Collision Attacks on the Reduced Dual-Stream Hash Function - PowerPoint PPT Presentation

Collision Attacks on the Reduced Dual-Stream Hash Function RIPEMD-128 Florian Mendel 1 , Tomislav Nad 2 , Martin Schl¨ affer 2 Katholieke Universiteit Leuven, ESAT/COSIC and IBBT, Belgium Graz University of Technology, IAIK, Austria FSE 2012 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 1 / 22

Outline Motivation 1 Description of RIPEMD-128 2 Outline of the Attack 3 Searching for Differential Characteristics 4 5 Finding a Colliding Message Pair Results and Summary 6 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 2 / 22

Motivation Outline Motivation 1 Description of RIPEMD-128 2 Outline of the Attack 3 Searching for Differential Characteristics 4 Finding a Colliding Message Pair 5 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 3 / 22

Motivation Motivation Cryptanalysis of ARX based designs is still important Very difficult without the right tools Even more for dual-stream hash functions Do the results on SHA-2 help to improve attacks on other designs? RIPEMD-128: shares some similarities with SHA-2 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 4 / 22

Description of RIPEMD-128 Outline Motivation 1 Description of RIPEMD-128 2 Outline of the Attack 3 Searching for Differential Characteristics 4 Finding a Colliding Message Pair 5 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 5 / 22

Description of RIPEMD-128 Description of RIPEMD-128 H j ISO/IEC standard [DBP96] Stream 1 Stream 2 designed by Dobbertin, Bosselaers and Preneel M j +1 M j +1 iterated, Merkle-Damg˚ ard hash function dual stream compression function ≪ 64 ≪ 32 ≪ 96 no output transformation 128-bit hash output H j +1 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 6 / 22

Description of RIPEMD-128 Step Update Transformation of RIPEMD-128 B ′ B ′ B ′ B ′ B i − 4 B i − 1 B i − 2 B i − 3 i − 4 i − 1 i − 2 i − 3 K i K ′ i f f ′ W i W ′ i ≪ s ≪ s ′ B ′ B ′ B ′ B i − 3 B i B i − 1 B i − 2 B ′ i − 3 i i − 1 i − 2 one message word updates two state variables different message word permutations different rotation values and Boolean functions no interaction between streams (SHA-2: with interaction) 4 rounds of 16 steps Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 7 / 22

Description of RIPEMD-128 Step Update Transformation of RIPEMD-128 A i − 1 A i − 2 A i − 3 A i − 4 E i − 1 E i − 2 E i − 3 E i − 4 − Σ 0 Σ 1 + K i f 0 f 1 W i A i − 1 A i − 2 A i − 3 E i − 1 E i − 2 E i − 3 A i E i one message word updates two state variables different message word permutations different rotation values and Boolean functions no interaction between streams (SHA-2: with interaction) 4 rounds of 16 steps Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 7 / 22

Outline of the Attack Outline Motivation 1 Description of RIPEMD-128 2 Outline of the Attack 3 Searching for Differential Characteristics 4 Finding a Colliding Message Pair 5 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 8 / 22

Outline of the Attack Overview of the Attack -4 H i − 1 -3 -2 -1 0 0 5 0 1 1 14 1 2 2 7 2 3 3 0 3 4 4 9 4 5 5 2 5 6 6 11 M i 6 7 7 4 7 8 8 13 8 9 9 6 9 10 10 right stream 15 10 11 11 8 11 left stream 12 12 1 12 13 13 10 13 3 14 14 14 15 15 12 15 16 7 6 17 4 11 18 13 3 19 1 7 20 10 0 21 6 13 22 15 5 23 3 10 24 12 14 25 0 15 26 9 8 27 5 12 28 2 4 29 14 9 30 11 1 31 8 2 32 3 15 33 10 5 34 14 1 35 4 3 36 9 7 37 15 14 38 8 6 39 1 9 40 2 11 41 7 8 42 0 12 43 6 2 44 13 10 45 11 0 46 5 4 47 12 13 H0 H i H1 H2 H3 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 9 / 22

Outline of the Attack Overview of the Attack -4 H i − 1 -3 -2 -1 0 0 5 0 1 1 14 1 choose a good starting point 2 2 7 2 1 3 3 0 3 4 4 9 4 5 5 2 5 few message word differences 6 6 11 M i 6 7 7 4 7 8 8 13 8 9 9 6 9 high probability characteristic 10 10 right stream 15 10 11 11 8 11 left stream 12 12 1 12 13 13 10 13 3 14 14 14 15 15 12 15 search for a characteristics 16 7 6 2 17 4 11 18 13 3 19 1 7 20 10 0 very sparse in R2 and R3 21 6 13 22 15 5 23 3 10 sparse in one stream in R1 24 12 14 25 0 15 26 9 8 27 5 12 28 2 4 29 14 9 30 11 1 determine message pair 3 31 8 2 32 3 15 33 10 5 34 14 1 message modification in R1 35 4 3 36 9 7 37 15 14 38 8 6 exhaustive search for R2, R3 39 1 9 40 2 11 41 7 8 42 0 12 43 6 2 44 13 10 45 11 0 ⇒ iterations between phases 46 5 4 47 12 13 H0 H i H1 H2 H3 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 9 / 22

