Preimage Analysis of the Maelstrom-0 Hash Function

Preimage and pseudo-collision attacks on step-reduced SM3 hash function

The security of permutation-based hash functions in the ideal permutation model has been studied when the input-length of compression function is larger than the input-length of the permutation function. In this paper, we consider permutation based compression functions that have input lengths shorter than that of the permutation. Under this assumption, we propose a permutation based compression function and prove its security with respect to collision and (second) preimage attacks in the ideal permutation model. The proposed compression function can be seen as a generalization of the compression function of MD6 hash function.

Consider the cryptographic hash function Skein-512-256, which became a finalist of the NIST hash function competition in 2010. Skein-512-256 compression function processes a 512-bit block message block in 72 rounds, 12 operations each. A practical algebraic preimage attack on round-reduced versions of the Skein-512-256 compression function is proposed. The corresponding computational problems are reduced to instances of the Boolean satisfiability problem (SAT). Using sequential SAT solvers, preimages of the first round and the first 7 operations of the second round of the compression function have been found. By applying a parallel SAT solver, the number of the second round’s operations has been increased to 8. Earlier, a practical preimage attack on at most 1-round Skein-512-256 compression function was published.

Hash functions, which can extract message digest from input messages as output, play an important role in digital signature and authentication. Meanwhile, Hash functions are essential in many cryptographic protocols and regimes. With the research becoming more and more in depth, a series of Hash functions is proposed, such as MD series and SHA series. At the same time, the security analysis and attacks against Hash functions are carried out. The security of Hash functions is threatened. In this case, how to improve the security of the Hash functions becomes the primary concern. In this paper, an optical Hash function based on the interaction between light and multiple scattering media is proposed. Unlike most of the traditional Hash functions which are based on mathematical transformations or complex logic operations, this method innovatively takes advantage of the natural random scattering effect of multiple scattering media on coherently modulated light, and realizes the “confusion” and “diffusion” of modulated light, which satisfies the core functional requirement of the Hash function: one-way encoding/encryption with strong security. The photoelectric hybrid system designed by this method can effectively simulate the "compression function" in the Hash function. Combined with the Sobel filter with feature extraction function, the input data of arbitrary length can be compressed and encrypted into the output with a fixed length of 256-bit (Hash value). The principle of the proposed optical Hash function can be described as follows. 1) Two 8-bit images with a size of 16×16 pixels are loaded in SLM<sub>1</sub> (amplitude-only spatial modulator) and SLM<sub>2</sub> (phase-only spatial modulator) respectively. 2) The coherent wavefront is modulated by SLM<sub>1</sub> and SLM<sub>2</sub>, and then propagates on multiple scattering media. 3) A speckle pattern is recorded by CCD because of the confusion of multiple scattering media. 4) The features of the speckle pattern, which is extracted by Sobel filter, serve as the input of the next compression function. For the unpredicted and non-duplicated disorder multiple scattering media, it is tremendously difficult to determine the internal state of the multiple scattering media. Therefore, the proposed optical Hash function is considered to have a high security. A series of simulation results shows that the proposed optical Hash function has a good “avalanche effect” and “collision resistance”, and its security performance is comparable to that of the most widely used traditional Hash functions (MD5 and SHA-1).

In this paper, we present a new technique to construct a collision attack from a particular preimage attack which is called a partial target preimage attack. Since most of the recent meet-in-the-middle preimage attacks can be regarded as the partial target preimage attack, a collision attack is derived from the meet-in-the-middle preimage attack. By using our technique, pseudo collisions of the 43-step reduced SHA-256 and the 46-step reduced SHA-512 can be obtained with complexities of 2126 and 2254.5, respectively. As far as we know, our results are the best pseudo collision attacks on both SHA-256 and SHA-512 in literature. Moreover, we show that our pseudo collision attacks can be extended to 52 and 57 steps of SHA-256 and SHA-512, respectively, by combined with the recent preimage attacks on SHA-2 by bicliques. Furthermore, since the proposed technique is quite simple, it can be directly applied to other hash functions. We apply our algorithm to several hash functions including Skein and BLAKE, which are the SHA-3 finalists. We present not only the best pseudo collision attacks on SHA-2 family, but also a new insight of relation between a meet-in-the-middle preimage attack and a pseudo collision attack.

