The SHA-3 Process. Keccak & SHA-3 day Brussels, 27 March 2013
|
|
|
- Marion Thomas
- 5 years ago
- Views:
Transcription
1 The SHA-3 Process Keccak & SHA-3 day Brussels, 27 March 2013
2 Timeline Summer 2005: Attacks on MD5, RIPEMD, SHA-0, SHA-1
3 The Wang effect Before 2005 MD4 (Dobbertin) MD5 (Boss., Den Boer) SHA (Chabaud-Joux) SHA-1 SHA-2 After Wang MD4 (seconds) MD5 (hours) SHA (days) SHA-1 (months (?)) SHA-2 (?) We need a competition like for the AES!
4 Timeline Nov 2005: 1 st NIST workshop Aug 2006: 2 nd NIST workshop Nov 2007: Start of the competition
5 NIST call: requirements To support 3 digest lengths: 256, 384, 512 Should work with HMAC Resistance against collision, preimage attacks, Length extension attacks, Look random Sufficiently different from SHA-2 Let the games begin
6 Timeline Oct 2008: End of submission (64) Dec 2008: Start of round 1 (51) Feb 2009: 1 st SHA-3 candidate conference
7 Submissions CDC
8 The battlefield CDC
9 Round 1 victims (+ Round 0) ehash.iaik.tugraz.at/wiki/the_sha-3_zoo
10 Timeline July 2009: Start of round 2 (14) Aug 2010: 2 nd SHA-3 candidate conference
11 Round 2 victims
12 Timeline Dec 2010: Start of round 3 (5)
13 The 5 finalists Blake JP Aumasson, L Henzen, W Meier, RCW Phan Grøstl JH P Gauravaram, LR Knudsen, K Matusiewicz, F Mendel, C Rechberger, M Schläffer, SS Thomsen H Wu Keccak G Bertoni, J Daemen, M Peeters, G Van Assche Skein N Ferguson, S Lucks, B Schneier, D Whiting, M Bellare, T Kohno, J Callas, J Walker
14 Blake Local wide-pipe Round function inspired by Salsa, Chacha 14/16 rounds
15 Blake G 0 G 2 G 5 v 0 v 1 v 2 v 3 v 1 G 4 v 0 v5 v 2 v 3 v 4 v 5 v 6 v 7 v 4 v6 v 7 v 8 v 9 v 10 v 11 v 8 v9 v 10 v 11 v 12 v 13 v 14 v 15 v 12 v13 v 14 v15 G 1 G 3 G 6 G 7
16 Blake G-function (1/8-round) c r (2i+1) c r (2i) m r (2i) m r (2i+1) a a b >>> 12 >>> 7 b c c d >>> 16 >>> 8 d
17 Blake features ARX Many rounds and fast Learned from mistakes in Lake
18 Grøstl 10/14 rounds
19 AESsy operations MixBytes ShiftBytes SubBytes
20 Grøstl features Substitution-Permutation Network Fast when AES instructions available Permutation-based design Problem with internal differential attack Solved by tweak
21 JH H (i 1) M (i) E d M (i) H (i)
22 JH S S S S S S S S S S S S S S S S L L L L L L L L S S S S S S S S S S S S S S S S L L L L L L L L S S S S S S S S S S S S S S S S L L L L L L L L 4-bit S-boxes (2) 2-input MDS layer
23 JH more rounds 17/42
24 JH features ShiftRows different from AES Bounds on characteristics Comparatively low speed Rebound attack on full function (42 rounds) Distinguisher
25 Keccak Sponge 24 rounds
26 Keccak state 5 x 5 x 2/4/ /64 bit
27 Keccak round steps y z z x
28 Keccak features Sponge: permutation-based Resembles 3D Cellular Automata Speed: in the middle
29 Skein: Unique Block Iteration (UBI) Mode of operation for a tweakable block cipher
30 Skein: Threefish <<< 46 <<< 36 <<< 19 <<< 37 <<< 33 <<< 27 <<< 14 <<< 42 <<< 17 <<< 49 <<< 36 <<< 39 <<< 44 <<< 9 <<< 54 <<< rounds
31 Skein features ARX Very many rounds and fast Threefish is very different from Blowfish, Twofish
32 Speed
33 ebash figures (long messages)
34 ebash figures (short messages)
35 ebash speed conclusions Skein and BLAKE are the fastest Grøstl and JH are the slowest Keccak and SHA-256 in the middle ARX trumps S-boxes Even with AES instruction extensions
36 XBX figures: AR7 (32-bit)
37 XBX figures: ATmega1284P (8-bit)
38 XBX after Grøstl team intervention
39 XBX figures conclusions Minimum required area can be more important than speed BLAKE always among the best Skein is the best on high-end platforms Keccak and Grøstl repeatedly among the best Figures depend greatly on effort spent
40 Minimal Sizes 256-bit State size (+FF) Message block Rounds BLAKE 512 (+ 1024) (x2) Grøstl 1024 (+512) Keccak bit State size (+FF) Message block Rounds BLAKE 1024 (+ 1024) (x2) Grøstl 2048 (+1024) JH 1024 (+512) Keccak Skein 512 (+1024)
41 SHA-3 key words Rebound Attack complexity/practicality Distinguisher nonrandom property Provable security indifferentiability
42 Remember the AES Key words? Security-margin weighted performance Side-channel attack resistance Algebra Pronunciation of Dutch vowels
43 Rebound attack Differential cryptanalysis on hash functions Look for characteristic ending in difference 0: h( x Δ) h( x) = 0 h( x Δ) = h( x) Every right pair is a collision Finding right pairs: since there is no secret key, solving a set of equations deterministically (in principle)
44 Solving strategies Δ Δ 1 Δ 1 Δ 2 Δ 2 Classical Message Modification Meet-i-t-middle /rebound
45 Attack complexity How practical is attack X? Number of computations Measured in equivalent hash computations? Amount of memory Large memories are slow! Complexity of the description Correctness!
