Search

This paper presents ongoing work toward analysis of a second round SHA-3 candidate Luffa. This article analyses the collision resistance of reduced-round versions of Luffa-256 v2 which is the 256-bit hash function in the Luffa family. This paper focuses on the hash function security. To the best of our knowledge, this is the first collision analysis for fixed initial vector of Luffa. We show that collisions for 4 out of 8 steps of Luffa-256 v2 can be found with complexity 290 using sophisticated message modification techniques.

In this paper, a higher order differential attack on the hash function Luffa v1 is discussed. We confirmed that the algebraic degree of the permutation Qj which is an important non-linear component of Luffa grows slower than an ideal case both by the theoretical and the experimental approaches. According to our estimate, we can construct a distinguisher for step-reduced variants of Luffa v1 up to 7 out of 8 steps by using a block message. The attack for 7 steps requires 2216 messages. As far as we know, this is the first report which investigates the algebraic property of Luffa v1. Besides, this attack does not pose any threat to the security of the full-step of Luffa v1 nor Luffa v2.

We present a second preimage attack on SHAMATA-512, which is a hash function of 512-bit output and one of the first round candidates of the SHA-3 competition. The attack controls several message blocks to fix some variables of internal state and uses a meet-in-the-middle approach to find second preimages. The time complexity is about 2452.7 computations of the step function and the memory complexity is about 2451.4 blocks of 128 bits.

This paper describes a new compression function, MAME designed for hardware-oriented hash functions which can be used in applications with reduced hardware requirements. MAME takes a 256-bit message block and a 256-bit chaining variable as input and produces a 256-bit output. In the light of recent attacks on MD5 and SHA-1, our design strategy is very conservative, and we show that our compression function is secure against various kinds of widely known attacks with very large security margins. The simple logical operations and the hardware efficient S-boxes are used to achieve a hardware implementation of MAME requiring only 8.1 Kgates on 0.18 μmtechnology.

SOBER-128 is a stream cipher designed by Rose and Hawkes in 2003. It can be also uses for generating Message Authentication Codes (MACs). The developers claimed that it is difficult to forge the MAC generated by SOBER-128, though, the security model defined in the proposal paper is not realistic. In this paper, we examine the security of the MAC generation function of SOBER-128 under the security notion given by Bellare and Namprempre. As a result, we show the MAC generation function of SOBER-128 is vulnerable against differential cryptanalysis. The success probability of this attack is estimated at 2− − 6.

SNOW 2.0 was developed by Johansson and Ekdahl in 2002, as a modified version of SNOW 1.0. In this paper we present the application of linear (masking) attack to SNOW 2.0 stream cipher. Our attack requires 2225 output words (2230 bits) and 2225 steps of analysis to distinguish the output of SNOW 2.0 from a truly random bit sequence.

We present a new keystream generator (KSG) MUGI, which is a variant of Panama proposed at FSE '98. MUGI has a 128-bit secret key and a 128-bit initial vector as parameters and generates a 64-bit string per round. The design is particularly suited for efficient hardware implementations, but the software performance of MUGI is excellent as well. A speed optimized implementation in hardware achieves about 3 Gbps with 26 Kgates, which is several times faster than AES. On the other hand the security was evaluated according to re-synchronization attack, related-key attack, and linear correlation of an output sequence. Our analysis confirms that MUGI is a secure KSG.