R-HASH: HASH FUNCTION USING RANDOM QUADRATIC POLYNOMIALS OVER GF(2)

Transcription

1 R-AS: AS FUNCTION USING RANDO QUADRATIC POLYNOIALS OVER GF() Dhananoy Dey 1, Noopur Shrotrya 1, Indranath Sengupta 1 SAG, etcalfe ouse, Delh-11 54, INDIA. {dhananoydey, noopurshrotrya}@sag.drdo.n Department of athematcs, Jadavpur Unversty, Kolkata, WB 7 3, INDIA. sengupta.ndranath@gmal.com ABSTRACT In ths paper we descrbe an mproved verson of F-hash [7] vz. R-hash: ash Functon Usng Random Quadratc Polynomals Over GF(). The compresson functon of F-hash conssts of 3 polynomals wth 64 varables over GF(), whch were taken from the frst 3 polynomals of FE challenge-1 by forcng last 16 varables as. The mode operaton used n computng F-hash was erkle-damgard. We have randomly selected 3 quadratc non-homogeneous polynomals havng 64 varables over GF() n case of R-hash to mprove the securty of the compresson functon used n F-hash. In desgnng R-hash, we have also changed the mode operaton used n F-hash, because of the theoretcal weakness found n the erkle-damgard constructon. In ths paper we wll prove that R-hash s more secure than F-hash and SA-56 as well as we wll show that t s also faster than F-hash. KEYWORDS Dedcated hash functons, dfferental attack, Q problem, premage attack. 1. INTRODUCTION After recent cryptanalytc attack on D5 [][15] [8] [31] and SA-1 [5] [6] [3] [4] [9], the securty of ther successor, SA- famly [1], aganst all knds of cryptanalytc attacks has become an mportant ssue. Although many theoretcal attacks [1], [18], [19], [], [1], [6] on the reduced round of SA-56 have been publshed durng 3 to 8, but there s stll no threat to the securty of SA-56. In 7 NIST announced the SA-3 competton [] for selectng a new hash functon, whch would resst length extenson attack and other theoretcal weakness of erkle-damgard constructon. The desgn prncples of all submtted hash functons for SA-3 competton are dfferent from erkle-damgard constructon. We can broadly categorse all the submtted hash functons accordng to ther desgn prncple n the followng way: balanced Festel network, unbalanced Festel network, wde ppe desgn, key schedule, DS matrx, output transformaton, S-box and feedback regster. NIST has already declared the DOI : 1.511/cst

2 SA-3 hash functon on Oct 1. NIST has selected Keccak [3] as the SA-3 hash from the fve SA-3 fnalsts, vz., Blake [1], Grøstl [9], J [7], Keccak [3] and Sken [8]. The compresson functon of F-hash [7] was desgned n such a way that t conssts of the frst 3 polynomals wth frst 64 varables taken from the polynomals of FE challenge-1 by forcng last 16 varables of the 8 varables to. A new hash functon R-hash has been desgned by modfyng F-hash by takng random quadratc polynomals to mprove the securty as well as the effcency of F-hash. The compresson functon of R-hash depends on the followng wellknown facts: It s easy to compute the values of a random set of m multvarate polynomals n n varables over a fnte feld F vz., p ( x,, x ),, p ( x,, x )) for any fxed n ( x 1,, x n ) F. ( 1 1 n m 1 n Solvng random system of polynomal equatons s an NP-hard problem * [11]. In desgnng R-hash, we have changed the paddng procedure, from the one we have appled n F-hash, to ncrease the sze of the nput to the hash functon. We have also changed the erkle- Damgard constructon appled n F-hash by applyng double-ppe desgn to remove the multcollsons attack [13], length extenson attack, fxed-pont attack [16] and herdng attack [14]. A complete descrpton of R-hash and ts analyss wll be presented n the followng subsequent sectons.. R-AS FUNCTION R-hash functon can take arbtrary length ( 64 < 51-bt block) of nput and gves 56 bts 51 * 56 output,.e. we can wrte R hash : ( Z ) Z. We have desgned R-hash by changng the compresson functon as well as the mode operaton. The compresson functon conssts of 3 random polynomals wth 64 varables of degree over GF(). Snce the number of coeffcents of a polynomal of degree wth 64 varables over GF() s at most 81, to generate 3 random polynomals wth 64 varables of degree over GF() requres 6659 random bts. These bts were generated n the followng way: () Frst we compute SA-51 of a fle contanng 968bb576eeb7c6def469a6b48497c4739ac188ef1f948d8a15399b3af8deb91db ef377e366ba9f3e11a85bc41dc49f716d5a1489aec7. () Then we apply SA-51 to the output of the above fle. () We repeat the above process 131 tmes. * It s true even f we restrct the total degree of these polynomals to at least. 16

