Introduction Solving AX systems BMW analysis Conclusion Practical Near-Collisions on the Compression Function of BMW Gaëtan Leurent and Søren S. Thomsen University of Luxembourg Technical University of Denmark FSE 2011 G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 1 / 24
Introduction Solving AX systems BMW analysis Conclusion The SHA-3 competition The SHA-3 competition ◮ 51 valid submissions ◮ 14 in the second round (July 2009) ◮ 5 finalists in December 2010 ◮ Winner in 2012? ◮ BMW was the fastest second-round candidate in software ◮ Not selected for the third round G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 2 / 24
Introduction Solving AX systems BMW analysis Conclusion Hash Function Design ◮ Build a small compression function, and iterate. ◮ Cut the message in chunks M 0 , ... M k ◮ H i = f ( M i , H i − 1 ) ◮ F ( M ) = Ω ( H k ) M 0 M 1 M 2 M 3 f f f f IV H 0 H 1 H 2 H 3 G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 3 / 24
Introduction Solving AX systems BMW analysis Conclusion Compression Function Attacks Fist results usually target the compression function ◮ Because it’s easier: more degrees of freedom ◮ Because good compression imply good hash function MD5 cryptanalysis ◮ 1993: Free-start collisions [den Boer and Bosselaers] ◮ 1996: Semi-free-start collisions [Dobbertin] ◮ 2005: Collisions [Wang et. al ] ◮ 2009: Rogue certificate [Stevens et. al ] Wang’s and Stevens’s attacks are based on the dBB path G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 4 / 24
Introduction Solving AX systems BMW analysis Conclusion Compression Function Attacks Fist results usually target the compression function ◮ Because it’s easier: more degrees of freedom ◮ Because good compression imply good hash function MD5 cryptanalysis ◮ 1993: Free-start collisions [den Boer and Bosselaers] ◮ 1996: Semi-free-start collisions [Dobbertin] ◮ 2005: Collisions [Wang et. al ] ◮ 2009: Rogue certificate [Stevens et. al ] Wang’s and Stevens’s attacks are based on the dBB path G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 4 / 24
Introduction Solving AX systems BMW analysis Conclusion Blue Midnight Wish f 0 x y Q a M P H f 2 H f 1 AddElement Q b ◮ Wide pipe: each line is 16 words (32 or 64 bits) ◮ Most of the diffusion happens in f 1 ◮ ARX: Addition, Rotations, Xors see details G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 5 / 24
Introduction Solving AX systems BMW analysis Conclusion Solving AX Systems Important Example x ⊕ ∆ = x ⊞ δ ◮ On average one solution ◮ Easy to solve because it’s a T-function. ◮ Guess LSB, check, and move to next bit ◮ How easy exactly? ◮ Backtracking is exponential in the worst case: x ⊕ ✵①✽✵✵✵✵✵✵✵ = x ◮ For random δ , ∆ , most of the time the system is inconsistent G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 6 / 24
Introduction Solving AX systems BMW analysis Conclusion Solving AX Systems Important Example x ⊕ ∆ = x ⊞ δ ◮ On average one solution ◮ Easy to solve because it’s a T-function. ◮ Guess LSB, check, and move to next bit ◮ How easy exactly? ◮ Backtracking is exponential in the worst case: x ⊕ ✵①✽✵✵✵✵✵✵✵ = x ◮ For random δ , ∆ , most of the time the system is inconsistent G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 6 / 24
Introduction Solving AX systems BMW analysis Conclusion Solving AX Systems Important Example x ⊕ ∆ = x ⊞ δ ◮ On average one solution ◮ Easy to solve because it’s a T-function. ◮ Guess LSB, check, and move to next bit ◮ How easy exactly? ◮ Backtracking is exponential in the worst case: x ⊕ ✵①✽✵✵✵✵✵✵✵ = x ◮ For random δ , ∆ , most of the time the system is inconsistent G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 6 / 24
