[PPT] - Practical attacks on AES-like cryptographic hash functions Stefan K PowerPoint Presentation

SLIDE 1

Practical attacks on AES-like cryptographic hash functions

Stefan K¨

lbl, Christian Rechberger

DTU - Technical University of Denmark

September 12, 2014

SLIDE 2

Cryptographic Hash Functions

“Today is the 12th of September...” h 4981A99EDA782

2/23

SLIDE 3

Cryptographic Hash Functions

“Today is the 13th of September...” h 11F9C8023AB0A

3/23

SLIDE 4

Cryptographic Hash Functions

Applications:

◮ Message Integrity ◮ Digital Signature Schemes ◮ Password Protection ◮ Key Derivation ◮ Payment Schemes (Bitcoin) ◮ ...

Features:

◮ No secret parameter is involved. ◮ Fast to compute.

4/23

SLIDE 5

Cryptographic Hash Functions

Security Requirements

◮ Preimage Resistance:

Given h(x) find x

◮ Second-Preimage Resistance:

Given x, h(x) find y = x s.t. h(x) = h(y)

◮ Collision Resistance:

Find x, y with x = y s.t. h(x) = h(y)

Generic Attack

Complexity 2n for (second) preimage and 2n/2 for collisions.

5/23

SLIDE 6

Cryptographic Hash Functions

Security Properties IV M Hash Function h

6/23

SLIDE 7

Cryptographic Hash Functions

Security Properties IV x1 xn f m0 f m1 f mn h Analyze the collision resistance of the compression function f

◮ semi-free-start collision: Find {mi, m′ i, xi} s.t.

f (mi, xi) = f (m′

i, xi) ◮ free-start collision: Find {mi, m′ i, xi, x′ i } s.t.

f (mi, xi) = f (m′

i, x′ i )

7/23

SLIDE 8

AES-based hash functions

Compression functions based on AES are common

◮ Whirlpool (ISO/IEC 10118-3)

◮ Maelstrom ◮ Whirlwind

◮ Streebog (GOST R 34.11-2012) ◮ SHA-3 Competiton

◮ Grøstl ◮ ECHO ◮ LANE 8/23

SLIDE 9

GOST R 34.11-2012

Compression Function

E

SPL

mi hi hi+1

9/23

SLIDE 10

GOST R 34.11-2012

Block Cipher E with 12 rounds of

◮ AK Adds the key byte-wise by XORing it to the state. ◮ S Substitutes each byte of the state independently using an

8-bit S-Box.

◮ P Transposes the state. ◮ L Multiplies each row by an 8 × 8 MDS matrix.

K 1 L0 AK1 S1 P1 L1

AK S P L

10/23

SLIDE 11

GOST R 34.11-2012

Block Cipher E with 12 rounds of

◮ AK Adds the key byte-wise by XORing it to the state. ◮ S Substitutes each byte of the state independently using an

8-bit S-Box.

◮ P Transposes the state. ◮ L Multiplies each row by an 8 × 8 MDS matrix.

K 1 L0 AK1 S1 P1 L1

AK S P L

10/23

SLIDE 12

GOST R 34.11-2012

Block Cipher E with 12 rounds of

◮ AK Adds the key byte-wise by XORing it to the state. ◮ S Substitutes each byte of the state independently using an

8-bit S-Box.

◮ P Transposes the state. ◮ L Multiplies each row by an 8 × 8 MDS matrix.

K 1 L0 AK1 S1 P1 L1

AK S P L

10/23

SLIDE 13

GOST R 34.11-2012

Block Cipher E with 12 rounds of

◮ AK Adds the key byte-wise by XORing it to the state. ◮ S Substitutes each byte of the state independently using an

8-bit S-Box.

◮ P Transposes the state. ◮ L Multiplies each row by an 8 × 8 MDS matrix.

K 1 L0 AK1 S1 P1 L1

AK S P L

10/23

SLIDE 14

Related Work

Overview of practical attacks on the compression function

Function Rounds Time Memory Type Reference GOST R 4.5 264 216 collision [WYW13] 4.75 practical 28 near-collision [AKY13] 4 219.8 216 collision this work 4.5 219.8 216 collision this work 5.5 264 264 collision [WYW13] 6.5 264 216 collision this work Whirlpool 4 225.1 216 collision this work 6.5 225.1 216 near-collision this work 4 28 28 collision1 [WYW13] 7 264 28 collision1 [SWWW12]

1free-start collision 11/23

SLIDE 15

Differential Cryptanalysis

x h y ∆x x∗ h y∗ ∆y

◮ ∆x = 0 and ∆y = 0 gives a collision. ◮ Find a differential characteristic leading to zero output

difference.

◮ Find a confirming message pair.

12/23

SLIDE 16

Rebound Attacks

Powerful technique for analysis of hash functions [MRST09]

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

Inbound Outbound Outbound Two parts:

◮ Inbound phase: Match-in-the-middle ◮ Outbound phase: Probabilistic

Many improvements over the last few years...