46 Cube distinguishers Cube/AIDA/higher order differential: cube tester c x V c x ( ) = f x ( ) Look for special c: Equal to zero, linear, unbalanced,
47 Cowboy sharpshooter
48 Timeline Mar 2012: 3 rd SHA-3 candidate conference Oct 2012: Decision
49 Outcomes of the SHA-3 competition A winner: Keccak Or SHA-256? Progress in knowledge on hash functions And on AES security Semi-automatic tools and libraries
Skein. John Kevin Hicks
Skein John Kevin Hicks 2 Outline Introduction Skein Overview Threefish Block Cipher Unique Block Iteration Optional Argument System Skein Performance Security Claims and Current Cryptanalysis Conclusions
Cryptography. Summer Term 2010
Summer Term 2010 Chapter 2: Hash Functions Contents Definition and basic properties Basic design principles and SHA-1 The SHA-3 competition 2 Contents Definition and basic properties Basic design principles
Cryptographic Hash Functions
Cryptographic Hash Functions Çetin Kaya Koç koc@cs.ucsb.edu Çetin Kaya Koç http://koclab.org Winter 2017 1 / 34 Cryptographic Hash Functions A hash function provides message integrity and authentication
Hardware Performance Evaluation of SHA-3 Candidate Algorithms
Journal of Information Security, 2012, 3, 69-76 http://dx.doi.org/10.4236/jis.2012.32008 Published Online April 2012 (http://www.scirp.org/journal/jis) Hardware Performance Evaluation of SHA-3 Candidate
Side-channel Analysis of Grøstl and Skein
2012 IEEE IEEE Symposium CS Security on Security and Privacy and Workshops Privacy Workshops Side-channel Analysis of Grøstl and Skein Christina Boura, Sylvain Lévêque, David Vigilant Gemalto 6 rue de
Security Analysis of Extended Sponge Functions. Thomas Peyrin
Security Analysis of Extended Sponge Functions Hash functions in cryptology: theory and practice Leiden, Netherlands Orange Labs University of Versailles June 4, 2008 Outline 1 The Extended Sponge Functions
Compact Implementation of Threefish and Skein on FPGA
Compact Implementation of Threefish and Skein on FPGA Nuray At, Jean-Luc Beuchat, and İsmail San Department of Electrical and Electronics Engineering, Anadolu University, Eskişehir, Turkey Email: {nat,
Compact FPGA Implementations of the Five SHA-3 Finalists
Compact FPGA Implementations of the Five SHA-3 Finalists Stéphanie Kerckhof 1,François Durvaux 1, Nicolas Veyrat-Charvillon 1, Francesco Regazzoni 1, Guerric Meurice de Dormale 2,andFrançois-Xavier Standaert
Permutation-based symmetric cryptography
Permutation-based symmetric cryptography Guido Bertoni 1 Joan Daemen 1 Michaël Peeters 2 Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Keccak & SHA-3 Day Université Libre de Bruxelles March
Jaap van Ginkel Security of Systems and Networks
Jaap van Ginkel Security of Systems and Networks November 17, 2016 Part 3 Modern Crypto SSN Modern Cryptography Hashes MD5 SHA Secret key cryptography AES Public key cryptography DES Presentations Minimum
Winter 2011 Josh Benaloh Brian LaMacchia
Winter 2011 Josh Benaloh Brian LaMacchia Symmetric Cryptography January 20, 2011 Practical Aspects of Modern Cryptography 2 Agenda Symmetric key ciphers Stream ciphers Block ciphers Cryptographic hash
H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls)
What is a hash function? mapping of: {0, 1} {0, 1} n H must be collision (2n/2 function calls), 2nd-preimage (2n function calls) and preimage resistant (2n function calls) The Merkle-Damgård algorithm
Network Security. Cryptographic Hash Functions Add-on. Benjamin s slides are authoritative. Chair for Network Architectures and Services
Chair for Network Architectures and Services Technische Universität München Network Security Cryptographic Hash Functions Add-on Benjamin s slides are authoritative Motivation (1) Common practice in data
Compact implementations of Grøstl, JH and Skein for FPGAs
Compact implementations of Grøstl, JH and Skein for FPGAs Bernhard Jungk Hochschule RheinMain University of Applied Sciences Wiesbaden Rüsselsheim Geisenheim bernhard.jungk@hs-rm.de Abstract. This work
