(Pseudo) Preimage Attack on Reduced-Round Grstl Hash Function and - - PowerPoint PPT Presentation

▶
pseudo preimage attack on reduced round gr stl hash
SMART_READER_LITE
LIVE PREVIEW

(Pseudo) Preimage Attack on Reduced-Round Grstl Hash Function and - - PowerPoint PPT Presentation

Jun 03, 2023 119 likes •382 views

SKLOIS (Pseudo) Preimage Attack on Reduced-Round Grstl Hash Function and Others Shuang Wu, Dengguo Feng, Wenling Wu, Jian Guo, Le Dong, Jian Zou March 20, 2012 Institute for

slide-1
SLIDE 1

.

SKLOIS

信息安全国家重点实验室

中国科学院软件研究所

Institute of Software, Chinese Academy of Sciences Institute for Infocomm Research, Singapore

(Pseudo) Preimage Attack on Reduced-Round Grøstl Hash Function and Others

Shuang Wu, Dengguo Feng, Wenling Wu, Jian Guo, Le Dong, Jian Zou March 20, 2012

slide-2
SLIDE 2

2

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Outline

Introduction Attack on Grøstl Other results Conclusion

slide-3
SLIDE 3

3

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Introduction

Meet-in-the-Middle pre-image attacks

  • Applied to full MD4, MD5,HAVAL-3/4,Tiger and

reduced-round HAS-160, RIPEMD, SHA-0/1, SHA-2 etc.

  • Tricks:

 Splice and Cut Techniques  Bicliques, Initial Structure (Message Stealing), local collision  Partial-Matching (Relations between deterministic values)

slide-4
SLIDE 4

4

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Introduction

Meet-in-the-Middle pre-image attacks

  • Yu Sasaki proposed the MitM preimage attack on AES-

like structures for the first time at FSE 2011

 Target: Whirlpool and AES hash modes

  • Use freedom degrees of the state for chunk separation
slide-5
SLIDE 5

5

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Outline

Introduction Attack on Grøstl Other results Conclusion

slide-6
SLIDE 6

6

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Specification of Grøstl hash function

  • Wide-pipe MD structure with output transformation
  • Permutations P and Q are AES-like structures with

8 × 8 states(Grøstl-256) and 8 ×16 states(Grøstl-512)

 10 rounds for Grøstl-256 and 14 rounds for Grøstl-512

Q P M Hi-1 Hi P X

slide-7
SLIDE 7

7

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Properties of the compression function

  • 2n-bit state, 𝐺 𝐼, 𝑁 = 𝑄 𝐼 ⊕ 𝑁 ⊕ 𝑅 𝑁 ⊕ 𝐼

 With 𝐼′ = 𝐼 ⊕ 𝑁,𝐺 𝐼′, 𝑁 = 𝑄 𝐼′ ⊕ 𝐼′ ⊕ 𝑅 𝑁 ⊕ 𝑁

  • Bounds for generic attacks

 Pre-image attack: 2𝑜

  • 𝑄 𝐼′ ⊕ 𝐼′ ⊕ 𝑅 𝑁 ⊕ 𝑁 = 𝑈
  • birthday attack on 2n-bit state

 Collision attack: 2

2𝑜 3

  • 𝑄 𝐼1

′ ⊕ 𝐼1 ′ ⊕ 𝑅 𝑁1 ⊕ 𝑁1 ⊕ 𝑄 𝐼2 ′ ⊕ 𝐼2 ′ ⊕ 𝑅 𝑁2 ⊕ 𝑁2 = 0

  • generalized birthday attack on 2n-bit state with four entries

Q P M Hi-1 Hi

slide-8
SLIDE 8

8

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Outline of the attack

slide-9
SLIDE 9

9

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Attack outline

  • Pseudo pre-image (H,M)

 𝐺 𝐼, 𝑁 = 𝑌, 𝑄 𝑌 ⊕ 𝑌 =∗ ||𝑈  X is a pre-image of the output transformation

  • With 𝐼′ = 𝐼 ⊕ 𝑁,

𝑄 𝐼′ ⊕ 𝐼′ ⊕ 𝑅 𝑁 ⊕ 𝑁 ⊕ 𝑌 = 0

Q P M H P X T X

slide-10
SLIDE 10

10

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256

How to convert the partial pre-images of 𝑄 𝑌 ⊕ 𝑌 into pseudo pre-image of the hash function

zero unknown Lookup table 1 Lookup table 2 𝑄 𝐼′ ⊕ 𝐼′ 𝑅 𝑁 ⊕ 𝑁 𝑌 ⊕ ⊕

2n

= 0

2n 2n-b b 2n-b b

2𝑦2 × 2𝑦1+𝑦2−𝑐 ×

2n

2𝑦1+𝑦2+𝑦3−2𝑜 × 2𝑦1+𝑦2+𝑦3−2𝑜 ≥ 1 ⇒ 𝑦1 + 𝑦2 + 𝑦3 ≥ 2𝑜 2𝑦3 × 2𝑦1 ×

slide-11
SLIDE 11

11

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Complexity evaluation

  • X: Fixed position partial preimage (n-bit) of

𝑄 𝑌 ⊕ 𝑌

 Let complexity to find one X be 2𝐷1(2𝑜,𝑜)

  • M: Randomly chosen message with padding

 Complexity=one Q call=1/2 compression function call

  • H’: Chosen position partial preimage (b-bit) of

𝑄 𝐼′ ⊕ 𝐼′

 Let complexity to find one H’ be 2𝐷2(2𝑜,𝑐)

slide-12
SLIDE 12

12

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

(1 + 𝐷𝑈𝑈)

