Out of Oddity – New Cryptanalytic Techniques Against Symmetric Primitives Optimized for Integrity Proof Systems

Abstract

The security and performance of many integrity proof systems like SNARKs, STARKs and Bulletproofs highly depend on the underlying hash function. For this reason several new proposals have recently been developed. These primitives obviously require an in-depth security evaluation, especially since their implementation constraints have led to less standard design approaches. This work compares the security levels offered by two recent families of such primitives, namely GMiMC and HadesMiMC. We exhibit low-complexity distinguishers against the GMiMC and HadesMiMC permutations for most parameters proposed in recently launched public challenges for STARK-friendly hash functions. In the more concrete setting of the sponge construction corresponding to the practical use in the ZK-STARK protocol, we present a practical collision attack on a round-reduced version of GMiMC and a preimage attack on some instances of HadesMiMC. To achieve those results, we adapt and generalize several cryptographic techniques to fields of odd characteristic.

Arion: Arithmetization-Oriented Permutation and Hashing from Generalized Triangular Dynamical Systems

“…Other Statistical Attacks The low differential probability protects Arion and ArionHash against classical and truncated differential attacks. We conclude that the full diffusion after two rounds protects Arion and ArionHash against impossible differential and zero-correlation attacks [14], boomerang attack [50], integral attack [11,21], multiple-of-n and mixture differential attacks [31,36]. Note that we mainly perform cryptanalysis for ensuring the security for the parameters that are suitbale for target applications.…”

“…Our findings in Table 5 suggest that after two rounds Arion-π has already almost full density over F p . Higher-order differential attacks [11,39,40] exploit that higher differentials will vanish at some point. Since Arion achieves degrees greater than or equal to q − 2 in the input variables we expect Arion to resist against higher-order differentials and distinguishers.…”

Related-Key Differential Cryptanalysis of GMiMC Used in Post-Quantum Signatures

“…Number of rounds of GMiMC-erf: For full-data scenario, the designers [2, Table 2] take R T D ≥ 1 + t + (t 2 + t) × n 2(n−1) rounds to provide the resistance against truncated differential attacks for multivariate case under single-key setting. This bound then has been broken and extended to t(t − 2) rounds by Beyne et al [7]. For low-data scenario, an attacker has limited data access, that is given only one or two known plaintext-ciphertext pairs for the cryptanalysis, thus designers mainly consider Greatest Common Divisors (GCD) and Gröbner Basis attacks, the number of rounds to provide security is…”

“…Contributions. On one hand, we investigate the potential threats of the relatedkey attacks for GMiMC-erf 7 when deployed as PRP/PRFs in the post-quantum signature schemes, which is the recommended version of GMiMC and aims at competing with LowMC in post-quantum signature applications.…”

“…We then construct two kinds of iterative related-key differentials to explore the security margin of GMiMC-erf under related-key setting, which are provided in Table 1. What calls for the attention is that our proposed related-key differentials are also constructed for collision attacks, it means that the output differences of our distinguishers must be zero, which are more demanding than the previous single-key truncated differentials [1,7] and supposed to be bounded by the birthday bound.…”