The Grindahl hash functions
The Grindahl hash functions Søren S. Thomsen joint work with Lars R. Knudsen Christian Rechberger Fast Software Encryption March 26 28, 2007 Luxembourg 1/ 17 1 Introduction 2 Grindahl 3 Design considerations
CS-E4320 Cryptography and Data Security Lecture 5: Hash Functions
Lecture 5: Hash Functions Céline Blondeau Email: celine.blondeau@aalto.fi Department of Computer Science Aalto University, School of Science Hash Functions Birthday Paradox Design of Hash Functions SHA-3
Protection of the digital Holy Quran Using SAB hash function
Protection of the digital Holy Quran Using SAB hash function Mohammad A. Ahmad1,a, Dr. Imad Fakhri Alshaikhli1,b, 1 Department of Computer Science, International Islamic University of Malaysia, 53100 Jalan
Overview. CSC 580 Cryptography and Computer Security. Hash Function Basics and Terminology. March 28, Cryptographic Hash Functions (Chapter 11)
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 28, 2017 Overview Today: Review Homework 8 solutions Discuss cryptographic hash functions Next: Study for quiz
Design and Analysis of a New Hash Function Gear
Design and Analysis of a New Hash Function Gear Mohammad A. AlAhmad Public Authority for Applied Education and Training College of Basic Education Computer Science Department P.O.Box 34567 Adaliyah, 73205
Grøstl a SHA-3 candidate
Grøstl a SHA-3 candidate http://www.groestl.info Praveen Gauravaram 1, Lars R. Knudsen 1, Krystian Matusiewicz 1, Florian Mendel 2, Christian Rechberger 2, Martin Schläffer 2, and Søren S. Thomsen 1 1
Keccak discussion. Soham Sadhu. January 9, 2012
Keccak discussion Soham Sadhu January 9, 2012 Keccak (pronounced like Ketchak ) is a cryptographic hash function designed by Guido Bertoni, Joan Daemen, Michaël Peeters and Gilles Van Assche. Keccak is
Improved (Pseudo) Preimage Attack and Second Preimage Attack on Round-Reduced Grøstl Hash Function *
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING 30, 1789-1806 (014) Improved (Pseudo) Preimage Attack and Second Preimage Attack on Round-Reduced Grøstl Hash Function * JIAN ZOU 1,, WENLING WU 1, SHUANG
Two Hardware Designs of BLAKE-256 Based on Final Round Tweak
Two Hardware Designs of BLAKE-256 Based on Final Round Tweak Muh Syafiq Irsyadi and Shuichi Ichikawa Dept. Knowledge-based Information Engineering Toyohashi University of Technology, Hibarigaoka, Tempaku,
Course Business. Midterm is on March 1. Final Exam is Monday, May 1 (7 PM) Allowed to bring one index card (double sided) Location: Right here
Course Business Midterm is on March 1 Allowed to bring one index card (double sided) Final Exam is Monday, May 1 (7 PM) Location: Right here 1 Cryptography CS 555 Topic 18: AES, Differential Cryptanalysis,
CSC 580 Cryptography and Computer Security
CSC 580 Cryptography and Computer Security Cryptographic Hash Functions (Chapter 11) March 22 and 27, 2018 Overview Today: Quiz (based on HW 6) Graded HW 2 due Grad/honors students: Project topic selection
Performance of Message Authentication Codes for Secure Ethernet
Performance of Message Authentication Codes for Secure Ethernet Philipp Hagenlocher Advisors: Dominik Scholz & Fabien Geyer Seminar Future Internet SS2018 Chair of Network Architectures and Services Departments
Block Ciphers. Lucifer, DES, RC5, AES. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk Block Ciphers 1
Block Ciphers Lucifer, DES, RC5, AES CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk Block Ciphers 1 ... Block Ciphers & S-P Networks Block Ciphers: Substitution ciphers
On Optimized FPGA Implementations of the SHA-3 Candidate Grøstl
On Optimized FPGA Implementations of the SHA-3 Candidate Grøstl Bernhard Jungk, Steffen Reith, and Jürgen Apfelbeck Fachhochschule Wiesbaden University of Applied Sciences {jungk reith}@informatik.fh-wiesbaden.de
A j-lanes tree hashing mode and j-lanes SHA-256
