Producing Collisions for PANAMA

Rijmen, Vincent; Rompay, Bart Van; Preneel, Bart; Vandewalle, Joos

doi:10.1007/3-540-45473-x_4

Cited by 8 publications

(26 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The attack is similar to the attack on PANAMA [4,10], since we construct a collision in the internal state during the message injection phase. In this phase, the message input can be used to control the differences in the internal state.…”

Section: Basic Attack Strategymentioning

confidence: 99%

Practical Collisions for SHAMATA-256

Indesteege

Mendel²,

Preneel

et al. 2009

Selected Areas in Cryptography

Self Cite

View full text Add to dashboard Cite

Abstract. In this paper, we present a collision attack on the SHA-3 submission SHAMATA. SHAMATA is a stream cipher-like hash function design with components of the AES, and it is one of the fastest submitted hash functions. In our attack, we show weaknesses in the message injection and state update of SHAMATA. It is possible to find certain message differences that do not get changed by the message expansion and non-linear part of the state update function. This allows us to find a differential path with a complexity of about 2 96 for SHAMATA-256 and about 2 110 for SHAMATA-512, using a linear low-weight codeword search. Using an efficient guess-and-determine technique we can significantly improve the complexity of this differential path for SHAMATA-256. With a complexity of about 2 40 we are even able to construct practical collisions for the full hash function SHAMATA-256.

show abstract

Section: Basic Attack Strategymentioning

confidence: 99%

Practical Collisions for SHAMATA-256

Indesteege

Mendel²,

Preneel

et al. 2009

Selected Areas in Cryptography

Self Cite

View full text Add to dashboard Cite

show abstract

“…This kind of attack improves the statistical attack which tries as many messages as the inverse of the probability of the differential trail. Such an attack has also been mounted on Panama [19,11] and on Grindahl in [18].…”

Section: Related Workmentioning

confidence: 99%

Analysis of the Collision Resistance of RadioGatúnUsing Algebraic Techniques

Bouillaguet

Fouque

2009

Selected Areas in Cryptography

View full text Add to dashboard Cite

Abstract. In this paper, we present some preliminary results on the security of the RadioGatún hash function. RadioGatún has an internal state of 58 words, and is parameterized by the word size, from one to 64 bits. We mostly study the one-bit version of RadioGatún since according to the authors, attacks on this version also affect the reasonably-sized versions. On this toy version, we revisit the claims of the designers and first improve some results. Secondly, given a differential path, we show how to find a message pair colliding more efficiently than the strategy proposed by the authors using algebraic techniques. We experimented this strategy on the one-bit version since we can efficiently find differential path by brute force. Even though the complexity of this collision attack is higher than the general security claim on RadioGatún 1 , it is still less than the birthday paradox on the size of the internal state.

show abstract

“…In this article, we describe a method to produce collisions for the Panama hash function that refines the method of Rijmen and coworkers [2] and reduces the workload from 2 82 to 2 6 applications of the state updating function. We can therefore generate collisions quasi instantaneously.…”

Section: Introductionmentioning

confidence: 99%

“…3. Like in [2], we use a differential trail (called differential path in [2]) that leads to a zero difference in state and buffer. A differential trail specifies both the message differences and the differences in the state and in the buffer.…”

Section: Introductionmentioning

confidence: 99%

“…For a pair of messages to follow the right differences in the state, a subset of the state bits must satisfy specific conditions. In the attack in [2], part of these conditions were transferred to equations on message words while the remaining ones were satisfied by trying many different message pairs and picking out those for which these conditions happened to be satisfied. In our attack, we transfer all conditions to equations on message bits using some simple new techniques explained in Sec.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Producing Collisions for Panama, Instantaneously

Daemen

Assche

2007

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. We present a practical attack on the Panama hash function that generates a collision in 2 6 evaluations of the state updating function. Our attack improves that of Rijmen and coworkers that had a complexity 2 82 , too high to produce a collision in practice. This improvement comes mainly from the use of techniques to transfer conditions on the state to message words instead of trying many message pairs and using the ones for which the conditions are satisfied. Our attack works for any arbitrary prefix message, followed by a pair of suffix messages with a given difference. We give an example of a collision and make the collision-generating program available. Our attack does not affect the Panama stream cipher, that is still unbroken to the best of our knowledge.

show abstract

Producing Collisions for PANAMA

Cited by 8 publications

References 1 publication

Practical Collisions for SHAMATA-256

Practical Collisions for SHAMATA-256

Analysis of the Collision Resistance of RadioGatúnUsing Algebraic Techniques

Producing Collisions for Panama, Instantaneously

Contact Info

Product

Resources

About