Security Analysis of SHA-256 and Sisters

Gilbert, Henri; Handschuh, Helena

doi:10.1007/978-3-540-24654-1_13

Cited by 200 publications

(120 citation statements)

References 18 publications

Supporting

Mentioning

119

Contrasting

Unclassified

Order By: Relevance

“…Being standardized by NIST in 2000 [13], the first published independent analysis of members of the SHA-2 family was done by Gilbert and Handschuh [6]. They show that there exists a 9-step local collision with probability 2 −66 .…”

Section: Survey Of Existing Results On Sha-256mentioning

confidence: 99%

“…In the case of the Boolean functions f IF and f M AJ , several approximations are possible which all hold with probability 0.5. Superficially comparing the results in [7] and [6] 1 would lead to the preliminary conclusion that the notion of modular differences instead of XOR differences offers a significant advantage. However, we argue that this is not the case.…”

Section: Description Of Sha-256mentioning

confidence: 99%

“…However, we argue that this is not the case. Using the XOR differences as presented in [6] and looking at possible characteristics for a local collision, we estimate that the probability of a single local collision (depending on the bit position of the perturbation) can be higher than 2 −39 . This is by assuming unknown state variables at the beginning of the local collision.…”

Section: Description Of Sha-256mentioning

confidence: 99%

“…The first perturbations start at step 5, and there are 23 of them in total. The local collision for SHA-256 as originally described in [6] needs 24 single-bit differences in the message. Using this as an upper bound, we would expect up to 552 single-bit differences in the expanded messages.…”

Section: Example Of a Collision-producing L-characteristic For 19-stementioning

confidence: 99%

See 3 more Smart Citations

Analysis of Step-Reduced SHA-256

Mendel

Pramstaller

Rechberger

et al. 2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. This is the first article analyzing the security of SHA-256 against fast collision search which considers the recent attacks by Wang et al. We show the limits of applying techniques known so far to SHA-256. Next we introduce a new type of perturbation vector which circumvents the identified limits. This new technique is then applied to the unmodified SHA-256. Exploiting the combination of Boolean functions and modular addition together with the newly developed technique allows us to derive collision-producing characteristics for step-reduced SHA-256, which was not possible before. Although our results do not threaten the security of SHA-256, we show that the low probability of a single local collision may give rise to a false sense of security.

show abstract

Section: Survey Of Existing Results On Sha-256mentioning

confidence: 99%

Section: Description Of Sha-256mentioning

confidence: 99%

Section: Description Of Sha-256mentioning

confidence: 99%

Section: Example Of a Collision-producing L-characteristic For 19-stementioning

confidence: 99%

See 2 more Smart Citations

Analysis of Step-Reduced SHA-256

Mendel

Pramstaller

Rechberger

et al. 2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Known Results for the SHA-2 Family: Gilbert and Handschuh (GH) [2] were the first to study local collisions in the SHA-2 family. They reported a 9-step local collision for linearized version of SHA-256 and estimated the probability of the differential path to be 2 −66 .…”

Section: Introductionmentioning

confidence: 99%

Non-linear Reduced Round Attacks against SHA-2 Hash Family

Sanadhya

Sarkar

Information Security and Privacy

View full text Add to dashboard Cite

Abstract. Most of the attacks against (reduced) SHA-2 family in literature have used local collisions which are valid for linearized version of SHA-2 hash functions. Recently, at FSE '08, an attack against reduced round SHA-256 was presented by Nikolić and Biryukov which used a local collision which is valid for the actual SHA-256 function. It is a 9-step local collision which starts by introducing a modular difference of 1 in the two messages. It succeeds with probability roughly 1/3. We build on the work of Nikolić and Biryukov and provide a generalized nonlinear local collision which accepts an arbitrary initial message difference. This local collision succeeds with probability 1. Using this local collision we present attacks against 18-step SHA-256 and 18-step SHA-512 with arbitrary initial difference. Both of these attacks succeed with probability 1. We then present special cases of our local collision and show two different differential paths for attacking 20-step SHA-256 and 20-step SHA-512. One of these paths is the same as presented by Nikolić and Biryukov while the other one is a new differential path. Messages following both these differential paths can be found with probability 1. This improves on the previous result where the success probability of 20-step attack was 1/3. Finally, we present two differential paths for 21-step collisions for SHA-256 and SHA-512, one of which is a new path. The success probability of these paths for SHA-256 is roughly 2 −15 and 2 −17 which improves on the 21-step attack having probability 2 −19 reported earlier. We show examples of message pairs following all the presented differential paths for up to 21-step collisions in SHA-256. We also show first real examples of colliding message pairs for up to 20-step reduced SHA-512.

show abstract

Trusted Communication in the Healthcare Sector Using Blockchain

Balasamy¹

2022

Internet of Healthcare Things

View full text Add to dashboard Cite

Security Analysis of SHA-256 and Sisters

Cited by 200 publications

References 18 publications

Analysis of Step-Reduced SHA-256

Analysis of Step-Reduced SHA-256

Non-linear Reduced Round Attacks against SHA-2 Hash Family

Trusted Communication in the Healthcare Sector Using Blockchain

Contact Info

Product

Resources

About