How to find many collisions of 3-pass HAVAL

Authors:
Kazuhiro Suzuki;Kaoru Kurosawa
Affiliations:
Venture Business Laboratory, Ibaraki University, Hitachi, Ibaraki, Japan;Department of Computer and Information Sciences, Ibaraki University, Hitachi, Ibaraki, Japan
Venue:
IWSEC'07 Proceedings of the Security 2nd international conference on Advances in information and computer security
Year:
2007

Citing 4
Cited 3

HAVAL - A One-Way Hashing Algorithm with Variable Length of Output

ASIACRYPT '92 Proceedings of the Workshop on the Theory and Application of Cryptographic Techniques: Advances in Cryptology
Cryptanalysis of the full HAVAL with 4 and 5 passes

FSE'06 Proceedings of the 13th international conference on Fast Software Encryption
Cryptanalysis of the hash functions MD4 and RIPEMD

EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques
How to break MD5 and other hash functions

EUROCRYPT'05 Proceedings of the 24th annual international conference on Theory and Applications of Cryptographic Techniques

Preimage Attacks on 3, 4, and 5-Pass HAVAL

ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Meet-in-the-Middle Attacks Using Output Truncation in 3-Pass HAVAL

ISC '09 Proceedings of the 12th International Conference on Information Security
Boomerang distinguishers on MD4-Family: first practical results on full 5-pass HAVAL

SAC'11 Proceedings of the 18th international conference on Selected Areas in Cryptography

Quantified Score

Hi-index	0.00

Visualization

Abstract

The hash function HAVAL is a well known Merkle-Damgård hash function such as MD4 and MD5. It has three variants, 3-, 4- and 5-pass HAVAL. On 3-pass HAVAL, the best known attack finds a collision pair with 27 computations of the compression function. To find k collision pairs, it requires 27k computations. In this paper, we present a better collision attack on 3-pass HAVAL, which can find k collision pairs with only 2k+33 computations. Further, our message differential is different from the previous ones. It is important to find collisions for different message differentials.