On the Security of Tandem-DM Ewan Fleischmann, Michael Gorski, - - PowerPoint PPT Presentation

▶
on the security of tandem dm
SMART_READER_LITE
LIVE PREVIEW

On the Security of Tandem-DM Ewan Fleischmann, Michael Gorski, - - PowerPoint PPT Presentation

Jun 06, 2023 213 likes •774 views

Outline Introduction Security of Tandem-DM Concluding Remarks On the Security of Tandem-DM Ewan Fleischmann, Michael Gorski, Stefan Lucks Bauhaus-University Weimar February 23, 2009 Ewan Fleischmann, Michael Gorski, Stefan Lucks On the

slide-1
SLIDE 1

Outline Introduction Security of Tandem-DM Concluding Remarks

On the Security of Tandem-DM

Ewan Fleischmann, Michael Gorski, Stefan Lucks

Bauhaus-University Weimar

February 23, 2009

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-2
SLIDE 2

Outline Introduction Security of Tandem-DM Concluding Remarks

1

Introduction Blockcipher Based Hashing Examples of DBL Hash Functions

2

Security of Tandem-DM Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

3

Concluding Remarks

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-3
SLIDE 3

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Approaches to building a cryptographic hash function

From Scratch (MD4, MD5, SHA-0/1, SHA-256/512, RIPEMD, ...) From a blockcipher (MMO, DM, MDC-2/4, Tandem-DM, Abreast-DM, ...) From number-theoretic primitives or hard problems (lattices, modular arithmetic, ...)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-4
SLIDE 4

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Approaches to building a cryptographic hash function

From Scratch (MD4, MD5, SHA-0/1, SHA-256/512, RIPEMD, ...) From a blockcipher (MMO, DM, MDC-2/4, Tandem-DM, Abreast-DM, ...) From number-theoretic primitives or hard problems (lattices, modular arithmetic, ...)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-5
SLIDE 5

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Approaches to building a cryptographic hash function

From Scratch (MD4, MD5, SHA-0/1, SHA-256/512, RIPEMD, ...) From a blockcipher (MMO, DM, MDC-2/4, Tandem-DM, Abreast-DM, ...) From number-theoretic primitives or hard problems (lattices, modular arithmetic, ...)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-6
SLIDE 6

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Approaches to building a cryptographic hash function

From Scratch (MD4, MD5, SHA-0/1, SHA-256/512, RIPEMD, ...) From a blockcipher (MMO, DM, MDC-2/4, Tandem-DM, Abreast-DM, ...) From number-theoretic primitives or hard problems (lattices, modular arithmetic, ...)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-7
SLIDE 7

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why?

Several attacks on MD4-type functions in recent years (MD4/5, SHA family, RIPEMED, ...) Only one primitve for encryption and hashing Low cost hardware

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-8
SLIDE 8

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why?

Several attacks on MD4-type functions in recent years (MD4/5, SHA family, RIPEMED, ...) Only one primitve for encryption and hashing Low cost hardware

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-9
SLIDE 9

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why?

Several attacks on MD4-type functions in recent years (MD4/5, SHA family, RIPEMED, ...) Only one primitve for encryption and hashing Low cost hardware

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-10
SLIDE 10

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why not?

Usually slower than dedicated hash function Weaknesses not relevant for encryption (e.g. DES weak keys) Output length too short (e.g. 128 bits for AES) = ⇒ double block length constructions needed (e.g. hash

  • utput size of 256 bits for AES)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-11
SLIDE 11

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why not?

Usually slower than dedicated hash function Weaknesses not relevant for encryption (e.g. DES weak keys) Output length too short (e.g. 128 bits for AES) = ⇒ double block length constructions needed (e.g. hash

  • utput size of 256 bits for AES)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-12
SLIDE 12

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why not?

Usually slower than dedicated hash function Weaknesses not relevant for encryption (e.g. DES weak keys) Output length too short (e.g. 128 bits for AES) = ⇒ double block length constructions needed (e.g. hash

  • utput size of 256 bits for AES)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-13
SLIDE 13

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - Why not?

