[PPT] - Sequential Hashing with Minimum Padding Shoichi Hirose University PowerPoint Presentation

SLIDE 1

Sequential Hashing with Minimum Padding

Shoichi Hirose

ASK 2016 (2016/09/28-30, Nagoya)

SLIDE 2

Introduction

Hash function H : ⌃⇤ ! ⌃n Two popular design strategies:

Construction: FIL primitive + domain extension

SLIDE 3

Strengthened MD

HF

Mm−1 M1 F F F IV Mm∥10* F 0*∥|M| Pros

Cons

sequence. Cons degrade efficiency.

SLIDE 4

HMAC [BCK96]

K M ipad ∥

∥ H H

SLIDE 5

Overview of the Results

Domain extension scheme for sequential hashing

Security analysis of the domain extension scheme

Application to sponge construction

SLIDE 6

Minimum and Non-Injective Padding

Minimum and non-injective padding is common for BC-based MAC E.g.) CMAC |Mm| = block length |Mm| 6= block length

EK EK Mm−1 EK Mm T M1 2L ... EK EK Mm−1 EK T M1 22L ... Mm∥10*

SLIDE 7

Minimum Padding for Sequential Hashing

For sequential iteration of F : ⌃n ⇥ ⌃w ! ⌃n with IV pad(M) = ( M if |M| > 0 and |M| ⌘ 0 (mod w) Mk10⇤ if |M| = 0 or |M| 6⌘ 0 (mod w)

SLIDE 8

Proposed Domain Extension Scheme

For message M = M1kM2k · · · kMm such that

Mm−1 Mm M1 M2 F F F F IV π0 w

Mm−1 M1 M2 F F F F IV π1 Mm∥10* w ⇡0 and ⇡1 are not cryptographic operations

SLIDE 9

Related Work (CR-Preserving Domain Extension)

Merkle 1989 IV F F F F M1 M2 Mm∥0*∥|M| Mm−1

Damg˚ ard 1989 IV F F F F 0∥M1 1∥M2 1∥Mm∥0d 1∥d

SLIDE 10

Related Work (CR-Preserving Domain Extension)

Nandi 2009 IV F F F F M1 M2 Mm∥0*∥|M| Mm−1

SLIDE 11

Suffix-Free-Prefix-Free Hashing [BGKZ12]

Mm−1 Mm M1 M2 F1 V F2 F2 F3

Cf.)

11∥Mm−1 10∥Mm 00∥M1 11∥M2 F V F F F

SLIDE 12

Merkle-Damg˚ ard with Permutation (MDP) [HPY07]

Mm−1 Mm M1 M2 F F F F π IV

Cf.) Ferguson, Kelsey 2001 (Comment on Draft FIPS 180-2) Mm−1 Mm M1 M2 F F F F IV C

SLIDE 13

GCBC1 [Nandi 09]

|Mm| = block length |Mm| 6= block length

EK Mm−1 EK Mm T M1 ... EK M2 EK 1 EK Mm−1 EK T M1 ... EK M2 EK 2 Mm∥10*

SLIDE 14

Collision Resistance in the Standard Model Lemma

Any collision pair for HF,{π0,π1}

implies

for F Proof: Backward induction {⇡0, ⇡1}-pseudo-collision pair for F: (V, X) and (V 0, X0) s.t. ⇡0(F(V, X)) = ⇡1(F(V 0, X0))

SLIDE 15

Collision Resistance in the Standard Model Theorem

The collision resisntance of HF,{π0,π1}

is reduced to

Everywhere preimage resistance of h: Advepre

(A) = max

SLIDE 16

Definition of Indifferentiability from a Random Oracle

[Maurer, Renner, Holenstein 04], [Coron, Dodis, Malinaud, Puniya 05] C S H F A A

with access to oracle H CF is indiff. from VIL RO (IRO) if no efficient adver A can tell apart (CF , F) and (H, SH)

SLIDE 17

Indifferentiability from a Random Oracle (IRO) Theorem

Suppose that CF F : ⌃n ⇥ ⌃w ! ⌃n is chosen uniformly at random. Then, for HF HF,{π0,π1}

, there exists a simulator S of F s.t., for any adversary A making

Advindiff

2n + 3q 2n 6q + 1 , and S makes at most q queries. Secure if + q = o(2n/2)

SLIDE 18

IRO in the Ideal Cipher Model

The CF F : ⌃n ⇥ ⌃w ! ⌃n is the Davies-Meyer mode of a BC E

Theorem

For the hash function HF,{π0,π1}

, there exists a simulator S of E s.t., for any adversary A making

Advindiff

2n + 3(qe + qd) 2n 6(qe + qd) 5 , and S makes at most qe queries. Secure if + qe + qd = o(2n/2)

SLIDE 19

Keyed via IV mode of HF,{π0,π1}

For message M such that

Mm−1 Mm M1 M2 F F F F K π0 w

Mm−1 M1 M2 F F F F K π1 Mm∥10* w

SLIDE 20

PRF Security Theorem

Let A be any adversary against KIV mode of HF,{π0,π1}

:

Then, there exists an adversary B against F such that Advprf

(A)  `q Advprf-rka

B runs in time at most t + O(`qTF ) and makes at most q queries. HF,{π0,π1} is PRF ( = F is PRF against {id, ⇡1, ⇡2}-restricted RKAs

SLIDE 21

Definition of PRF

A keyed function f : K ⇥ D ! R is PRF ( = fK is indistinguishable from uniform random function ⇢ : D ! R

Adversary x . . . Oracle R(x) A R R is fK or ⇢ Advprf

SLIDE 22

PRF against Related Key Attacks

f : K ⇥ D ! R is PRF against -restricted RKAs if f is indistinguishable from uniform random keyed function ⇢ : K ⇥ D ! R

Adversary ψ, x . . . Oracle Rψ(K)(x) A R, K R 2 {f, ⇢} 2 Advprf-rka

(A) =

SLIDE 23

PRF Modes Based on Hash Function

Modes using a hash function

Modes using a compression function

ard (MD) with prefix-free encoding [BCK1996]

All of the above assume injective padding except for OMD MAC function.

SLIDE 24

AMAC (Augmented MAC) [BBT16]

K M ∥ Out H

E.g.) truncation or mod function AMACH is PRF ( = F is PRF under leakage of the key by Out

SLIDE 25

BNMAC (Boosted NMAC) [Yas07]

Double-key version (Single-key version is also presented) M2m−1 M1 M2 F F F F K M3 M4 M2m K′ ∥ 11...1 BNMACF is PRF ( = F is PRF and ∆-2PRF

SLIDE 26

Application to Sponge Construction

For message M such that

π0 IV P Mm−1 M1 M2 P P P Mm

π1 IV P Mm−1 M1 M2 P P P Mm∥10*

SLIDE 27

IRO in the Ideal Permutaton Model

The permutation P : ⌃b ! ⌃b is chosen uniformly at random

Theorem

For the hash function GP,{π0,π1}

, there exists a simulator S of P s.t., for any adversary A making

Advindiff

2c + 3(qf + qb) 2c 6(qf + qb) 5 , and S makes at most qf queries. Secure if + qf + qb = o(2c/2)

SLIDE 28

Conclusion

Domain extension scheme for sequential hashing

Security analysis of the domain extension scheme

Application to sponge construction