Efficient collision search attacks on SHA-0

Xiaoyun Wang,Hongbo Yu,Yiqun Lisa Yin

DOI: https://doi.org/10.1007/11535218_1

2005-01-01

Abstract:In this paper, we present new techniques for collision search in the hash function SHA-0. Using the new techniques, we can find collisions of the full 80-step SHA-0 with complexity less than 239 hash operations.

What problem does this paper attempt to address?

Efficient collision search attacks on SHA-0.

Tao Qin,Hanli Chen,IF Akyildiz,W Su,Y Sankarasubramaniam,E Cayirci,A Perrig,J Stankovic,D Wagner,R Di Pietro,LV Mancini,C Soriente,A Spognardi,G Tsudik,TS Chen,J Chen,YR Tu,MYI Idris,EM Tamil,NM Noor,Z Razak,KW Fong,S Capkun,JP Hubaux,EO Bla,M Zitterbart,J Albath,S Madria,E Laurent,VD Gligor,H Chan,A Perrig,D Song,M Conti,RD Pietro,LV Mancini,A Mei,M De Soete,P D'Arco,H Ren,X Sun,Z Ruan,B Wang,D Wei,HA Chan,B Silombela,Z Su,C Lin,FJ Feng,X Wang,H Yu,X Wang,H Yu,YL Yin

2002-01-01

Information Technology Journal

Abstract:Node capture is a severe threat to data security in Wireless Sensor Networks(WSNs). This paper aimed to design an enhanced and efficient scheme against node capture attack using hash-chain in wireless sensor networks. Key management is the fundamental security mechanism in wireless sensor networks, but existing schemes based on probability have poor resistance to node capture attack. In order to improve the resilience against node capture attack, a hash-chain based scheme to resist node capture attack was presented. The main idea of the proposed consisted of applying a hash function on the initial preloaded keys before deployment. During the key pre-distribution, the selected keys were hashed according to certain rules and the hashed results were as communication key. Theoretical analysis and simulation results show that, key exposal probability and average insecure degree decrease by 56 and …
How to Break MD5 and Other Hash Functions

Xiaoyun Wang,Hongbo Yu

DOI: https://doi.org/10.1007/11426639_2

2005-01-01

Abstract:MD5 is one of the most widely used cryptographic hash functions nowadays. It was designed in 1992 as an improvement of MD4, and its security was widely studied since then by several authors. The best known result so far was a semi free-start collision, in which the initial value of the hash function is replaced by a non-standard value, which is the result of the attack. In this paper we present a new powerful attack on MD5 which allows us to find collisions efficiently. We used this attack to find collisions of MD5 in about 15 minutes up to an hour computation time. The attack is a differential attack, which unlike most differential attacks, does not use the exclusive-or as a measure of difference, but instead uses modular integer subtraction as the measure. We call this kind of differential a modular differential. An application of this attack to MD4 can find a collision in less than a fraction of a second. This attack is also applicable to other hash functions, such as RIPEMD and HAVAL.
Cryptanalysis on SHA 1

Xiaoyun Wang,Andrew C Yao,Frances Yao

2005-01-01

Abstract:Page 1. Cryptanalysis on SHA-1 Xiaoyun Wang, Andrew C Yao, and Frances Yao Xiaoyun Wang Tsinghua University & Shandong Unversity Andrew C Yao Tsinghua University Frances Yao City University of Hong Kong Page 2. Outline ∎ Obstacles for further improvement on SHA-1 attack ∎ New collision path for SHA-1 (First iteration path) ∎ Comparing new collision path with previous path ∎ Strategies for message modification ∎ Details of message modification ∎ The complexity of searching for collisions Page 3. Obstacles for Further Improvement on SHA-1 Attack ∎ Unlike SHA-0 and MD5, many message conditions and chaining variable conditions must co-exist in each step of differential path Page 4. Obstacles for Further Improvement on SHA-1 Attack (continued) ∎ Difficult, because message space available is tight: -- 50 message conditions in steps 17-80 -- hence 50 message conditions in steps 12-16 …
Search framework for neutral bits and boomerangs in SHA-1 collision attacks.

