Efficient Algorithms for Computing Differential Properties of Addition

Lipmaa, Helger; Moriai, Shiho

doi:10.1007/3-540-45473-x_28

Cited by 113 publications

(131 citation statements)

References 5 publications

Supporting

Mentioning

126

Contrasting

Unclassified

Order By: Relevance

“…In this way, we can recover 192 last subkey bits one by one. We will recover the least significant 10 bits of k 9,0 , k 9,1 and k 9,6 ; the least significant 35 bits of k 9,3 and k 9,4 ; the least significant 31 bits of k 9,2 ; the least significant 39 bits of k 9,5 ; and the least significant 22 bits of k 9,7 .…”

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

“…We will depict how to recover the least significant 10 bits of k 9,6 as an example to illustrate the method. We make use of two of the bit conditions in v 33,6 , i.e.…”

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

“…Apply this procedure recursively to recover the least significant 8 bits of k 9,6 . After that, a similar argument allows to recover k 9,6,8 and k 9,6,9 .…”

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

“…They gave a known-related-key 35-round boomerang distinguisher on threefish-512, but they had only given a key recovery attack of 32 rounds. The difference they used is the XOR difference and they used the algorithms in [9] to find the differentials of their attacks. Their attacks can be applied for the new rotations as well, with new differential trails and different probabilities.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Improved Related-Key Boomerang Attacks on Round-Reduced Threefish-512

Chen

Jia

2010

Information Security, Practice and Experience

View full text Add to dashboard Cite

Abstract. Hash function Skein is one of the 14 NIST SHA-3 second round candidates. Threefish is a tweakable block cipher as the core of Skein, defined with a 256-, 512-, and 1024-bit block size. The 512-bit block size is the primary proposal of the authors. Skein had been updated after it entered the second round; the only difference between the original and the new version is the rotation constants. In this paper we construct related-key boomerang distinguishers on round-reduced Threefish-512 based on the new rotation constants using the method of modular differential. With these distinguishers, we mount related-key boomerang key recovery attacks on Threefish-512 reduced to 32, 33 and 34 rounds. The attack on 32-round Threefish-512 has time complexity 2 195 with memory of 2 12 bytes. The attacks on Threefish-512 reduced to 33 and 34 rounds have time complexity of 2 324.6 and 2 474.4 encryptions respectively, and both with negligible memory. The best key recovery attack known before is proposed by Aumasson et al. Their attack, which bases on the old rotation constants, is also a related-key boomerang attack. For 32-round Threefish-512, their attack requires 2 312 encryptions and 2 71 bytes of memory.

show abstract

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

“…We will depict how to recover the least significant 10 bits of k 9,6 as an example to illustrate the method. We make use of two of the bit conditions in v 33,6 , i.e.…”

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

“…Apply this procedure recursively to recover the least significant 8 bits of k 9,6 . After that, a similar argument allows to recover k 9,6,8 and k 9,6,9 .…”

Section: Related-key Boomerang Key Recovery Attack On 33-round Threefmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improved Related-Key Boomerang Attacks on Round-Reduced Threefish-512

Chen

Jia

2010

Information Security, Practice and Experience

View full text Add to dashboard Cite

show abstract

“…3. The last condition, (6), is of the same form as the first condition, so it can be solved in exactly the same way. The expected probability that a solution exists is again 2 −19.5 .…”

Section: The First Phase Of the Attackmentioning

confidence: 99%

Collisions and Other Non-random Properties for Step-Reduced SHA-256

Indesteege

Mendel²,

Preneel

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract.We study the security of step-reduced but otherwise unmodified SHA-256. We show the first collision attacks on SHA-256 reduced to 23 and 24 steps with complexities 2 18 and 2 28.5 , respectively. We give example colliding message pairs for 23-step and 24-step SHA-256. The best previous, recently obtained result was a collision attack for up to 22 steps. We extend our attacks to 23 and 24-step reduced SHA-512 with respective complexities of 2 44.9 and 2 53.0 . Additionally, we show nonrandom behaviour of the SHA-256 compression function in the form of free-start near-collisions for up to 31 steps, which is 6 more steps than the recently obtained non-random behaviour in the form of a semi-freestart near-collision. Even though this represents a step forwards in terms of cryptanalytic techniques, the results do not threaten the security of applications using SHA-256.

show abstract

Solving Systems of Differential Equations of Addition

Paul

Preneel

2005

Information Security and Privacy

View full text Add to dashboard Cite

Efficient Algorithms for Computing Differential Properties of Addition

Cited by 113 publications

References 5 publications

Improved Related-Key Boomerang Attacks on Round-Reduced Threefish-512

Improved Related-Key Boomerang Attacks on Round-Reduced Threefish-512

Collisions and Other Non-random Properties for Step-Reduced SHA-256

Solving Systems of Differential Equations of Addition

Contact Info

Product

Resources

About