Introduction Solving AX systems BMW analysis Conclusion Solving AX Systems Important Example x ⊕ ∆ = x ⊞ δ ◮ On average one solution ◮ Easy to solve because it’s a T-function. ◮ Guess LSB, check, and move to next bit ◮ How easy exactly? ◮ Backtracking is exponential in the worst case: x ⊕ ✵①✽✵✵✵✵✵✵✵ = x ◮ For random δ , ∆ , most of the time the system is inconsistent G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 6 / 24
Introduction Solving AX systems BMW analysis Conclusion Transition Automata We use automata to study AX systems: [Mouha et. al ] ◮ States represent the carries ◮ Transitions are labeled with the variables Carry transitions for x ⊕ ∆ = x ⊞ δ . c x c’ c x c’ ∆ δ ∆ δ 0 0 0 0 0 1 0 0 0 - 0 0 0 1 0 1 0 0 1 - 0 0 1 0 - 1 0 1 0 1 0 0 1 1 - 1 0 1 1 1 0 1 0 0 - 1 1 0 0 0 0 1 0 1 - 1 1 0 1 1 0 1 1 0 0 1 1 1 0 - 0 1 1 1 1 1 1 1 1 - G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 7 / 24
Introduction Solving AX systems BMW analysis Conclusion Transition Automata We use automata to study AX systems: [Mouha et. al ] ◮ States represent the carries ◮ Transitions are labeled with the variables Carry transitions for x ⊕ ∆ = x ⊞ δ . The edges are indexed by ∆ , δ , x 0,0,0 1,0,1 0,0,1 0,1,0 1,1,0 0,1,1 1,1,1 start 0 1 see example 1,0,0 G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 7 / 24
Introduction Solving AX systems BMW analysis Conclusion Decision Automata ◮ Remove x from the transitions ◮ Convert the non-deterministic automata to deterministic. Carry transitions for x ⊕ ∆ = x ⊞ δ . The edges are indexed by ∆ , δ , x 0,0,0 1,0,1 0,0,1 0,1,0 1,1,0 0,1,1 1,1,1 start 0 1 1,0,0 ◮ Can decide whether a given ∆ , δ is compatible. G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 8 / 24
Introduction Solving AX systems BMW analysis Conclusion Decision Automata ◮ Remove x from the transitions ◮ Convert the non-deterministic automata to deterministic. Decision automaton for x ⊕ ∆ = x ⊞ δ . The edges are indexed by ∆ , δ 0,0 1,0 0,0 0,1 1,1 0,1 1,1 start 0 1 1,0 ◮ Can decide whether a given ∆ , δ is compatible. G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 8 / 24
Introduction Solving AX systems BMW analysis Conclusion Decision Automata ◮ Remove x from the transitions ◮ Convert the non-deterministic automata to deterministic. Decision automaton for x ⊕ ∆ = x ⊞ δ . The edges are indexed by ∆ , δ 1,0 0,0 1,1 0,1 1,1 0,1 { 0 } { 0 , 1 } { 1 } start 0,0 1,0 ◮ Can decide whether a given ∆ , δ is compatible. G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 8 / 24
Introduction Solving AX systems BMW analysis Conclusion Solving AX systems Take an AX system with variables and parameters. e.g. x ⊕ ∆ = x ⊞ δ 1 Compute carry transitions 2 Build transition automaton 3 Remove variables and compute equivalent deterministic automaton ◮ For each values of the parameters: ◮ Test if system is coherent in linear time ◮ Find a solution in linear time Can also study properties of the systems. G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 9 / 24
Introduction Solving AX systems BMW analysis Conclusion Some Properties Important Example x ⊕ ∆ = x ⊞ δ ◮ For this particular system, we can build very efficient test: � ∆ 0 = δ 0 ◮ Consistent iff ∀ i : ∆ i = 1 δ i ⊕ ∆ i + 1 ⊕ δ i + 1 = 0 or ✦✭✭❉❫❞✮✫✶✮ ✫✫ ✦✭✭✭✭✭❉❫❞✮❃❃✶✮❫❞✮ ✫ ✭⑦❉✮✮ ❁❁ ✶✮ ◮ Probability 2 − 13 . 9 for random δ , ∆ ◮ Probability 2 − 1 for random δ and ∆ = − 1 ◮ Solutions: ✭❉❫❞✮❃❃✶ ❫ ✭r✫✭⑦❉⑤✵①✽✵✵✵✵✵✵✮✮ G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 10 / 24
Introduction Solving AX systems BMW analysis Conclusion Application to BMW f 0 x y Q a M P H f 2 H f 1 AddElement Q b ◮ If we have ◮ a (near) collision in Q a ◮ a (near) collision in M ◮ a (near) collision in the the first rounds of f 1 this can be seen in the output: HH 0 = ( XH ≫ 5 ⊕ Q ≫ 5 16 ⊕ M 0 ) ⊞ ( XL ⊕ Q 24 ⊕ Q 0 ) G. Leurent, S. Thomsen (Uni.lu & DTU) Practical Near-Collisions on the Compression Function of BMW FSE 2011 11 / 24
Recommend
More recommend
