The Boomerang Attacks on the Round-Reduced Skein-512

Abstract

Abstract. The hash function Skein is one of the five finalists of the NIST SHA-3 competition; it is based on the block cipher Threefish which only uses three primitive operations: modular addition, rotation and bitwise XOR (ARX). This paper studies the boomerang attacks on Skein-512. Boomerang distinguishers on the compression function reduced to 32 and 36 rounds are proposed, with complexities 2 104.5 and 2 454 respectively. Examples of the distinguishers on 28-round and 31-round are also given. In addition, the boomerang distinguishers are applicable to the key-recovery attacks on reduced Threefish-512. The complexities for key-recovery attacks reduced to 32-/33-/34-round are about 2 181 , 2 305 and 2 424 . Because Laurent et al. [14] pointed out that the previous boomerang distinguishers for Threefish-512 are in fact not compatible, our attacks are the first valid boomerang attacks for the final round Skein-512.

Improved boomerang attacks on round‐reduced SM3 and keyed permutation of BLAKE‐256

“…According to the differences of the given example, it is supposed to be generated by adding one step after their 32-step distinguisher. Then, we study the given 33-step boomerang : 3, 4,5, 7,10, 12, 21, 22, 23, 28, 30, 32 E 0 : 13 F 0 : 13 G 0 : 13, 32 H 0 : 4,5,7,10,12,13,21,22,28,30,32 w 0 : 4, 5,7, 12, 20, 21, 22, 28, 30 w' 0 : 4, 5,7, 12, 20, 21, 22, 28, 30 SS1 0,10 = A 0,23 , SS1 0,20 = E 0,13 D 0,23 ≠ (A 0 ⊕ B 0 ⊕ C 0 ) 23 D 0,i ≠ SS2 0,i (i = 3, 10) D 0,i ≠ w' 0,i (i = 4, 5,7, 12, 21, 22, 28, 30) SS2 0,20 ≠ w' 0,20 H 0,13 ≠ (E 0 ⊕ F 0 ⊕ G 0 ) 13 H 0,i ≠ w 0,i (i = 4, 5,7, 12, 21, 22, 28, 30) H 0,10 ≠ SS1 0,10 , SS1 0,20 ≠ w 0,20 [17] and find some contradictions between the two differential characteristics.…”

“…For an n-bit random function, there exist three types of boomerang distinguishers according to the input and output differences (refer to [6,11,12]). …”

Boomerang Attack on Step-Reduced SHA-512

“…In their works, the boomerang attacks are standalone distinguishers and work in the same way as for block ciphers -by producing the quartet of plaintexts and ciphertexts (input chaining values and output chaining values). Boomerang distinguishers have also been applied to SIMD-512 [18], HAVAL [27], RIPEMD [28], HAS-160 [29], Skein [9,35] and SM3 [16,3].…”

Information Security and Cryptology

“…The first application presented in [13] used the idea of boomerang attack for the message modification technique in the collision attack for SHA-1. Boomerang distinguishers have also been applied to SIMD-512 [18], HAVAL [27], RIPEMD [28], HAS-160 [29], Skein [9,35] and SM3 [3,16]. The standard applications of boomerang attack to hash function were independently proposed by Biryukov et al on BLAKE [6] and Lamberger and Mendel on the SHA-2 family [17].…”

“…Until 2009, the first FHE scheme was constructed by Gentry [19,20]. A great many FHE schemes have been constructed, e.g., [4,6,7,[10][11][12]14,21,23,25,27,35] and references therein. A great many FHE schemes have been constructed, e.g., [4,6,7,[10][11][12]14,21,23,25,27,35] and references therein.…”