Usually slower than dedicated hash function Weaknesses not relevant for encryption (e.g. DES weak keys) Output length too short (e.g. 128 bits for AES) = ⇒ double block length constructions needed (e.g. hash

  • utput size of 256 bits for AES)

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-14
SLIDE 14

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - The Goal

’Secure’ (ideal cipher model) e.g. birthday type collision resistance Long hash output (e.g. >> 128 bits = blocksize) Efficient: efficiency = size of message input number of blockcipher calls needed to process this input

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-15
SLIDE 15

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - The Goal

’Secure’ (ideal cipher model) e.g. birthday type collision resistance Long hash output (e.g. >> 128 bits = blocksize) Efficient: efficiency = size of message input number of blockcipher calls needed to process this input

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-16
SLIDE 16

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - The Goal

’Secure’ (ideal cipher model) e.g. birthday type collision resistance Long hash output (e.g. >> 128 bits = blocksize) Efficient: efficiency = size of message input number of blockcipher calls needed to process this input

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-17
SLIDE 17

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Blockcipher Based Hashing - The Goal

’Secure’ (ideal cipher model) e.g. birthday type collision resistance Long hash output (e.g. >> 128 bits = blocksize) Efficient: efficiency = size of message input number of blockcipher calls needed to process this input

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-18
SLIDE 18

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Example: Hirose’s FSE’06 proposal

E E Gi−1 Hi−1 Gi Hi Mi const Rate 1/2, Output size: 2n (i.e. AES-256 256 bits) Collision Resistance: > 2124.5 for CF (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-19
SLIDE 19

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Example: Hirose’s FSE’06 proposal

E E Gi−1 Hi−1 Gi Hi Mi const Rate 1/2, Output size: 2n (i.e. AES-256 256 bits) Collision Resistance: > 2124.5 for CF (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-20
SLIDE 20

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Example: Hirose’s FSE’06 proposal

E E Gi−1 Hi−1 Gi Hi Mi const Rate 1/2, Output size: 2n (i.e. AES-256 256 bits) Collision Resistance: > 2124.5 for CF (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-21
SLIDE 21

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Tandem-DM - a DBL hash function

E E Gi−1 Hi−1 Gi Hi Mi Rate 1/2, Output: 2n (i.e. AES-256: 2n = 256-bit) Proof of Collision Resistance: this presentation/paper (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-22
SLIDE 22

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Tandem-DM - a DBL hash function

E E Gi−1 Hi−1 Gi Hi Mi Rate 1/2, Output: 2n (i.e. AES-256: 2n = 256-bit) Proof of Collision Resistance: this presentation/paper (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-23
SLIDE 23

Outline Introduction Security of Tandem-DM Concluding Remarks Blockcipher Based Hashing Examples of DBL Hash Functions

Tandem-DM - a DBL hash function

E E Gi−1 Hi−1 Gi Hi Mi Rate 1/2, Output: 2n (i.e. AES-256: 2n = 256-bit) Proof of Collision Resistance: this presentation/paper (n, 2n)-blockchiffre, n-bit cipher/plaintext, 2n-bit key

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-24
SLIDE 24

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Security Bound

Theorem (Bound for Collision Resistance) Let F be the Tandem-DM compression function and n, q be natural numbers with q < 2n. Let N′ = 2n − q and let α be any positive number with eq/N′ ≤ α and τ = αN′/q (and ex being the exponential function). Then AdvColl

F

(q) ≤ q2neqτ(1−ln τ)/N′ + 4qα/N′ + 6q/(N′)2 + 2q/(N′)3.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-25
SLIDE 25

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Security Bound

Corollary/Conjecture For the compression function Tandem-DM, instantiated with AES-256, any adversary asking less than 2120.4 (backward or forward) oracle queries cannot find a collision with probability greater than 1/2. In this case, α = 24.0.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-26
SLIDE 26

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Theorem (Bound for Preimage Resistance) Let F := F TDM be the Tandem-DM compression function. For every N′ = 2n − q and q > 1 AdvInv

F (q) ≤ 2q/(N′)2.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-27
SLIDE 27

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (1)

E E −1 Adversary Query History Q: {}

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-28
SLIDE 28

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (1)

E E −1 K1, X1 Y1 Adversary Query History Q : {(X1, K1, Y1)}

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-29
SLIDE 29

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (1)

E E −1 K1, X1 Y1 K2, Y2 X2 Adversary Query History Q: {(X1, K1, Y1), (X2, K2, Y2)}

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-30
SLIDE 30

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (1)

E E −1 K1, X1 Y1 K2, Y2 X2 K3, X3 Y3 Adversary Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3)}

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-31
SLIDE 31

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (1)

