Design principles for dedicated hash functions

This paper deals with a generalization of Luby's and Rackoff's results [9] on the construction of block ciphers and their consequences for block cipher implementations. Based on dedicated hash functions, block ciphers are proposed which are more efficient and operate on larger blocks than their original Luby-Rackoff counterparts.

A cryptographic hash function compresses arbitrarily long messages to digests of a short and fixed length. Most of existing hash functions are designed to evaluate a compression function with a finite domain in a mode of operation, and the compression function itself is often designed from block ciphers or permutations. This modular design approach allows for a rigorous security analysis via means of both cryptanalysis and provable security. We present a survey on the state of the art in hash function security and modular design analysis. We focus on existing security models and definitions, as well as on the security aspects of designing secure compression functions (indirectly) from either block ciphers or permutations. In all of these directions, we identify open problems that, once solved, would allow for an increased confidence in the use of cryptographic hash functions.

An important property of a hash function is the performance. We study fast iterated hash functions based on block ciphers. These hash functions and their compression functions are analyzed in the standard black-box model. We show an upper bound on rate of any collision resistant hash function. In addition, we improve known bound on the rate of collision resistant compression functions.

We report on linear analyses of block-cipher based compression and hash functions. Our aim is not to find collisions nor (second) preimages, but to detect non-random properties that may distinguish a compression or hash function from an ideal primitive (random oracle). We study single-block modes of operation such as Davies-Meyer (DM), Matyas-Meyer-Oseas (MMO) and Miyaguchi-Preneel (MP) and double-block modes such as Hirose's, Tandem-DM, Parallel-DM and Abreast-DM. This paper points out weaknesses coming from the feedforward operation used in these hash modes. We use an inside-out approach: we show how a weakness (linear relation) in the underlying block cipher can propagate to the compression function and eventually to the whole hash function. To demonstrate our ideas, we instantiate the block cipher underlying these modes with 21-round PRESENT, the full 16-round DES and 9-round Serpent. For instance, in DM-PRESENT-80 mode, we can distinguish the hash function from an ideal primitive with 264 hash computations.

We propose a class of almost rate-1 construction for 2n-bit hash functions, based on (2n, n) blockciphers, where 2n is the length of the cipher key and n is the cipher block length. These hash functions we proposed are proved to be optimum collision resistance and preimage resistance in the ideal cipher model. The hash rate of the construction is l-1/l where l is the number of cipher calls in the compression function. The hash rate is closed to 1 if l is large. Compare with existing DBL hash functions based on block ciphers with optimum collision resistance and preimage resistance, they are more efficient and simpler.

Hash functions, which can extract message digest from input messages as output, play an important role in digital signature and authentication. Meanwhile, Hash functions are essential in many cryptographic protocols and regimes. With the research becoming more and more in depth, a series of Hash functions is proposed, such as MD series and SHA series. At the same time, the security analysis and attacks against Hash functions are carried out. The security of Hash functions is threatened. In this case, how to improve the security of the Hash functions becomes the primary concern. In this paper, an optical Hash function based on the interaction between light and multiple scattering media is proposed. Unlike most of the traditional Hash functions which are based on mathematical transformations or complex logic operations, this method innovatively takes advantage of the natural random scattering effect of multiple scattering media on coherently modulated light, and realizes the “confusion” and “diffusion” of modulated light, which satisfies the core functional requirement of the Hash function: one-way encoding/encryption with strong security. The photoelectric hybrid system designed by this method can effectively simulate the "compression function" in the Hash function. Combined with the Sobel filter with feature extraction function, the input data of arbitrary length can be compressed and encrypted into the output with a fixed length of 256-bit (Hash value). The principle of the proposed optical Hash function can be described as follows. 1) Two 8-bit images with a size of 16×16 pixels are loaded in SLM<sub>1</sub> (amplitude-only spatial modulator) and SLM<sub>2</sub> (phase-only spatial modulator) respectively. 2) The coherent wavefront is modulated by SLM<sub>1</sub> and SLM<sub>2</sub>, and then propagates on multiple scattering media. 3) A speckle pattern is recorded by CCD because of the confusion of multiple scattering media. 4) The features of the speckle pattern, which is extracted by Sobel filter, serve as the input of the next compression function. For the unpredicted and non-duplicated disorder multiple scattering media, it is tremendously difficult to determine the internal state of the multiple scattering media. Therefore, the proposed optical Hash function is considered to have a high security. A series of simulation results shows that the proposed optical Hash function has a good “avalanche effect” and “collision resistance”, and its security performance is comparable to that of the most widely used traditional Hash functions (MD5 and SHA-1).

