[PPT] - Boomerang Distinguisher for the SIMD-512 Compression Function PowerPoint Presentation

SLIDE 1

Institute for Applied Information Processing and Communications (IAIK)

Boomerang Distinguisher for the SIMD-512 Compression Function

Florian Mendel and Tomislav Nad

Institute for Applied Information Processing and Communications (IAIK) Graz University of Technology Inffeldgasse 16a, A-8010 Graz, Austria Tomislav.Nad@iaik.tugraz.at

Tomislav Nad 13.12.2011 Indocrypt 2011 1

SLIDE 2

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 2

SLIDE 3

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 3

SLIDE 4

Institute for Applied Information Processing and Communications (IAIK)

SHA-3 Competition

Organized by NIST [Nat07] Successor for SHA-1 and SHA-2 64 submissions 51 round 1 candidates 14 round 2 candidates 5 finalists

Tomislav Nad 13.12.2011 Indocrypt 2011 4

SLIDE 5

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 5

SLIDE 6

Institute for Applied Information Processing and Communications (IAIK)

SIMD Is a Message Digest[LBF08]

Designed by Ga¨ etan Leurent, Charles Bouillaguet and Pierre-Alain Fouque Round 2 candidate Message block

SIMD-256: 512 bits SIMD-512: 1024 bits

Inner state (wide-pipe)

SIMD-256: 16 32-bit words SIMD-512: 32 32-bit words

Tomislav Nad 13.12.2011 Indocrypt 2011 6

SLIDE 7

Institute for Applied Information Processing and Communications (IAIK)

The SIMD Hash Function

Similar to Chop-MD Internal state is twice as large as the output Output transformation: truncation T

IV C M1 C M2 C M3 C Ml C′ |M| T H(m)

Tomislav Nad 13.12.2011 Indocrypt 2011 7

SLIDE 8

Institute for Applied Information Processing and Communications (IAIK)

The SIMD Compression Function (1/2)

Modified Davis-Meyer construction Expanded message size: 8 · blocksize Strong security in the message expansion M M Hi−1 E P Hi

Tomislav Nad 13.12.2011 Indocrypt 2011 8

SLIDE 9

Institute for Applied Information Processing and Communications (IAIK)

The SIMD Compression Function (2/2)

Based on a Feistel structure; similar to MD5 SIMD-256: 4 times the step function in parallel SIMD-512: 8 times the step function in parallel 32 steps plus 4 steps in the feed-forward

Tomislav Nad 13.12.2011 Indocrypt 2011 9

SLIDE 10

Institute for Applied Information Processing and Communications (IAIK)

Update Function at Step t

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt wt

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 10

SLIDE 11

Institute for Applied Information Processing and Communications (IAIK)

Update Function at Step t

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt wt

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

At

i =(Dt−1 i

⊞ wt

i ⊞ Φ(At−1 i

, Bt−1

i

, Ct−1

i

)) ≪ st ⊞ (At−1

pt(i) ≪ r t)

Bt

i =At−1 i

≪ r t Ct

i =Bt−1 i

Dt

i =Ct−1 i

Φ is either IF or MAJ

Tomislav Nad 13.12.2011 Indocrypt 2011 10

SLIDE 12

Institute for Applied Information Processing and Communications (IAIK)

Results on SIMD-512

Distinguisher

Mendel and Nad [MN09]

Full compression function (complexity: 2427) → tweaked!

Nikoli´ c et al. [INS10]

12 out of 32 steps (complexity: 2236)

Yu and Wang [YW11]

Full compression function (complexity: 2398)

Free-start near-collision

Yu and Wang [YW11]

24 out of 32 steps (complexity: 2208)

Tomislav Nad 13.12.2011 Indocrypt 2011 11

SLIDE 13

Institute for Applied Information Processing and Communications (IAIK)

Our Contribution

Application of Higher-Order Differentials to SIMD-512

Non-random properties for the permutation of SIMD-512 Extend technique to overcome the feed-forward of SIMD-512 Non-random properties for the compression function of SIMD-512

Tomislav Nad 13.12.2011 Indocrypt 2011 12

SLIDE 14

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 13

SLIDE 15

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differentials

Introduced by Lai in [Lai94] First applied to block ciphers by Knudsen [Knu94] Recently applied to SHA-2 [BLMN11] and several SHA-3 candidates

BLAKE [BNR11], Hamsi [BC10], Keccak [BC10], Luffa [WHYK10], ...