In this paper, we show that some new variants of the Very Smooth Hash (VSH) hash function are susceptible to similar types of preimage attacks as the original VSH. We also generalise the previous mathematical results, which have been used in the preimage attacks. VSH is a hash function based on the multiexponentiation of prime numbers modulo some large product of two primes. The security proof of VSH is based on some computational problems in number theory, which are related to the problem of factoring large integers. However, the preimage resistance of VSH has been studied and found somewhat lacking especially in password protection. There have been many different variants of VSH proposed by the original authors and others. Especially the discrete logarithm version of VSH has been proposed in order to make the hash values shorter. Further proposals have used the discrete logarithm in finite fields and elliptic curves to gain even more advantage to the hash length. Our results demonstrate that even for these new variants, the same ideas for preimage attacks can be applied as for the original VSH and they result in effective preimage attacks.

In this study the authors propose a new multivariate hash function with HAsh Iterative FrAmework framework which we call the hash function quadratic polynomials multiplying linear polynomials (QML). The new hash function is made of cubic polynomials which are the products of quadratic polynomials and linear polynomials. The authors design the quadratic-polynomial part of the compression function based on the centre map of the multivariate public key cryptosystem Matsumoto-Imai cryptosystem (MI). The hash function QML can keep the three cryptography properties and be immune to the pre-image attack, second pre-image attack, collision attack, differential attack and algebraic attack. The required memory storage is about 50% of the one which is built of the cubic polynomials and their coefficients are random. On the avalanche effect, by experiments the authors get the result that about one half of the output bits are different when one input bit is changed randomly. The one-round diffusion of the hash function QML is twice of that of Blake. Also the authors simplify the matrixes of the new hash function, analyse the rationality and show the comparable data. Finally, the authors give the advice to the parameters of the new hash function and summarise the paper.

The zipper hash utilizes two‐pass hashing to strengthen the iterated hash functions against the generic attack. In this paper, we analyze the features of zipper hash and several existing generic attacks on hash functions. A new tree structure called inverse‐diamond, which starts from one fixed point and ends with many points, is exploited to guarantee that the corresponding message blocks in the two passes be identical. Then, combining the inverse‐diamond structure of depth l, with the multicollision of length n – l (n is bit number of the hash value) and the (k, 2k + k − 1)‐expandable message together, we firstly present a second preimage attack on zipper hash of which the time complexity is about O((2 k + n)2n/2 + 2n − k + (n − l)2n − l + 2l + 1), less than O(2n), and the memory complexity is about O(2k + 1 + 3*2l). Specially, if k = l = n/2, then the time complexity is about O(n2n/2), and the memory complexity is about O(2n/2). Copyright © 2015 John Wiley & Sons, Ltd.

This paper evaluates the preimage resistance of the Tiger hash function. To our best knowledge, the maximum number of the attacked steps is 17 among previous preimage attacks on Tiger, where the full version has 24 steps. Our attack will extend the number of the attacked steps to 23. The main contribution is a pseudo-preimage attack on the compression function up to 23 steps with a complexity of 2181 following the meet-in-the-middle approach. This attack can be converted to a preimage attack on 23-step Tiger hash function with a complexity of 2187.5. The memory requirement of our attack is 222 words. A Tiger digest has 192bits. Therefore, our attacks are faster than the exhaustive search.

According to the order of the message words in HAVAL algorithm and the property of the function in the first pass,a preimage attack of the compression function from step 3 to step 122 was proposed by using "meeting-in-the-middle attack" and the exhaustive search method.The preimage attack on the 120-step reduced compression function was extended to the preimage attack on the 120-step reduced HAVAL by using "meeting-in-the-middle method" and the tree method respectively.The results play an important role in the evaluation of the security of hash functions.