Outline of the Attack Choosing a Starting Point -4 H i − 1 -3 -2 -1 0 0 5 0 which message words should 1 1 14 1 2 2 7 2 3 3 0 3 4 4 9 4 contain differences? 5 5 2 5 6 6 11 M i 6 7 7 4 7 8 8 13 8 as few words as possible 9 9 6 9 10 10 15 10 11 11 8 11 only words used late in R3 12 12 1 12 13 13 10 13 3 14 14 14 15 15 12 15 short local collisions in R2 16 7 6 17 4 11 18 13 3 19 1 7 20 10 0 21 6 13 22 15 5 23 3 10 24 12 14 25 0 15 26 9 8 27 5 12 28 2 4 29 14 9 30 11 1 31 8 2 32 3 15 33 10 5 34 14 1 35 4 3 36 9 7 37 15 14 38 8 6 39 1 9 40 2 11 41 7 8 42 0 12 43 6 2 44 13 10 45 11 0 46 5 4 47 12 13 H0 H i H1 H2 H3 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 10 / 22

Outline of the Attack Choosing a Starting Point -4 H i − 1 -3 -2 -1 0 0 5 0 which message words should 1 1 14 1 2 2 7 2 3 3 0 3 4 4 9 4 contain differences? 5 5 2 5 6 6 11 M i 6 7 7 4 7 8 8 13 8 as few words as possible 9 9 6 9 10 10 15 10 11 11 8 11 only words used late in R3 12 12 1 12 13 13 10 13 impossible 3 14 14 14 15 15 12 15 short local collisions in R2 16 7 6 17 4 11 18 13 3 19 1 7 message word 13 20 10 0 21 6 13 22 15 5 23 3 10 single local collision (R1-R2) 24 12 14 25 0 15 26 9 8 27 5 12 impossible in left stream 28 2 4 29 14 9 30 11 1 31 8 2 32 3 15 33 10 5 34 14 1 35 4 3 36 9 7 37 15 14 38 8 6 39 1 9 40 2 11 41 7 8 42 0 12 43 6 2 44 13 10 45 11 0 46 5 4 47 12 13 H0 H i H1 H2 H3 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 10 / 22

Outline of the Attack Choosing a Starting Point -4 H i − 1 -3 -2 -1 0 0 5 0 which message words should 1 1 14 1 2 2 7 2 3 3 0 3 4 4 9 4 contain differences? 5 5 2 5 6 6 11 M i 6 7 7 4 7 8 8 13 8 as few words as possible 9 9 6 9 10 10 15 10 11 11 8 11 only words used late in R3 12 12 1 12 13 13 10 13 3 14 14 14 15 15 12 15 short local collisions in R2 16 7 6 17 4 11 18 13 3 19 1 7 message word 13 20 10 0 21 6 13 22 15 5 23 3 10 single local collision (R1-R2) 24 12 14 25 0 15 26 9 8 27 5 12 impossible in left stream 28 2 4 29 14 9 30 11 1 31 8 2 message word 0 and 6 32 3 15 33 10 5 34 14 1 35 4 3 36 9 7 left: two short local collisions 37 15 14 38 8 6 39 1 9 right: one long local collision 40 2 11 41 7 8 42 0 12 43 6 2 avoid overlapping of LCs 44 13 10 45 11 0 46 5 4 collision for 38 steps 47 12 13 H0 H i H1 H2 H3 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 10 / 22

Searching for Differential Characteristics Outline Motivation 1 Description of RIPEMD-128 2 Outline of the Attack 3 Searching for Differential Characteristics 4 Finding a Colliding Message Pair 5 Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 11 / 22

Searching for Differential Characteristics Differences and Conditions Generalized Conditions [DR06] take all 16 possible conditions on a pair of bits into account ∗ ) ( X i , X i ( 0 , 0 ) ( 1 , 0 ) ( 0 , 1 ) ( 1 , 1 ) ( X i , X ∗ i ) ( 0 , 0 ) ( 1 , 0 ) ( 0 , 1 ) ( 1 , 1 ) - - ? � � � � 3 � � � - - � � - � - - 5 - - - x � � 7 � � � 0 � - - - A - � - � - � - - � � - � u B - - - - - n � C � � - - - � � - � � 1 D - - - - - � � � # E 2-bit Conditions [MNS11] linear relation between closely related bits: X i ⊕ X j = 0 / 1 2-bit conditions on any generalized condition (-,x,?,...) used to determine critical bits (those with many relations) Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 12 / 22

Searching for Differential Characteristics Propagation of Differences and Conditions Stored conditions all possible pairs on bits (generalized conditions) all possible pairs on carries Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 13 / 22

Searching for Differential Characteristics Propagation of Differences and Conditions Stored conditions all possible pairs on bits (generalized conditions) all possible pairs on carries 2-bit conditions all inputs and outputs of Boolean functions modular additions even on carries (sign of carry) Martin Schl¨ affer (FSE 2012) Collision Attacks on RIPEMD-128 13 / 22