Security Analysis of Zipper Hash Against Multicollisions Attacks

Cryptographic Primitives that Resist Backdooring and Subversion

In this paper, we clarify the security of practical cryptosystems with hash functions based on key derivation functions (KDFs). We use the indifferentiability framework in order to discuss the security because the indifferentiability from Random Oracle (and its variants) guarantees that cryptosystems remain secure even if Random Oracles (ROs) are instantiated with hash functions. Though previous works on the indifferentiability of Merkle-Damgård (MD) hash functions focus on stand-alone hash functions, there is no work which focuses on MD hash functions with KDFs. Many cryptosystems need longer output lengths of hash functions than stand-alone hash functions and KDFs are used to generate longer digests as specified in PKCS #1 v2.1 and IEEE P1363. Specifically, we obtain the following results. We denote the MD hash function using Stam’s type-II compression function by MD-SCFII and MD-SCFII with KDFs by KDF-MD-SCFII. Cryptosystems secure in the pub-RO model (FDH, PSS, Fiat-Shamir, and so on): Dodis et al. proposed the indifferentiability from pub-RO to prove the security of these cryptosystems using MD-SCFII while did not consider the KDF structures. So we propose a different framework, indifferentiability from privleak-RO. Using this framework and their result, we show that these cryptosystems using KDF-MD-SCFIIs are secure. Encryption schemes secure in the RO model (OAEP, RSA-KEM, PSEC-KEM, ECIES-KEM and so on): The encryption schemes are secure in the “fixed inputl length” RO model because the input lengths of ROs from the encryption schemes are fixed. We show that this fact guarantees the security of the encryption schemes using KDF-MD-SCFII. KeywordsHash FunctionEncryption SchemeRandom OracleCompression FunctionRandom Oracle ModelThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

We present a new tighter security proof for unbounded hash tree keyless signature (time-stamping) schemes that use Merkle-Damgård (MD) hash functions with Preimage Aware (PrA) compression functions. It is known that the PrA assumption alone is insufficient for proving the security of unbounded hash tree schemes against back-dating attacks. We show that many known PrA constructions satisfy a stronger Bounded Pre-Image Awareness (BPrA) condition that assumes the existence of an extractor \(\mathcal{E}\) that is bounded in the sense that for any efficiently computable query string α, the number of outputs y for which \(\mathcal{E}(y,\alpha)\) succeeds does not exceed the number of queries in α. We show that blockcipher based MD-hash functions with rate-1 compression functions (such as Davies-Meyer and Miyaguchi-Preneel) of both type I and type II are BPrA. We also show that the compression function of Shrimpton-Stam that uses non-compressing components is BPrA. The security proof for unbounded hash-tree schemes is very tight under the BPrA assumption. In order to have 2s-security against back-dating, the hash function must have n = 2s + 4 output bits, assuming that the security of the hash function is close to the birthday barrier, i.e. that there are no structural weaknesses in the hash function itself. Note that the previous proofs that assume PrA gave the estimation n = 2s + 2 log2 C + 2, where C is the maximum allowed size of the hash tree. For example, if s = 100 (2100-security) and C = 260, the previous proofs require n = 322 output bits, while the new proof requires n = 204 output bits.KeywordsHash FunctionSuccess ProbabilityBlock CipherRandom OracleCompression FunctionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Higher order eTCR hash functions

Addition of hash component in a message is always for verification of authentication of message without integrity. In order to retain integrity certain schemes such as Merkle–Damgard scheme or Rabin scheme based on the block cipher can be used. However, the block cipher schemes in messages do not get applicable on image which are encoding message in a visual format. Therefore, block cipher based schemes are not able to provide tamper localization in case of image authentication. Tamper detection is needed in case of images as it is not visualized without proper verification. Moreover, localization is not possible by hash verification making the authentication processes only detectable but not identifiable. The paper presents a generation process of three least significant bits of hash function. The image insertion is not visualized due to human eye limitation. The method proposed is able to embed a secret image (gray scale) inside a corner image. Experimental results show an improvement in peak signal-to-noise ratio (PSNR) values of the proposed technique over the other techniques available, such as hash-based LSB(2-3-3) image steganography in spatial domain. This paper proposes an image authentication process not only for robustness, security, and tamper detection but also successfully able to identify tamper by a process of tamper localization. The parameters compared include the classical mechanism along with newly introduced entropy measurement of images. A performance analysis is able to show the result claimed in the paper. The paper uses a least significant bit (LSB) based hash function, which is a blind technique as image-related information is never sent to receiver separately. In fact, the proposed approach is a clever design as the generated hash function will be embedded in the image itself. The proposed mechanism is able to offer good imperceptibility between original image and embedded image with hash bits. Even a minute tampering can be detected with proper localization; the localization of tampering is having its wide applicability in case of forensic evidence of malicious image morphing.