3 The hash value of a message of length followng manner: L = 51 l + 8r bts can be computed n the Paddng: Frst we append 1 to the end of the message to ndcate the termnaton of the message. Let k be the number of zeros added for paddng. Frst, 7-bt representaton of r bytes s appended to the end of k zeros and then 64-bt representaton of l blocks s placed to the end of 7- bt representaton of r bytes. Now k wll be the smallest non-negatve nteger satsfyng the followng condton: 8r + 1+ k mod 51. e., k + 8r 44 mod 51 The paddng procedure s shown n Fgure 1. Accordng to ths paddng procedure, we can 9 64 compute the hash value of a message of length ( 1) bts. 1 k-bt 7-bt 64-bt Fgure 1: Paddng Procedure Parsng: Let l' be the length of the padded message. Dvde the padded message nto n ( = l' / 51) 51-bt block.e. sxteen 3-bt words nstead of 448-bt block, whch s () appled n F-hash to mprove the effcency. Let denote the th block of the padded message, where 1 n and each word of th block s denoted by for 15. Intal Value: Take the frst 56 bts ntal value.e., eght 3-bt words from the expanson of the fractonal part of and hexadecmal representaton of these eght words are gven below: () = 43F6A88, = A4938, Thus IV =. 1 = 85A38D3, = 99F31D, 6 = 13198AE, = 8EFA98, 3 7 = , = EC4E6C89. ( 1) () ( n) ash Computaton: For each 51-bt block,,,, the followng four steps are executed for all the values of from 1 to n. 1. Intalzaton: The frst channg varable CV = 1 7 s the 56-bt ntal value IV.. Transformaton: Dvde the nput message block nto two equal parts,.e., = L R. Transform the message block n the followng way: L ( L CV counter ), ' 1 161

4 where counter mod 64 =. Xorng counter removes the fxed pont attack, because as the number of blocks ncreases, counter wll be dfferent for each block. Now, = L' R. We dvde ths 3. Iteraton: () nto sxteen 3-bt words, 1,, 15. For = to 6 (a) For k = to 7 k p( k k + 1) (b) R' ( R ( 1 7 )) (c) For = to 15 + mod 16 where p : Z 64 Z 3 be a functon defned by p 31 3 ( x) =. p1( x1,, x64) +. p( x1,, x64) p3( x1,, x64 x Z can be represented by 1x x64, Snce any element 64 x where x1x x64 denotes the bnary representaton of x n decreasng order of ther sgnfcance. p x 1,, x ) denotes the th polynomal wth 64 varables. ( 64 ) For = 7 CV R'' ' (a) p( ) k k k + 1 R ''' ( R'' ( 1 7 (b) )) The fnal hash value of the message wll be Ln, attack, multcollson attack and herdng attack. Snce to remove the length extenson CV s the ntal value for ( +1) the block and CVn s not known; hence appendng any extra block to compute the R-hash would not be possble. The complete algorthm s gven n Algorthm 1 and block dagram of R-hash s shown n Fgure. Process of Implementaton: In order to compute R-hash(), frst the paddng rule s appled and then the padded message s dvded nto 51-bt blocks. Now each 51-bt block s dvded nto sxteen 3-bt words and each 3-bt word s read n lttle endan format. For example, suppose we have to read an ASCII fle wth data abcd, t wll be read as x

