Attacks on Fast Double Block Length Hash Functions

We provide a proof of security for a huge class of double block length hash function that we will call Cyclic-DM . Using this result, we are able to give a collision resistance bound for Abreast-DM , one of the oldest and most well-known constructions for turning a block cipher with n -bit block length and 2n -bit key length into a 2n -bit cryptographic hash function. In particular, we show that when Abreast-DM is instantiated using a block cipher with 128-bit block length and 256-bit key length, any adversary that asks less than 2124.42 queries cannot find a collision with success probability greater than 1/2. Surprisingly, this about 15 years old construction is one of the few constructions that have the desirable feature of a near-optimal collision resistance guarantee. We are also able to derive several DBL constructions that lead to compression functions offering an even higher security guarantee and more efficiency than Abreast-DM (e.g. share a common key). Furthermore we give a practical DBL construction that has the highest security guarantee of all DBL compression functions currently known in literature. We also provide a (relatively weak) analysis of preimage resistance for Cyclic-DM .

The idea of double block length hashing is to construct a compression function on 2n bits using a block cipher with an n-bit block size. All optimally secure double block length hash functions known in the literature employ a cipher with a key space of double block size, 2n-bit. On the other hand, no optimally secure compression functions built from a cipher with an n-bit key space are known. Our work deals with this problem. Firstly, we prove that for a wide class of compression functions with two calls to its underlying n-bit keyed block cipher collisions can be found in about $$2^{n/2}$$2n/2 queries. This attack applies, among others, to functions where the output is derived from the block cipher outputs in a linear way. This observation demonstrates that all security results of designs using a cipher with 2n-bit key space crucially rely on the presence of these extra n key bits. The main contribution of this work is a proof that this issue can be resolved by allowing the compression function to make one extra call to the cipher. We propose a family of compression functions making three block cipher calls that asymptotically achieves optimal collision resistance up to $$2^{n(1-\varepsilon )}$$2n(1-ź) queries and preimage resistance up to $$2^{3n(1-\varepsilon )/2}$$23n(1-ź)/2 queries, for any $$\varepsilon >0$$ź>0. To our knowledge, this is the first optimally collision secure double block length construction using a block cipher with single length key space. We additionally prove this class of functions indifferentiable from random functions in about $$2^{n/2}$$2n/2 queries, and demonstrate that no other function in this direction achieves a bound of similar kind.

We consider the question of efficiently extending the key length of block ciphers. To date, the approach providing highest security is triple encryption (used e.g. in Triple-DES), which was proved to have roughly κ + min {n/2, κ/2} bits of security when instantiated with ideal block ciphers with key length κ and block length n, at the cost of three block-cipher calls per message block. This paper presents a new practical key-length extension scheme exhibiting κ + n/2 bits of security – hence improving upon the security of triple encryption – solely at the cost of two block cipher calls and a key of length κ + n. We also provide matching generic attacks showing the optimality of the security level achieved by our approach with respect to a general class of two-query constructions.

In CRYPTO’89, Merkle presented three double-block-length hash functions based on DES. They are optimally collision resistant in a black-box model, that is, the time complexity of any collision-finding algorithm for them is Ω(2l/2) if DES is a random block cipher, where l is the output length. Their drawback is that their rates are low. In this article, new double-block-length hash functions with higher rates are presented which are also optimally collision resistant in the black-box model. They are composed of block ciphers whose key length is twice larger than their block length.

A cryptographic hash function compresses arbitrarily long messages to digests of a short and fixed length. Most of existing hash functions are designed to evaluate a compression function with a finite domain in a mode of operation, and the compression function itself is often designed from block ciphers or permutations. This modular design approach allows for a rigorous security analysis via means of both cryptanalysis and provable security. We present a survey on the state of the art in hash function security and modular design analysis. We focus on existing security models and definitions, as well as on the security aspects of designing secure compression functions (indirectly) from either block ciphers or permutations. In all of these directions, we identify open problems that, once solved, would allow for an increased confidence in the use of cryptographic hash functions.