Semantic hashing represents documents as compact binary vectors (hash codes) and allows both efficient and effective similarity search in large-scale information retrieval. The state of the art has primarily focused on learning hash codes that improve similarity search effectiveness, while assuming a brute-force linear scan strategy for searching over all the hash codes, even though much faster alternatives exist. One such alternative is multi-index hashing, an approach that constructs a smaller candidate set to search over, which depending on the distribution of the hash codes can lead to sub-linear search time. In this work, we propose Multi-Index Semantic Hashing (MISH), an unsupervised hashing model that learns hash codes that are both effective and highly efficient by being optimized for multi-index hashing. We derive novel training objectives, which enable to learn hash codes that reduce the candidate sets produced by multi-index hashing, while being end-to-end trainable. In fact, our proposed training objectives are model agnostic, i.e., not tied to how the hash codes are generated specifically in MISH, and are straight-forward to include in existing and future semantic hashing models. We experimentally compare MISH to state-of-the-art semantic hashing baselines in the task of document similarity search. We find that even though multi-index hashing also improves the efficiency of the baselines compared to a linear scan, they are still upwards of 33% slower than MISH, while MISH is still able to obtain state-of-the-art effectiveness.

With the increasing amount of multimedia data, cross-modality hashing has made great progress as it achieves sub-linear search time and low memory space. However, due to the huge discrepancy between different modalities, most existing cross-modality hashing methods cannot learn unified hash codes and functions for modalities at the same time. The gap between separated hash codes and functions further leads to bad search performance. In this paper, to address the issues above, we propose a novel end-to-end Deep Unified Cross-Modality Hashing method named DUCMH, which is able to jointly learn unified hash codes and unified hash functions by alternate learning and data alignment. Specifically, to reduce the discrepancy between image and text modalities, DUCMH utilizes data alignment to learn an auxiliary image to text mapping under the supervision of image-text pairs. For text data, hash codes can be obtained by unified hash functions, while for image data, DUCMH first maps images to texts by the auxiliary mapping, and then uses the mapped texts to obtain hash codes. DUCMH utilizes alternate learning to update unified hash codes and functions. Extensive experiments on three representative image-text datasets demonstrate the superiority of our DUCMH over several state-of-the-art cross-modality hashing methods.

In CRYPTO’89, Merkle presented three double-block-length hash functions based on DES. They are optimally collision resistant in a black-box model, that is, the time complexity of any collision-finding algorithm for them is Ω(2l/2) if DES is a random block cipher, where l is the output length. Their drawback is that their rates are low. In this article, new double-block-length hash functions with higher rates are presented which are also optimally collision resistant in the black-box model. They are composed of block ciphers whose key length is twice larger than their block length.

Hashing has been used for decades in many fields such as encryption, password verification, and pattern search. Hash systems consist mainly of three components: the hash function, the hash table, and the linked lists that are attached to the hash table. One of the major benefits of using a hash function is reduction in the runtime of the hash-based software systems. However, their linked lists are a major source of time consumption. In this paper, an innovative method is proposed to remove all the linked lists attached to the hash table and collect the necessary information in a one-dimensional array. The method can be used to create an index for the human genome. The human genome is the size of a million-page book with no index, and it is difficult to find the needed information. The proposed method transforms list search operations with linear time complexity into array searches with logarithmic time complexity. In a sample problem, finding inversions in genomic sequences, the proposed indexing system is compared with traditional hashing systems with linked lists. It is demonstrated that, in addition to time complexity reduction, the proposed method reduces the space required for the hash system to one half of what is used by linked list based methods.

