Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 - PowerPoint PPT Presentation

Outline Attack Conclusion ECHO-256 Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function Jérémy Jean and Pierre-Alain Fouque Ecole Normale Supérieure FSE’2011 February 14, 2011 FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 1/19

Outline Attack Conclusion ECHO-256 Outline Outline of the talk Outline Previous cryptanalysis Description of ECHO-256 Collision attack on 4-round ECHO-256 Rebound attacks and improvements FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 2/19

Outline Attack Conclusion ECHO-256 Cryptanalysis Previous cryptanalysis of ECHO-256 Hash function Rounds Time Memory Type Reference 2 112 2 85 . 3 5/8 collision [Schläffer-eprint10] Compression function Rounds Time Memory Type Reference 2 64 2 32 3/8 free-start collision [Peyrin-C10] 2 96 2 32 3/8 semi-free-start collision [Peyrin-C10] 2 96 2 32 4.5/8 distinguisher [Peyrin-C10] 2 36 2 16 4/8 distinguisher new 2 52 2 16 4/8 semi-free-start collision new 2 160 2 128 6/8 collision, chosen salt [Schläffer-eprint10] 2 160 2 128 7/8 distinguisher, chosen salt [Schläffer-eprint10] Permutation Rounds Time Memory Type Reference 2 182 2 37 8/8 distinguisher [SLWSO-A10] 2 151 2 67 8/8 distinguisher [NayaPlasencia-eprint10] FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 3/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 Description of the hash function ECHO-256 Merkle-Damgård construction HAIFA design (counter & salt) 2048-bit internal state as a 4 × 4 matrix of AES states 8-round AES-based permutation : BSB, BSR, BMC Output transformation : compress and truncate 2 rounds AES AES MixColumns 0 0 1 1 BSB BSR BMC 2 2 3 3 FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 4/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 Alternative view Breaking down to the AES-state level of operations SuperSBox = SB – MC – SB [LMRRS-A09, GP-FSE10] SuperMixColumns = MC – BMC [Schläffer-SAC10] BSB BSR BMC FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 5/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 Alternative view Breaking down to the AES-state level of operations SuperSBox = SB – MC – SB [LMRRS-A09, GP-FSE10] SuperMixColumns = MC – BMC [Schläffer-SAC10] BSB BSR BMC SB SR MC SB SR MC BSR BMC 1 round of AES 1 round of AES FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 5/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 Alternative view Breaking down to the AES-state level of operations SuperSBox = SB – MC – SB [LMRRS-A09, GP-FSE10] SuperMixColumns = MC – BMC [Schläffer-SAC10] BSB BSR BMC SB SR MC SB SR MC BSR BMC SR SB MC SB SR BSR MC BMC SuperSBox SuperMixColumns FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 5/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 SuperSBox Description Super transformation used in [LMRRS-A09, GP-FSE10] SuperSBox = SB – MC – SB Works on 32-bit AES-columns P (∆ IN → ∆ OUT exists ) ≈ 1 / 2 SuperSBox SB MC SB ∆ IN ∆ OUT FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 6/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 MixColumns and BigMixColumns 4 parallel applications of MixColumns/BigMixColumns MixColumns BigMixColumns MC MC MC MC MC MC MC MC MC : AES MixColumns FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 7/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 SuperMixColumns 16 × 16 matrix of SMC Super transformation introduced in [Schläffer-SAC10] Works on 16 × 1 byte-slices M SMC = M ⊗ M ( M from MixColumns ) Branch number = 8 (optimal : 17) p = 2 − 24 Sparse paths : 4 → 16 → 4, SuperMixColumns MC BMC one slice ♣ FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 8/19

Outline Attack Conclusion ECHO-256 Description of ECHO-256 SuperMixColumns Restriction Sparse paths = ⇒ one-dimensional subsets of kernels Span ( v ) ⊂ ker ( M SMC | 4 ,..., 15 ) M SMC = M SMC | 4 ,..., 15 0 v = [ 14 0 0 0 9 0 0 0 13 0 0 0 11 0 0 0 ] T λ v SuperMixColumns MC BMC one slice ♣ FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 8/19

Outline Attack Conclusion ECHO-256 Rebound Technique Rebound technique For a given truncated differential path Set differences and values around a non-linear layer using its differential properties with amortized complexity one NL = AES SBox or SuperSBox Differences Differences L NL L Diff. prop. Values Values FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 9/19

Outline Attack Conclusion ECHO-256 Overview Path for the 4-round collision attack S0 S1 S2 S3 S4 S5 S6 S7 S8 SR SB MC SB SR BSR MC BMC S8 S9 S10 S11 S12 S13 S14 S15 S16 SR SB MC SB SR BSR MC BMC S16 S17 S18 S19 S20 S21 S22 S23 S24 SR SB MC SB SR BSR MC BMC S24 S25 S26 S27 S28 S29 S30 S31 S32 SR SB MC SB SR BSR MC BMC ⊕ S33 S34 BF FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 10/19

Outline Attack Conclusion ECHO-256 Overview Finding a valid pair Path Path from [Schläffer-SAC10] Modified in the first round Overview Differential attack Two subparts solved sequentially One merging step FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 11/19

Outline Attack Conclusion ECHO-256 Overview Finding a valid pair Path Path from [Schläffer-SAC10] Modified in the first round Overview Differential attack Two subparts solved sequentially One merging step FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 11/19

Outline Attack Conclusion ECHO-256 Overview Merging the two subparts Goal : find values for white bytes. Known : red bytes (1st subpart), blue bytes (2nd subpart) SuperMixColumns FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 12/19

Outline Attack Conclusion ECHO-256 Overview Merging the two subparts Goal : find values for white bytes. Known : red bytes (1st subpart), blue bytes (2nd subpart) SuperMixColumns Problem Fails w.h.p in [Schläffer-SAC10] Cause : system without solution FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 12/19

Outline Attack Conclusion ECHO-256 Overview Merging the two subparts Goal : find values for white bytes. Known : red bytes (1st subpart), blue bytes (2nd subpart) a 0 b 0 b 1 b 2 b 3 a 1 SuperMixColumns a 2 a 3 Problem Correction Fails w.h.p in [Schläffer-SAC10] Merge still possible... Cause : system without solution ...but 128-bit constraint slice # 0 : 2 a 0 + 3 a 1 + a 2 + a 3 = 14 b 0 + 11 b 1 + 13 b 2 + 9 b 3 meet-in-the-middle condition FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 12/19

Outline Attack Conclusion ECHO-256 Overview How to solve the merge problem Steps of the attack 1 Solve first column of Round 2 � 2 Fix differences for a valid path through SMC � 3 Input Differences = ⇒ Values for Rounds 3 & 4 � 4 Deduce three last columns � 5 Values for Round 1 = ⇒ Collision � � First subpart � Second subpart Round 1 Round 2 Round 3 Round 4 Start Here FSE’2011 – Jérémy Jean and Pierre-Alain Fouque Ecole Normale Superieure Practical Near-Collisions and Collisions on Reduced-Round ECHO-256 Compression Function 13/19