Tomislav Nad 13.12.2011 Indocrypt 2011 14

SLIDE 16

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differentials: Basic Definitions

Definition

Let (S, +) and (T, +) be abelian groups. For a function f : S → T, the derivative at a point a1 ∈ S is defined as ∆(a1)f(y) = f(y + a1) − f(y) . The i-th derivative of f at (a1, a2, . . . , ai) is then recursively defined as ∆(a1,...,ai)f(y) = ∆(ai)(∆(a1,...,ai−1)f(y)) .

Tomislav Nad 13.12.2011 Indocrypt 2011 15

SLIDE 17

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differentials: Basic Definitions

Definition

A differential of order i for a function f : S → T is an (i + 1)-tuple (a1, a2, . . . , ai; b) such that ∆(a1,...,ai)f(y) = b .

Tomislav Nad 13.12.2011 Indocrypt 2011 16

SLIDE 18

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differential Collision

When applying differential cryptanalysis to a hash function, a collision for the hash function corresponds to a pair of inputs with output difference zero.

Tomislav Nad 13.12.2011 Indocrypt 2011 17

SLIDE 19

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differential Collision

When applying differential cryptanalysis to a hash function, a collision for the hash function corresponds to a pair of inputs with output difference zero.

Definition

An i-th-order differential collision for f : S → T is an i-tuple (a1, a2, . . . , ai) together with a value y such that ∆(a1,...,ai)f(y) = 0 .

Tomislav Nad 13.12.2011 Indocrypt 2011 17

SLIDE 20

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differential Collision

When applying differential cryptanalysis to a hash function, a collision for the hash function corresponds to a pair of inputs with output difference zero.

Definition

An i-th-order differential collision for f : S → T is an i-tuple (a1, a2, . . . , ai) together with a value y such that ∆(a1,...,ai)f(y) = 0 . Note that the common definition of a collision for hash functions corresponds to a higher-order differential collision of order i = 1.

Tomislav Nad 13.12.2011 Indocrypt 2011 17

SLIDE 21

Institute for Applied Information Processing and Communications (IAIK)

Complexity

What is the query complexity of a differential collision of

rder i?

From the definition before we see that we can freely choose i + 1 of the input parameters which then fix the remaining ones ⇒ Query complexity: ≈ 2n/(i+1)

Tomislav Nad 13.12.2011 Indocrypt 2011 18

SLIDE 22

Institute for Applied Information Processing and Communications (IAIK)

Complexity

What is the query complexity of a differential collision of

rder i?

From the definition before we see that we can freely choose i + 1 of the input parameters which then fix the remaining ones ⇒ Query complexity: ≈ 2n/(i+1) Note that the complexity might be much higher in practice than this bound for the query complexity.

Tomislav Nad 13.12.2011 Indocrypt 2011 18

SLIDE 23

Institute for Applied Information Processing and Communications (IAIK)

Higher-Order Differential Collision for Block Cipher based Compression Functions

Observation

For any block-cipher-based compression function with which can be written in the form f(y) = E(y) + L(y), where L is a linear function with respect to +, an i-th-order differential collision for the block cipher transfers to an i-th-order collision for the compression function for i ≥ 2.

Tomislav Nad 13.12.2011 Indocrypt 2011 19

SLIDE 24

Institute for Applied Information Processing and Communications (IAIK)

Compression Function Constructions

E Mj Hj−1 Hj

Davies-Meyer

E Hj−1 Mj Hj

Miyaguchi-Preneel

E Hj−1 Mj Hj

Matyas-Meyer- Oseas

Tomislav Nad 13.12.2011 Indocrypt 2011 20

SLIDE 25

Institute for Applied Information Processing and Communications (IAIK)

Second-order Differential Collision

Second-order differential collision: f(y) − f(y + a2) + f(y + a1 + a2) − f(y + a1) = 0