In this article, the security of double-block-length hash functions with the rate 1 is analyzed, whose compression functions are composed of block ciphers with their key length twice larger than their block length. First, the analysis by Satoh, Haga and Kurosawa is investigated, and it is shown that there exists a case uncovered by their analysis. Second, a large class of compression functions are defined, and it is shown that they are at most as secure as those of single-block-length hash functions. Finally, some candidate hash functions are given which are possibly optimally collision-resistant.

We present new preimage attacks on standard Keccak-224 and Keccak-256 that are reduced to 3 and 4 rounds. An allocating approach is used in the attacks, and the whole complexity is allocated to two stages, such that fewer constraints are considered and the complexity is lowered in each stage. Specifically, we are trying to find a 2-block preimage, instead of a 1-block one, for a given hash value, and the first and second message blocks are found in two stages, respectively. Both the message blocks are constrained by a set of newly proposed conditions on the middle state, which are weaker than those brought by the initial values and the hash values. Thus, the complexities in the two stages are both lower than that of finding a 1-block preimage directly. Together with the basic allocating approach, an improved method is given to balance the complexities of two stages, and hence, obtains the optimal attacks. As a result, we present the best theoretical preimage attacks on Keccak-224 and Keccak-256 that are reduced to 3 and 4 rounds. Moreover, we practically found a (second) preimage for 3-round Keccak-224 with a complexity of \(2^{39.39}\).

Hash functions, which can extract message digest from input messages as output, play an important role in digital signature and authentication. Meanwhile, Hash functions are essential in many cryptographic protocols and regimes. With the research becoming more and more in depth, a series of Hash functions is proposed, such as MD series and SHA series. At the same time, the security analysis and attacks against Hash functions are carried out. The security of Hash functions is threatened. In this case, how to improve the security of the Hash functions becomes the primary concern. In this paper, an optical Hash function based on the interaction between light and multiple scattering media is proposed. Unlike most of the traditional Hash functions which are based on mathematical transformations or complex logic operations, this method innovatively takes advantage of the natural random scattering effect of multiple scattering media on coherently modulated light, and realizes the “confusion” and “diffusion” of modulated light, which satisfies the core functional requirement of the Hash function: one-way encoding/encryption with strong security. The photoelectric hybrid system designed by this method can effectively simulate the "compression function" in the Hash function. Combined with the Sobel filter with feature extraction function, the input data of arbitrary length can be compressed and encrypted into the output with a fixed length of 256-bit (Hash value). The principle of the proposed optical Hash function can be described as follows. 1) Two 8-bit images with a size of 16×16 pixels are loaded in SLM<sub>1</sub> (amplitude-only spatial modulator) and SLM<sub>2</sub> (phase-only spatial modulator) respectively. 2) The coherent wavefront is modulated by SLM<sub>1</sub> and SLM<sub>2</sub>, and then propagates on multiple scattering media. 3) A speckle pattern is recorded by CCD because of the confusion of multiple scattering media. 4) The features of the speckle pattern, which is extracted by Sobel filter, serve as the input of the next compression function. For the unpredicted and non-duplicated disorder multiple scattering media, it is tremendously difficult to determine the internal state of the multiple scattering media. Therefore, the proposed optical Hash function is considered to have a high security. A series of simulation results shows that the proposed optical Hash function has a good “avalanche effect” and “collision resistance”, and its security performance is comparable to that of the most widely used traditional Hash functions (MD5 and SHA-1).

We propose a class of almost rate-1 construction for 2n-bit hash functions, based on (2n, n) blockciphers, where 2n is the length of the cipher key and n is the cipher block length. These hash functions we proposed are proved to be optimum collision resistance and preimage resistance in the ideal cipher model. The hash rate of the construction is l-1/l where l is the number of cipher calls in the compression function. The hash rate is closed to 1 if l is large. Compare with existing DBL hash functions based on block ciphers with optimum collision resistance and preimage resistance, they are more efficient and simpler.

