Cryptographic Hash Function EDON-R Presented by Prof. Danilo - - PowerPoint PPT Presentation

▶
cryptographic hash function edon r
SMART_READER_LITE
LIVE PREVIEW

Cryptographic Hash Function EDON-R Presented by Prof. Danilo - - PowerPoint PPT Presentation

Sep 14, 2023 161 likes •720 views

1 Cryptographic Hash Function EDON-R Presented by Prof. Danilo Gligoroski Department of Telematics Faculty of Information Technology, Mathematics and Electrical Engineering Norwegian University of Science and TechnologyTechnology - NTNU,

slide-1
SLIDE 1

1

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Cryptographic Hash Function EDON-R

Presented by

  • Prof. Danilo Gligoroski

Department of Telematics Faculty of Information Technology, Mathematics and Electrical Engineering Norwegian University of Science and TechnologyTechnology - NTNU, NORWAY

slide-2
SLIDE 2

2

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Outline

Short history of EDON-R Specific design characteristics Known attacks on EDON-R Are there any one-way bijections embedded in EDON-R? SW/HW performance and memory requirements

slide-3
SLIDE 3

3

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Short history of EDON-R

  • Theoretical principles of EDON-R were described at

the Second NIST Hash Workshop – 2006 in the presentation: Edon-R Family of Cryptographic Hash Functions

– No concrete realization

slide-4
SLIDE 4

4

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Short history of EDON-R

  • Theoretical principles of EDON-R were described at

the Second NIST Hash Workshop – 2006 in the presentation: Edon-R Family of Cryptographic Hash Functions

– No concrete realization

  • First implementation of Edon-R(256, 384, 512)

published at http://eprint.iacr.org/2007/154

– Big acknowledgement for Søren Steffen Thomsen, giving me comments about zero being a fixed point in that realization

slide-5
SLIDE 5

5

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Short history of EDON-R

  • Additionally, the following contributors joined the

EDON-R (SHA-3) team:

– Rune Steinsmo Ødegård – Investigating the mathematical properties of defined quasigroups – Marija Mihova – Investigating the differential properties in EDON-R operations – Svein Johan Knapskog (general comments and suggestions for improvements, proofreading) – Ljupco Kocarev (general comments and suggestions for improvements, proofreading) – Aleš Drápal (Theory of quasigroups and suggestions for improvements) – Vlastimil Klima (cryptanalysis and suggestions for improvements)

slide-6
SLIDE 6

6

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-7
SLIDE 7

7

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Concatenation of at least 65 bits (Merkle-Damgård strenghtening)

slide-8
SLIDE 8

8

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-9
SLIDE 9

9

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-10
SLIDE 10

10

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-11
SLIDE 11

11

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-12
SLIDE 12

12

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Function is defined by quasigroup operations

slide-13
SLIDE 13

13

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Quasigroup operations are defined on 256-bit or 512-bit operands.

slide-14
SLIDE 14

14

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Quasigroup operations are defined on 256-bit or 512-bit operands.

(X0, X1, …, X7) (Y0, Y1, …, Y7)

32-bit or 64-bit variables

slide-15
SLIDE 15

15

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Quasigroup operations are defined on 256-bit or 512-bit operands.

(X0, X1, …, X7) (Y0, Y1, …, Y7)

32-bit or 64-bit variables

Operations:

slide-16
SLIDE 16

16

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-17
SLIDE 17

17

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Simple re-indexing (no computational costs)

slide-18
SLIDE 18

18

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-19
SLIDE 19

19

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-20
SLIDE 20

20

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-21
SLIDE 21

21

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-22
SLIDE 22

22

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-23
SLIDE 23

23

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-24
SLIDE 24

24

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Rotations differ from each

  • ther for at least 2

positions.

slide-25
SLIDE 25

25

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R Two orthogonal Latin Squares of order 8

slide-26
SLIDE 26

26

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R Two orthogonal Latin Squares of order 8

Four corresponding nonsingular in (Z2, +, x) matrices.

slide-27
SLIDE 27

27

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Four nonsingular in (Z2, +, x) matrices.

slide-28
SLIDE 28

28

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

Four nonsingular in (Z2, +, x) matrices. Two diffusion (bi-stochastic) matrices

slide-29
SLIDE 29

29

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-30
SLIDE 30

30

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-31
SLIDE 31

31

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-32
SLIDE 32

32

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-33
SLIDE 33

33

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-34
SLIDE 34

34

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

slide-35
SLIDE 35

35

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R Theorem 3:

slide-36
SLIDE 36

36

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-37
SLIDE 37

37

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-38
SLIDE 38

38

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-39
SLIDE 39

39

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-40
SLIDE 40

40

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-41
SLIDE 41

41

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-42
SLIDE 42

42

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-43
SLIDE 43

43

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-44
SLIDE 44

44

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-45
SLIDE 45

45

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R is provably resistant against differential cryptanalysis

slide-46
SLIDE 46

46

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Specific design characteristics for EDON-R

