Abstract:The Meet-in-the-Middle (MITM) preimage attack is highly effective in breaking the preimage resistance of many hash functions, including but not limited to the full MD5, HAVAL, and Tiger, and reduced SHA-0/1/2. It was also shown to be a threat to hash functions built on block ciphers like AES by Sasaki in 2011. Recently, such attacks on AES hashing modes evolved from merely using the freedom of choosing the internal state to also exploiting the freedom of choosing the message state. However, detecting such attacks especially those evolved variants is difficult. In previous works, the search space of the configurations of such attacks is limited, such that manual analysis is practical, which results in sub-optimal solutions. In this paper, we remove artificial limitations in previous works, formulate the essential ideas of the construction of the attack in well-defined ways, and translate the problem of searching for the best attacks into optimization problems under constraints in Mixed-Integer-Linear-Programming (MILP) models. The MILP models capture a large solution space of valid attacks; and the objectives of the MILP models are attack configurations with the minimized computational complexity. With such MILP models and using the off-the-shelf solver, it is efficient to search for the best attacks exhaustively. As a result, we obtain the first attacks against the full (5-round) and an extended (5.5-round) version of Haraka-512 v2, and 8-round AES-128 hashing modes, as well as improved attacks covering more rounds of Haraka-256 v2 and other members of AES and Rijndael hashing modes.

Second Preimage Attack on 5-Pass HAVAL and Partial Key-Recovery Attack on HMAC/NMAC-5-Pass HAVAL

Full Key-Recovery Attack on the HMAC/NMAC Based on 3 and 4-Pass HAVAL

Cryptanalysis of the full HAVAL with 4 and 5 passes

Cryptanalysis On Hmac/Nmac-Md5 And Md5-Mac

Differential and Correlation Power Analysis Attacks on HMAC-Whirlpool

An Attack on Hash Function HAVAL-128

MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

Evade Deep Image Retrieval by Stashing Private Images in the Hash Space.

A First-Order Differential Power Analysis Attack on Hmac-Sm3

A Chosen - Plaintext Differential Power Analysis Attack on HMAC - SM3.

Partial Key Recovery Attack on SHA-0-MAC

The second-preimage attack on MD4

Classical and Quantum Meet-in-the-Middle Nostradamus Attacks on AES-like Hashing

Automatic Search of Meet-in-the-Middle Preimage Attacks on AES-like Hashing

A Second Preimage Attack on the XOR Hash Combiner

Meet-in-the-Middle Preimage Attacks on Sponge-based Hashing.

Distinguishing Attack on the Secret-Prefix MAC Based on the 39-Step SHA-256

Cryptanalysis of the Hash Functions MD4 and RIPEMD

Correlation Power Attack on a Message Authentication Code Based on SM3.

Fault-assisted side-channel analysis of HMAC-Streebog