Degang Li,Yang Yang,Guang Zeng

DOI: https://doi.org/10.1049/ise2.12122

2023-01-01

Abstract:AbstractNeutral bits and boomerangs are key techniques for accelerating collision search in SHA‐1 attacks. The current acceleration techniques for SHA‐1 near‐collision attacks are reviewed and a generic search framework for neutral bits and boomerangs is presented. The framework can efficiently construct auxiliary paths for a given differential path and message bit relations and find and store ideal boomerangs. The framework was applied to free‐start attacks for 76‐step SHA‐1, and the complexity was reduced from to . Relaxing the boomerang's restrictions on message words, the authors propose an accelerating technique termed semi‐boomerangs, combined with the search framework of boomerangs, which increases the speed of collision search by 3.48 times in a free‐start attack for 80‐step SHA‐1 and the complexity for 80‐step attack was reduced from to .
22-Step Collisions for SHA-2

Somitra Kumar Sanadhya,Palash Sarkar

DOI: https://doi.org/10.48550/arXiv.0803.1220

2008-03-08

Abstract:In this note, we provide the first 22-step collisions for SHA-256 and SHA-512. Detailed technique of generating these collisions will be provided in the next revision of this note.

Cryptography and Security
Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

Hongbo Yu,Xiaoyun Wang

DOI: https://doi.org/10.1007/978-3-540-76788-6_17

2007-01-01

Abstract:In this paper, we present a new type of multi-collision attack on the compression functions of both MD4 and 3-Pass HAVAL. Different from Joux's multi-collision attack, our method focuses on the multi-collision of the compression function. For MD4, we utilize two different feasible collision differential paths to find a 4-collision with about 2 21 MD4 computations. For 3-Pass HAVAL, we can find a 4-collision with complexity about 2(30) and a 8-near-collision with complexity 2(9).
SHA-256 Collision Attack with Programmatic SAT

Nahiyan Alamgir,Saeed Nejati,Curtis Bright

2024-06-29

Abstract:Cryptographic hash functions play a crucial role in ensuring data security, generating fixed-length hashes from variable-length inputs. The hash function SHA-256 is trusted for data security due to its resilience after over twenty years of intense scrutiny. One of its critical properties is collision resistance, meaning that it is infeasible to find two different inputs with the same hash. Currently, the best SHA-256 collision attacks use differential cryptanalysis to find collisions in simplified versions of SHA-256 that are reduced to have fewer steps, making it feasible to find collisions. In this paper, we use a satisfiability (SAT) solver as a tool to search for step-reduced SHA-256 collisions, and dynamically guide the solver with the aid of a computer algebra system (CAS) used to detect inconsistencies and deduce information that the solver would otherwise not detect on its own. Our hybrid SAT + CAS solver significantly outperformed a pure SAT approach, enabling us to find collisions in step-reduced SHA-256 with significantly more steps. Using SAT + CAS, we find a 38-step collision of SHA-256 with a modified initialization vector -- something first found by a highly sophisticated search tool of Mendel, Nad, and Schläffer. Conversely, a pure SAT approach could find collisions for no more than 28 steps. However, our work only uses the SAT solver CaDiCaL and its programmatic interface IPASIR-UP.

Cryptography and Security,Discrete Mathematics,Logic in Computer Science,Symbolic Computation
A Lightweight Detection Algorithm for Collision-Optimized Divide-and-Conquer Attacks

Changhai Ou,Siew-Kei Lam,Chengju Zhou,Guiyuan Jiang,Fan Zhang

DOI: https://doi.org/10.1109/tc.2020.3002795

IF: 3.183

2020-01-01

IEEE Transactions on Computers

Abstract:By introducing collision information into divide-and-conquer attacks, several existing works transform the original candidate space, which may be too large to enumerate, into a significantly smaller collision space, thus making key recovery possible. However, the inefficient collision detection algorithms and fault tolerance mechanisms make them time-consuming and their success rate low. Moreover, they may still leave very huge chain spaces that makes it difficult for key recovery. In this article, we exploit collision attack to optimize Template Attack (TA), and propose a Lightweight Collision Detection (LCD) algorithm. The proposed method exploits a jump detection mechanism to efficiently reduce the repetitive collision detections on chains with the same prefix sub-chains. We then introduce guessing theory to reorder the collision detection of the sub-keys according to their guessing lengths, and provide us with an evaluation tool. Finally, we design a highly efficient fault tolerance mechanism for our LCD to allow flexible thresholds adjustment, and further optimize sieving mechanism to efficiently extract the best chains with the largest number of collisions. Experimental results fully demonstrate LCD's superiority.
MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

