Unaligned Rebound Attack: Application to Keccak

Abstract

Abstract. We analyze the internal permutations of Keccak, one of the NIST SHA-3 competition finalists, in regard to differential properties. By carefully studying the elements composing those permutations, we are able to derive most of the best known differential paths for up to 5 rounds. We use these differential paths in a rebound attack setting and adapt this powerful freedom degrees utilization in order to derive distinguishers for up to 8 rounds of the internal permutations of the submitted version of Keccak. The complexity of the 8 round distinguisher is 2 491.47 . Our results have been implemented and verified experimentally on a small version of Keccak. This is currently the best known differential attack against the internal permutations of Keccak.

Differential Propagation Analysis of Keccak

“…Recently, new results were published on the differential resistance of this function and among those heuristic techniques were proposed to build low-weight differential trails [12,15]. These gave the currently best trails for 3, 4 and 5 rounds of the underlying permutation Keccak-f [1600].…”

Collision Attacks on Up to 5 Rounds of SHA-3 Using Generalized Internal Differentials

“…Namely, we require that there exists a low Hamming weight state u 0 ∈ [i, v 0 ] in the CP-kernel (otherwise θ will significantly increase the weight of the internal difference already in the first round). Techniques to find state differences that stay in the CP-kernel for two consecutive rounds were described in [11,14,21] in order to construct low Hamming weight classical differential characteristics. Here, we use these techniques in a straightforward way in order to construct low Hamming weight internal differential characteristics that fulfill the two constraints: As done in several previous paper which analyze standard differential characteristics of Keccak, we first assume that the χ mappings act as an identity on the input internal differences (this is typically possible when the input internal difference is of low weight).…”

New Attacks on Keccak-224 and Keccak-256

“…However, extending such a characteristic to more rounds in a similar way is more challenging, since we have to ensure that the state differential before the application of θ remains in the CP-kernel at the beginning of each round. In [9] and [14], the authors propose algorithms for constructing low Hamming weight differential characteristics for Keccak. Both of these algorithms successfully find differential characteristics that stay in the CP-kernel for 2 rounds (named double kernel trails in [14]), some of which lead to collisions on the n-bit extract taken from the final state after 2 rounds, with high probability.…”

“…Our attacks on round-reduced Keccak make use of the type of differential characteristics that were found in [9] and [14], namely low Hamming weight characteristics that stay in the CP-kernel for 2 rounds. The double kernel trails with the highest probability have Hamming weight of 6 at the input to the initial round, and due to their low hamming weight, we could easily find all these characteristics within a minute on a standard PC.…”

“…Since the characteristics that we use start with a low Hamming weight state difference, we can extend them backwards by one round without reducing their probability significantly (as done in [9]): we take this low Hamming weight initial state difference, and choose a valid state difference input to the previous Sbox layer which could produce it. We then apply L −1 , and obtain a new initial state difference for the extended characteristic, which serves as a target difference for our new algorithm.…”