A symmetric block cipher scheme is proposed in this paper. Based on IDEA, this scheme introduces a hash function in the block cipher design. From the scheme, a block cipher with good strength can be easily designed. In this paper, an AES-like block cipher is demonstrated as an example of using the scheme.

An important property of a hash function is the performance. We study fast iterated hash functions based on block ciphers. These hash functions and their compression functions are analyzed in the standard black-box model. We show an upper bound on rate of any collision resistant hash function. In addition, we improve known bound on the rate of collision resistant compression functions.

Recently, a fast and secure hash function SFHA - 256 has been proposed and claimed as more secure and as having a better performance than the SHA - 256. In this paper an improved version of SFHA - 256 is proposed and analyzed using two parameters, namely the avalanche effect and uniform deviation. The experimental results and further analysis ensures the performance of the newly proposed and improved SFHA-256. From the analysis it can be concluded that the newly proposed algorithm is more secure, efficient, and practical.

Addition of hash component in a message is always for verification of authentication of message without integrity. In order to retain integrity certain schemes such as Merkle–Damgard scheme or Rabin scheme based on the block cipher can be used. However, the block cipher schemes in messages do not get applicable on image which are encoding message in a visual format. Therefore, block cipher based schemes are not able to provide tamper localization in case of image authentication. Tamper detection is needed in case of images as it is not visualized without proper verification. Moreover, localization is not possible by hash verification making the authentication processes only detectable but not identifiable. The paper presents a generation process of three least significant bits of hash function. The image insertion is not visualized due to human eye limitation. The method proposed is able to embed a secret image (gray scale) inside a corner image. Experimental results show an improvement in peak signal-to-noise ratio (PSNR) values of the proposed technique over the other techniques available, such as hash-based LSB(2-3-3) image steganography in spatial domain. This paper proposes an image authentication process not only for robustness, security, and tamper detection but also successfully able to identify tamper by a process of tamper localization. The parameters compared include the classical mechanism along with newly introduced entropy measurement of images. A performance analysis is able to show the result claimed in the paper. The paper uses a least significant bit (LSB) based hash function, which is a blind technique as image-related information is never sent to receiver separately. In fact, the proposed approach is a clever design as the generated hash function will be embedded in the image itself. The proposed mechanism is able to offer good imperceptibility between original image and embedded image with hash bits. Even a minute tampering can be detected with proper localization; the localization of tampering is having its wide applicability in case of forensic evidence of malicious image morphing.

In this chapter, we give an introduction to basic methods of symmetric-key cryptography. At first, we consider symmetric-key encryption.We explain the notions of stream and block ciphers. The operation modes of block ciphers are studied and, as prominent examples for block ciphers, DES and AES are described. Later, we introduce cryptographic hash functions. Methods for the construction of cryptographic hash functions, such as Merkle–Damg˚ard’s method and the sponge construction, are explained in detail. As an application of hash functions, we get message authentication codes, MACs for short. MACs are the standard symmetric-key technique to guarantee the integrity and authenticity of messages.

We report on linear analyses of block-cipher based compression and hash functions. Our aim is not to find collisions nor (second) preimages, but to detect non-random properties that may distinguish a compression or hash function from an ideal primitive (random oracle). We study single-block modes of operation such as Davies-Meyer (DM), Matyas-Meyer-Oseas (MMO) and Miyaguchi-Preneel (MP) and double-block modes such as Hirose's, Tandem-DM, Parallel-DM and Abreast-DM. This paper points out weaknesses coming from the feedforward operation used in these hash modes. We use an inside-out approach: we show how a weakness (linear relation) in the underlying block cipher can propagate to the compression function and eventually to the whole hash function. To demonstrate our ideas, we instantiate the block cipher underlying these modes with 21-round PRESENT, the full 16-round DES and 9-round Serpent. For instance, in DM-PRESENT-80 mode, we can distinguish the hash function from an ideal primitive with 264 hash computations.