RIPEMD-160 is a hash function published in 1996, which shares similarities with other hash functions designed in this time-period like MD4, MD5 and SHA-1. However, for RIPEMD-160, no (semi-free-start) collision attacks on the full number of steps are known. Hence, it is still used, e.g., to generate Bitcoin addresses together with SHA-256, and is an ISO/IEC standard. Due to its dual-stream structure, even semifree- start collision attacks starting from the first step only reach 36 steps, which were firstly shown by Mendel et al. at Asiacrypt 2013 and later improved by Liu, Mendel and Wang at Asiacrypt 2017. Both of the attacks are based on a similar freedom degree utilization technique as proposed by Landelle and Peyrin at Eurocrypt 2013. However, the best known semi-free-start collision attack on 36 steps of RIPEMD-160 presented at Asiacrypt 2017 still requires 255.1 time and 232 memory. Consequently, a practical semi-free-start collision attack for the first 36 steps of RIPEMD-160 still requires a significant amount of resources. Considering the structure of these previous semi-free-start collision attacks for 36 steps of RIPEMD-160, it seems hard to extend it to more steps. Thus, we develop a different semi-free-start collision attack framework for reduced RIPEMD-160 by carefully investigating the message expansion of RIPEMD-160. Our new framework has several advantages. First of all, it allows to extend the attacks to more steps. Second, the memory complexity of the attacks is negligible. Hence, we were able to mount semi-free-start collision attacks on 36 and 37 steps of RIPEMD-160 with practical time complexity 241 and 249 respectively. Additionally, we describe semi-free-start collision attacks on 38 and 40 (out of 80) steps of RIPEMD-160 with time complexity 252 and 274.6, respectively. To the best of our knowledge, these are the best semi-free-start collision attacks for RIPEMD-160 starting from the first step with respect to the number of steps, including the first practical colliding message pairs for 36 and 37 steps of RIPEMD-160.

Discrete aggregation hashing for image set classification

Hash functions have a space complexity of O(n) and a possible time complexity of 0(1). Thus, packet classifiers exploit hashing to achieve packet classification in wire speed. Especially evolvable hash functions can adapt to a changing classification data base. But hash functions do have an important flaw. Some of the hashed keys may result in a large number of collisions. If those keys occur frequently, overall performance of a hash based packet classifier suffers. Although there is only limited or no existing locality in the data to be computed by a packet classifier, utilizing a cache can solve this problem. Unlike classical caches known from microprocessors, which are not adequate for packet classification and lookup algorithms, the proposed cache bases on a different strategy. It caches only the keys producing the most collisions instead of the ones that occur most often. That way, a cache improves the worst case performance of a hash function-based classifier. Based on simulation results, we show that even the mean performance improves significantly.

Maelstrom-0 is the second member of a family of AES-based hash functions whose designs are pioneered by Paulo Baretto and Vincent Rijmen. According to its designers, the function is designed to be an evolutionary lightweight alternative to the ISO standard Whirlpool. In this paper, we study the preimage resistance of the Maelstrom-0 hash function using its proposed 3CM chaining construction. More precisely, we apply a meet-in-the-middle preimage attack on the compression function and combine it with a guess and determine approach which allows us to obtain a 6-round pseudo preimage for a given compression function output with time complexity of 2496 and memory complexity of 2112. Then, we propose a four stage attack in which we adopt another meet-in-the-middle attack and a 2-block multicollision approach to defeat the two additional checksum chains and turn the pseudo preimage attack on the compression function into a preimage attack on the hash function. Using our approach, preimages of the 6-round reduced Maelstrom-0 hash function are generated with time complexity of 2505 and memory complexity of 2112.

The zipper hash utilizes two‐pass hashing to strengthen the iterated hash functions against the generic attack. In this paper, we analyze the features of zipper hash and several existing generic attacks on hash functions. A new tree structure called inverse‐diamond, which starts from one fixed point and ends with many points, is exploited to guarantee that the corresponding message blocks in the two passes be identical. Then, combining the inverse‐diamond structure of depth l, with the multicollision of length n – l (n is bit number of the hash value) and the (k, 2k + k − 1)‐expandable message together, we firstly present a second preimage attack on zipper hash of which the time complexity is about O((2 k + n)2n/2 + 2n − k + (n − l)2n − l + 2l + 1), less than O(2n), and the memory complexity is about O(2k + 1 + 3*2l). Specially, if k = l = n/2, then the time complexity is about O(n2n/2), and the memory complexity is about O(2n/2). Copyright © 2015 John Wiley & Sons, Ltd.

Digital forensics is a branch of Computer Science aiming at investigating and analyzing electronic devices in the search for crime evidence. There are several ways to perform this search. Known File Filter (KFF) is one of them, where a list of interest objects is used to reduce/separate data for analysis. Holding a database of hashes of such objects, the examiner performs lookups for matches against the target device. However, due to limitations over hash functions (inability to detect similar objects), new methods have been designed, called approximate matching. This sort of function has interesting characteristics for KFF investigations but suffers mainly from high costs when dealing with huge data sets, as the search is usually done by brute force. To mitigate this problem, strategies have been developed to better perform lookups. In this paper, we present the state of the art of similarity digest search strategies, along with a detailed comparison involving several aspects, as time complexity, memory requirement, and search precision. Our results show that none of the approaches address at least these main aspects. Finally, we discuss future directions and present requirements for a new strategy aiming to fulfill current limitations.