A j-lanes tree hashing mode and j-lanes SHA-5 Shay Gueron 1, 1 Department of Mathematics, University of Haifa, Israel Intel Corporation, Israel Development Center, Haifa, Israel August 1, Abstract. j-lanes
SHA-3 vs the world. David Wong
SHA-3 vs the world David Wong Sneru MD4 Sneru MD4 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård SHA-1 SHA-2 Sneru MD4 MD5 Merkle Damgård
Hash functions & MACs
ECE 646 Lecture 11 Hash functions & MACs Required Reading W. Stallings, "Cryptography and Network-Security, Chapter 11 Cryptographic Hash Functions Appendix 11A Mathematical Basis of Birthday Attack Chapter
More engineering. considerations for the SHA-3 hash function
More engineering considerations for the SHA-3 hash function Jean-Philippe Aumasson Dan Bernstein Charles Bouillaguet Daniel Brown Orr Dunkelman Sebastiaan Indesteege Emilia Käsper Dmitry Khovratovich Jongsung
HOST Cryptography III ECE 525 ECE UNM 1 (1/18/18)
AES Block Cipher Blockciphers are central tool in the design of protocols for shared-key cryptography What is a blockcipher? It is a function E of parameters k and n that maps { 0, 1} k { 0, 1} n { 0,
KangarooTwelve: fast hashing based on Keccak-p
KangarooTwelve: fast hashing based on Keccak-p Guido Bertoni 3, Joan Daemen,2, Michal Peeters, Gilles Van Assche, Ronny Van Keer, and Benoît Viguier 2 STMicroelectronics 2 Radboud University 3 Security
Compact Hardware Implementations of the SHA-3 Candidates ARIRANG, BLAKE, Grøstl, and Skein
Compact Hardware Implementations of the HA-3 Candidates ARIRANG, BLAKE, Grøstl, and kein tefan Tillich, Martin Feldhofer, Wolfgang Issovits, Thomas Kern, Hermann Kureck, Michael Mühlberghuber, Georg Neubauer,
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Next Topic in Cryptographic Tools Symmetric key encryption Asymmetric key encryption Hash functions and
Hardware Implementations of the Round-Two SHA-3 Candidates: Comparison on a Common Ground
Hardware Implementations of the Round-Two SHA-3 Candidates: Comparison on a Common Ground Stefan Tillich 1 2, Martin Feldhofer 1, Mario Kirschbaum 1, Thomas Plos 1, Jörn-Marc Schmidt 1, Alexander Szekely
CSCI 454/554 Computer and Network Security. Topic 4. Cryptographic Hash Functions
CSCI 454/554 Computer and Network Security Topic 4. Cryptographic Hash Functions Hash function lengths Outline Hash function applications MD5 standard SHA-1 standard Hashed Message Authentication Code
Outline. Hash Function. Length of Hash Image. AIT 682: Network and Systems Security. Hash Function Properties. Question
Hash function lengths Outline AIT 682: Network and Systems Security Topic 4. Cryptographic Hash Functions Instructor: Dr. Kun Sun Hash function applications MD5 standard SHA-1 standard Hashed Message Authentication
Outline. AIT 682: Network and Systems Security. Hash Function Properties. Topic 4. Cryptographic Hash Functions. Instructor: Dr.
AIT 682: Network and Systems Security Topic 4. Cryptographic Hash Functions Instructor: Dr. Kun Sun Hash function lengths Outline Hash function applications MD5 standard SHA-1 standard Hashed Message Authentication
The road from Panama to Keccak via RadioGatún
The road from Panama to Keccak via RadioGatún Guido Bertoni 1, Joan Daemen 1, Michaël Peeters 2 and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Abstract. In this paper, we explain the
A High-Speed Unified Hardware Architecture for AES and the SHA-3 Candidate Grøstl
A High-Speed Unified Hardware Architecture for AES and the SHA-3 Candidate Grøstl Marcin Rogawski Kris Gaj Cryptographic Engineering Research Group (CERG) http://cryptography.gmu.edu Department of ECE,
SHA3 Core Specification. Author: Homer Hsing
SHA3 Core Specification Author: Homer Hsing homer.hsing@gmail.com Rev. 0.1 January 29, 2013 This page has been intentionally left blank. www.opencores.org Rev 0.1 ii Rev. Date Author Description 0.1 01/29/2013
ECE 646 Lecture 12. Hash functions & MACs. Digital Signature. Required Reading. Recommended Reading. m message. hash function hash value.