5 R hash ( a ) 3. ANALYSIS OF R-AS = 7 A8 FA 11 D 7 E1E B 8 EB 55 F 19 D 39 C 6488 CBE C 61 9 E E 7 DBE 8 A 3 AAEFE 38 R hash ( ab ) = 69 C 8 E F 75 DDBC 5 A8 A 687 B 97 BE 9 A 6 F 48 E 75 BB 73 B 3 FC 17 AD F 5 E 88 R hash ( abc ) = AE 1771 AE 76 C 49 CB D 8 B 8 A9 849 FAF 9 5 E 51 BC 14 DBBF 4 AE 7 AA 8 F Test Value of F-hash: Test values of the three nputs are gven below: In ths secton we wll present the complete analyss of R-hash, whch ncludes propertes, effcency, as well as the securty analyss of ths functon Effcency of R-hash Functon The followng table gves a comparatve study n the effcency of R-hash wth F-hash on an Intel CoreDuo PC wth P84 Ghz processor wth GB RA. Fle Sze (n B) F-hash (n sec) R-hash (n Sec) Table 1: Comparatve n the Effcency of R-hash Ths shows that R-hash s almost three tmes faster than F-hash. 3.. Premage Resstance To fnd premage of R-hash, one has to solve 3 random quadratc multvarate polynomal equatons wth 64 varables over GF() whch s an Q-problem. If t s easy to fnd out premage of R-hash, then Q-problem s no longer an NP-hard problem, whch s a contradcton. Thus R-hash s premage resstant hash functon Second Premage Resstance We know that collson resstance mples second premage resstance. Therefore, the proof of collson resstance of R-hash gves the second premage resstance of R-hash Collson Resstance Snce we have totally changed the desgn prncple of the compresson functon n R-hash, therefore the dfferental attack appled for SA- and SA-1 by Chabaud and Joux n [4] and by Wang et al. n [3], [9] to fnd the collson s not applcable to R-hash functon. All these attacks use the message expanson relaton to fnd the collson, 163

6 Input Repeat for each block w o w 15 L R CV -1 Counter L R L R <<< 64 p Repeat 6 tmes L R p L R... CV L n R n R hash Fgure : Block Dagram of R-hash 164

7 but n our desgn, we have not appled the message expanson algorthm. ence, ths hash functon s collson resstance aganst the above methods. Snce the desgn of the compresson functon of R-hash s dfferent from SA- famly, the cross dependence equaton descrbed by Sanadhya and Sarkar n [5] cannot be formed n R-hash. Thus ths procedure too cannot be appled to our hash functon for fndng collsons. Besdes these, we have computed R-hash for a number of fles by changng only one bt to the nput. In most of the cases, we found that 17 bts changed after one round computaton of R-hash and 51 bts changed after two rounds. So t would be dffcult to control these bts as the number of rounds ncreases. Thus, dfferental attack to fnd the collson for R- hash would be dffcult Avalanche Effect We have taken an nput fle consstng of 51 bts and computed R-hash(). By th changng the bt of, the fles have been generated, for Thus ammng dstance of each from s exactly 1 for We then computed R- hash( ) for 1 51, computed the ammng dstances d between R-hash() and R- hash( ), for 1 51 and fnally computed the dstances between correspondng eght 3-bt words of the hash values. The followng table shows the maxmum, the mnmum, the mode and the mean values of the above dstances. Changes W1 W W3 W4 W5 W6 W7 8 W F-hash R-hash ax n ode ean Table : ammng Dstances To satsfy strct avalanche crteron, each d should be 18 for But we have found that d ' s were lyng between 14 and 165 for the above fles and n most of the cases d = 131. The observed devaton s acceptable so as to resst collson search usng dfferental attack. The followng table and fgure show the dstrbuton of the 51 fles wth respect to ther dfferences (dstance) n bts. Range of Dstance No. of Fles % F-hash % R-hash 18 ± ± ± ± Table 3: Dstrbuton of the Dfferences of R-hash by Changng a Sngle Bt 165

