SipHash: a fast short-input PRF Jean-Philippe Aumasson, Daniel J. - - PowerPoint PPT Presentation

▶
siphash a fast short input prf
SMART_READER_LITE
LIVE PREVIEW

SipHash: a fast short-input PRF Jean-Philippe Aumasson, Daniel J. - - PowerPoint PPT Presentation

May 11, 2023 180 likes •623 views

SipHash: a fast short-input PRF Jean-Philippe Aumasson, Daniel J. Bernstein SipHash: a fast short-input MAC Jean-Philippe Aumasson, Daniel J. Bernstein UMAC (Black, Halevi, Krawczyk, Krovetz, Rogaway; 2000)

slide-1
SLIDE 1

SipHash: a fast short-input PRF

Jean-Philippe Aumasson, Daniel J. Bernstein

slide-2
SLIDE 2

SipHash: a fast short-input MAC

Jean-Philippe Aumasson, Daniel J. Bernstein

slide-3
SLIDE 3

UMAC

(Black, Halevi, Krawczyk, Krovetz, Rogaway; 2000)

http://fastcrypto.org/umac/update.pdf

1 cycle/byte on a Pentium III !

slide-4
SLIDE 4

UMAC(m) = H(k1, m) ⊕ AES(k2, n)

slide-5
SLIDE 5

UMAC’s universal hash

Polynomial-evaluation using 64-bit multipliers with Horner’s rule

slide-6
SLIDE 6

UMAC fast C implementation

2000+ LoC (without AES) Not portable

slide-7
SLIDE 7

http://fastcrypto.org/umac/2004/src/umac.c

slide-8
SLIDE 8

UMAC uses a PRG to expand the key to 33280 bits

slide-9
SLIDE 9

RFC4418 replaces UMAC’s PRG with an AES-based KDF...

slide-10
SLIDE 10

… and uses AES and this KDF in a “Pad-Derivation Function”

slide-11
SLIDE 11

Not so simple

slide-12
SLIDE 12

SipHash

Simple ARX round function Simple JH-like message injection No key expansion No external primitive No state between messages

slide-13
SLIDE 13

SipHash initialization

256-bit state v0 v1 v2 v3 128-bit key k0 k1 v0 = k0 ⊕ 736f6d6570736575 v1 = k1 ⊕ 646f72616e646f6d v2 = k0 ⊕ 6c7967656e657261 v3 = k1 ⊕ 7465646279746573

slide-14
SLIDE 14

SipHash initialization

256-bit state v0 v1 v2 v3 128-bit key k0 k1 v0 = k0 ⊕ “somepseu” v1 = k1 ⊕ “dorandom” v2 = k0 ⊕ “lygenera” v3 = k1 ⊕ “tedbytes”

slide-15
SLIDE 15

SipHash compression

Message parsed as 64-bit words m0, m1, …

v3 ⊕= m0 c iterations of SipRound v0 ⊕= m0

slide-16
SLIDE 16

SipHash compression

Message parsed as 64-bit words m0, m1, …

v3 ⊕= m1 c iterations of SipRound v0 ⊕= m1

slide-17
SLIDE 17

SipHash compression

Message parsed as 64-bit words m0, m1, …

v3 ⊕= m2 c iterations of SipRound v0 ⊕= m2

slide-18
SLIDE 18

SipHash compression

Message parsed as 64-bit words m0, m1, …

Etc.

slide-19
SLIDE 19

SipRound

slide-20
SLIDE 20

SipHash finalization

v2 ⊕= 255 d iterations of SipRound Return v0 ⊕ v1 ⊕ v2 ⊕ v3

slide-21
SLIDE 21

SipHash-2-4 hashing 15 bytes

slide-22
SLIDE 22

Family SipHash-c-d Fast proposal: SipHash-2-4 Conservative proposal: SipHash-4-8 Weaker versions for cryptanalysis: SipHash-1-0, SipHash-2-0, etc. SipHash-1-1, SipHash-2-1, etc. Etc.

slide-23
SLIDE 23

(Many) short inputs?

slide-24
SLIDE 24
slide-25
SLIDE 25

Hash tables

h = {} # empty table h[‘foo’] = ‘bar’ # insert ‘bar’ Print h[‘foo’] # lookup

Non-crypto functions to produce ‘foo’:

for (; nKeyLength > 0; nKeyLength -=1) { hash = ((hash << 5) + hash) + *arKey++; }

slide-26
SLIDE 26

Hash flooding attacks

Multicollisions forcing worst-case complexity of Θ(n2), instead of Θ(n)

[when table implemented as linked lists]

slide-27
SLIDE 27

djbdns/cache.c, 1999

slide-28
SLIDE 28

USENIX 2003

Vulnerabilities in Perl, web proxy, IDS

slide-29
SLIDE 29

CCC 2011

Affected: PHP, ASP.net, Python, etc.

slide-30
SLIDE 30
slide-31
SLIDE 31

How short?

OpenDNS cache: 27 bytes on average Ruby on Rails web application: <20 bytes

slide-32
SLIDE 32

Why SipHash?

Minimizes hash flooding

→ impact limited to sqrt(communication)

Well-defined security goal (PRF) Competitive in speed with non-crypto hashes

slide-33
SLIDE 33

How fast?

SipHash-2-4 on an AMD Athlon II Neo Long data: 1.44 cycles/byte

Byte length 8 16 32 64 Cycles (per byte) 123 (15.38) 134 (8.38) 158 (4.25) 204 (3.19)

slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36

amd64; K10 45nm; 2010 AMD Phenom II X6 1090T

slide-37
SLIDE 37

x86; K10 45nm; 2010 AMD Phenom II X6 1090T

slide-38
SLIDE 38

Cryptanalysis

slide-39
SLIDE 39

Generic attacks

≈ 2128 key recovery ≈ 2192 state recovery ≈ 2128 internal-collision forgeries ≈ 2s forgery attack with success probability 2s-64

slide-40
SLIDE 40

Characteristic verified with ARXtools

http://www.di.ens.fr/~leurent/arxtools.html

slide-41
SLIDE 41

Proof of insecurity

SipRound( 0 ) = 0 That is, SipRound is not ideal Therefore SipHash is insecure

slide-42
SLIDE 42

Proof of simplicity

June 20: paper published online June 28: 18 third-party implementations

C (Floodyberry, Boßlet, Neves); C# (Haynes) Cryptol (Lazar); Erlang, Javascript, PHP (Denis) Go (Chestnykh); Haskell (Hanquez); Java, Ruby (Boßlet); Lisp (Brown);

slide-43
SLIDE 43

More on SipHash:

http://131002.net/siphash Thanks to all implementers!