Preimages for Step-Reduced SHA-2

Authors:
Kazumaro Aoki;Jian Guo;Krystian Matusiewicz;Yu Sasaki;Lei Wang
Affiliations:
NTT Information Sharing Platform Laboratories, NTT Corporation, Tokyo, Japan 180-8585;Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore;Department of Mathematics, Technical University of Denmark, Denmark;NTT Information Sharing Platform Laboratories, NTT Corporation, Tokyo, Japan 180-8585 and University of Electro-Communications, Tokyo, Japan 182-8585;University of Electro-Communications, Tokyo, Japan 182-8585
Venue:
ASIACRYPT '09 Proceedings of the 15th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Year:
2009

Citing 12
Cited 18

Handbook of Applied Cryptography

Handbook of Applied Cryptography
HAVAL - A One-Way Hashing Algorithm with Variable Length of Output

ASIACRYPT '92 Proceedings of the Workshop on the Theory and Application of Cryptographic Techniques: Advances in Cryptology
New Collision Attacks against Up to 24-Step SHA-2

INDOCRYPT '08 Proceedings of the 9th International Conference on Cryptology in India: Progress in Cryptology
Preimage Attacks on 3, 4, and 5-Pass HAVAL

ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Finding Preimages in Full MD5 Faster Than Exhaustive Search

EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
Preimage Attacks on Reduced Tiger and SHA-2

Fast Software Encryption
Meet-in-the-Middle Attacks Using Output Truncation in 3-Pass HAVAL

ISC '09 Proceedings of the 12th International Conference on Information Security
Meet-in-the-Middle Preimage Attacks Against Reduced SHA-0 and SHA-1

CRYPTO '09 Proceedings of the 29th Annual International Cryptology Conference on Advances in Cryptology
A meet-in-the-middle collision attack against the new FORK-256

INDOCRYPT'07 Proceedings of the cryptology 8th international conference on Progress in cryptology
Analysis of step-reduced SHA-256

FSE'06 Proceedings of the 13th international conference on Fast Software Encryption
Finding collisions in the full SHA-1

CRYPTO'05 Proceedings of the 25th annual international conference on Advances in Cryptology
Second preimages on n-bit hash functions for much less than 2n work

EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques

Efficient hardware implementations of high throughput SHA-3 candidates keccak, luffa and blue midnight wish for single- and multi-message hashing

Proceedings of the 3rd international conference on Security of information and networks
(Second) preimage attacks on step-reduced RIPEMD/RIPEMD-128 with a new local-collision approach

CT-RSA'11 Proceedings of the 11th international conference on Topics in cryptology: CT-RSA 2011
Meet-in-the-middle attacks on reduced-round XTEA

CT-RSA'11 Proceedings of the 11th international conference on Topics in cryptology: CT-RSA 2011
Meet-in-the-middle preimage attacks on AES hashing modes and an application to whirlpool

FSE'11 Proceedings of the 18th international conference on Fast software encryption
Preimage attacks on full-ARIRANG

ACISP'11 Proceedings of the 16th Australasian conference on Information security and privacy
Improved preimage attack on one-block MD4

Journal of Systems and Software
The first 30 years of cryptographic hash functions and the NIST SHA-3 competition

CT-RSA'10 Proceedings of the 2010 international conference on Topics in Cryptology
Second-Order differential collisions for reduced SHA-256

ASIACRYPT'11 Proceedings of the 17th international conference on The Theory and Application of Cryptology and Information Security
Preimage attacks on Full-ARIRANG: analysis of DM-Mode with middle feed-forward

WISA'11 Proceedings of the 12th international conference on Information Security Applications
Narrow-Bicliques: cryptanalysis of full IDEA

EUROCRYPT'12 Proceedings of the 31st Annual international conference on Theory and Applications of Cryptographic Techniques
Three-subset meet-in-the-middle attack on reduced XTEA

AFRICACRYPT'12 Proceedings of the 5th international conference on Cryptology in Africa
Preimage attacks on step-reduced SM3 hash function

ICISC'11 Proceedings of the 14th international conference on Information Security and Cryptology
(Pseudo) preimage attack on round-reduced grøstl hash function and others

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
Bicliques for preimages: attacks on skein-512 and the SHA-2 family

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
Converting meet-in-the-middle preimage attack into pseudo collision attack: application to SHA-2

FSE'12 Proceedings of the 19th international conference on Fast Software Encryption
The stream cipher core of the 3GPP encryption standard 128-EEA3: timing attacks and countermeasures

Inscrypt'11 Proceedings of the 7th international conference on Information Security and Cryptology
Bicliques for permutations: collision and preimage attacks in stronger settings

ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
Preimage attacks on Feistel-SP functions: impact of omitting the last network twist

ACNS'13 Proceedings of the 11th international conference on Applied Cryptography and Network Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we present preimage attacks on up to 43-step SHA-256 (around 67% of the total 64 steps) and 46-step SHA-512 (around 57.5% of the total 80 steps), which significantly increases the number of attacked steps compared to the best previously published preimage attack working for 24 steps. The time complexities are 2251.9, 2509 for finding pseudo-preimages and 2254.9, 2511.5 compression function operations for full preimages. The memory requirements are modest, around 26 words for 43-step SHA-256 and 46-step SHA-512. The pseudo-preimage attack also applies to 43-step SHA-224 and SHA-384. Our attack is a meet-in-the-middle attack that uses a range of novel techniques to split the function into two independent parts that can be computed separately and then matched in a birthday-style phase.