Tomislav Nad 13.12.2011 Indocrypt 2011 21

SLIDE 26

Institute for Applied Information Processing and Communications (IAIK)

Second-order Differential Collision

Second-order differential collision: f(y) − f(y + a2) + f(y + a1 + a2) − f(y + a1) = 0 Query complexity: 2n/3

Tomislav Nad 13.12.2011 Indocrypt 2011 21

SLIDE 27

Institute for Applied Information Processing and Communications (IAIK)

Second-order Differential Collision

Second-order differential collision: f(y) − f(y + a2) + f(y + a1 + a2) − f(y + a1) = 0 Query complexity: 2n/3 We are not aware of any algorithm faster than 2n/2

Tomislav Nad 13.12.2011 Indocrypt 2011 21

SLIDE 28

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Split underlying block cipher E into two subparts, E = E1 ◦ E0. Assume we are given two differentials for the two subparts: E−1

0 (y + β) − E−1 0 (y) = α

(1) and E1(y + γ) − E1(y) = δ (2) where the differential in E−1 holds with probability p0 and in E1 holds with probability p1.

Tomislav Nad 13.12.2011 Indocrypt 2011 22

SLIDE 29

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X.

X

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 30

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ.

X X ∗ Y Y ∗ γ β γ β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 31

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ.

X X ∗ Y Y ∗ γ β γ β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 32

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗.

E−1 E−1 P P∗ X X ∗ Y Y ∗ E−1 E−1 Q Q∗ γ β γ β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 33

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗. Compute forward to obtain C, C∗, D, D∗.

E1 E−1 E1 E−1 P P∗ C C∗ X X ∗ D D∗ Y Y ∗ E1 E−1 E1 E−1 Q Q∗ γ β γ β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 34

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗. Compute forward to obtain C, C∗, D, D∗. Check if P∗ − P = Q∗ − Q and D − C = D∗ − C∗ is fulfilled.

E1 E−1 E1 E−1 P P∗ C C∗ X X ∗ D D∗ Y Y ∗ E1 E−1 E1 E−1 Q Q∗ γ β γ β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 35

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗. Compute forward to obtain C, C∗, D, D∗. Check if P∗ − P = Q∗ − Q and D − C = D∗ − C∗ is fulfilled.

E1 E−1 E1 E−1 P P∗ C C∗ X X ∗ D D∗ Y Y ∗ E1 E−1 E1 E−1 Q Q∗ γ α β γ α β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 36

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗. Compute forward to obtain C, C∗, D, D∗. Check if P∗ − P = Q∗ − Q and D − C = D∗ − C∗ is fulfilled.

E1 E−1 E1 E−1 P P∗ C C∗ X X ∗ D D∗ Y Y ∗ δ δ E1 E−1 E1 E−1 Q Q∗ γ α β γ α β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 37

Institute for Applied Information Processing and Communications (IAIK)

Basic Attack Strategy

Choose a random value for X. Compute X ∗ = X + β, Y = X + γ, and Y ∗ = X ∗ + γ. Compute backward to obtain P, P∗, Q, Q∗. Compute forward to obtain C, C∗, D, D∗. Check if P∗ − P = Q∗ − Q and D − C = D∗ − C∗ is fulfilled. Attack succeeds with probability p2

0 · p2 1.

E1 E−1 E1 E−1 P P∗ C C∗ X X ∗ D D∗ Y Y ∗ δ δ E1 E−1 E1 E−1 Q Q∗ γ α β γ α β

Tomislav Nad 13.12.2011 Indocrypt 2011 23

SLIDE 38

Institute for Applied Information Processing and Communications (IAIK)

Related Work

Block Cipher Cryptanalysis

It stands between the boomerang attack and the inside-out attack both introduced by Wagner [Wag99]

Hash Functions Cryptanalysis

A previous application of the boomerang attack to hash functions is due to Joux and Peyrin [JP07] The attack bears resemblance with the rebound attack introduced by Mendel et al. [MRST09] A framework similar to this was independently proposed by Biryukov et al. [BNR11]

