goal: avoid large input-output correlations Correlation ( v , u ) is composed of trails Q to u from v C ( v , u ) = ∑ C ( Q ) Q ∈ ( v , u ) Correlation contribution: C ( Q ) = ( − 1 ) sign ( Q ) 2 − w c ( Q ) / 2 with ∑ w c ( Q ) = w c ( q i , q o ) If w c ( Q ) > b , Q contributes very little ∀ Q : w c ( Q ) > b : wide trail strategy
Advanced hash function design: inside Keccak Like a block cipher inverse permutation need not be efficient round constants instead of round keys no need for key schedule …but not quite round function that is nonlinear and has good diffusion sequence of identical rounds width ranges from 600 to 2400 bits Advancing the inner function capacity up to 512 bits long term: security strength up to 256 bits Required width b : Designing the permutation f Choices for the permutation f 17 / 46 rate: b − 512 bits
Advanced hash function design: inside Keccak Advancing the inner function Choices for the permutation f The obvious choices addition - rotation - XOR (ARX) appears very powerful, but … unsuited for dedicated hardware and DPA protection hard to evaluate strength all of the MD4 and SHA family is already based on ARX Square-inspired, like Rijndael (AES) S-box with optimum worst-case LC and DC properties mixing layer with optimum worst-case diffusion: MDS transposition layer with optimum dispersion results in strong bounds for trail weights let’s try it! 18 / 46
Advanced hash function design: inside Keccak Advancing the inner function Inspiration from AES AES-based approach: size parameters AES structure must be scaled up from 128 to 600-2400 bits Three size parameters: S-box width: n bits MDS width: m S-boxes Dimension: d 19 / 46 Permutation width: b = m d n AES: n = 8 , m = 4 , d = 2 so b = 128
Advanced hash function design: inside Keccak Advancing the inner function Inspiration from AES Scaling up AES structure Increase S-box width n ? software: # elements in lookup tables: 2 n hardware: strong increase in # gates decreasing S-box width would be a better idea … Increase MDS matrix size m ? SW with T -tables: size of elements is nm HW and compact SW: strong increase in # operations/gates Increase the dimension d ? slows down diffusion strong increase in number of rounds All in all, scaling up appears very expensive 20 / 46
Advanced hash function design: inside Keccak Advancing the inner function Inspiration from AES A greedy aspect in AES-inspired design Choice of nonlinear layer for given width n , choose S-boxes with optimum worst-case nonlinearity irrespective of implementation cost Choice of mixing layer for given size m , choose mixing transformation with optimum worst-case diffusion irrespective of implementation cost Focus on worst-case LC/DC propagation over few rounds Tends to result in expensive round function 21 / 46
Advanced hash function design: inside Keccak no requirement for high worst-case diffusion globally more efficient Ambition: cheaper round function, more rounds but clustering of trails chaining of low-weight structures into narrow trails A matching transposition layer should prevent average diffusion preferably high A modest mixing layer Advancing the inner function no requirement for high worst-case nonlinearity A modest nonlinear layer Go for a less greedy approach An alternative to imitating AES 22 / 46 log ( DP ( a , b )) ≈ O ( HW ( a )) log ( C 2 ( v , u )) ≈ O ( HW ( u ))
Advanced hash function design: inside Keccak Motivating the design of Keccak - f Outline 1 Advancing hash function design 2 Advancing the mode 3 Advancing the inner function 4 Motivating the design of Keccak - f 5 Keccak resources 23 / 46
Recommend
More recommend
