Collision Attacks on Up to 5 Rounds of SHA-3 Using Generalized Internal Differentials

Abstract

Abstract. On October 2-nd 2012 NIST announced its selection of the Keccak scheme as the new SHA-3 hash standard. In this paper we present the first published collision finding attacks on reduced-round versions of Keccak-384 and Keccak-512, providing actual collisions for 3-round versions, and describing an attack which is 2 45 times faster than birthday attacks for 4-round Keccak-384. For Keccak-256, we increase the number of rounds which can be attacked to 5. All these results are based on a generalized internal differential attack (introduced by Peyrin at Crypto 2010), and use it to map a large number of Keccak inputs into a relatively small subset of possible outputs with a surprisingly large probability. In such a squeeze attack it is easier to find random collisions in the reduced target subset by a standard birthday argument.

Cube Attacks and Cube-Attack-Like Cryptanalysis on the Round-Reduced Keccak Sponge Function

“…Considering attacks that break core security properties of the keyless, hashing mode, much faster than exhaustive search, the best result is 5 rounds [13]. As we can break up to 9 rounds of the keyed variants, the conclusion from our analysis is that the security margin of Keccak is somewhat reduced in the keyed modes.…”

Preserving Forward Anonymity on Dynamic ID based Remote User Authentication Scheme

“…Since the probability for obtaining the inverse of a hash is less than is less than the probability for obtaining the collision Preserving Forward Anonymity on Dynamic ID based Remote User attack, then in this case the probability for obtaining the collision attack should be observed. Suppose keccak-256 is used, then it can be attacked by methods which were proposed by Dinur et al [9,14], Naya-Plasencia et al [13], Kolbl et al [15] and Daemen et al [17]. Assume that the attacker used an attack proposed by Daemen et al [17] with probability of 2 -296 , in the 24-round collision attack, then the probability of obtaining the collision is equal to 2 -296 [17].Since the probability of obtaining the inverse of a hash value is always less than the probability for obtaining its collision, then the probability for obtaining the inverse of Keccak hash value is less than 2 -296 .…”

ICEPOLE: High-Speed, Hardware-Oriented Authenticated Encryption

“…Internal differentials The best collision attack against Keccak was obtained through the technique called internal differentials [13]. While in standard differential attacks we consider two different plaintexts, in internal differential attacks only one plaintext is considered, and the statistical evolution of the differences between its parts is followed.…”

“…Without κ all rounds of the permutation P would be equal making it subject to attacks exploiting symmetry such as slide attacks [10]. The constants used in Keccak have very low Hamming weight and this feature was exploited in two cryptanalytic attacks [13,22] against the round-reduced Keccak. These results motivated us to introduce constants with much higher Hamming weight.…”

“…This decision has been motivated by cryptanalysis on the round-reduced Keccak where two different techniques [13,22] have exploited the fact the state is initialized with the all-zero maintaining many different symmetries.…”