Improved Rebound Attack on the Finalist Grstl Jrmy Jean 1 Mara - - PowerPoint PPT Presentation

▶
improved rebound attack on the finalist gr stl
SMART_READER_LITE
LIVE PREVIEW

Improved Rebound Attack on the Finalist Grstl Jrmy Jean 1 Mara - - PowerPoint PPT Presentation

Jan 21, 2023 521 likes •1.25k views

Improved Rebound Attack on the Finalist Grstl Jrmy Jean 1 Mara Naya-Plasencia 2 Thomas Peyrin 3 1 cole Normale Suprieure, France 2 University of Versailles, France 3 Nanyang Technological University, Singapore FSE2012 March 19,

slide-1
SLIDE 1

Improved Rebound Attack on the Finalist Grøstl

Jérémy Jean1 María Naya-Plasencia2 Thomas Peyrin3

1École Normale Supérieure, France 2University of Versailles, France 3Nanyang Technological University, Singapore

FSE’2012 – March 19, 2012

slide-2
SLIDE 2

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

SHA-3 Competition Finalists

◮

In December 2010, the NIST chose the 5 finalists of the SHA-3 competition:

  • BLAKE
  • Grøstl
  • JH
  • Keccak
  • Skein

◮

This year, the winner will be chosen.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 2/27

slide-3
SLIDE 3

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl: Compression Function (CF) Grøstl-v0 [Knudsen et al. 08] has been tweaked for the final:

◮

Grøstl-256: |h| = |m|=512 bits.

◮

Grøstl-512: |h| = |m|=1024 bits. P Q h m h′

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 3/27

slide-4
SLIDE 4

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl: Internal Permutations Permutations P and Q apply the wide-trail strategy from the AES.

◮

Grøstl-256: 10 rounds on state a 8 × 8.

◮

Grøstl-512: 14 rounds on state a 8 × 16.

AddRoundConstant SubBytes ShiftBytes MixBytes

Tweak: constants in ARK and Sh changed to introduce asymmetry between P and Q

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 4/27

slide-5
SLIDE 5

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl: Finalization Round Once all blocks of message have been treated: truncation. hi−1 P h

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 5/27

slide-6
SLIDE 6

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl: Best Analysis After the Tweak

◮

Grøstl-256:

  • [Sasaki et al A10]: 8-round permutation distinguisher.
  • [Gilbert et al. FSE10]: 8-round CF distinguisher.
  • [Boura et al. FSE11]: 10-round zero-sum.

◮

Grøstl-512

  • [Schläffer 2011]: 6-round collision on the CF.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 6/27

slide-7
SLIDE 7

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Our New Results 1/2

◮

Based on the rebound technique [Mendel et al. FSE09].

◮

Based on a way of finding solutions for three consecutive full active rounds: new.

◮

They apply both to 256 and 512 versions.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 7/27

slide-8
SLIDE 8

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Our New Results 2/2

◮

On Grøstl-256, we provide distinguishers for 9 rounds of the permutation (total: 10).

◮

On Grøstl-512, we provide distinguishers for 8, 9 and 10 rounds of the permutation (total: 14).

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 8/27

slide-9
SLIDE 9

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Rebound Attack

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 9/27

slide-10
SLIDE 10

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Rebound Attack

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

Inbound Outbound Outbound

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 9/27

slide-11
SLIDE 11

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

SuperSBox

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

SuperSBox = SB ◦ MC ◦ SB

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 10/27

slide-12
SLIDE 12

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl-256 Permutation

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 11/27

slide-13
SLIDE 13

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Differential Characteristic for 9 rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 12/27

slide-14
SLIDE 14

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound for 3 Full-Active Rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 13/27

slide-15
SLIDE 15

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound for 3 Full-Active Rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 13/27

slide-16
SLIDE 16

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound for 3 Full-Active Rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 13/27

slide-17
SLIDE 17

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound for 3 Full-Active Rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 13/27

slide-18
SLIDE 18

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound for 3 Full-Active Rounds: Analysis Counting 8 forward SuperSBox sets of 264 values and differences

  • 8 backward SuperSBox sets of 264 values and differences
  • Overlapping on 512 bits of values + 512 bits of differences

Number of Solutions Expected 28×64 28×64 2−512−512 = 2512+512−512−512 = 1 Limited Birthday 2384 operations Our Algorithm 2256 operations, memory 264

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 14/27

slide-19
SLIDE 19

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Solving the 3 Active Rounds: Context The 8 forward Li overlaps the 8 backwards L′

i like this:

L′

1 L′ 2 L′ 3 L′ 4 L′ 5 L′ 6 L′ 7 L′ 8

L1 L2 L3 L4 L5 L6 L7 L8

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 15/27

slide-20
SLIDE 20

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Solving the 3 Active Rounds: Step 1 We start by choosing one element in each of the four first L′

i.

L′

1 L′ 2 L′ 3 L′ 4

L8

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 16/27

slide-21
SLIDE 21

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Solving the 3 Active Rounds: Step 2 This determines a single element in each Li.

  • L′

1

L1 L2 L3 L4 L5 L6 L7 L8

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 17/27

slide-22
SLIDE 22

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Solving the 3 Active Rounds: Step 3 Each determined element in the remaining L′

i exists with

p = 2−8×8.

L′

5 L′ 6 L′ 7 L′ 8

L8

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 18/27

slide-23
SLIDE 23

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Summing Up Inbound Phase In total we try 2256 combinations of (L′

1, L′ 2, L′ 3, L′ 4) and each gives

a solution with probability: 2−4×8×8 = 2−256. Outbound Phase Probability 2−2×56 to pass two 8 → 1 transitions in the MixBytes. Distinguisher We distinguish the 9-round permutation in 2256+112 = 2367

  • perations and 264 in memory.