8 3.6. Randomness Test Fgure 3: Dstrbuton of the Dfferences of R-hash by Changng a Sngle Bt To conduct randomness test, we have generated a fle consstng of bts by concatenatng all the output of R-hash of the fles, 1,,, 51. After that, we have dvded bts nto 64 blocks of length 48 bts each, 3 blocks of length 496 bts each, 16 blocks of length 819 bts each, 8 blocks of length bts each, 4 blocks of length 3768 bts each, blocks of length bts each and 1 block of the complete bts. Thus we have generated 17 blocks n total and conducted fve basc randomness tests n these blocks. The concse result s shown n the followng table The Bt-Varance Test Test No. of Passed Faled % Blocks Frequency Seral Poker Runs Autocorrelaton Table 4: Result of Randomness Test The bt varance test conssts of measurng the mpact of change n nput message bts on the dgest bts. ore specfcally, gven an nput message, all the small changes as well as the large changes of ths nput message bts are taken and the bts n the correspondng dgest are evaluated for each such change. Afterwards, for each dgest bt the probabltes 166

9 of takng on the values of 1 and are measured consderng all the dgests produced by applyng nput message bt changes. If P ( 1) = P () = 1/ for all dgest bts = 1,, 56 then, the R-hash functon has attaned maxmum performance n terms of the bt varance test [17]. The bt varance test actually measures the unformty of each bt of the dgest. Snce t s computatonally dffcult to consder all nput message bt changes, we have evaluated the results for only up to 513 fles, vz., 1,,, 51, whch we have generated for conductng avalanche effect, and found the followng results: Number of dgests = 513 ean frequency of 1s (expected) = 56.5 ean frequency of 1s (calculated) = CONCLUSIONS In ths paper a dedcated hash functon R-hash has been presented whose securty s based on the Q-problem over fnte feld. Ths hash functon has the followng advantages over F-hash: t s much more effcent, t s secure aganst multcollson attack, fxed pont attack, length extenson attack and herdng attack. oreover, analyss of ths hash functon vz. avalanche effect, bt-varance test, randomness test as well as securty proof are also descrbed here. From these expermental results, t s clear that ths hash functon can also be used as a pseudo-random number generator because of the good randomness property of ts output besdes the other applcatons of cryptographc hash functons. ACKNOWLEDGEENTS The frst two authors are thankful to rs Pratbha Yadav, SAG, for her support to carry out ths work and are also very thankful to Dr. P. K. Saxena, Drector SAG, for hs encouragement to pursue ths work. The authors are thankful to r. Bharat Lal Jangd, SAG, for carryng out the randomness tests of R-hash. The authors are also thankful to Dr. P. R. shra, SAG, for hs crtcal suggestons and comments on the frst draft of ths paper. REFERENCES [1] J. Aumasson, L. enzen, W. eer, R. Phan, SA-3 Proposal BLAKE (9), submsson to NIST s SA-3 competton. [] J. Black,. Cochran & T. ghland, A Study of the D5 Attacks: Insghts and Improvements, n Proceedngs of Fast Software Encrypton FSE 6, LNCS 447, Sprnger, 6. [3] G. Berton, J. Daemen,. Peeters, G. Assche, The KECCAK sponge functon famly (9), submsson to NISTs SA-3 competton. [4] F. Chabaud & A. Joux, Dfferental Collsons n SA-, advances n Cryptology - CRYPTO 98, LNCS 146, Sprnger-Verlag, [5] C. Cannere, F. endel & C. Rechberger, Collsons for 7-step SA-1: On the Full Cost of Collson Search, n Proceedngs of SAC 7, LNCS 4876, Sprnger, 7. [6] C. Cannere & C. Rechberger, Premages for Reduced SA- and SA-1, advances n Cryptology - CRYPTO 8, LNCS 5157, Sprnger-Verlag,