Addition of hash component in a message is always for verification of authentication of message without integrity. In order to retain integrity certain schemes such as Merkle–Damgard scheme or Rabin scheme based on the block cipher can be used. However, the block cipher schemes in messages do not get applicable on image which are encoding message in a visual format. Therefore, block cipher based schemes are not able to provide tamper localization in case of image authentication. Tamper detection is needed in case of images as it is not visualized without proper verification. Moreover, localization is not possible by hash verification making the authentication processes only detectable but not identifiable. The paper presents a generation process of three least significant bits of hash function. The image insertion is not visualized due to human eye limitation. The method proposed is able to embed a secret image (gray scale) inside a corner image. Experimental results show an improvement in peak signal-to-noise ratio (PSNR) values of the proposed technique over the other techniques available, such as hash-based LSB(2-3-3) image steganography in spatial domain. This paper proposes an image authentication process not only for robustness, security, and tamper detection but also successfully able to identify tamper by a process of tamper localization. The parameters compared include the classical mechanism along with newly introduced entropy measurement of images. A performance analysis is able to show the result claimed in the paper. The paper uses a least significant bit (LSB) based hash function, which is a blind technique as image-related information is never sent to receiver separately. In fact, the proposed approach is a clever design as the generated hash function will be embedded in the image itself. The proposed mechanism is able to offer good imperceptibility between original image and embedded image with hash bits. Even a minute tampering can be detected with proper localization; the localization of tampering is having its wide applicability in case of forensic evidence of malicious image morphing.

We show that if there exists a computationally collision free function f from m bits to t bits where m > t, then there exists a computationally collision free function h mapping messages of arbitrary polynomial lengths to t-bit strings.Let n be the length of the message. h can be constructed either such that it can be evaluated in time linear in n using 1 processor, or such that it takes time O(log(n)) using O(n) processors, counting evaluations of f as one step. Finally, for any constant k and large n, a speedup by a factor of k over the first construction is available using k processors.Apart from suggesting a generally sound design principle for hash functions, our results give a unified view of several apparently unrelated constructions of hash functions proposed earlier. It also suggests changes to other proposed constructions to make a proof of security potentially easier.We give three concrete examples of constructions, based on modular squaring, on Wolfram’s pseudoranddom bit generator [Wo], and on the knapsack problem.KeywordsHash FunctionKnapsack ProblemFunction FamilyDigital Signature SchemeProbabilistic PolynomialThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The security of hash functions based on a block cipher with a block length of m bits and a key length of k bits, where $k\leq m$ , is considered. New attacks are presented on a large class of iterated hash functions with a 2m -bit hash result which processes in each iteration two message blocks using two encryptions. In particular, the attacks break three proposed schemes: Parallel-DM, the PBGV hash function, and the LOKI DBH mode.

A symmetric block cipher scheme is proposed in this paper. Based on IDEA, this scheme introduces a hash function in the block cipher design. From the scheme, a block cipher with good strength can be easily designed. In this paper, an AES-like block cipher is demonstrated as an example of using the scheme.

In this paper we investigate the differential properties of block ciphers in hash function modes of operation. First we show the impact of differential trails for block ciphers on collision attacks for various hash function constructions based on block ciphers. Further, we prove the lower bound for finding a pair that follows some truncated differential in case of a random permutation. Then we present open-key differential distinguishers for some well known round-reduced block ciphers.

