Abstract:The SHA-2 family including SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA512/256 is a U.S. federal standard published by NIST. Especially, there is no doubt that SHA-256 is one of the most important hash functions used in real-world applications. Due to its complex design compared with SHA-1, there is almost no progress in collision attacks on SHA-2 after ASIACRYPT 2015. In this work, we retake this challenge and aim to significantly improve collision attacks on the SHA-2 family. First, we observe from many existing attacks on SHA-2 that the current advanced tool to search for SHA-2 characteristics has reached the bottleneck. Specifically, longer differential characteristics could not be found, and this causes that the collision attack could not reach more steps. To address this issue, we adopt Liu et al.’s MILP-based method and implement it with SAT/SMT for SHA-2, where we also add more techniques to detect contradictions in SHA-2 characteristics. This answers an open problem left in Liu et al.’s paper to apply the technique to SHA-2. With this SAT/SMT-based tool, we search for SHA-2 characteristics by controlling its sparsity in a dedicated way. As a result, we successfully find the first practical semi-free-start (SFS) colliding message pair for 39-step SHA-256, improving the best 38-step SFS collision attack published at EUROCRYPT 2013. In addition, we also report the first practical free-start (FS) collision attack on 40-step SHA-224, while the previously best theoretic 40-step attack has time complexity 2 110 . Moreover, for the first time, we can mount practical and theoretic collision attacks on 28-step and 31-step SHA-512, respectively, which improve the best collision attack only reaching 27 steps of SHA-512 at ASIACRYPT 2015. In a word, with new techniques to find SHA-2 characteristics, we have made some notable progress in the analysis of SHA-2 after the major achievements made at EUROCRYPT 2013 and ASIACRYPT 2015.

SHA-256 Collision Attack with Programmatic SAT

New Records in Collision Attacks on SHA-2.

22-Step Collisions for SHA-2

Finding collisions in the full SHA-1

Automating Collision Attacks on RIPEMD-160

Study the function of building blocks in SHA Family

SAT based error tolerant algebraic side channel attacks

Colliding Message Pairs for 23 and 24-step SHA-512

Practical Collision Attacks Against Round-Reduced SHA-3.

New Collision Attacks on Round-Reduced Keccak.

Analysis of RIPEMD-160: New Collision Attacks and Finding Characteristics with MILP.

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Breaking a New Hash Function Design Strategy Called SMASH

SAT-based Formal Verification of Fault Injection Countermeasures for Cryptographic Circuits

Adaptive Restart and CEGAR-based Solver for Inverting Cryptographic Hash Functions

SAT-based Formal Fault-Resistance Verification of Cryptographic Circuits

Improved 2-round collision attack on IoT hash standard ASCON-HASH

Efficient collision search attacks on SHA-0

Practical Collision Attack on 40-Step RIPEMD-128.

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Partial-Collision Attack on the Round-Reduced Compression Function of Skein-256.