Boomerang attacks on BLAKE-32 Arnab Roy (joint work with Alex - - PowerPoint PPT Presentation

▶
boomerang attacks on blake 32
SMART_READER_LITE
LIVE PREVIEW

Boomerang attacks on BLAKE-32 Arnab Roy (joint work with Alex - - PowerPoint PPT Presentation

Jun 18, 2023 117 likes •400 views

Boomerang attacks on BLAKE-32 Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli c) University of Luxembourg, Luxembourg February 15, 2011 Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli c) Boomerang attacks on BLAKE-32

slide-1
SLIDE 1

Boomerang attacks on BLAKE-32

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c)

University of Luxembourg, Luxembourg

February 15, 2011

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-2
SLIDE 2

About BLAKE

BLAKE is now one of the five finalists in SHA-3 competition anounced by NIST. One of the two (Addition-Rotation-Xor)ARX designs in the final round It is one of the fastest functions on various platforms in software

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-3
SLIDE 3

Hash function BLAKE-32

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-4
SLIDE 4

Hash function BLAKE-32

Initialization

  • v0

v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15

  • ←
  • h0

h1 h2 h3 h4 h5 h6 h7 s0 ⊕ c0 s1 ⊕ c1 s2 ⊕ c2 s3 ⊕ c3 t0 ⊕ c4 t0 ⊕ c5 t1 ⊕ c6 t1 ⊕ c7

  • Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´

c) Boomerang attacks on BLAKE-32

slide-5
SLIDE 5

Hash function BLAKE-32

Initialization

  • v0

v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15

  • ←
  • h0

h1 h2 h3 h4 h5 h6 h7 s0 ⊕ c0 s1 ⊕ c1 s2 ⊕ c2 s3 ⊕ c3 t0 ⊕ c4 t0 ⊕ c5 t1 ⊕ c6 t1 ⊕ c7

  • Each round is composed of 8 applications of G function and

Compression function iterates a series of 10 rounds

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-6
SLIDE 6

Hash function BLAKE-32

Initialization

  • v0

v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15

  • ←
  • h0

h1 h2 h3 h4 h5 h6 h7 s0 ⊕ c0 s1 ⊕ c1 s2 ⊕ c2 s3 ⊕ c3 t0 ⊕ c4 t0 ⊕ c5 t1 ⊕ c6 t1 ⊕ c7

  • Each round is composed of 8 applications of G function and

Compression function iterates a series of 10 rounds Each round uses all 16 message words according to permutation table described in the proposal of BLAKE

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-7
SLIDE 7

Hash function BLAKE-32

Initialization

  • v0

v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15

  • ←
  • h0

h1 h2 h3 h4 h5 h6 h7 s0 ⊕ c0 s1 ⊕ c1 s2 ⊕ c2 s3 ⊕ c3 t0 ⊕ c4 t0 ⊕ c5 t1 ⊕ c6 t1 ⊕ c7

  • Each round is composed of 8 applications of G function and

Compression function iterates a series of 10 rounds Each round uses all 16 message words according to permutation table described in the proposal of BLAKE Finalization procedure is linear

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-8
SLIDE 8

High probability differential trail

m m’ G m 1 round 1.5 round a b c d

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-9
SLIDE 9

High probability differential trail

1 round 1.5 round a b c d m m’ G m’

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-10
SLIDE 10

High probability differential trails

We obtain a 2-round differential trail with probability 2−1 with active MSB 3-round differential trail with probability 2−s where s = 6, 7, 8 3.5-round differential trail with probability ≥ 2−32

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-11
SLIDE 11

High probability differential trails

We obtain a 2-round differential trail with probability 2−1 with active MSB 3-round differential trail with probability 2−s where s = 6, 7, 8 3.5-round differential trail with probability ≥ 2−32 2-round differential trail with probability 2−(3t−1) or 2−3tor 2−(3t+1) where t is number of active bits (excluding MSB)

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-12
SLIDE 12

High probability differential trails

We obtain a 2-round differential trail with probability 2−1 with active MSB 3-round differential trail with probability 2−s where s = 6, 7, 8 3.5-round differential trail with probability ≥ 2−32 2-round differential trail with probability 2−(3t−1) or 2−3tor 2−(3t+1) where t is number of active bits (excluding MSB) 3-round differential trail consistent with the counters t0, t1 which has probability 2−21

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-13
SLIDE 13

High probability differential trails

We obtain a 2-round differential trail with probability 2−1 with active MSB 3-round differential trail with probability 2−s where s = 6, 7, 8 3.5-round differential trail with probability ≥ 2−32 2-round differential trail with probability 2−(3t−1) or 2−3tor 2−(3t+1) where t is number of active bits (excluding MSB) 3-round differential trail consistent with the counters t0, t1 which has probability 2−21 2-round differential trail with ith and (i + 16)th bit active with probability 2−9(when ith bit is MSB) otherwise probability is ≥ 2−14

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-14
SLIDE 14

Boomerang attack on Compression Function

f0 f1 ∇∗ ∇ P1 P2 P3 P4 Pr[∆ → ∆∗] = p Pr[∇ → ∇∗] = q f = f1 ◦ f0 f (P1) ⊕ f (P3) = ∇∗ f (P2) ⊕ f (P4) = ∇∗ ∆∗ ∆ ∆ ∆∗ Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-15
SLIDE 15

Boomerang attack on Compression Function

f0 f1 ∇∗ ∇ P1 P2 P3 P4 Pr[∆ → ∆∗] = p Pr[∇ → ∇∗] = q f = f1 ◦ f0 f (P1) ⊕ f (P3) = ∇∗ f (P2) ⊕ f (P4) = ∇∗ ∆∗ ∆ ∆ ∆∗ Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-16
SLIDE 16

Boomerang distinguisher

Let F(H) = f (H) ⊕ H where f = f1 ◦ f0.