Tomislav Nad 13.12.2011 Indocrypt 2011 24

SLIDE 39

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 25

SLIDE 40

Institute for Applied Information Processing and Communications (IAIK)

Application to SIMD-512 Permutation

M M Hi−1 E P Hi

Tomislav Nad 13.12.2011 Indocrypt 2011 26

SLIDE 41

Institute for Applied Information Processing and Communications (IAIK)

Application to SIMD-512 Permutation

Second-order differential collision with complexity ≈ 2226.52

Tomislav Nad 13.12.2011 Indocrypt 2011 27

SLIDE 42

Institute for Applied Information Processing and Communications (IAIK)

Application to SIMD-512 Permutation

Second-order differential collision with complexity ≈ 2226.52 Finding the differential characteristics for backward and forward direction is the most difficult part of the attack

Tomislav Nad 13.12.2011 Indocrypt 2011 27

SLIDE 43

Institute for Applied Information Processing and Communications (IAIK)

Application to SIMD-512 Permutation

Second-order differential collision with complexity ≈ 2226.52 Finding the differential characteristics for backward and forward direction is the most difficult part of the attack We have two requirements for the differential characteristics:

independent high probability

Tomislav Nad 13.12.2011 Indocrypt 2011 27

SLIDE 44

Institute for Applied Information Processing and Communications (IAIK)

Finding Differential Characteristics

Linearize the hash function

Tomislav Nad 13.12.2011 Indocrypt 2011 28

SLIDE 45

Institute for Applied Information Processing and Communications (IAIK)

Finding Differential Characteristics

Linearize the hash function

Modular additions → XOR operation Boolean functions fIF, fMAJ → 0-function

Tomislav Nad 13.12.2011 Indocrypt 2011 28

SLIDE 46

Institute for Applied Information Processing and Communications (IAIK)

Finding Differential Characteristics

Linearize the hash function

Modular additions → XOR operation Boolean functions fIF, fMAJ → 0-function

Use a probabilistic algorithm from coding theory

Tomislav Nad 13.12.2011 Indocrypt 2011 28

SLIDE 47

Institute for Applied Information Processing and Communications (IAIK)

Finding Differential Characteristics

Linearize the hash function

Modular additions → XOR operation Boolean functions fIF, fMAJ → 0-function

Use a probabilistic algorithm from coding theory Results

Backward: steps 1-18 (probability 2−72.04) Forward: steps 19-32 (probability 2−51.4)

Tomislav Nad 13.12.2011 Indocrypt 2011 28

SLIDE 48

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Probability of the Characteristics

Backward: 2−72.04 Forward: 2−51.4

Tomislav Nad 13.12.2011 Indocrypt 2011 29

SLIDE 49

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Probability of the Characteristics

Backward: 2−72.04 Forward: 2−51.4 ⇒ complexity for the attack is 22·(72.04+51.4) ≈ 2247

Tomislav Nad 13.12.2011 Indocrypt 2011 29

SLIDE 50

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Probability of the Characteristics

Backward: 2−72.04 Forward: 2−51.4 ⇒ complexity for the attack is 22·(72.04+51.4) ≈ 2247 Ignoring conditions at the end [WYY05]

Tomislav Nad 13.12.2011 Indocrypt 2011 29

SLIDE 51

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Probability of the Characteristics

Backward: 2−72.04 Forward: 2−51.4 ⇒ complexity for the attack is 22·(72.04+51.4) ≈ 2247 Ignoring conditions at the end [WYY05] ⇒ improved complexity is 2226.52

Tomislav Nad 13.12.2011 Indocrypt 2011 29

SLIDE 52

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 30

SLIDE 53

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 54

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt wt

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 55

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt A−1

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 56

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt B−1

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 57

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt C−1

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 58

Institute for Applied Information Processing and Communications (IAIK)

Extending the Attack to the Compression Function

M M Hi−1 E P Hi

At−1

i

Bt−1

i

Ct−1

i

Dt−1

i

Φt ≪ rt D−1

i

≪ st At−1

pt (i) ≪ rt

At

i

Bt

i

Ct

i

Dt

i

Tomislav Nad 13.12.2011 Indocrypt 2011 31

SLIDE 59

Institute for Applied Information Processing and Communications (IAIK)

