Reset Indifferentiability from Weakened Random Oracle Salvages One-Pass Hash Functions

Abstract

Abstract. Ristenpart et al. showed that the limitation of the indifferentiability theorem of Maurer et al. which does not cover all multi-stage security notions Sm but covers only single-stage security notions Ss, defined reset indifferentiability, and proved the reset indifferentiability theorem, which is an analogy of the indifferentiability theorem covers all security notions S (= Ss ∪ Sm): F1 r F2 ⇒ ∀C ∈ C, ∀S ∈ S: C(F1) ≻S C(F2) (if a hash function H U is reset indifferentiable from a random oracle RO, C ∈ C which is a set of all cryptosystems is at least as S-secure in the U model as in the RO model). Unfortunately, they also proved the impossibility of H U r RO where H is a one-pass hash construction such as ChopMD and Sponge.In this paper, we will propose a new proof of molular approach instead of the RO methodology, "Reset Indifferentiability from Weakened Random Oracle", called as the WRO methodology, in order to ensure the S-security of C with H U , salvaging ChopMD and Sponge. The concrete proof procedure of the WRO methodology is as follows:1. Define a new concept of WRO instead of RO, 2. Prove that H U r WRO, (here an example of H is ChopMD and Sponge), and 3. Prove that C is S-secure in the WRO model.As a result we can prove that C with H U is S-secure by combining the results of Steps 2, 3, and the theorem of Ristenpart et al. Moreover, for public-key encryption (as cryptosystem C) and chosendistribution attack (as the game of S ∈ Sm) we will prove that C(WRO) is S-secure, which implies the appropriateness of the new concept of the WRO model.

Open problems in hash function security

“…Several research papers [12,41,81,97] attempt to come up with such definitions, but not much is known yet of what the implications of these new definitions are and which designs satisfy them. One alternative, as attempted by [12], might be to establish indifferentiability results and composition theorems for only limited classes of games.…”