SPN-Hash: Improving the Provable Resistance against Differential Collision Attacks

Abstract

Abstract. Collision resistance is a fundamental property required for cryptographic hash functions. One way to ensure collision resistance is to use hash functions based on public key cryptography (PKC) which reduces collision resistance to a hard mathematical problem, but such primitives are usually slow. A more practical approach is to use symmetric-key design techniques which lead to faster schemes, but collision resistance can only be heuristically inferred from the best probability of a single differential characteristic path. We propose a new hash function design with variable hash output sizes of 128, 256, and 512 bits, that reduces this gap. Due to its inherent Substitution-Permutation Network (SPN) structure and JH mode of operation, we are able to compute its differential collision probability using the concept of differentials. Namely, for each possible input differences, we take into account all the differential paths leading to a collision and this enables us to prove that our hash function is secure against a differential collision attack using a single input difference. None of the SHA-3 finalists could prove such a resistance. At the same time, our hash function design is secure against pre-image, second pre-image and rebound attacks, and is faster than PKC-based hashes. Part of our design includes a generalization of the optimal diffusion used in the classical wide-trail SPN construction from Daemen and Rijmen, which leads to near-optimal differential bounds when applied to non-square byte arrays. We also found a novel way to use parallel copies of a serial matrix over the finite field GF (2 4 ), so as to create lightweight and secure byte-based diffusion for our design. Overall, we obtain hash functions that are fast in software, very lightweight in hardware (about 4625 GE for the 256-bit hash output) and that provide much stronger 2 security proofs regarding collision resistance than any of the SHA-3 finalists.

FOAM: Searching for Hardware-Optimal SPN Structures and Components with a Fair Comparison

“…This has been done already when r < c with a security bound equivalent to the case where r = c (square array) [15]. When r > c and c divides r, a simple generalization has been proposed in [13] where a 4-round security bound is proven when the diffusion matrix is MDS. In this section, we propose a generalized optimal diffusion for the case r > c where c may not divide r and the diffusion matrix may not be MDS, i.e.…”

“…Thus, we extend a new concept from [13] called Generalized Optimal Diffusion (GOD) for r × c cell-array when r > c, which we describe below. Our strategy is to distribute the cells of an input column as uniformly as possible to each output column.…”

“…SC (SubCells) is first applied, followed by MC (MixColumn) and then the optimal diffusion. The Generalized Optimal Diffusion (GOD) defined in [13] applies only when r is a multiple c. Here, we deinfe GOD for any r > c.…”

“…Let us look at an application example of Theorem 1 to derive the number of active S-boxes of an AES-like SPN structure, which cannot be deduced by the known results of [13,15]. Consider an SPN structure with state size 24-cell, the diffusion matrices being an 8 × 8 matrix with branch number 7, i.e.…”

“…If c divides r and B = r + 1, i.e. MixColumn is MDS, then the number of active S-boxes over four rounds is at least (r + 1) × (c + 1) (known result from [13]). 3.…”