The Usage of Counter Revisited: Second-Preimage Attack on New - PowerPoint PPT Presentation

The Usage of Counter Revisited: Second-Preimage Attack on New Russian Standardized Hash Function Jérémy Jean 1 joint work with: Jian Guo 1 Gaëtan Leurent 2 Thomas Peyrin 1 Lei Wang 1 1 Nanyang Technological University, Singapore 2 INRIA, France SAC 2014 – August 14, 2014

Introduction Our observation Diamond attack Expandable message attack Conclusion Streebog : new Russian hash function. New hash function standard in Russia. ◮ Standardized name: GOST R 34.11-2012 ◮ Nickname of that function: Streebog . ◮ Previous standard: GOST R 34.11-94. ◮ Theoretical weaknesses. ◮ Rely on the GOST block cipher from the same standard. ◮ This block cipher has also been weakened by third-party ◮ cryptanalysis. SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 2/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Specifications: domain extension. Two versions: Streebog-256 and Streebog-512 . ◮ 10 ∗ padding: m 1 || · · · || m t || m (blocks of 512 bits). ◮ Compression function: g . ◮ Checksum: Σ , over the message blocks m i (addition modulo 2 512 ). ◮ Counter: N , HAIFA input to g over the number of processed bits. ◮ Three stages: initialization, message processing and finalization. ◮ . . . Σ m 1 m 2 m t m h t − 1 h t + 1 h t + 2 h 1 h 2 h t . . . h 0 = IV g g g g g g h . . . N | M | 512 512 512 0 0 Stage 1 Stage 2 Stage 3 SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 3/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Specifications: compression function. Simplification: the counter counts #blocks, not #bits. ◮ g compresses ( h i − 1 , i , m i ) to h i using: h i = f ( h i − 1 ⊕ i , m i ) ⊕ h i − 1 . ◮ Our attack is independent of the specifications of f (deterministic). ◮ m i i g h i − 1 h i f g is one instantiation of a HAIFA compression function. ◮ The counter is simply XORed to the input of the f function. ◮ SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 4/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent compression function. m i i h i − 1 h i f h i = h i − 1 ⊕ f ( h i − 1 ⊕ i , m i ) ⇐ ⇒ SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 5/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent compression function. m i i h i − 1 h i f h i = h i − 1 ⊕ f ( h i − 1 ⊕ i , m i ) ⇐ ⇒ m i i h i − 1 f SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 5/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent compression function. m i i h i − 1 h i f h i = h i − 1 ⊕ f ( h i − 1 ⊕ i , m i ) ⇐ ⇒ m i i h i − 1 h i ⊕ i f SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 5/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent compression function. m i i h i − 1 h i f h i = h i − 1 ⊕ f ( h i − 1 ⊕ i , m i ) ⇐ ⇒ m i i i h i − 1 h i f SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 5/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent compression function. m i i h i − 1 h i f � h i = F ( h i − 1 ⊕ i , m i ) ⊕ i , h i = h i − 1 ⊕ f ( h i − 1 ⊕ i , m i ) ⇐ ⇒ F ( x , m i ) = f ( x , m i ) ⊕ x . m i i i h i − 1 h i f F The function F is independent of the counter value! SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 5/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Iteration of the equivalent compression function. We have an equivalent representation of the compression function. ◮ Its iteration allows to combine the counter additions. ◮ m i m i + 1 i + 1 i + 1 i i h i − 1 h i + 1 f f F F def ∆( i ) = i ⊕ ( i + 1 ) , def F ∆( i ) ( X , Y ) = F ( X , Y ) ⊕ ∆( i ) . i i i + 1 i + 1 i + 2 h i − 1 h i + 1 F F ∆( i ) ∆( i + 1 ) F ∆( i ) F ∆( i + 1 ) SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 6/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Relations between functions F ∆( i ) for 1 ≤ i ≤ t (1/2). Recall that t is the number of full blocks m 1 || · · · || m t || m , | m | < 512. We observe that: For all even i , ∆( i ) = i ⊕ ( i + 1 ) = 1. ◮ = ⇒ The same function F 1 is used every other time. Sequence of ∆( i ) is very structured. ◮ i : 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 ∆( i ) : 1 3 1 7 1 3 1 15 1 3 1 7 1 3 1 31 1 3 1 7 1 3 1 15 Let s > 0, and denoting � i � the s -bit binary representation of i < 2 s − 1: � � � � ∆( i + 2 s ) = 1 ||� i � ⊕ 1 ||� i + 1 � = � i � ⊕ � i + 1 � = ∆( i ) . More generally: F ∆( i ) = F ∆( i + j · 2 s ) for all 0 ≤ i ≤ 2 s − 1 and j ≥ 0. For example, with s = 2, F 1 and F 1 + 2 2 = F 5 are equal. SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 7/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Relations between functions F ∆( i ) for 1 ≤ i ≤ t (2/2). Given an integer s > 0, we have: ∀ i ∈ { 0 , . . . , 2 s − 2 } , ∀ j > 0 : F ∆( i ) = F ∆( j · 2 s + i ) 512 − s bits s bits 512 − s bits s bits 0 < i > j < i > 0 < i + 1 > j < i + 1 > = < i ⊕ ( i + 1 ) > = < i ⊕ ( i + 1 ) > 0 0 ∆( i ) ∆( i + j · 2 s ) Consequently: The same sequence of 2 s − 1 functions are used in the domain ◮ extension algorithm. This seems weaker than a true HAIFA mode. ◮ SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 8/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Equivalent description of stage 2 of the domain extension. The last function differs in each 2 s -chunk. ◮ = ⇒ We call it G j = F ∆( j × 2 s − 1 ) . We define l as the number of ( 2 s − 1 ) -chains of F functions: ◮ � t � . Moreover, let p be the remainder of t modulo 2 s . l = 2 s That is: the function F 2 s − 2 ◦ · · · F 1 ◦ F 0 is reused l times. ◮ 0 F 2 s − 2 ◦ · · · F 1 ◦ F 0 . . . F 2 s − 2 IV F 0 F 1 G 1 . . . . . . . . . . . . . . . F 0 F 1 F 2 s − 2 G l . . . F p F 0 F 1 h t t + 1 SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 9/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Cryptographic consequences of the HAIFA instantiation. Streebog is one choice of counter usage from the HAIFA framework. Consequences of this choice: Counters at steps i and i + 1 can be combined. ◮ Distinction of compression function calls in the HAIFA framework ◮ not achieved. Domain extension similar to a Merkle-Damgård scheme. ◮ = ⇒ Possibility to apply existing known second-preimage attacks. SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 10/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Cryptographic consequences of the HAIFA instantiation. Streebog is one choice of counter usage from the HAIFA framework. Consequences of this choice: Counters at steps i and i + 1 can be combined. ◮ Distinction of compression function calls in the HAIFA framework ◮ not achieved. Domain extension similar to a Merkle-Damgård scheme. ◮ = ⇒ Possibility to apply existing known second-preimage attacks. Our second-preimage attacks on Streebog (security level: 2 512 ): Using a diamond structure: ◮ Original message of at least 2 179 blocks. ◮ 2 342 compression function evaluations. ◮ Using a expandable message: ◮ Original message of at least 2 259 blocks. ◮ 2 266 compression function evaluations. ◮ SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 10/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Diamond structure (1/2) Diamond structure: F 2 s − 3 ◦···◦ F 1 F 2 s − 2 F 0 Introduced in [KK06]. ◮ Complete binary tree. ◮ h 0 1 Nodes: chaining values. ◮ m 0 1 Edges: 1-block n -bit messages. ◮ 2 2 s − 1 h ⋄ Depth d . ◮ m 1 1 Construction: h 1 1 Levels constructed sequentially. ◮ Complexity: 2 ( n + d ) / 2 calls. ◮ Evaluation done in [KK13]. ◮ SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 11/19

Introduction Our observation Diamond attack Expandable message attack Conclusion Diamond structure (2/2) Diamond used in our attack: F 2 s − 3 ◦···◦ F 1 F 2 s − 2 F 0 Root h ⋄ . ◮ Depth d = 2 s − 1. ◮ h 0 1 F i ’s used to join the levels. ◮ m 0 1 #leaves=2 2 s − 1 . ◮ 2 2 s − 1 h ⋄ Remarks: m 1 1 Same function at each level in h 1 ◮ 1 the original attack on Merkle-Damgård. Here, full control of the counter ◮ effect in the ( 2 s − 1 ) -chains with different functions F i . SAC 2014 – J. Guo, J. Jean, G. Leurent, T. Peyrin, L. Wang – Cryptanalysis of Streebog 12/19