Pseudo-Preimage Attack on 5-round Grøstl-256

Overall complexity of the attack is

2𝑦1+𝐷1(2𝑜,𝑜) + 2𝑦3+𝐷2(2𝑜,𝑐) + 2𝑦2−1 + 2𝑦1+𝑦2−𝑐𝐷𝑈𝑈

Lookup table 1 Lookup table 2 𝑄 𝐼′ ⊕ 𝐼′ 𝑅 𝑁 ⊕ 𝑁 𝑌 ⊕ ⊕

2n

= 0

2n 2n-b b 2n-b b

2𝑦2 × 2𝑦1+𝑦2−𝑐 ×

2n

2𝑦1+𝑦2+𝑦3−2𝑜 × 2𝑦3 × 2𝑦1 ×

2𝑦1+𝐷1(2𝑜,𝑜) 2𝑦3+𝐷2(2𝑜,𝑐) 2𝑦1+𝑦2−𝑐𝐷𝑈𝑈 2𝑦2−1

slide-13
SLIDE 13

13

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Partial preimage attacks on 𝑄 𝑌 ⊕ 𝑌

slide-14
SLIDE 14

14

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256

Evaluation of 𝐷1(2𝑜, 𝑜) (fixed position partial preimage)

  • Freedom degrees in blue and red bytes: 64 and 48 bits
  • Size of the matching point: 64 bits
  • Size of the full match: 256 bits
  • Complexity: 2207 P(X) calls = 2206 compression function calls
slide-15
SLIDE 15

15

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256

Evaluation of 𝐷2(2𝑜, 𝑐) (chosen position partial preimage)

  • Note: we can choose the positions of the target zero

bits

  • Choose optimal positions to maximize the size of the

matching point

slide-16
SLIDE 16

16

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Graphs of 𝑛(𝑐) and 𝐷2(2𝑜, 𝑐) for different b

Grøstl-256

slide-17
SLIDE 17

17

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 5-round Grøstl-256 Overall complexity of pseudo-preimage attack

  • n 5-round Grøstl-256
  • When 𝑐 = 35, the overall complexity reaches its

minimum value 2244.85

slide-18
SLIDE 18

18

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Results on Grøstl-512

slide-19
SLIDE 19

19

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Pseudo-Preimage Attack on 8-round Grøstl-512

Preimage attack on the output transformation

slide-20
SLIDE 20

20

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Summary of results

Algorithm Target Type Rounds Time Memory Source Grøstl-256 Hash Function Collision 3

264

  • Martin

Schlæffer Compression Function Semi-Free-Start Collision 6

2112 264

Martin Schlæffer Permutation Distinguisher 9

2368 264

Jérémy Jean et al. Permutation Zero-Sum Distinguisher 10

2509

  • Christina

Boura et al. Output Transformation Preimage 5

2206 248

Ours Hash Function Pseudo Preimage 5

2244.85 2230.13

Ours Grøstl-512 Hash Function Collision 3

2192

  • Martin

Schlæffer Compression Function Semi-Free-Start Collision 7

2152 256

Yu Sasaki Permutation Distinguisher 10

2392 264

Jérémy Jean et al. Output Transformation Preimage 8

2495 216

Ours Hash Function Pseudo Preimage 8

2507.32 2507.00

Ours

slide-21
SLIDE 21

21

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Outline

Introduction Attack on Grøstl Other results Conclusion

slide-22
SLIDE 22

22

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Other results in this paper

Algorithm Target Type Rounds Time Memory Source Whirlpool Hash Function 2nd Preimage 5

2504 28

Yu Sasaki Hash Function 2nd Preimage 5

2448 264

Ours Hash Function Preimage 5

2481.5 264

Ours Algorithm Hash Mode Type

Rounds

Time Memory Message Length Source AES MMO,MP 2nd Preimage 7

2120 28

  • Yu Sasaki

MMO,MP,DM 2nd Preimage 7

2128−𝑙 2𝑙

2𝑙 blocks John Kelsey et at. MMO,MP,DM 2nd Preimage 7 2120−min

(𝑙,24)

216

2𝑙 blocks Ours DM Preimage 7

2125 28

  • Yu Sasaki

DM Preimage 7

2122.7 216

>28 blocks Ours

slide-23
SLIDE 23

23

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

New Related Result Announcement

Converting partial pre-images into pseudo collisions

  • The technique is proposed by Ji Li et al.
  • Target: 8-round Grøstl-512 output transformation
  • The complexity is 2248
slide-24
SLIDE 24

24

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Outline

Introduction Attack on Grøstl Other results Conclusion

slide-25
SLIDE 25

25

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Conclusion

We proposed:

  • Pseudo preimage attack on 5-round Grøstl-256 and 8-

round Grøstl-512 for the first time

 We found that partial preimage attack on 𝑄 𝑌 ⊕ 𝑌 (n-bit size) can be converted in to pseudo preimage attack on the hash function  An interesting observation: Properties of the permutation 𝑅 are not concerned in this attack, i.e. this attack works with any 𝑅.

  • So, our attack works on Grøstl-256 with 5-round P and full 10-round Q

and Grøstl-512 with 8-round P and full 14-round Q.

Q P M Hi-1 Hi P

slide-26
SLIDE 26

26

中国科学院软件研究所 Institute of Software, Chinese Academy of Sciences

信息安全国家重点实验室

The State Key Laboratory Of Information Security

Thank you!

Any questions?