13/23

SLIDE 17

Finding the characteristic

Technique similar to start-from-the-middle

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

1 2 3

1. Propagate difference from AK 4 to S2.
2. Choose differences in AK 2 to ensure 64–8 by using freedom of

S-Box.

3. Solve 8–1 by swapping values (a, b) ↔ (b, a).

Complexity

Finding the characteristic 219.8

14/23

SLIDE 18

Finding the message pair

We need to fulfill conditions on 81 bytes.

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

◮ First we fix the values of AK 2 such that S2 = S(AK 2). ◮ This solves 64 byte conditions but uses all degrees of freedom

we have for the state.

15/23

SLIDE 19

Finding the message pair

We need to fulfill conditions on 81 bytes.

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

◮ First we fix the values of AK 2 such that S2 = S(AK 2). ◮ This solves 64 byte conditions but uses all degrees of freedom

we have for the state.

15/23

SLIDE 20

Finding the message pair

We need to fulfill conditions on 81 bytes.

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

◮ How to solve the conditions for AK 1 = S(S1)...

16/23

SLIDE 21

Finding the message pair

AC S P L

AK1 S1 P1 L1 AK2 S2 P2 L2

AK S P L AK S P L

K1 K2

17/23

SLIDE 22

Finding the message pair

AC S P L

AK1 S1 P1 L1 AK2 S2 P2 L2

AK S P L AK S P L

K1 K2

17/23

SLIDE 23

Finding the message pair

AC S P L

AK1 S1 P1 L1 AK2 S2 P2 L2

AK S P L AK S P L

K1 K2

17/23

SLIDE 24

Finding the message pair

AC S P L

AK1 S1 P1 L1 AK2 S2 P2 L2

AK S P L AK S P L

K1 K2

17/23

SLIDE 25

Finding the message pair

We need to fulfill conditions on 81 bytes.

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

◮ How to solve the conditions for AK 3 = S(S3)...

18/23

SLIDE 26

Finding the message pair

AC2 KS2 KP2 K2 AC3 KS3 KP3 K3

AC S P L AC S P L AK AK

AK2 AK3

19/23

SLIDE 27

Finding the message pair

AC2 KS2 KP2 K2 AC3 KS3 KP3 K3

AC S P L AC S P L AK AK

AK2 AK3

19/23

SLIDE 28

Finding the message pair

AC2 KS2 KP2 K2 AC3 KS3 KP3 K3

AC S P L AC S P L AK AK

AK2 AK3

19/23

SLIDE 29

Finding the message pair

We need to fulfill conditions on 81 bytes.

AK0 AK1 AK2 AK3 AK4

S P L AK S P L AK S P L AK S P L AK

◮ One byte condition remaining in AK 1. ◮ ∆AK 0 = ∆AK 4.

Complexity

Repeat message finding procedure 216 times.

20/23

SLIDE 30

Attack

Summary of Attack on GOST R

◮ Finding Characteristic: 219.8 ◮ Finding Message Pair: 216

Costs depend on properties of the S-Box

S-Box MDP ANS Matching Costs #S2 AES 2−6 127 26.42 255.91 Whirlpool 2−5 101.49 225.10 253.32 GOST R 2−5 107.05 219.77 253.94

21/23

SLIDE 31

Conclusion

Function Rounds Time Memory Type GOST R 4 219.8 216 collision 4.5 219.8 216 collision 6.5 264 216 collision Whirlpool 4 225.1 216 collision 6.5 225.1 216 near-collision ◮ Technique could be used to fulfill more conditions ◮ Application on other designs ◮ https://github.com/kste/aeshash

22/23

SLIDE 32

Thank you for your attention!

23/23

SLIDE 33

References I

Riham AlTawy, Aleksandar Kircanski, and Amr M. Youssef, Rebound Attacks on Stribog, Cryptology ePrint Archive, Report 2013/539, 2013, http://eprint.iacr.org/. Mario Lamberger, Florian Mendel, Martin Schl¨ affer, Christian Rechberger, and Vincent Rijmen, The Rebound Attack and Subspace Distinguishers: Application to Whirlpool, Journal of Cryptology (2013), 1–40 (English). Florian Mendel, Christian Rechberger, Martin Schl¨ affer, and Søren S. Thomsen, The Rebound Attack: Cryptanalysis of Reduced Whirlpool and Grøstl, FSE (Orr Dunkelman, ed.), Lecture Notes in Computer Science, vol. 5665, Springer, 2009,

pp. 260–276.

1/2

SLIDE 34

References II

Yu Sasaki, Lei Wang, Shuang Wu, and Wenling Wu, Investigating Fundamental Security Requirements on Whirlpool: Improved Preimage and Collision Attacks, vol. 7658, pp. 562–579, Springer Berlin Heidelberg, 2012. Zongyue Wang, Hongbo Yu, and Xiaoyun Wang, Cryptanalysis

f GOST R Hash Function, Cryptology ePrint Archive, Report

2013/584, 2013, http://eprint.iacr.org/.

2/2