ECE 646 Lecture 12 Required Reading W. Stallings, "Cryptography and Network-Security, Chapter 11 Cryptographic Hash Functions & MACs Appendix 11A Mathematical Basis of Birthday Attack Chapter 12 Message
First practical results on reduced-round Keccak Unaligned rebound attack. María Naya-Plasencia INRIA Paris-Rocquencourt, France
First practical results on reduced-round Keccak Unaligned rebound attack María Naya-Plasencia INRIA Paris-Rocquencourt, France Outline Introduction First Practical Results [NP-Röck-Meier11] CP-Kernel:
Lecture 5. Cryptographic Hash Functions. Read: Chapter 5 in KPS
Lecture 5 Cryptographic Hash Functions Read: Chapter 5 in KPS 1 Purpose CHF one of the most important tools in modern cryptography and security CHF-s are used for many authentication, integrity, digital
Version 2.0, November 11, Stefan Tillich, Martin Feldhofer, Mario Kirschbaum, Thomas Plos, Jörn-Marc Schmidt, and Alexander Szekely
High-Speed Hardware Implementations of BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein Version 2.0, November 11, 2009 Stefan Tillich,
Chapter 2 Hardware Implementation of Hash Functions
Chapter 2 Hardware Implementation of Hash Functions Zhijie Shi, Chujiao Ma, Jordan Cote, and Bing Wang 2.1 Introduction to Cryptographic Hash Functions Hash algorithm is a type of cryptographic primitives.
Jaap van Ginkel Security of Systems and Networks
Jaap van Ginkel Security of Systems and Networks November 5, 2012 Part 3 Modern Crypto SSN Week 2 Hashes MD5 SHA Secret key cryptography AES Public key cryptography DES Book Chapter 1 in full Chapter 2
SHA-3. Demise of MD5 and SHA-1 Emerging New Hash. part 1
Demise of MD5 and SHA-1 Emerging New Hash SHA-3 part 1 Stanis law Radziszowski Computer Science Rochester Institute of Technology Rochester, New York, USA March 2011 Abstract A hash function H : {0,1}
Power Analysis of MAC-Keccak: A Side Channel Attack. Advanced Cryptography Kyle McGlynn 4/12/18
Power Analysis of MAC-Keccak: A Side Channel Attack Advanced Cryptography Kyle McGlynn 4/12/18 Contents Side-Channel Attack Power Analysis Simple Power Analysis (SPA) Differential Power Analysis (DPA)
Groestl Tweaks and their Effect on FPGA Results
Groestl Tweaks and their Effect on FPGA Results Marcin Rogawski and Kris Gaj George Mason University {kgaj, mrogawsk}@gmu.edu Abstract. In January 2011, Groestl team published tweaks to their specification
Report regarding the winter school on Hash 3 : Proofs, Analysis and Implementation
Report regarding the winter school on Hash 3 : Proofs, Analysis and Implementation Praveen Gauravaram Department of Mathematics, Technical University of Denmark Building S303, Matematiktorvet Kgs.Lyngby,
symmetric cryptography s642 computer security adam everspaugh
symmetric cryptography s642 adam everspaugh ace@cs.wisc.edu computer security Announcements Midterm next week: Monday, March 7 (in-class) Midterm Review session Friday: March 4 (here, normal class time)
Security Evaluation of Hash Functions: Gröbner Basis Based Cryptanalysis of SHA-1. Makoto Sugita IPA Security Center
Security Evaluation of Hash Functions: Gröbner Basis Based Cryptanalysis of SHA-1 Makoto Sugita IPA Security Center 1 Part I Japanese Standardization Effort (CRYPTREC) 2 Security evaluation methods and
ECE 646 Lecture 11. Hash functions & MACs. Digital Signature. message. hash. function. Alice. Bob. Alice s public key. Alice s private key
ECE 646 Lecture 11 Hash functions & MACs Digital Signature Alice Message Signature Message Signature Bob Hash function Hash function Hash value Public key algorithm yes Hash value 1 Hash value 2 no Public
Fundamentals of Cryptography
Fundamentals of Cryptography Topics in Quantum-Safe Cryptography June 23, 2016 Part III Data Encryption Standard The Feistel network design m m 0 m 1 f k 1 1 m m 1 2 f k 2 2 DES uses a Feistel network
