LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry - - PowerPoint PPT Presentation

lux hash function
SMART_READER_LITE
LIVE PREVIEW

LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry - - PowerPoint PPT Presentation

LUX Hash Function LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry Khovratovich University of Luxembourg LUX Hash Function Outline 1 Design 2 Security Analysis 3 Implementation 4 Advantages LUX Hash Function Design Design LUX Hash


slide-1
SLIDE 1

LUX Hash Function

LUX Hash Function

Ivica Nikoli´ c, Alex Biryukov, Dmitry Khovratovich

University of Luxembourg

slide-2
SLIDE 2

LUX Hash Function

Outline

1 Design 2 Security Analysis 3 Implementation 4 Advantages

slide-3
SLIDE 3

LUX Hash Function

Design Design

slide-4
SLIDE 4

LUX Hash Function Design

General Design of LUX

Stream based (RadioGatun like) hash function Big internal state - 3 × message digest Message is processed by small (32-bit or 64-bit) chunks Round function uses Rijndael-like transformation

slide-5
SLIDE 5

LUX Hash Function Design

The internal state of LUX

The state can be divided into two parts: Buffer - m × 16 matrix of bytes (light transforms) Core - m × 8 matrix of bytes (heavy transforms) Output m Core Buffer Total 256 4 4×8 4×16 96 512 8 8×8 8×16 192 Feedforwards between the core and the buffer in each round

slide-6
SLIDE 6

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-7
SLIDE 7

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-8
SLIDE 8

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-9
SLIDE 9

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-10
SLIDE 10

LUX Hash Function Design

State update function (round transformation)

Rijndael round

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-11
SLIDE 11

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-12
SLIDE 12

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-13
SLIDE 13

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-14
SLIDE 14

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-15
SLIDE 15

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-16
SLIDE 16

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-17
SLIDE 17

LUX Hash Function Design

State update function (round transformation)

Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core

slide-18
SLIDE 18

LUX Hash Function Design

Hashing

... ... ... m1 m2 m3 mk h1 h2 h3

Three phases of hashing: Input phase - absorb the whole message Blank rounds phase - increase diffusion of the last message blocks Output phase - produce the hash value from the state

slide-19
SLIDE 19

LUX Hash Function Security Analysis

Security Security

slide-20
SLIDE 20

LUX Hash Function Security Analysis

Multicollisions, length-extension, herding, 2-nd

Multicollision, length-extension and herding attacks require internal collisions 2-nd preimage attack (Dean, Kelsey-Schneier) requires finding at least one preimage for some intermediate state value The big internal state of LUX-n has 3n bits ⇒ internal collisions/preimages are expensive

slide-21
SLIDE 21

LUX Hash Function Security Analysis

Collisions

Truncated differentials (see Peyrin’s attack on Grindahl) Build a trail of truncated differentials Complexity of the attack depends on the number of active S-Boxes Fix some values of the S-Boxes with the message input The best truncated differential trail found for LUX-256 has 88 active S-Boxes where 38 can be fixed ⇒ complexity 2300

slide-22
SLIDE 22

LUX Hash Function Security Analysis

Preimages

Whole execution of LUX is invertible ⇒ try MITM attack for preimages Big internal state (3n) stops this attack Try to fix some intermediate values in the buffer. Due to the xor of the core to the buffer, only n bits can be fixed ⇒ complexity of MITM on 2n-bit state is 2n

slide-23
SLIDE 23

LUX Hash Function Security Analysis

Recent cryptanalysis

Free-start collisions/preimages and distinguishers (Wu et al.) Free start attacks on invertible functions are trivial. Outputting the whole state at once stops the distinguisher based on the properties of the output transform Length extension slide attack (Peyrin) Needs salt size to be equal to 31 (mod 32) bits. Salt size is fixed to 128-bits in LUX.

slide-24
SLIDE 24

LUX Hash Function Implementation

Implementation Implementation

slide-25
SLIDE 25

LUX Hash Function Implementation

Implementation results

Primitive comparation to AES (counting the number of XORs and table look-ups) gives a speed-up of 1.2 in favor of LUX 224/256 384/512 32-bit (C) 16.7 28.2 64-bit (asm) 10.2 9.5 Speed on 32-bit can be improved with an assembler implementation The new Intel instruction set can improve the speed of LUX-256

slide-26
SLIDE 26

LUX Hash Function Advantages

Advantages Advantages

slide-27
SLIDE 27

LUX Hash Function Advantages

Pros

Rijndael-based - well analyzed transformation Cryptanalysis can be focused only on the construction Implementation tricks of Rijndael can be used in LUX Speed - one of the fastest on both 32 and 64-bit platforms Stable high speed on various processors (AMD, Intel) Overperforms all AES based functions

slide-28
SLIDE 28

LUX Hash Function

Check LUXembourg on cryptolux.org/LUX