Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 Hash Function

Michał Trojnara

Institute of TelecommunicationsFaculty of Electronics and Information Technology

Warsaw University of Technology

26 May 2010

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

Outline

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

History of StreamHash Family

Jan 2007 NIST published draft of requirements for theSHA-3 competition

Nov 2007 NIST requested submissions for new hashfunctions

Oct 2008 StreamHash function submitted for the SHA-3competition

Dec 2008 StreamHash function published by NISTDec 2008 Published attacks against StreamHash function

2009-2010 Working on the successor – StreamHash2

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Preimage Attack

Dmitry Khovratovich and Ivica Nikolic, University ofLuxembourgMulticollision Attack (Antoine Joux: Multicollisions inIterated Hash Functions, CRYPTO 2004)

Complexity of n2 · 2

n/4 for finding collisionsComplexity of n

2 · 2n/2 for finding preimages

Issue addressed in StreamHash2 by introducing a counter

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Preimage Attack

Dmitry Khovratovich and Ivica Nikolic, University ofLuxembourgMulticollision Attack (Antoine Joux: Multicollisions inIterated Hash Functions, CRYPTO 2004)

Complexity of n2 · 2

n/4 for finding collisionsComplexity of n

2 · 2n/2 for finding preimages

Issue addressed in StreamHash2 by introducing a counter

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Preimage Attack

Dmitry Khovratovich and Ivica Nikolic, University ofLuxembourgMulticollision Attack (Antoine Joux: Multicollisions inIterated Hash Functions, CRYPTO 2004)

Complexity of n2 · 2

n/4 for finding collisionsComplexity of n

2 · 2n/2 for finding preimages

Issue addressed in StreamHash2 by introducing a counter

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Collision Attack

Tor E. Bjørstad, Department of Informatics, University ofBergen, NorwayInternal state cyclesThe ⊕ operation of StreamHash did not propagatechanges between the four bytes of the 32-byte state wordIssue addressed by replacing ⊕ operation with �

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Collision Attack

Tor E. Bjørstad, Department of Informatics, University ofBergen, NorwayInternal state cyclesThe ⊕ operation of StreamHash did not propagatechanges between the four bytes of the 32-byte state wordIssue addressed by replacing ⊕ operation with �

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

HistoryPrior Cryptanalysis

Collision Attack

Tor E. Bjørstad, Department of Informatics, University ofBergen, NorwayInternal state cyclesThe ⊕ operation of StreamHash did not propagatechanges between the four bytes of the 32-byte state wordIssue addressed by replacing ⊕ operation with �

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Functional Requirements

Hash function h(m) is expected to meet the followingrequirements

Input m can be of any lengthOutput of h(m) has a predefined, fixed lengthh(m) is fast to compute for any given m

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Functional Requirements

Hash function h(m) is expected to meet the followingrequirements

Input m can be of any lengthOutput of h(m) has a predefined, fixed lengthh(m) is fast to compute for any given m

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Functional Requirements

Hash function h(m) is expected to meet the followingrequirements

Input m can be of any lengthOutput of h(m) has a predefined, fixed lengthh(m) is fast to compute for any given m

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Security Requirements

Preimage resistancePractically infeasible for any given h(m) to compute mSecond preimage resistancePractically infeasible for any given m1 message it isinfeasible to find another m2 such that h(m1) = h(m2)

Collision resistancePractically infeasible to find two different messages m1 andm2 such that h(m1) = h(m2)

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Security Requirements

Preimage resistancePractically infeasible for any given h(m) to compute mSecond preimage resistancePractically infeasible for any given m1 message it isinfeasible to find another m2 such that h(m1) = h(m2)

Collision resistancePractically infeasible to find two different messages m1 andm2 such that h(m1) = h(m2)

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Security Requirements

Preimage resistancePractically infeasible for any given h(m) to compute mSecond preimage resistancePractically infeasible for any given m1 message it isinfeasible to find another m2 such that h(m1) = h(m2)

Collision resistancePractically infeasible to find two different messages m1 andm2 such that h(m1) = h(m2)

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Merkle-Damgård Construction

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

RequirementsTraditional Design

Davies-Meyer Compression Function

Hi ← Emi (Hi−1)⊕ Hi−1

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

State Vector

State vector consists of 32-bit words7× 32 = 224 bits8× 32 = 256 bits12× 32 = 384 bits16× 32 = 512 bits

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

NLF Transformation

NLF is a non-linear transformation based on an S-BOX

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

StreamHash Family Structure

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

NLF Implementation of StreamHash2 Function

statei+1 ← statei � S-BOX [LSB(statei)⊕ b ⊕ i] � c

, where:b processed byte valuec processed byte indexi state vector index

S-BOX S-BOX tablestate state vector

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Next Section

1 Origins of StreamHash FamilyHistoryPrior Cryptanalysis

2 Hash FunctionsRequirementsTraditional Design

3 StreamHash2StreamHash2 DesignProperties

4 Conclusion

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Simplicity

Clear and easy to analyze designMinimal size of codeMinimal size of variablesLow size of static dataFlexible hash value length

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Simplicity

Clear and easy to analyze designMinimal size of codeMinimal size of variablesLow size of static dataFlexible hash value length

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Simplicity

Clear and easy to analyze designMinimal size of codeMinimal size of variablesLow size of static dataFlexible hash value length

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Simplicity

Clear and easy to analyze designMinimal size of codeMinimal size of variablesLow size of static dataFlexible hash value length

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Simplicity

Clear and easy to analyze designMinimal size of codeMinimal size of variablesLow size of static dataFlexible hash value length

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Performance

Easy to parallelize internal structureNegligible performance impact of machine endiannessHigh performance on 8-bit and 16-bit architecturesLow latencyHigh throughput for short messages

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Performance

Easy to parallelize internal structureNegligible performance impact of machine endiannessHigh performance on 8-bit and 16-bit architecturesLow latencyHigh throughput for short messages

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Performance

Easy to parallelize internal structureNegligible performance impact of machine endiannessHigh performance on 8-bit and 16-bit architecturesLow latencyHigh throughput for short messages

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Performance

Easy to parallelize internal structureNegligible performance impact of machine endiannessHigh performance on 8-bit and 16-bit architecturesLow latencyHigh throughput for short messages

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

Streamhash2 Advantages – Performance

Easy to parallelize internal structureNegligible performance impact of machine endiannessHigh performance on 8-bit and 16-bit architecturesLow latencyHigh throughput for short messages

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

StreamHash2 Disadvantages

Expensive hardware implementationSide-channel attacks on S-BOX lookupsMathematical background not well studied in cryptographicapplications

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

StreamHash2 Disadvantages

Expensive hardware implementationSide-channel attacks on S-BOX lookupsMathematical background not well studied in cryptographicapplications

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

StreamHash2 DesignProperties

StreamHash2 Disadvantages

Expensive hardware implementationSide-channel attacks on S-BOX lookupsMathematical background not well studied in cryptographicapplications

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

Conclusion

A new family of cryptographic hash functions was proposedSecurity properties of this new family require some furtheranalysis

Michał Trojnara StreamHash2 Hash Function

Origins of StreamHash FamilyHash Functions

StreamHash2Conclusion

Conclusion

A new family of cryptographic hash functions was proposedSecurity properties of this new family require some furtheranalysis

Michał Trojnara StreamHash2 Hash Function