EDON-R has double size chaining (pipe) values

  • For n=224, 256, chaining value has 512 bits
  • For n=384, 512, chaining value has 1024 bits
  • Gives resistance against length-extension attack
  • Gives resistance against multi-collision attack
slide-47
SLIDE 47

47

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

  • 1. Khovratovic and Nikolic
  • Free-start collisions in Edon-R
  • Using free-start collisions to launch preimage attack with TIME ~ O(22n/3)

and MEMORY ~ O(22n/3) i.e. the attack has this property: TIME * MEMORY > 2n + n/3 >> 2n

  • 2. Klima: EDON-R is "almost" as ordinary strengthened MD design.
  • That "almost" is in the small additional factor of 265 to the generic

multicollision attack that comes from the Merkle-Damgård strengthening.

Known attacks on EDON-R

slide-48
SLIDE 48

48

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Known attacks on EDON-R

  • 1. Khovratovic and Nikolic
  • Free-start collisions in Edon-R
  • Using free-start collisions to launch preimage attack with TIME ~ O(22n/3)

and MEMORY ~ O(22n/3) i.e. the attack has this property: TIME * MEMORY > 2n + n/3 >> 2n

  • 2. Klima: EDON-R is "almost" as ordinary strengthened MD design.
  • That "almost" is in the small additional factor of 265 to the generic

multicollision attack that comes from the Merkle-Damgård strengthening. Idea to defend from both attacks without changing anything in the definition of the compression function

slide-49
SLIDE 49

49

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Are there one-way bijections embedded in EDON-R?

Example:

* 1 2 3 1 2 3 1 1 3 2 2 2 3 1 3 3 2 1

slide-50
SLIDE 50

50

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Are there one-way bijections embedded in EDON-R?

Example:

1. Fix C0=1, C1=0, B0=2,

* 1 2 3 1 2 3 1 1 3 2 2 2 3 1 3 3 2 1

slide-51
SLIDE 51

51

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Are there one-way bijections embedded in EDON-R?

Example:

1. Fix C0=1, C1=0, B0=2, 2. For every A0 in {0,1,2,3}, compute: 1. X0

(3),

2. X0

(2),

3. X0

(1),

4. A1, 5. X1

(1),

6. X1

(2),

7. X1

(3),

8. B1,

* 1 2 3 1 2 3 1 1 3 2 2 2 3 1 3 3 2 1

slide-52
SLIDE 52

52

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Are there one-way bijections embedded in EDON-R?

Example:

1. Fix C0=1, C1=0, B0=2, 2. For every A0 in {0,1,2,3}, compute: 1. X0

(3),

2. X0

(2),

3. X0

(1),

4. A1, 5. X1

(1),

6. X1

(2),

7. X1

(3),

8. B1,

1. The mapping: A0 → B1 is a bijection. 2. Knowing A0, it is easy to compute B1. 3. However: Knowing B1, it is “hard” to find A0. 4. For tiny quasigroups of order 4 we found that 144 quasigroups. give bijections for every value of C0, C1 and B0.

* 1 2 3 1 2 3 1 1 3 2 2 2 3 1 3 3 2 1

slide-53
SLIDE 53

53

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

Are there one-way bijections embedded in EDON-R?

Example:

1. Fix C0=1, C1=0, B0=2, 2. For every A0 in {0,1,2,3}, compute: 1. X0

(3),

2. X0

(2),

3. X0

(1),

4. A1, 5. X1

(1),

6. X1

(2),

7. X1

(3),

8. B1,

1. The mapping: A0 → B1 is a bijection. 2. Knowing A0, it is easy to compute B1. 3. However: Knowing B1, it is “hard” to find A0. 4. For tiny quasigroups of order 4 we found that 144 quasigroups. give bijections for every value of C0, C1 and B0.

* 1 2 3 1 2 3 1 1 3 2 2 2 3 1 3 3 2 1

slide-54
SLIDE 54

54

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R

SW/HW performance and memory requirements

Software performances of the optimized C implementation on the NIST reference platform

Intel C++ v11.0.66, in 64-bit mode EDON-R 224/256 achieves 4.54 cycles/byte Intel C++ v11.0.66, in 64-bit mode EDON-R 384/512 achieves 2.29 cycles/byte

Memory requirements

EDON-R 224/256 needs 256 bytes EDON-R 384/512 needs 512 bytes

8-bit MCU (ATmega16, ATmega406)

EDON-R 224/256, compiled C code produces ~6KB of machine instructions, speed 616 cycles/bytes EDON-R 384/512, compiled C code produces ~38KB of machine instructions, speed 1857 cycles/bytes

HW – gate count

EDON-R 224/256, ~13,000 gates EDON-R 384/512, ~25,000 gates

slide-55
SLIDE 55

55

25-28 Feb 2009, Leuven, Belgium, The First SHA-3 Candidate Conference, Cryptographic Hash Function EDON-R