Pushing the Limits of SHA-3 Hardware Implementations to Fit on RFID
Motivation Keccak Our Designs Results Comparison Conclusions 1 / 24 Pushing the Limits of SHA-3 Hardware Implementations to Fit on RFID Peter Pessl and Michael Hutter Motivation Keccak Our Designs Results
Preimage Analysis of the Maelstrom-0 Hash Function
Preimage Analysis of the Maelstrom-0 Hash Function Riham AlTawy and Amr M. Youssef Concordia Institute for Information Systems Engineering, Concordia University, Montréal, Québec, Canada Abstract. Maelstrom-0
BYTE SLICING GRØSTL Optimized Intel AES-NI and 8-bit Implementations of the SHA-3 Finalist Grøstl
BYTE SLICING GRØSTL Optimized Intel AES-NI and 8-bit Implementations of the SHA-3 Finalist Grøstl Kazumaro Aoki 1, Günther Roland 2, Yu Sasaki 1 and Martin Schläffer 2 1 NTT Corporation, Japan 2 IAIK,
CubeHash parameter tweak: 10 smaller MAC overhead
CubeHash parameter tweak: 10 smaller MAC overhead Daniel J. Bernstein Department of Computer Science University of Illinois at Chicago Chicago, IL 60607 7045 cubehash@box.cr.yp.to 1 Introduction CubeHashi+r/b+f
Permutation-based Authenticated Encryption
Permutation-based Authenticated Encryption Gilles Van Assche 1 1 STMicroelectronics COST Training School on Symmetric Cryptography and Blockchain Torremolinos, Spain, February 2018 1 / 44 Outline 1 Why
Side-Channel Analysis of Six SHA-3 Candidates
Side-Channel Analysis of Six SHA-3 Candidates Olivier Benoît and Thomas Peyrin Ingenico, France forename.name@ingenico.com Abstract. In this paper we study six 2nd round SHA-3 candidates from a side-channel
3 rd SKINNY Breaking Competition
3 rd SKINNY Breaking Competition C. Beierle, J. Jean, S. Kӧlbl, G. Leander, A. Moradi, T. Peyrin, Y. Sasaki, P. Sasdrich and S.M. Sim Eurocrypt 2018 Rump Session@ Tel Aviv 01/May/2018 SKINNY Overview Lightweight
CubeHash. D. J. Bernstein University of Illinois at Chicago
CubeHash D. J. Bernstein University of Illinois at Chicago CubeHash security is very well understood. Third-party analyses by Aumasson, Brier, Dai, Ferguson, Khazaei, Khovratovich, Knellwolf, Lucks, McKay,
A Low-Area yet Performant FPGA Implementation of Shabal
A Low-Area yet Performant FPGA Implementation of Shabal Jérémie Detrey, Pierrick Gaudry, and Karim Khalfallah 2 CARAMEL project-team, LORIA, INRIA / CNRS / Nancy Université, Campus Scientifique, BP 239,
Preimage attacks on the round-reduced Keccak with the aid of differential cryptanalysis
Preimage attacks on the round-reduced Keccak with the aid of differential cryptanalysis Pawe l Morawiecki 1,3, Josef Pieprzyk 2, Marian Srebrny 1,3, and Micha l Straus 1 1 Section of Informatics, University
NIST SHA-3 ASIC Datasheet
NIST SHA-3 ASIC Datasheet -- NIST SHA-3 Competition Five Finalists on a Chip (Version 1.1) Technology: IBM MOSIS 0.13µm CMR8SF-RVT Standard-Cell Library: ARM s Artisan SAGE-X V2.0 Area: 5mm 2 (Core: 1.656mm
SHA-3. Demise of MD5 and SHA-1. Emerging New Hash. anything. x = y. 256 bits (32 bytes, like this napisze do ciebie z dalekiej pod...
Demise of MD5 and SHA-1 Emerging New Hash SHA-3 Stanis law Radziszowski Computer Science Rochester Institute of Technology Rochester, New York, USA November 2010 Abstract A hash function H : {0,1} {0,1}
Practical attacks on the Maelstrom-0 compression function
Practical attacks on the Maelstrom-0 compression function Stefan Kölbl, Florian Mendel Graz University of Technology, A-8010 Graz, Austria stefan.koelbl@student.tugraz.at Abstract. In this paper we present
Observations and Attacks On The SHA-3 Candidate Blender
Observations and Attacks On The SHA-3 Candidate Blender Craig Newbold cjnewbold@googlemail.com Abstract 51 candidates have been accepted as first round candidates in NIST s SHA-3 competition, to decide
A hash function is strongly collision-free if it is computationally infeasible to find different messages M and M such that H(M) = H(M ).