In modern cryptography, hash functions are considered as one of the key components for secure communication. They play a vital role in a wide range of applications such as ensuring the authentication and integrity of the data, in forensic investigation, password storage, random number generations for unique session keys, and for creating a unified view in blockchain. The Avalanche effect (also known as diffusion) is an important characteristic of a hash function where a minor change in the hash function’s input will result in a significantly different output. The absence of this property implies that the hash function is vulnerable to various attacks such as collision attack, length extension attack, and preimage attack. Through this research, we have investigated the Avalanche effect of sixteen hash functions and two hash-based applications, namely Hash-based Message Authentication Code (HMAC) and Public Key Cryptography Standards (PKCS). To measure the performance of these hash functions and hash-based applications, we have implemented a generic circuit using CrypTool for automating the simulation process for multiple trials. Simulation results indicate that around half of the inputs of each hash function failed to exhibit the Strict Avalanche Criterion (SAC) and, Bit Independence Criterion (BIC). Moreover, we ranked the hash functions based on Multi Criteria Decision Metrics (MCDM) using intermediate states of simulation results. Furthermore, a total of fifteen statistical tests were carried out to evaluate the randomization property of the hash functions using NIST (National Institute of Standards and Technology) toolkit. This study is aimed to open up a future scope of research to the need for improvement of various hash functions by analyzing the randomization and non-correlation properties of existing functions in terms of the Avalanche effect.

We study the security of AES in the open-key setting by showing an analysis on hash function modes instantiating AES including Davies-Meyer, Matyas-Meyer-Oseas, and Miyaguchi-Preneel modes. In particular, we propose preimage attacks on these constructions, while most of previous work focused their attention on collision attacks or distinguishers using non-ideal differential properties. This research is based on the motivation that we should evaluate classical and important security notions for hash functions and avoid complicated attack models that seem to have little relevance in practice. We apply a recently developed meet-in-the-middle preimage approach. As a result, we obtain a preimage attack on 7 rounds of Davies-Meyer AES and a second preimage attack on 7 rounds of Matyas-Meyer-Oseas and Miyaguchi-Preneel AES. Considering that the previous best collision attack only can work up to 6 rounds, the number of attacked rounds reaches the best in terms of the classical security notions. In our attacks, the key is regarded as a known constant, and the attacks thus can work for any key length in common.KeywordsAEShash functionDavies-MeyerMatyas-Meyer-OseasMiyaguchi-PreneelPGVpreimagemeet-in-the-middleWhirlpool

We present new preimage attacks on standard Keccak-224 and Keccak-256 that are reduced to 3 and 4 rounds. An allocating approach is used in the attacks, and the whole complexity is allocated to two stages, such that fewer constraints are considered and the complexity is lowered in each stage. Specifically, we are trying to find a 2-block preimage, instead of a 1-block one, for a given hash value, and the first and second message blocks are found in two stages, respectively. Both the message blocks are constrained by a set of newly proposed conditions on the middle state, which are weaker than those brought by the initial values and the hash values. Thus, the complexities in the two stages are both lower than that of finding a 1-block preimage directly. Together with the basic allocating approach, an improved method is given to balance the complexities of two stages, and hence, obtains the optimal attacks. As a result, we present the best theoretical preimage attacks on Keccak-224 and Keccak-256 that are reduced to 3 and 4 rounds. Moreover, we practically found a (second) preimage for 3-round Keccak-224 with a complexity of \(2^{39.39}\).

In this paper we study the inversion problem of MD4 cryptographic hash function developed by R. Rivest in 1990. By MD4-k we denote a truncated variant of MD4 hash function in which k represents a number of steps used to calculate a hash value (the full version of MD4 function corresponds to MD4-48). H. Dobbertin has showed that MD4-32 hash function is not one-way, namely, it can be inverted for the given image of a random input. He suggested to add special conditions to the equations that describe the computation of concrete steps (chaining variables) of the considered hash function. These additional conditions allowed to solve the inversion problem of MD4-32 within a reasonable time by solving corresponding system of equations. The main result of the present paper is an automatic derivation of “Dobbertin’s conditions” using parallel SAT solving algorithms. We also managed to solve several inversion problems of functions of the kind MD4-k (for k from 31 up to 39 inclusive). Our method significantly outperforms previously existing approaches to solving these problems.

We propose a class of almost rate-1 construction for 2n-bit hash functions, based on (2n, n) blockciphers, where 2n is the length of the cipher key and n is the cipher block length. These hash functions we proposed are proved to be optimum collision resistance and preimage resistance in the ideal cipher model. The hash rate of the construction is l-1/l where l is the number of cipher calls in the compression function. The hash rate is closed to 1 if l is large. Compare with existing DBL hash functions based on block ciphers with optimum collision resistance and preimage resistance, they are more efficient and simpler.