Extended Attack Strategy

F1 F −1 F1 F−1 P P∗ R R∗ X X∗ S S∗ Y Y ∗ δ δ F1 F −1 F1 F −1 Q Q γ α β γ α β Tomislav Nad 13.12.2011 Indocrypt 2011 32

SLIDE 60

Institute for Applied Information Processing and Communications (IAIK)

Extended Attack Strategy

F1 F −1 F2 F1 F−1 F2 P P∗ R R∗ X X∗ ˜ S ˜ S∗ ˜ δ ˜ δ ˜ R ˜ R∗ S S∗ Y Y ∗ δ δ F1 F −1 F2 F1 F −1 F2 Q Q γ α β γ α β Tomislav Nad 13.12.2011 Indocrypt 2011 32

SLIDE 61

Institute for Applied Information Processing and Communications (IAIK)

Extended Attack Strategy

F1 F −1 F2 F1 F−1 F2 P P∗ R R∗ X X∗ ˜ S ˜ S∗ ˜ δ ˜ δ ˜ R ˜ R∗ S S∗ Y Y ∗ δ δ F1 F −1 F2 F1 F −1 F2 Q Q γ α β γ α β Tomislav Nad 13.12.2011 Indocrypt 2011 32

SLIDE 62

Institute for Applied Information Processing and Communications (IAIK)

Extended Attack Strategy

F1 F −1 F2 F1 F−1 F2 PAi P∗

Ai

R R∗ X X∗ ˜ SDi ˜ S∗

Di

˜ δDi ˜ δDi ˜ RDi ˜ R∗

Di

S S∗ Y Y ∗ δ δ F1 F −1 F2 F1 F −1 F2 QAi Q∗

Ai

γ αAi β γ αAi β Tomislav Nad 13.12.2011 Indocrypt 2011 32

SLIDE 63

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Using the same differential characteristic (fix β, γ) Backward: only difference in ∆A−1

6

Forward: only difference in ∆A31

3 and ∆B31

Tomislav Nad 13.12.2011 Indocrypt 2011 33

SLIDE 64

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Using the same differential characteristic (fix β, γ) Backward: only difference in ∆A−1

6

Forward: only difference in ∆A31

3 and ∆B31

Input to IF function Used to compute ∆A32

6

Tomislav Nad 13.12.2011 Indocrypt 2011 33

SLIDE 65

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Using the same differential characteristic (fix β, γ) Backward: only difference in ∆A−1

6

Forward: only difference in ∆A31

3 and ∆B31

Input to IF function Used to compute ∆A32

6

Added costs: 23 Ignore costs: last three steps in both directions

Tomislav Nad 13.12.2011 Indocrypt 2011 33

SLIDE 66

Institute for Applied Information Processing and Communications (IAIK)

Complexity of the Attack

Using the same differential characteristic (fix β, γ) Backward: only difference in ∆A−1

6

Forward: only difference in ∆A31

3 and ∆B31

Input to IF function Used to compute ∆A32

6

Added costs: 23 Ignore costs: last three steps in both directions

Final complexity: ≈ 2200.6 Generic complexity: 2256

Tomislav Nad 13.12.2011 Indocrypt 2011 33

SLIDE 67

Institute for Applied Information Processing and Communications (IAIK)

Outline

1

SHA-3 Competition

2

SIMD

3

Higher-Order Differentials and Boomerangs

4

Distinguisher for SIMD-512 Permutation

5

Distinguisher for SIMD-512 Compression Function

6

Conclusions

Tomislav Nad 13.12.2011 Indocrypt 2011 34

SLIDE 68

Institute for Applied Information Processing and Communications (IAIK)

Conclusions

Application of the boomerang attack on SIMD-512 Using techniques from coding theory to search for two differential characteristics Construct a second-order differential collision and define a distinguishing property Distinguisher for the full permutation of SIMD-512 Extend the attack to the full compression function of SIMD-512

Best distinguishing attack for SIMD-512 (2200.6 vs. 2398)

Tomislav Nad 13.12.2011 Indocrypt 2011 35

SLIDE 69

Institute for Applied Information Processing and Communications (IAIK)

Thank you for your Attention!

