SHA-3 vs the world David Wong Snefru MD4 Snefru MD4 Snefru MD4 - - PowerPoint PPT Presentation

▶
sha 3 vs the world
SMART_READER_LITE
LIVE PREVIEW

SHA-3 vs the world David Wong Snefru MD4 Snefru MD4 Snefru MD4 - - PowerPoint PPT Presentation

Dec 11, 2023 390 likes •1.27k views

SHA-3 vs the world David Wong Snefru MD4 Snefru MD4 Snefru MD4 MD5 MerkleDamgrd SHA-1 SHA-2 Snefru MD4 MD5 MerkleDamgrd SHA-1 SHA-2 Snefru MD4 MD5 MerkleDamgrd SHA-1 SHA-2 Snefru MD4 MD5 MerkleDamgrd

slide-1
SLIDE 1

SHA-3 vs the world

David Wong

slide-2
SLIDE 2

Snefru MD4

slide-3
SLIDE 3

Snefru MD4

slide-4
SLIDE 4

Snefru MD4 MD5 SHA-1 SHA-2

Merkle–Damgård

slide-5
SLIDE 5

Snefru MD4 MD5 SHA-1 SHA-2

Merkle–Damgård

slide-6
SLIDE 6

Snefru MD5 SHA-1 SHA-2

Merkle–Damgård

MD4

slide-7
SLIDE 7
slide-8
SLIDE 8

Snefru MD5 SHA-1 SHA-2

Merkle–Damgård

MD4

slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

Keccak

BLAKE, Grøstl, JH, Skein

slide-12
SLIDE 12

Outline

1.SHA-3 2.derived functions 3.derived protocols

slide-13
SLIDE 13

f

permutation-based cryptography

slide-14
SLIDE 14

AES

AES is a permutation input

  • utput
slide-15
SLIDE 15

AES

AES is a permutation input

  • utput

key

slide-16
SLIDE 16

f

Sponge Construction

slide-17
SLIDE 17

f

Sponge Construction

1 1 1 1

slide-18
SLIDE 18

f

Sponge Construction r c

1 1 1 1

slide-19
SLIDE 19

f

Sponge Construction

AES

key r c r c

1 1 1 1

slide-20
SLIDE 20

f

message ⊕ Sponge Construction

1 1 1 1

slide-21
SLIDE 21

f

message

⊕ ⊕

Sponge Construction

slide-22
SLIDE 22

f

message

⊕ ⊕

f

Sponge Construction

slide-23
SLIDE 23

f

message

⊕ ⊕

f

⊕

Sponge Construction

slide-24
SLIDE 24

f

message

⊕ ⊕

f

⊕

f

Sponge Construction

slide-25
SLIDE 25

f

message

⊕ ⊕

f

⊕

f

absorbing

Sponge Construction

slide-26
SLIDE 26

absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

Sponge Construction

slide-27
SLIDE 27

absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f

Sponge Construction

slide-28
SLIDE 28

absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f

Sponge Construction

slide-29
SLIDE 29

absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

slide-30
SLIDE 30

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

squeezing

Sponge Construction

absorbing

slide-31
SLIDE 31
slide-32
SLIDE 32

Keccak

Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche

slide-33
SLIDE 33

SHA-3 competition 2012 2007

slide-34
SLIDE 34
slide-35
SLIDE 35

SHA-3 competition 2012 2007 SHA-3 standard (FIPS 202) 2015

slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38

Where is SHA-3 being used?

slide-39
SLIDE 39

Outline

1.SHA-3 2.derived functions 3.derived protocols

slide-40
SLIDE 40
slide-41
SLIDE 41

SHAKE is a XOF

slide-42
SLIDE 42
slide-43
SLIDE 43

SHA-3 competition 2012 2007 SHA-3 standard (FIPS 202) 2015 SP 800-185 2016

slide-44
SLIDE 44

KMAC TupleHash ParallelHash

slide-45
SLIDE 45

KMAC TupleHash ParallelHash message || SHA-256(message)

slide-46
SLIDE 46

KMAC TupleHash ParallelHash message || SHA-256(key||message)

slide-47
SLIDE 47

KMAC TupleHash ParallelHash message || more || SHA-256(key||message||more)

slide-48
SLIDE 48

KMAC TupleHash ParallelHash message || SHAKE(key || message)

slide-49
SLIDE 49

KMAC TupleHash ParallelHash message || SHAKE(key || message) my RSA public key = (e, N)

slide-50
SLIDE 50

KMAC TupleHash ParallelHash message || SHAKE(key || message) my RSA public key = (e, N) fingerprint = SHA-256(e || N)

slide-51
SLIDE 51

KMAC TupleHash ParallelHash message || SHAKE(key || message) fingerprint1 = SHA-256(1010110000000010001…) e N

