Search

We cryptanalyze several symmetric encryption and hashing algorithms. A central factor in the security of symmetric cryptographic algorithms is the resistance of their core building block, the primitive, against cryptanalytic attacks such as differential, linear, and algebraic cryptanalysis. The fundamental idea of differential cryptanalysis is to extract secret information or forge malicious messages by investigating the behavior of the primitive for two related, slightly different inputs, and has proven both very powerful and highly versatile since its inception in the 1990s. Resistance against such attacks is thus one of the cornerstones in the design of block ciphers. More recently, alternative symmetric primitives have risen to general attention: Permutations and tweakable block ciphers in particular have shown the potential to rival block ciphers in their role as the ideal primitive for efficient and elegant schemes. However, the available cryptanalytic tools and theory on the design and analysis of these alternative primitives are arguably less mature than for block ciphers. We investigate the security of these primitives against differential cryptanalysis. Compared to classic block ciphers, adversaries who target permutations or tweakable block ciphers can take advantage of known, chosen, or related round-key material. We find that in some cases, the designers' block-cipher-based design strategies do not sufficiently protect against variations of the classical differential strategy. In particular, we break the full security claims of the tweakable block cipher MANTIS-5 and the permutation Simpira v1. We provide a key recovery attack for the round-reduced block cipher LowMC and analyze the authenticated cipher Prost in a related-key setting. We also develop techniques to improve the computer-aided differential analysis of unkeyed primitives, leading to the best practical collision attacks on the round-reduced hash standard SHA-2., This work was partially funded by the European Union's Horizon 2020 research and innovation programme under grant agreement number 644052 (HECTOR).

At EUROCRYPT 2004, Bellare and Kohno presented the concept of a regular hash function. For a hash function to be regular, every hash value must have the same number of preimages in the domain. The findings of their paper remained unchallenged for over six years, and made their way into several research papers and textbooks. In their paper, Bellare and Kohno claim that regular hash functions are more resistant against the birthday attack than random hash functions. We counter their arguments, by showing that the success probability of the birthday attack against a regular hash function can be made arbitrarily close to that of a random hash function (for the same number of trials). Our analysis uses the fact that the choices of the attacker can be limited to any subset of the domain. Furthermore, we prove that it is not possible to construct a hash function that is regular for only a small fraction of subsets of the domain. In order to avoid these problems, we propose to model hash functions as random functions. Compared to regular functions, we argue that the statistics of random functions are more similar to hash functions used in practice, regardless of how the attacker chooses the domain points. ispartof: pages:1-18 ispartof: pages:1-18 ispartof: ECRYPT II Hash Workshop location:Tallinn, Estonia date:19 May - 20 May 2011 status: published

We introduce tuple cryptanalysis, a variant of structural cryptanalysis techniques as square, saturation, integral, internal collision, or multiset cryptanalysis, the main difference being that tuple cryptanalysis considers ordered rather than unordered multisets. This allows cryptanalysts to better trace structural properties within a cipher's internal state. Unlike previous works that focus on S-box based algorithms, structural analysis is applied to ARX constructions, with preliminary results on reduced versions of Skein's and BLAKE's ARX cores. Due to its simplicity and effcient verification, tuple cryptanalyis can be used as a security benchmark for ARX schemes. ispartof: pages:1-13 ispartof: pages:1-13 ispartof: ECRYPT II Hash Workshop location:Tallinn, Estonia date:19 May - 20 May 2011 status: published