Second-Order Differential Collisions for Reduced SHA-256

Abstract

Abstract. In this work, we introduce a new non-random property for hash/compression functions using the theory of higher order differentials. Based on this, we show a second-order differential collision for the compression function of SHA-256 reduced to 47 out of 64 steps with practical complexity. We have implemented the attack and provide an example. Our results suggest that the security margin of SHA-256 is much lower than the security margin of most of the SHA-3 finalists in this setting. The techniques employed in this attack are based on a rectangle/boomerang approach and cover advanced search algorithms for good characteristics and message modification techniques. Our analysis also exposes flaws in all of the previously published related-key rectangle attacks on the SHACAL-2 block cipher, which is based on SHA-256. We provide valid rectangles for 48 steps of SHACAL-2.

The Boomerang Attacks on BLAKE and BLAKE2

“…About the boomerang attack on hash functions, we mainly review the known-related-key boomerang method given in [19]. We consider the compression function, denoted by CF , as CF (M, K) = E(M, K) + M and that it can be decomposed into two sub-functions as CF = CF 1 • CF 0 .…”

“…We consider the compression function, denoted by CF , as CF (M, K) = E(M, K) + M and that it can be decomposed into two sub-functions as CF = CF 1 • CF 0 . In this way, we can start from the middle steps since M and the key K can be chosen randomly [19,23]. Then we have a backward (top) differential characteristic (β, β k ) → α with probability p for CF −1 0 , and a forward (bottom) differential characteristic (γ, γ k ) → δ with probability q for CF 1 .…”

The Boomerang Attacks on the Round-Reduced Skein-512

“…In the known-key setting, a (related-key) boomerang attack can be used to distinguish a given permutation from a random oracle; it is called known-related-key boomerang attack in [5]. Applying the known-related-key boomerang attack to the compression function in the MMO mode, i.e, CF (K, M ) = E K (M ) + M , it is possible to start from the middle rounds because the message M and the key K can be selected randomly (refer to [5] and [14]).…”

“…Applying the known-related-key boomerang attack to the compression function in the MMO mode, i.e, CF (K, M ) = E K (M ) + M , it is possible to start from the middle rounds because the message M and the key K can be selected randomly (refer to [5] and [14]). The (known-relatedkey) boomerang attack is particularly efficient for the ARX-type hash functions because their compression functions have strong diffusion after several steps, only short differential paths with high probabilities can be found.…”

“…Based on the differential paths, we give boomerang distinguisher on the compression function of Skein-512 reduced to 32 round with complexity 2 104. 5 . The distinguisher can be extended to 36 rounds by adding two more rounds on the top and bottom of the differential paths respectively.…”