10 [7] D. Dey, P. R. shra & I. Sengupta, F-hash: ash Functons Usng Restrcted FE Challenge-1, Internatonal Journal of Advanced Scence and Technology Vol. 37, Dec 11. Avalable onlne at [8] N. Ferguson, S. Lucks, B. Schneer, D. Whtng,. Bellare, T. Kohno, J. Callas, J. Walker, The Sken ash Functon Famly (9), submsson to NIST s SA-3 competton. [9] P. Gauravaram, L. Knudsen, K. atusewcz, F. endel, C. Rechberger,. Schlaffer, S. Thomsen, Grøstl a SA-3 Canddate (9), submsson to NIST s SA-3 competton. [1]. Glbert &. andschuh, Securty Analyss of SA-56 and Ssters, n Proceedngs of SAC 3, LNCS 36, Sprnger, 3. [11]. Garey & D. Johnson, Computers and Intractablty - A Gude to the Theory of NPcompleteness, Freeman and Co., [1] S. Indesteege, F. endel, B. Preneel & C. Rechberger, Collsons and other Non-Random Propertes for Step-Reduced SA-56. Cryptology eprnt Archve. Avalable onlne at [13] A. Joux, ultcollsons n Iterated ash Functons - Applcaton to Cascaded Constructons, advances n Cryptology CRYPTO 4, LNCS 315, Sprnger, 4. [14] J. Kelsey & T. Kohno, erdng ash Functons and the Nostradamus Attack, advances n Cryptology EUROCRYPT 6, LNCS 44, Sprnger-Verlag, 6. [15] V. Klma, Tunnels n ash Functons: D5 Collsons wthn a nute, Cryptology eprnt Archve. Avalable onlne at [16] J. Kelsey & B. Schneer, Second Premages on n-bt ash Functons for uch Less Than n Work, advances n Cryptology EUROCRYPT 5, LNCS 3494, Sprnger-Verlag, 5. [17] D.Karras & V. Zorkads, A Novel Sute of Tests for Evaluatng One-Way ash Functons for Electronc Commerce Applcatons, IEEE,. [18] F. endel, N. Pramstaller, C. Rechberger & V. Rmen, Analyss of Step-Reduced SA-56, n Proceedngs of FSE 6, LNCS 447, Sprnger, 6. [19] F. endel, N. Pramstaller, C. Rechberger & V. Rmen, Analyss of Step-Reduced SA-56, Cryptology eprnt Archve. Avalable onlne at [] I. Nkolc & A. Bryukov, Collsons for Step-Reduced SA-56 n Proceedngs of FSE 8, Sprnger, 8. [1] Natonal Insttute of Technology, Secure ash Standard, FIPS Publcaton-18-,. Avalable onlne at [] Natonal Insttute of Standards and Technology, Cryptographc ash Proect, Avalable onlne at [3] N. Pramstaller, C. Rechberger & V. Rmen, Explotng Codng Theory for Collson Attacks on SA-1, n Cryptography and Codng, 1th IA Internatonal Conference Proceedngs, LNCS 3796, Sprnger, 5. [4]. Sugta,. Kawazoe &. Ima, Groebner Bass Based Cryptanalyss of SA-1, Cryptology eprnt Archve. Avalable onlne at [5] S. Sanadhya & P. Sarkar, Non-Lnear Reduced Round Attacks Aganst SA- ash famly, Informaton Securty and Prvacy - ACISP 8, LNCS, Sprnger, 8. [6] S. Sanadhya & P. Sarkar, Attackng Step Reduced SA- Famly n a Unfed Framework, Cryptology eprnt Archve. Avalable onlne at [7]. Wu, The ash Functon J (9), submsson to NIST s SA-3 competton. [8] X. Wang &. Yu, ow to Break D5 and Other ash Functons, advances n Cryptology EUROCRYPT 5, LNCS 3494, Sprnger, 5. [9] X. Wang, Y. Yn &. Yu, Fndng Collsons n the Full SA-1, advances n Cryptology CRYPTO 5, LNCS 361, pages 17-36, Sprnger, 5. [3] X. Wang,. Yu & Y. Yn, Effcent Collson Search Attacks on SA-, n Advances n Cryptology - CRYPTO 5, LNCS 361, Sprnger, 5. [31] T. Xe, D. Feng & F. Lu, A New Collson Dfferental for D5 wth ts Full Dfferental Path, Cryptology eprnt Archve. Avalable onlne at 168