CA642: CRYPTOGRAPHY AND NUMBER THEORY 1 8 Hash Functions 8.1 Hash Functions Hash Functions A hash function is an efficient function mapping binary strings of arbitrary length to binary strings of fixed
Block Ciphers. Secure Software Systems
1 Block Ciphers 2 Block Cipher Encryption function E C = E(k, P) Decryption function D P = D(k, C) Symmetric-key encryption Same key is used for both encryption and decryption Operates not bit-by-bit but
Security margin evaluation of SHA-3 contest finalists through SAT-based attacks
Security margin evaluation of SHA-3 contest finalists through SAT-based attacks Ekawat Homsirikamol 2, Pawe l Morawiecki 1, Marcin Rogawski 2, and Marian Srebrny 1,3 1 Section of Informatics, University
Building a 256-bit hash function on a stronger MD variant
Cent. Eur. J. Comp. Sci. 4(2) 2014 67-85 DOI: 10.2478/s13537-014-0204-7 Central European Journal of Computer Science Building a 256-bit hash function on a stronger MD variant Research Article Harshvardhan
Cryptanalysis on Hash Functions. Xiaoyun Wang Tsinghua University & Shandong University
Cryptanalysis on Hash Functions Xiaoyun Wang Tsinghua University & Shandong University 05-10-2006 Outline Introduction to hash function Hash function and signature Dedicated hash function Modular differential
Appendix K SHA-3. William Stallings
Appendix K SHA-3 William Stallings K.1 THE ORIGINS OF SHA-3... 2 K.2 EVALUATION CRITERIA FOR SHA-3... 4 K.3 THE SPONGE CONSTRUCTION... 6 K.4 THE SHA-3 ITERATION FUNCTION f... 13 Structure of f... 14 Theta
Sponge-based pseudo-random number generators
Sponge-based pseudo-random number generators Guido Bertoni 1, Joan Daemen 1, Michaël Peeters 2, and Gilles Van Assche 1 1 STMicroelectronics 2 NXP Semiconductors Abstract. This paper proposes a new construction
ECE 646 Lecture 11. Hash functions & MACs. Digital Signature. Required Reading. Recommended Reading. m message. hash function hash value
ECE 646 Lecture 11 Required Reading W. Stallings, "Cryptograpy and Network-Security, Capter 11 Cryptograpic Has Functions & s Appendix 11A Matematical Basis of Birtday Attack Capter 12 Autentication Codes
Revisiting the IDEA Philosophy
Revisiting the IDEA Philosophy Pascal Junod 1,2 Marco Macchetti 2 1 University of Applied Sciences Western Switzerland (HES-SO) 2 Nagracard SA, Switzerland FSE 09 Leuven (Belgium), February 24, 2009 Outline
Finding Second Preimages of Short Messages for Hamsi-256
Finding Second Preimages of Short Messages for Hamsi-256 Thomas Fuhr ANSSI, Paris, France and TELECOM-ParisTech, Paris, France thomas.fuhr@ssi.gouv.fr Abstract. In this paper we study the second preimage
Meet-in-the-Middle Preimage Attacks on AES Hashing Modes and an Application to Whirlpool
Meet-in-the-Middle Preimage Attacks on AES Hashing Modes and an Application to Whirlpool Yu Sasaki NTT Information Sharing Platform Laboratories, NTT Corporation 3-9-11 Midoricho, Musashino-shi, Tokyo
CS 645 : Lecture 6 Hashes, HMAC, and Authentication. Rachel Greenstadt May 16, 2012
CS 645 : Lecture 6 Hashes, HMAC, and Authentication Rachel Greenstadt May 16, 2012 Reminders Graded midterm, available on bbvista Project 3 out (crypto) Hash Functions MAC HMAC Authenticating SSL Man-in-the-middle
Lecture 4: Authentication and Hashing
Lecture 4: Authentication and Hashing Introduction to Modern Cryptography 1 Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 1 These slides are based on Benny Chor s slides. Some Changes in Grading
Generic Related-Key Attacks for HMAC
Generic Related-Key Attacks for HMAC Thomas Peyrin 1,, Yu Sasaki 2,andLeiWang 1,3 1 Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore
Lecture 2: Secret Key Cryptography
T-79.159 Cryptography and Data Security Lecture 2: Secret Key Cryptography Helger Lipmaa Helsinki University of Technology helger@tcs.hut.fi 1 Reminder: Communication Model Adversary Eve Cipher, Encryption
Introduction to Cryptology. Lecture 17
Introduction to Cryptology Lecture 17 Announcements HW7 due Thursday 4/7 Looking ahead: Practical constructions of CRHF Start Number Theory background Agenda Last time SPN (6.2) This time Feistel Networks
Compact Hardware Implementations of ChaCha, BLAKE, Threefish, and Skein on FPGA
Compact Hardware Implementations of ChaCha, BLAKE, Threefish, and Skein on FPGA Nuray At, Jean-Luc Beuchat, Eiji Okamoto, İsmail San, and Teppei Yamazaki Department of Electrical and Electronics Engineering,
Open Problems in Hash Function Security
Open Problems in Hash Function Security Elena Andreeva, Bart Mennink, and Bart Preneel Dept. Electrical Engineering, ESAT/COSIC, KU Leuven, and iminds, Belgium {elena.andreeva, bart.mennink, bart.preneel}@esat.kuleuven.be
Efficient and Provably Secure Methods for Switching from Arithmetic to Boolean Masking
Efficient and Provably Secure Methods for Switching from Arithmetic to Boolean Masking Blandine Debraize Gemalto, 6 rue de la Verrerie, 92197 Meudon Cedex, France blandine.debraize@gemalto.com Abstract.
