Rebound Attacks on Stribog

Abstract

Abstract. In August 2012, the Stribog hash function was selected as the new Russian hash standard (GOST R 34.11-2012). Stribog is an AES-based primitive and is considered as an asymmetric reply to the new SHA-3. In this paper we investigate the collision resistance of the Stribog compression function and its internal cipher. Specifically, we present a message differential path for the internal block cipher that allows us to efficiently obtain a 5-round free-start collision and a 7.75 free-start near collision for the internal cipher with complexities 2 8 and 2 40 , respectively. Finally, the compression function is analyzed and a 7.75 round semi free-start collision, 8.75 and 9.75 round semi free-start near collisions are presented along with an example for 4.75 round 49 out of 64 bytes near colliding message pair.

Watch your constants: malicious Streebog

“…As for Grøstl-256, a 6-round semi free-start collision is given. Subsequently, rebound attacks have been applied to other AES-based hash functions such as LANE [17], JH [28], Echo [12], Streebog [3], and Grøstl [24]. Various tweaks have been applied to the basic rebound attack in order to construct differential paths that cover more rounds such as merging multiple in-bounds [15], super Sbox cryptanalysis [9], extended 5-round inbound [15], and linearized match-in-themiddle and start-from-the-middle techniques [19].…”

“…This can be done by performing the following steps: [3,3], shared between the two solutions, one needs to repeat the above procedure 2 8 times. For more details on the specifics of the used technique, the reader is referred to [30].…”

“…This solution gives us a specific input and output differences ∆ 1 in and ∆ 1 out at M 1 [3,3] and M L 4 [3,3], respectively. In the sequel, we restart the above two procedures to search for the second differential characteristic and its solution such that this second search covers rounds five to eight and have an input difference ∆ 2 in at M 5 [3,3] equals to the output difference ∆ 1 out of the first path. Since we restrict the input difference of the second path to a specific value, the complexity of the second procedure of our search is increased by a factor of 2 8 .…”

“…Finally, we search for the third and last differential path and its solution which covers rounds nine to twelve. For this path, we have to restrict its input difference [3,3] and its output difference ∆ 3 out at M 12 [3,3] to be equal ∆ 1 in at M 1 [3,3], so that the latter cancels out after the feedforward.…”

“…This fact opens the door to our analysis, which makes use of exactly two parameters: the heavily random looking independent constants and the number of rounds, to present practical collisions for a malicious version of Streebog. Early works related to the cryptanalysis of Streebog have been introduced in [3][4][5]16] and in [13,10,30], where practical semi free-start collision and near collision examples for reduced round versions have been presented in only [3,30].…”