SLIDE 1
LUX Hash Function
LUX Hash Function
Ivica Nikoli´ c, Alex Biryukov, Dmitry Khovratovich
University of Luxembourg
LUX Hash Function
LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry - - PowerPoint PPT Presentation
LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry - - PowerPoint PPT Presentation
LUX Hash Function LUX Hash Function Ivica Nikoli c, Alex Biryukov, Dmitry Khovratovich University of Luxembourg LUX Hash Function Outline 1 Design 2 Security Analysis 3 Implementation 4 Advantages LUX Hash Function Design Design LUX Hash
SLIDE 2
SLIDE 3
LUX Hash Function
Design Design
SLIDE 4
LUX Hash Function Design
General Design of LUX
Stream based (RadioGatun like) hash function Big internal state - 3 × message digest Message is processed by small (32-bit or 64-bit) chunks Round function uses Rijndael-like transformation
SLIDE 5
LUX Hash Function Design
The internal state of LUX
The state can be divided into two parts: Buffer - m × 16 matrix of bytes (light transforms) Core - m × 8 matrix of bytes (heavy transforms) Output m Core Buffer Total 256 4 4×8 4×16 96 512 8 8×8 8×16 192 Feedforwards between the core and the buffer in each round
SLIDE 6
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 7
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 8
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 9
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 10
LUX Hash Function Design
State update function (round transformation)
Rijndael round
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 11
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 12
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 13
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 14
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 15
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 16
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 17
LUX Hash Function Design
State update function (round transformation)
Message XOR to the core and the buffer Update of the core and the buffer XOR of the core to the buffer Feedforward from the buffer to the core
SLIDE 18
LUX Hash Function Design
Hashing
... ... ... m1 m2 m3 mk h1 h2 h3
Three phases of hashing: Input phase - absorb the whole message Blank rounds phase - increase diffusion of the last message blocks Output phase - produce the hash value from the state
SLIDE 19
LUX Hash Function Security Analysis
Security Security
SLIDE 20
LUX Hash Function Security Analysis
Multicollisions, length-extension, herding, 2-nd
Multicollision, length-extension and herding attacks require internal collisions 2-nd preimage attack (Dean, Kelsey-Schneier) requires finding at least one preimage for some intermediate state value The big internal state of LUX-n has 3n bits ⇒ internal collisions/preimages are expensive
SLIDE 21
LUX Hash Function Security Analysis
Collisions
Truncated differentials (see Peyrin’s attack on Grindahl) Build a trail of truncated differentials Complexity of the attack depends on the number of active S-Boxes Fix some values of the S-Boxes with the message input The best truncated differential trail found for LUX-256 has 88 active S-Boxes where 38 can be fixed ⇒ complexity 2300
SLIDE 22
LUX Hash Function Security Analysis
Preimages
Whole execution of LUX is invertible ⇒ try MITM attack for preimages Big internal state (3n) stops this attack Try to fix some intermediate values in the buffer. Due to the xor of the core to the buffer, only n bits can be fixed ⇒ complexity of MITM on 2n-bit state is 2n
SLIDE 23
LUX Hash Function Security Analysis
Recent cryptanalysis
Free-start collisions/preimages and distinguishers (Wu et al.) Free start attacks on invertible functions are trivial. Outputting the whole state at once stops the distinguisher based on the properties of the output transform Length extension slide attack (Peyrin) Needs salt size to be equal to 31 (mod 32) bits. Salt size is fixed to 128-bits in LUX.
SLIDE 24
LUX Hash Function Implementation
Implementation Implementation
SLIDE 25
LUX Hash Function Implementation
Implementation results
Primitive comparation to AES (counting the number of XORs and table look-ups) gives a speed-up of 1.2 in favor of LUX 224/256 384/512 32-bit (C) 16.7 28.2 64-bit (asm) 10.2 9.5 Speed on 32-bit can be improved with an assembler implementation The new Intel instruction set can improve the speed of LUX-256
SLIDE 26
LUX Hash Function Advantages
Advantages Advantages
SLIDE 27
LUX Hash Function Advantages
Pros
Rijndael-based - well analyzed transformation Cryptanalysis can be focused only on the construction Implementation tricks of Rijndael can be used in LUX Speed - one of the fastest on both 32 and 64-bit platforms Stable high speed on various processors (AMD, Intel) Overperforms all AES based functions
SLIDE 28
LUX Hash Function