Practical Collisions for SHAMATA-256

Abstract

Abstract. In this paper, we present a collision attack on the SHA-3 submission SHAMATA. SHAMATA is a stream cipher-like hash function design with components of the AES, and it is one of the fastest submitted hash functions. In our attack, we show weaknesses in the message injection and state update of SHAMATA. It is possible to find certain message differences that do not get changed by the message expansion and non-linear part of the state update function. This allows us to find a differential path with a complexity of about 2 96 for SHAMATA-256 and about 2 110 for SHAMATA-512, using a linear low-weight codeword search. Using an efficient guess-and-determine technique we can significantly improve the complexity of this differential path for SHAMATA-256. With a complexity of about 2 40 we are even able to construct practical collisions for the full hash function SHAMATA-256.

Selected Areas in Cryptography

“…Beyond step 4, if we change the value of W 6 in step 5, we still make the output of step 5 stable by changing the H [4] by a same amount. However this change will be propagated by the right G function in step 1, we can fix this by changing the H [5], H [6] and H [7] by proper values, respectively. This method applies to W 7 in step 5 similarly.…”

Analysis of cryptographic hash functions

“…Google Search (https://www.google.com) still uses MD2 for root certificate. The current best preimage attacks against MD2 are due to Knudsen et al [88] with both time and memory complexity about 2 73 , yet the attacks require more than one message block, which is difficult to be used for forgery. Similar situation happens to the CA certificate using MD5, until the rogue certificate [152] is announced.…”