Security Analysis of the Mode of JH Hash Function

Abstract

Recently, NIST has selected 14 second round candidates of SHA3 competition. One of these candidates will win the competition and eventually become the new hash function standard. In TCC'04, Maurer et al introduced the notion of indifferentiability as a generalization of the concept of the indistinguishability of two systems. Indifferentiability is the appropriate notion of modeling a random oracle as well as a strong security criteria for a hash-design. In this paper we analyze the indifferentiability and preimage resistance of JH hash function which is one of the SHA3 second round candidates. JH uses a 2n bit fixed permutation based compression function and applies chopMD domain extension with specific padding.-We show under the assumption that the underlying permutations is a 2nbit random permutation, JH mode of operation with output length 2n − s bits, is indifferentiable from a random oracle with distinguisher's advantage bounded by O(q 2 σ 2 s + q 3 2 n) where σ is the total number of blocks queried by distinguisher.-We show that the padding rule used in JH is essential as there is a simple indifferentiablity distinguisher (with constant query complexity) against JH mode of operation without length padding outputting n bit digest.-We prove that a little modification (namely chopping different bits) of JH mode of operation enables us to construct a hash function based on random permutation (without any length padding) with similar bound of sponge constructions (with fixed output size) and with same efficiency.-On the other hand, we improve the preimage attack of query complexity 2 510.3 due to Mendel and Thompson. Using multicollisions in both forward and reverse direction, we show a preimage attack on JH with n = 512, s = 512 in 2 507 queries to the permutation.

Key Wrapping with a Fixed Permutation

“…However, our concept is not based on a secure PRP, as we work with a single permutation. The provable security framework for schemes employing a single permutation typically follows [2,4] the indifferentiability framework [13]. Assuming no non-trivial properties of the permutation, the designers replace it with a randomly chosen permutation and prove indistinguishability from the random oracle even though the adversary can query the randomly chosen permutation as well.…”

Improved indifferentiability security bound for the JH mode

“…Generic attacks have also been reported on hash modes other than the plain Merkle-Damgärd mode. A few of these are the 2nd pre-image attacks on the dithered variants of the Merkle-Damgärd construction [1], a pre-image attack on the JH mode [8], 1st/2nd pre-image and multi-collision attacks on the Sponge construction when the state-size is not sufficiently large [7], collision attacks on some concatenated hash functions [13], multi-collisions in iterated concatenated and expanded hash functions [12], and multi-collisions on some generalized sequential hash functions [18].…”

“…More technically, the indifferentiability framework measures the extent to which a hash function behaves as a random oracle under the assumption that the underlying small compression function is an ideal object. The class of indifferentiability attacks includes more attacks [2,8,9] than just useful generic attacks as above. Thus in some sense, an indifferentiable hash function can be viewed as eliminating potential future attacks.…”

“…Since its publication in 2007, the JH mode of operation has undergone an extensive security analysis. The first published analysis of the JH mode was done by Bhattacharyya, Mandal and Nandi, who showed that the indifferentiability security of the basic version of the JH mode up to n/3 bits [8]; 1 they have also shown a generic pre-image attack on the JH mode with (information theoretic) work which is slightly less than n bits. A year later, in [16], it was shown that the JH mode achieves the optimal collision resistance of up to n/2 bits.…”

Discrete-time interacting quantum walks and quantum Hash schemes

“…There are many theoretical studies about classical Hash functions [21,22] and mature Hash functions such as MD5, SHA1 and SHA512. Now classical Hash functions are used extensively in quantum protocols to ensure the safety of quantum communication [23,24], yet it is contradictory with the fact that the quantum computer can crack most classical Hash functions.…”