E E −1 K1, X1 Y1 K2, Y2 X2 K3, X3 Y3

  • Adversary

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .}

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-32
SLIDE 32

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-33
SLIDE 33

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-34
SLIDE 34

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-35
SLIDE 35

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

1 Adversary A wins if queries can be assembled to hash two

distinct colliding words

2 Advantage(A) is the probability of A winning 3 Adv(q) is the max of Advantage(A) taken over all adversaries

making at most q queries.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-36
SLIDE 36

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

1 Adversary A wins if queries can be assembled to hash two

distinct colliding words

2 Advantage(A) is the probability of A winning 3 Adv(q) is the max of Advantage(A) taken over all adversaries

making at most q queries.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-37
SLIDE 37

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Model for the proof (2)

Query History Q: {(X1, K1, Y1), (X2, K2, Y2), (X3, K3, Y3), . . .} E X1 Y1 K1 XOR − Output X1 ⊕ Y1

1 Adversary A wins if queries can be assembled to hash two

distinct colliding words

2 Advantage(A) is the probability of A winning 3 Adv(q) is the max of Advantage(A) taken over all adversaries

making at most q queries.

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-38
SLIDE 38

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Main Idea

Main Idea Upper bound the probability of the adversary making a query that can be used as the final query to complete a collision. [TL] [BL] A1 B1 V W L1 [TR] [BR] A2 B2 V W L2

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-39
SLIDE 39

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Analysis Details

1 We examine the adversarys queries one at a time as they

come in

2 The latest query made by the adversary is ’successful’ if the

adversary can use it to build a collision

3 We upper bound the probability of a query being successful,

and multiply this probability by q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-40
SLIDE 40

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Analysis Details

1 We examine the adversarys queries one at a time as they

come in

2 The latest query made by the adversary is ’successful’ if the

adversary can use it to build a collision

3 We upper bound the probability of a query being successful,

and multiply this probability by q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-41
SLIDE 41

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Analysis Details

1 We examine the adversarys queries one at a time as they

come in

2 The latest query made by the adversary is ’successful’ if the

adversary can use it to build a collision

3 We upper bound the probability of a query being successful,

and multiply this probability by q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-42
SLIDE 42

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Some difficulties

1 A query can be used in many different ways to complete a

collision (in different positions of the diagram, or several different times in a diagram)

2 All cases require separate analysis 3 The probability of success of a query will depend on the

previous query history Q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-43
SLIDE 43

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Some difficulties

1 A query can be used in many different ways to complete a

collision (in different positions of the diagram, or several different times in a diagram)

2 All cases require separate analysis 3 The probability of success of a query will depend on the

previous query history Q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-44
SLIDE 44

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Some difficulties

1 A query can be used in many different ways to complete a

collision (in different positions of the diagram, or several different times in a diagram)

2 All cases require separate analysis 3 The probability of success of a query will depend on the

previous query history Q

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-45
SLIDE 45

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Proof Overview

1 Exhibit predicates Lucky(Q), Win1(Q), Win2(Q) and

Win3(Q) such that

2 CollTDM(Q) ⇒

Lucky(Q) ∨ Win1(Q) ∨ Win2(Q) ∨ Win3(Q)

3 Upper bound separately the probabilities Pr[Lucky(Q)],

Pr[Win1(Q)], Pr[Win2(Q)] and Pr[Win3(Q)]

4 Then Pr[Coll(Q)] ≤

Pr[Lucky(Q)]+Pr[Win1(Q)]+Pr[Win2(Q)]+Pr[Win3(Q)].

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-46
SLIDE 46

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Proof Overview

1 Exhibit predicates Lucky(Q), Win1(Q), Win2(Q) and

Win3(Q) such that

2 CollTDM(Q) ⇒

Lucky(Q) ∨ Win1(Q) ∨ Win2(Q) ∨ Win3(Q)

3 Upper bound separately the probabilities Pr[Lucky(Q)],

Pr[Win1(Q)], Pr[Win2(Q)] and Pr[Win3(Q)]

4 Then Pr[Coll(Q)] ≤

Pr[Lucky(Q)]+Pr[Win1(Q)]+Pr[Win2(Q)]+Pr[Win3(Q)].

