Distinguishers beyond three rounds of the RIPEMD-128/-160 compression functions

  • Authors:
  • Yu Sasaki;Lei Wang

  • Affiliations:
  • NTT Secure Platform Laboratories, NTT Corporation, Musashino-shi, Tokyo, Japan;The University of Electro-Communications, Choufu-shi, Tokyo, Japan

  • Venue:
  • ACNS'12 Proceedings of the 10th international conference on Applied Cryptography and Network Security
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper presents differential-based distinguishers against ISO standard hash functions RIPEMD-128 and RIPEMD-160. Second-order differential paths are constructed on reduced steps of their compression functions. These lead to 4-sum attacks on 47 steps (out of 64 steps) of RIPEMD-128 and 40 steps (out of 80 steps) of RIPEMD-160. Then new properties called a (partial) 2-dimension sum and q-multi-second-order collision are considered. The partial 2-dimension sum is generated on 48 steps of RIPEMD-128 and 42 steps of RIPEMD-160, with a complexity of 235 and 236, respectively. Theoretically, 2-dimension sums are generated faster than the brute force attack up to 52 steps of RIPEMD-128 and 51 steps of RIPEMD-160, with a complexity of 2101 and 2158, respectively. The attacks on RIPEMD-128 can also be regarded as q-multi-second-order collision attacks. The practical attacks are implemented and generated examples are presented. We stress that our results do not impact to the security of full RIPEMD-128 and RIPEMD-160 hash functions.