Haiyan Yu,Xiaoyun Wang

2007-01-01

Abstract:In this paper, we present a new type of MultiCollision attack on the compression functions both of MD4 and 3-Pass HAVAL. For MD4, we utilize two feasible different collision differential paths to find a 4collision with 2 MD4 computations. For 3-Pass HAVAL, we present three near-collision differential paths to find a 8-NearCollision with 2 HAVAL computations.
An Attack on Hash Function HAVAL-128

Wang Xiaoyun,Feng Dengguo,Yu Xiuyuan

DOI: https://doi.org/10.1360/122004-107

2005-01-01

Abstract:In this paper, we give a fast attack against hash function—HAVAL-128. HAVAL was presented by Y. L. Zheng et al. at Auscrypto’92. It can be processed in 3, 4 or 5 passes, and produces 128, 160, 192, or 224-bit fingerprint. We break the HAVAL with 128-bit fingerprint. The conclusion is that, given any 1024-bit message m, we just make some modifications about m, and the modified message m can collide with another message m′ only with probability 1/27, where m′=m+Δm, in which Δm is a fixed difference selected in advance. In addition, two collision examples for HAVAL-128 are given in this paper.
Cryptanalysis of the full HAVAL with 4 and 5 passes

Hongbo Yu,Xiaoyun Wang,Aaram Yun,Sangwoo Park

DOI: https://doi.org/10.1007/11799313_7

2006-01-01

Abstract:HAVAL is a cryptographic hash function with variable digest size proposed by Zheng, Pieprzyk and Seberry in 1992. It has three variants, 3-, 4-, and 5-pass HAVAL. Previous results on HAVAL suggested only practical collision attacks for 3-pass HAVAL. In this paper, we present collision attacks for 4 and 5 pass HAVAL. For 4-pass HAVAL, we describe two practical attacks for finding 2-block collisions, one with 243 computations and the other with 236 computations. In addition, we show that collisions for 5-pass HAVAL can be found with about 2123 computations, which is the first attack more efficient than the birthday attack.
Cryptanalysis of the Hash Functions MD4 and RIPEMD

Xiaoyun Wang,Xuejia Lai,Dengguo Feng,Hui Chen,Xiuyuan Yu

DOI: https://doi.org/10.1007/11426639_1

2005-01-01

Abstract:MD4 is a hash function developed by Rivest in 1990. It serves as the basis for most of the dedicated hash functions such as MD5, SHAx, RIPEMD, and HAVAL. In 1996, Dobbertin showed how to find collisions of MD4 with complexity equivalent to 220 MD4 hash computations. In this paper, we present a new attack on MD4 which can find a collision with probability 2− 2 to 2− 6, and the complexity of finding a collision doesn’t exceed 28 MD4 hash operations. Built upon the collision search attack, we present a chosen-message pre-image attack on MD4 with complexity below 28. Furthermore, we show that for a weak message, we can find another message that produces the same hash value. The complexity is only a single MD4 computation, and a random message is a weak message with probability 2− 122.The attack on MD4 can be directly applied to RIPEMD which has two parallel copies of MD4, and the complexity of finding a collision is about 218 RIPEMD hash operations.
The NISQ Complexity of Collision Finding