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-47
SLIDE 47

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Proof Overview

1 Exhibit predicates Lucky(Q), Win1(Q), Win2(Q) and

Win3(Q) such that

2 CollTDM(Q) ⇒

Lucky(Q) ∨ Win1(Q) ∨ Win2(Q) ∨ Win3(Q)

3 Upper bound separately the probabilities Pr[Lucky(Q)],

Pr[Win1(Q)], Pr[Win2(Q)] and Pr[Win3(Q)]

4 Then Pr[Coll(Q)] ≤

Pr[Lucky(Q)]+Pr[Win1(Q)]+Pr[Win2(Q)]+Pr[Win3(Q)].

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-48
SLIDE 48

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Proof Overview

1 Exhibit predicates Lucky(Q), Win1(Q), Win2(Q) and

Win3(Q) such that

2 CollTDM(Q) ⇒

Lucky(Q) ∨ Win1(Q) ∨ Win2(Q) ∨ Win3(Q)

3 Upper bound separately the probabilities Pr[Lucky(Q)],

Pr[Win1(Q)], Pr[Win2(Q)] and Pr[Win3(Q)]

4 Then Pr[Coll(Q)] ≤

Pr[Lucky(Q)]+Pr[Win1(Q)]+Pr[Win2(Q)]+Pr[Win3(Q)].

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-49
SLIDE 49

Outline Introduction Security of Tandem-DM Concluding Remarks Results on Collision Resistance Results on Preimage Resistance Model for the proof Proof Details

Example Case: Win1(Q) = ¬Lucky(Q) ∧ Fit1(Q) Fit1(Q): The last query is used only once in position TL. Note that this is equal to the case where the last query is used only once in position TR.

Fit1a(Q) all queries used in the collision are pairwise different, Fit1b(Q) BL = TR and BR is different to TL, BL, TR, Fit1c(Q) BL = BR and TR is different to TL, BL, BR, Fit1d(Q) TR = BR and BL is different to TL, TR, BR,

[TL] [BL] A1 B1 V W L1 [TR] [BR] A2 B2 V W L2

Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-50
SLIDE 50

Outline Introduction Security of Tandem-DM Concluding Remarks

Concluding Remarks

1 Only two rate 1/2 DBL compression functions with birthday

type collision resistance known: Hirose FSE’06 and Tandem-DM

2 Tandem-DM (Eurocrypt’92) took > 15 years for a security

proof

3 Still missing tight proofs for e.g. MDC-2, MDC-4, ... 4 essentially no generic results known in this field 5 needs to be a lot more research done Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-51
SLIDE 51

Outline Introduction Security of Tandem-DM Concluding Remarks

Concluding Remarks

1 Only two rate 1/2 DBL compression functions with birthday

type collision resistance known: Hirose FSE’06 and Tandem-DM

2 Tandem-DM (Eurocrypt’92) took > 15 years for a security

proof

3 Still missing tight proofs for e.g. MDC-2, MDC-4, ... 4 essentially no generic results known in this field 5 needs to be a lot more research done Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-52
SLIDE 52

Outline Introduction Security of Tandem-DM Concluding Remarks

Concluding Remarks

1 Only two rate 1/2 DBL compression functions with birthday

type collision resistance known: Hirose FSE’06 and Tandem-DM

2 Tandem-DM (Eurocrypt’92) took > 15 years for a security

proof

3 Still missing tight proofs for e.g. MDC-2, MDC-4, ... 4 essentially no generic results known in this field 5 needs to be a lot more research done Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-53
SLIDE 53

Outline Introduction Security of Tandem-DM Concluding Remarks

Concluding Remarks

1 Only two rate 1/2 DBL compression functions with birthday

type collision resistance known: Hirose FSE’06 and Tandem-DM

2 Tandem-DM (Eurocrypt’92) took > 15 years for a security

proof

3 Still missing tight proofs for e.g. MDC-2, MDC-4, ... 4 essentially no generic results known in this field 5 needs to be a lot more research done Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM

slide-54
SLIDE 54

Outline Introduction Security of Tandem-DM Concluding Remarks

Concluding Remarks

1 Only two rate 1/2 DBL compression functions with birthday

type collision resistance known: Hirose FSE’06 and Tandem-DM

2 Tandem-DM (Eurocrypt’92) took > 15 years for a security

proof

3 Still missing tight proofs for e.g. MDC-2, MDC-4, ... 4 essentially no generic results known in this field 5 needs to be a lot more research done Ewan Fleischmann, Michael Gorski, Stefan Lucks On the Security of Tandem-DM