Questions?

Tomislav Nad 13.12.2011 Indocrypt 2011 36

SLIDE 70

Institute for Applied Information Processing and Communications (IAIK)

References I

Christina Boura and Anne Canteaut. Zero-Sum Distinguishers for Iterated Permutations and Application to Keccak- and Hamsi-256. In Alex Biryukov, Guang Gong, and Douglas R. Stinson, editors, Selected Areas in Cryptography, volume 6544 of LNCS, pages 1–17. Springer, 2010. Alex Biryukov, Mario Lamberger, Florian Mendel, and Ivica Nikolic. Second-Order Differential Collisions for Reduced SHA-256. In ASIACRYPT, 2011. To appear. Alex Biryukov, Ivica Nikolic, and Arnab Roy. Boomerang Attacks on BLAKE-32. In Antoine Joux, editor, FSE, volume 6733 of LNCS, pages 218–237. Springer, 2011. Przemyslaw Sokolowski Ivica Nikoli´ c, Josef Pieprzyk and Ron Steinfeld. Rotational Cryptanalysis of (Modified) Versions of BMW and SIMD. Available online, 2010.

Tomislav Nad 13.12.2011 Indocrypt 2011 37

SLIDE 71

Institute for Applied Information Processing and Communications (IAIK)

References II

Antoine Joux and Thomas Peyrin. Hash Functions and the (Amplified) Boomerang Attack. In Alfred Menezes, editor, CRYPTO, volume 4622 of LNCS, pages 244–263. Springer, 2007. Lars R. Knudsen. Truncated and Higher Order Differentials. In Bart Preneel, editor, FSE, volume 1008 of LNCS, pages 196–211. Springer, 1994. Xuejia Lai. Higher Order Derivatives and Differential Cryptanalysis. In Richard E. Blahut, Daniel J. Costello Jr., Ueli Maurer, and Thomas Mittelholzer, editors, Communications and Cryptography: Two Sides of One Tapestry, pages 227–233. Kluwer Academic Publishers, 1994.

Tomislav Nad 13.12.2011 Indocrypt 2011 38

SLIDE 72

Institute for Applied Information Processing and Communications (IAIK)

References III

Ga¨ etan Leurent, Charles Bouillaguet, and Pierre-Alain Fouque. SIMD Is a Message Digest. Submission to NIST (Round 1), December 2008. Available online: http: //csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html. Florian Mendel and Tomislav Nad. A Distinguisher for the Compression Function of SIMD-512. In Bimal K. Roy and Nicolas Sendrier, editors, INDOCRYPT, volume 5922 of LNCS, pages 219–232. Springer, 2009. Florian Mendel, Christian Rechberger, Martin Schl¨ affer, and Søren S. Thomsen. The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl. In Orr Dunkelman, editor, FSE, volume 5665 of LNCS, pages 260–276. Springer, 2009. National Institute of Standards and Technology. Cryptographic Hash Algorithm Competition, November 2007. Available online: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html.

Tomislav Nad 13.12.2011 Indocrypt 2011 39

SLIDE 73

Institute for Applied Information Processing and Communications (IAIK)

References IV

David Wagner. The Boomerang Attack. In Lars R. Knudsen, editor, FSE, volume 1636 of LNCS, pages 156–170. Springer, 1999. Dai Watanabe, Yasuo Hatano, Tsuyoshi Yamada, and Toshinobu Kaneko. Higher Order Differential Attack on Step-Reduced Variants of Luffa v1. In Seokhie Hong and Tetsu Iwata, editors, FSE, volume 6147 of LNCS, pages 270–285. Springer, 2010. Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu. Finding Collisions in the Full SHA-1. In Victor Shoup, editor, CRYPTO, volume 3621 of LNCS, pages 17–36. Springer, 2005. Hongbo Yu and Xiaoyun Wang. Cryptanalysis of the Compression Function of SIMD. In Udaya Parampalli and Philip Hawkes, editors, ACISP, volume 6812 of LNCS, pages 157–171. Springer, 2011.

Tomislav Nad 13.12.2011 Indocrypt 2011 40