slide-52
SLIDE 52

KMAC TupleHash ParallelHash message || SHAKE(key || message) fingerprint1 = SHA-256(1010110000000010001…) e N fingerprint2 = SHA-256(1010110000000010001…) e N

slide-53
SLIDE 53

KMAC TupleHash ParallelHash message || SHAKE(key || message) SHAKE(len(e) || e || len(N) || N)

slide-54
SLIDE 54

squeezing absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

slide-55
SLIDE 55

squeezing absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

slide-56
SLIDE 56

squeezing absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

slide-57
SLIDE 57

squeezing absorbing

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

slide-58
SLIDE 58

KMAC TupleHash ParallelHash message || SHAKE(key || message) SHAKE(len(e) || e || len(N) || N) SHAKE(SHAKE(b1) || SHAKE(b2) || SHAKE(b3) || …)

slide-59
SLIDE 59

SHA-3 competition 2012 2007 SHA-3 / SHAKE 2015 TupleHash / ParallelHash / KMAC 2016

slide-60
SLIDE 60

Keyak and Ketje

slide-61
SLIDE 61

SHA-3 competition 2012 2007 SHA-3 / SHAKE 2015 TupleHash / ParallelHash / KMAC 2016 KangarooTwelve & MarsupilamiFourteen

slide-62
SLIDE 62
slide-63
SLIDE 63

SHA-3 competition 2012 2007 SHA-3 / SHAKE 2015 TupleHash / ParallelHash / KMAC 2016 KangarooTwelve & MarsupilamiFourteen

slide-64
SLIDE 64

github.com/gvanas/KeccakCodePackage

slide-65
SLIDE 65

Outline

1.SHA-3 2.derived functions 3.derived protocols

slide-66
SLIDE 66

f

message

⊕ ⊕

f

⊕

f

  • utput

f f

Sponge Construction

squeezing absorbing

slide-67
SLIDE 67

f

input

⊕

init

  • utput

duplexing

Duplex Construction

f

input

⊕

  • utput

duplexing

f

input

  • utput

duplexing

⊕

slide-68
SLIDE 68

Keyed-mode

f

key

⊕

init duplexing

slide-69
SLIDE 69

Keyed-mode

f

key

⊕

init duplexing

secret part leak

slide-70
SLIDE 70

f

key

⊕

init duplexing

Encryption?

slide-71
SLIDE 71

f

key

⊕

init duplexing

ciphertext1 plaintext1

⊕

Encryption

slide-72
SLIDE 72

f

key

⊕

init duplexing

ciphertext1 plaintext1

⊕

f

⊕

tag1

duplexing

Authenticated Encryption

slide-73
SLIDE 73

f

key

⊕

init duplexing

ciphertext1 plaintext1

⊕

f

⊕

tag1

duplexing

f

ciphertext2

duplexing

f

⊕

tag2

duplexing

plaintext2

⊕

Sessions

slide-74
SLIDE 74

myProtocol = Strobe_init(“myWebsite.com”) myProtocol.KEY(sharedSecret) buffer += myProtocol.send_ENC(“GET /”) buffer += myProtocol.send_MAC(len=16) // send the buffer // receive a ciphertext message = myProtocol.recv_ENC(ciphertext[:-16])

  • k = myProtocol.recv_MAC(ciphertext[-16:])

if !ok { // reset the connection } Strobe

slide-75
SLIDE 75
slide-76
SLIDE 76

myHash = Strobe_init(“hash”) myHash.AD(“something to be hashed”) hash = myHash.PRF(outputLen=16) Hash Function

slide-77
SLIDE 77

KDF = Strobe_init(“deriving keys”) KDF.KEY(keyExchangeOutput) keys = KDF.PRF(outputLen=32) key1 = keys[:16] key2 = keys[16:] Key Derivation Function

slide-78
SLIDE 78

data = 010100…

⊕

  • peration = AD

⊕

slide-79
SLIDE 79

data = 010100…

  • peration = send_MAC

f

⊕ ⊕

  • peration = AD

⊕

len = 16 tag

slide-80
SLIDE 80

init

  • peration = KEY

f

⊕

data = 010100…

slide-81
SLIDE 81

init

  • peration = KEY

f

⊕

data = 010100…

f

⊕

  • peration = send_ENC

data = hello

⊕

ciphertext

slide-82
SLIDE 82

init

  • peration = KEY

f

⊕

data = 010100…

f f

⊕

  • peration = send_ENC

data = hello

⊕

ciphertext

len = 16 tag

⊕

  • peration = send_MAC
slide-83
SLIDE 83

strobe.sourceforge.io

slide-84
SLIDE 84

Outline

1.SHA-3 2.derived functions 3.derived protocols 4.Disco?

slide-85
SLIDE 85

www.discocrypto.com

Noise + Strobe = Disco

slide-86
SLIDE 86

I write about crypto at www.cryptologie.net I tweet my mind on twitter.com/lyon01_david

and I work here