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-17
SLIDE 17

Boomerang distinguisher

Let F(H) = f (H) ⊕ H where f = f1 ◦ f0. For the boomerang quartet (P1, P2, P3, P4) we obtain: P1 ⊕ P2 = ∆, (1) P3 ⊕ P4 = ∆, (2) [F(P1) ⊕ P1] ⊕ [F(P3) ⊕ P3] = ∇∗, (3) [F(P2) ⊕ P2] ⊕ [F(P4) ⊕ P4] = ∇∗ (4)

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-18
SLIDE 18

Boomerang distinguisher

Let F(H) = f (H) ⊕ H where f = f1 ◦ f0. For the boomerang quartet (P1, P2, P3, P4) we obtain: P1 ⊕ P2 = ∆, (1) P3 ⊕ P4 = ∆, (2) [F(P1) ⊕ P1] ⊕ [F(P3) ⊕ P3] = ∇∗, (3) [F(P2) ⊕ P2] ⊕ [F(P4) ⊕ P4] = ∇∗ (4) For a random n-bit compression function finding such quartet will have complexity 2n(with a fixed difference)

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-19
SLIDE 19

Boomerang distinguisher

Let F(H) = f (H) ⊕ H where f = f1 ◦ f0. For the boomerang quartet (P1, P2, P3, P4) we obtain: P1 ⊕ P2 = ∆, (1) P3 ⊕ P4 = ∆, (2) [F(P1) ⊕ P1] ⊕ [F(P3) ⊕ P3] = ∇∗, (3) [F(P2) ⊕ P2] ⊕ [F(P4) ⊕ P4] = ∇∗ (4) For a random n-bit compression function finding such quartet will have complexity 2n(with a fixed difference) To get a boomerang distinguisher for compression function F we need p2q2 > 2−n

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-20
SLIDE 20

Zero-sum distinguisher

P4 f0 f1 ∆∗ ∇∗ ∇ P1 P2 P3 ∆

From the last equations we get: F(P1) ⊕ F(P2) ⊕ F(P3)⊕F(P4) = 0

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-21
SLIDE 21

Zero-sum distinguisher

P4 f0 f1 ∆∗ ∇∗ ∇ P1 P2 P3 ∆

From the last equations we get: F(P1) ⊕ F(P2) ⊕ F(P3)⊕F(P4) = 0 For a random permutation complexity is 2n/4. But with fixed difference the complexity rises to 2n/2

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-22
SLIDE 22

Boomerang attack on BLAKE-32

The real probability of the Boomerang is ˆ p2ˆ q2, where ˆ p, ˆ q are the amplified probability defined as: ˆ p =

  • ∆∗ Pr[∆ → ∆∗]2 , ˆ

q =

  • ∇ Pr[∇ → ∇∗]2

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-23
SLIDE 23

Boomerang attack on BLAKE-32

The real probability of the Boomerang is ˆ p2ˆ q2, where ˆ p, ˆ q are the amplified probability defined as: ˆ p =

  • ∆∗ Pr[∆ → ∆∗]2 , ˆ

q =

  • ∇ Pr[∇ → ∇∗]2

But getting these probabilities is hard in some cases. So we run computer simulation

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-24
SLIDE 24

Boomerang attack on BLAKE-32

The real probability of the Boomerang is ˆ p2ˆ q2, where ˆ p, ˆ q are the amplified probability defined as: ˆ p =

  • ∆∗ Pr[∆ → ∆∗]2 , ˆ

q =

  • ∇ Pr[∇ → ∇∗]2

But getting these probabilities is hard in some cases. So we run computer simulation For the attack on Hash function, the returned pairs are consistent if v12 ⊕ v13 and v14 ⊕ v15 are fixed. This increases the complexity of the attack by a factor of 264

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-25
SLIDE 25

Summary of our attack

CF/KP1 Rounds CF/KP calls CF 4 267 CF 5 271.2 CF 6 2102 CF 6.5 2184 CF 7 2232 KP 4 23 KP 5 27.2 KP 6 211.75 KP 7 2122 KP 8 2242

1CF = Compression Function, KP = Keyed Permutation Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-26
SLIDE 26

Conclusion

Application of the concept of boomerang distinguisher to compression function Shown such distinguisher for CF of BLAKE-32 Classical boomerang distinguisher for KP of BLAKE-32 Attack works for 2/3 of the total number of rounds of the CF and 4/5 of the total number of rounds of the KP The attack can be equally applied to other versions of BLAKE BLAKE-32 has been tweaked to 15 rounds in the final round

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32

slide-27
SLIDE 27

THANK YOU!

Arnab Roy (joint work with Alex Biryukov and Ivica Nikoli´ c) Boomerang attacks on BLAKE-32