Note: This compares to a generic complexity of 2384 operations.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 19/27

slide-24
SLIDE 24

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Grøstl-512 Permutation

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 20/27

slide-25
SLIDE 25

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Differential Characteristic for 10 rounds

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 21/27

slide-26
SLIDE 26

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound Phase

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 22/27

slide-27
SLIDE 27

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound Phase

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 22/27

slide-28
SLIDE 28

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound Phase

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 22/27

slide-29
SLIDE 29

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Inbound Phase

SB Sh Mb SB Sh Mb SB Sh Mb SB Sh Mb

S0 S1 S2 S3 S3 S4 S5 S6 S6 S7 S8 S9 S9 S10 S11 S12

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 22/27

slide-30
SLIDE 30

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Observations Counting 16 forward SuperSBox sets of 264 values and differences

  • 16 backward SuperSBox sets of 264 values and differences
  • Overlapping on 1024 bits of values + 1024 bits of differences

Number of Solutions Expected 216×64 216×64 2−1024−1024 = 21024+1024−1024−1024 = 1 Limited Birthday 2896 operations Our Algorithm 2280 operations, memory 264

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 23/27

slide-31
SLIDE 31

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Algorithm: Guess-and-Determine Approach Constraints The differences around the MixBytes layer are restricted since the right state is not fully active. Mb Notations Forward SuperSBoxes: L1, . . . , L16.

  • Backward SuperSBoxes: L′

1, . . . , L′ 16.

  • FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl

24/27

slide-32
SLIDE 32

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Algorithm: Guess-and-Determine Approach

L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 24/27

slide-33
SLIDE 33

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆ ⋆

L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-34
SLIDE 34

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 Next step: L′

5, L′ 6, L′ 7, L′ 8.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-35
SLIDE 35

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-36
SLIDE 36

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 Next step: L1, L16.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-37
SLIDE 37

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 Next step: L′

4.

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-38
SLIDE 38

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-39
SLIDE 39

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 Next step: L15.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-40
SLIDE 40

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256 Current Probability 1 Next step: L6.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-41
SLIDE 41

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • ⋆
  • ⋆
  • ⋆
  • ⋆
  • ⋆
  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-42
SLIDE 42

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 Next step: L′

9.

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-43
SLIDE 43

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-44
SLIDE 44

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 Next step: L14.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-45
SLIDE 45

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 Next step: L′

3.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-46
SLIDE 46

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-47
SLIDE 47

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 Next step: L1.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-48
SLIDE 48

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-49
SLIDE 49

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16 Current Probability 1 Next step: L′

1.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-50
SLIDE 50

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • ⋆

⋆ ⋆

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-51
SLIDE 51

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 Next step: L13.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-52
SLIDE 52

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 Next step: L′

2.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-53
SLIDE 53

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-54
SLIDE 54

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 Next step: L7, L16.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-55
SLIDE 55

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-56
SLIDE 56

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 1 Next step: L′

10, L′ 11.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-57
SLIDE 57

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-58
SLIDE 58

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1) Next step: L8, L9, L11, L15.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-59
SLIDE 59

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-60
SLIDE 60

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2) Next step: L′

12.L′ 4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-61
SLIDE 61

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-62
SLIDE 62

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3) Next step: L10, L12.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-63
SLIDE 63

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-64
SLIDE 64

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3) Next step: L′

2.L′ 16

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-65
SLIDE 65

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3+5) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-66
SLIDE 66

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3+5) Next step: L′

13, L′ 14, L′ 15.L′ 16

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-67
SLIDE 67

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Current Complexity 2256+16+8 Current Probability 2−8·(1+2+3+5+8+8+8) L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-68
SLIDE 68

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Guess-and-Determine Algorithm

  • L′

i

Li Number of different differences in each Li 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 9 9 10 10 11 11 12 12 13 13 14 14 15 15 16 16 3 4 3 4 5 6 8 6 5 4 3 4 3 2 2 2

Final Complexity 2256+16+8 = 2280 Final Probability 2−8·(1+2+3+5+8+8+8) = 2−280 The End.L′

4

Legend Known value and difference Known difference ⋆ Guessed value and difference Highlight current step

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 25/27

slide-69
SLIDE 69

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Summing Up Inbound Phase In total we try: 2256+16+8 = 2280possibilities, and each gives a solution with probability 2−8×(1+2+3+5+8+8+8) = 2−280. Outbound Phase Again: P(outbound) = 2−2×56 = 2−112. Distinguisher Finally, we distinguish the 10-round permutation in 2280+112 = 2392 operations and 264 in memory. This compares to a generic complexity of 2448 operations.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 26/27

slide-70
SLIDE 70

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Conclusion

◮

We have provided new rebound results on building blocks of both versions of Grøstl that improve the previous number of analysed rounds.

◮

We propose a way to solve 3 fully active states in the middle.

◮

The results do not threaten the security of Grøstl, but we believe they will help better understanding AES-based constructions and their bounds regarding rebound techniques.

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 27/27

slide-71
SLIDE 71

Grøstl & SHA-3 Cryptanalysis Techniques Grøstl-256 Grøstl-512 Conclusion

Conclusion

◮

We have provided new rebound results on building blocks of both versions of Grøstl that improve the previous number of analysed rounds.

◮

We propose a way to solve 3 fully active states in the middle.

◮

The results do not threaten the security of Grøstl, but we believe they will help better understanding AES-based constructions and their bounds regarding rebound techniques.

Thank you!

FSE’2012 – J. Jean, M. Naya-Plasencia, T. Peyrin – Improved Rebound Attack on the Finalist Grostl 27/27