While differential behavior of modern ciphers in a single secret key scenario is relatively well understood, and simple techniques for computation of security lower bounds are readily available, the security of modern block ciphers against related-key attacks is still very ad hoc. In this paper we make a first step towards provable security of block ciphers against related-key attacks by presenting an efficient search tool for finding differential characteristics both in the state and in the key (note that due to similarities between block ciphers and hash functions such tool will be useful in analysis of hash functions as well). We use this tool to search for the best possible (in terms of the number of rounds) related-key differential characteristics in AES, byte-Camellia, Khazad, FOX, and Anubis. We show the best related-key differential characteristics for 5, 11, and 14 rounds of AES-128, AES-192, and AES-256 respectively. We use the optimal differential characteristics to design the best related-key and chosen key attacks on AES-128 (7 out of 10 rounds), AES-192 (full 12 rounds), byte-Camellia (full 18 rounds) and Khazad (7 and 8 out of 8 rounds). We also show that ciphers FOX and Anubis have no related-key attacks on more than 4-5 rounds.KeywordsCryptanalysis toolsearch for best differential characteristicsrelated-key attackopen keyAESCamelliaKhazadAnubisFOX

In CRYPTO’89, Merkle presented three double-block-length hash functions based on DES. They are optimally collision resistant in a black-box model, that is, the time complexity of any collision-finding algorithm for them is Ω(2l/2) if DES is a random block cipher, where l is the output length. Their drawback is that their rates are low. In this article, new double-block-length hash functions with higher rates are presented which are also optimally collision resistant in the black-box model. They are composed of block ciphers whose key length is twice larger than their block length.

创新点 1、 本文主要讨论每个块都是某一个内层快的多项式的分块扩散矩阵。与前人工作不同的是: 我们从内层块出发, 由里及外地构造MDS分块扩散层。 这使得我们最后能给出找到MDS分块矩阵的明确算法。 2、 我们采用了新方法来验证分块扩散矩阵的MDS性。 新方法基于内层块的极小多项式, 只需检验外层矩阵的子矩阵 (多项式矩阵) 的行列式与此极小多项式是否互素。 这比带入内层块然后计算大尺寸行列式要高效得多。 3、 我们发现了一种新的用于外层矩阵的变换。 这种变换可以从一个MDS分块矩阵得出多个MDS分块矩阵。 更重要的是, 我们可以利用这种变换导出所有外层矩阵上的一个等价关系, 并且MDS性是这种等价关系下的不变量。 因而我们可以把所有外层矩阵分类, 每一类或者都是MDS的或者都不是MDS的, 只需检验一个即可。 这样就大大减小了寻找MDS分块矩阵时的搜索空间。

Fully homomorphic encryption (FHE) is a powerful cryptographic technique allowing to perform computation directly over encrypted data. Motivated by the overhead induced by the homomorphic ciphertexts during encryption and transmission, the transciphering technique, consisting in switching from a symmetric encryption to FHE encrypted data was investigated in several papers. Different stream and block ciphers were evaluated in terms of their “FHE-friendliness”, meaning practical implementations costs while maintaining sufficient security levels. In this work, we present a first evaluation of hash functions in the homomorphic domain, based on well-chosen block ciphers. More precisely, we investigate the cost of transforming PRINCE, SIMON, SPECK, and LowMC, a set of lightweight block-ciphers into secure hash primitives using well-established hash functions constructions based on block-ciphers, and provide evaluation under bootstrappable FHE schemes. We also motivate the necessity of practical homomorphic evaluation of hash functions by providing several use cases in which the integrity of private data is also required. In particular, our hash constructions can be of significant use in a threshold-homomorphic based protocol for the single secret leader election problem occurring in blockchains with Proof-of-stake consensus. Our experiments showed that using a TFHE implementation of a hash function, we are able to achieve practical runtime, and appropriate security levels (e.g., for PRINCE it takes 1.28 minutes to obtain a 128 bits of hash).