Improving Local Collisions: New Attacks on Reduced SHA-256

Abstract

In this paper, we focus on the construction of semi-free-start collisions for SHA-256, and show how to turn them into collisions. We present a collision attack on 28 steps of the hash function with practical complexity. Using a two-block approach we are able to turn a semifree-start collision into a collision for 31 steps with a complexity of at most 2 65.5. The main improvement of our work is to extend the size of the local collisions used in these attacks. To construct differential characteristics and confirming message pairs for longer local collisions, we had to improve the search strategy of our automated search tool. To test the limits of our techniques we present a semi-free-start collision for 38 steps.

Improved Cryptanalysis of Reduced RIPEMD-160

“…To find a non-linear differential path in RIPEMD-160, we use the techniques developed by Mendel et al [11,12]. This automated search algorithm can be used to find both, differential characteristics and conforming message pairs (note that we will use it only for the differential characteristics part in this article).…”

“…If an inconsistency occurs, the algorithm backtracks to an earlier state of the search and tries to correct it. Similar to [11,12], we denote these three parts of the search by decision (guessing), deduction (propagation), and backtracking (correction). Then, the search algorithm proceeds as follows: During the search, we mainly use generalized conditions [4] to store, restrict and propagate information (see Table 7 of Appendix B).…”

“…Similar to [11,12], new restrictions are propagated using brute-force propagation within bitslices for each Boolean function and modular addition. In the backtracking, we remember a small set of critical bits and repeatedly check if all of them can be resolved.…”

“…The move of the industry towards SHA-3 will take a lot of time and even broken functions such as MD5 or SHA-1 remain widely used. Among the MD-SHA family, only SHA-2 and RIPEMD-160 compression functions are still unbroken, although practical collisions on the SHA-2 compression function have been improved from 24 to 38 steps recently [11,12]. The compression function used in RIPEMD-128 was recently shown not to be collision resistant [8].…”

Boomerang Attack on Step-Reduced SHA-512

“…Then Mendel et al improved the semi-free-start collisions on SHA-256 from 24 to 32 steps and gave a collision attack for 27 steps, which are all practical [19]. The best known collision attacks on SHA-256 so far are semi-free-start collisions for 38 and collisions for 31 out of 64 steps by Mendel et al in [20]. Recently, Eichlseder et al presented semi-free-start collisions for SHA-512 on up to 38 steps in [8].…”