Broad View of Cryptographic Hash Functions
www.ijcsi.org 239 Broad View of Cryptographic ash Functions Mohammad A. AlAhmad 1, Imad Fakhri Alshaikhli 2 1 Department of Computer Science, International Islamic University of Malaysia, 53100 Jalan Gombak
arxiv: v3 [cs.cr] 13 Aug 2016
![arxiv: v3 [cs.cr] 13 Aug 2016](/thumbs/84/89334194.jpg "arxiv: v3 [cs.cr] 13 Aug 2016")
Some observations on the optimization of a parallel SHAKE function using Sakura Kevin Atighehchi arxiv:1608.00492v3 [cs.cr] 13 Aug 2016 Aix Marseille Univ, CNRS, LIF, Marseille, France kevin.atighehchi@univ-amu.fr
Cryptography Trends: A US-Based Perspective. Burt Kaliski, RSA Laboratories IPA/TAO Cryptography Symposium October 20, 2000
Cryptography Trends: A US-Based Perspective Burt Kaliski, RSA Laboratories IPA/TAO Cryptography Symposium October 20, 2000 Outline Advanced Encryption Standard Dominant design Thoughts on key size Advanced
L3: Basic Cryptography II. Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806
L3: Basic Cryptography II Hui Chen, Ph.D. Dept. of Engineering & Computer Science Virginia State University Petersburg, VA 23806 8/29/2016 CSCI 451 -Fall 2016 1 Acknowledgement Many slides are from or
Comp527 status items. Crypto Protocols, part 2 Crypto primitives. Bart Preneel July Install the smart card software. Today
Comp527 status items Crypto Protocols, part 2 Crypto primitives Today s talk includes slides from: Bart Preneel, Jonathan Millen, and Dan Wallach Install the smart card software Bring CDs back to Dan s
Cryptanalysis vs. Reality. Small Cryptanalysis
1 / 34 Cryptanalysis vs. Reality + Small Cryptanalysis Jean-Philippe Aumasson http://131002.net @aumasson 2 / 34 Cryptanalysis used to be connected to reality (replica of a Turing s bombe used to break
Stream Ciphers and Block Ciphers
Stream Ciphers and Block Ciphers Ruben Niederhagen September 18th, 2013 Introduction 2/22 Recall from last lecture: Public-key crypto: Pair of keys: public key for encryption, private key for decryption.
Differential Cryptanalysis in ARX Ciphers, Applications to LEA
Differential Cryptanalysis in ARX Ciphers, Applications to LEA Ashutosh Dhar Dwivedi 1,2, Gautam Srivastava 2,3 1 Institute of Computer Science, Polish Academy of Sciences, Warsaw, Poland 2 Department
L3. An Introduction to Block Ciphers. Rocky K. C. Chang, 29 January 2015
L3. An Introduction to Block Ciphers Rocky K. C. Chang, 29 January 2015 Outline Product and iterated ciphers A simple substitution-permutation network DES and AES Modes of operations Cipher block chaining
Cryptographic Hash Functions. Rocky K. C. Chang, February 5, 2015
Cryptographic Hash Functions Rocky K. C. Chang, February 5, 2015 1 This set of slides addresses 2 Outline Cryptographic hash functions Unkeyed and keyed hash functions Security of cryptographic hash functions