Yassine Hamoudi,Qipeng Liu,Makrand Sinha

2024-02-28

Abstract:Collision-resistant hashing, a fundamental primitive in modern cryptography, ensures that there is no efficient way to find distinct inputs that produce the same hash value. This property underpins the security of various cryptographic applications, making it crucial to understand its complexity. The complexity of this problem is well-understood in the classical setting and $\Theta(N^{1/2})$ queries are needed to find a collision. However, the advent of quantum computing has introduced new challenges since quantum adversaries $\unicode{x2013}$ equipped with the power of quantum queries $\unicode{x2013}$ can find collisions much more efficiently. Brassard, Höyer and Tapp and Aaronson and Shi established that full-scale quantum adversaries require $\Theta(N^{1/3})$ queries to find a collision, prompting a need for longer hash outputs, which impacts efficiency in terms of the key lengths needed for security. This paper explores the implications of quantum attacks in the Noisy-Intermediate Scale Quantum (NISQ) era. In this work, we investigate three different models for NISQ algorithms and achieve tight bounds for all of them: (1) A hybrid algorithm making adaptive quantum or classical queries but with a limited quantum query budget, or (2) A quantum algorithm with access to a noisy oracle, subject to a dephasing or depolarizing channel, or (3) A hybrid algorithm with an upper bound on its maximum quantum depth; i.e., a classical algorithm aided by low-depth quantum circuits. In fact, our results handle all regimes between NISQ and full-scale quantum computers. Previously, only results for the pre-image search problem were known for these models by Sun and Zheng, Rosmanis, Chen, Cotler, Huang and Li while nothing was known about the collision finding problem.

Quantum Physics,Computational Complexity,Cryptography and Security,Data Structures and Algorithms
CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Changhai Ou,Debiao He,Kexin Qiao,Shihui Zheng,Siew-Kei Lam,Fan Zhang

DOI: https://doi.org/10.1109/tcad.2023.3288512

IF: 2.9

2023-01-01

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

Abstract:By introducing collision information into divide-and-conquer distinguishers, the existing collision-optimized side-channel attacks transform the given candidate space into a significantly smaller collision space, thus achieving more efficient key recovery. However, the candidates of the first several subkeys shared by collision chains are still repeatedly detected, which happens very frequently and brings huge computational overhead. To alleviate this, we propose a highly efficient collision-optimized attack named collision tree (CoTree). This collision detection tool exploits tree structure to store the chains created from the same subchain on the same branch, thus significantly reducing the storage requirements. It then benefits from the properties of both tree and collisions and exploits a top-down tree building procedure and traverses each node only once when detecting their collisions with a candidate of the subkey currently under consideration. Finally, unlike the traditional top-down node removal, CoTree launches a bottom-up branch removal procedure to remove the chains unsatisfying the collision conditions from the tree after traversing all the considered candidates of this subkey, thus avoiding the traversal of the branches satisfying the collision condition. These strategies make our CoTree significantly alleviate the repetitive collision detection, and our experiments verify that it significantly outperforms the existing works.
Improved 2-round collision attack on IoT hash standard ASCON-HASH

Di Zhai,Wei Bai,Jianding Fu,Hongjian Gao,Xueqiong Zhu

DOI: https://doi.org/10.1016/j.heliyon.2024.e26119

IF: 3.776

2024-02-28

Heliyon

Abstract:Lightweight cryptography algorithms are a class of ciphers designed to protect data generated and transmitted by the Internet of Things. They typically have low requirements in terms of storage space and power consumption, and are well-suited for resource-limited application scenarios such as embedded systems, actuators, and sensors. The NIST-approved competition for lightweight cryptography aims to identify lightweight cryptographic algorithms that can serve as standards. Its objective is to enhance data security in various scenarios. Among the chosen standards for lightweight cryptography, ASCON has been selected. ASCON-HASH is a hash function within the ASCON family. This paper presents a detailed analysis of the differential characteristics of ASCON-HASH, utilizing the quadratic S-box. Additionally, we employ message modification techniques and ultimately demonstrate a non-practical collision attack on the 2-round ASCON-HASH, requiring a time complexity of 2 98 hash function calls.
Partial Key Recovery Attack on SHA-0-MAC

QIAO Si-yuan,JIA Ke-ting

2010-01-01

Abstract:A partial key recovery attack on SHA-0-MAC is presented, which is the first partial key recovery attack on SHA-0-MAC. SHA-0-MAC is a kind of MDx-MAC based on hash function SHA-0. MDx-MAC was first proposed by Preneel et al. in Crypto'95,which has 3 160-bit subkeys K0 K1, K2. 160-bit K0 can be fully recovered, and 128 bits of the subkey K1 with 2125.58 MAC queries. By using Wang's new methods of partial key recovery of MD5-MAC and a special pseudo collision differential path given by Biham et al. , the sufficient conditions are deduced which make the differential path hold.
Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Amit Kumar Chauhan,Abhishek Kumar,Somitra Kumar Sanadhya

DOI: https://doi.org/10.46586/tosc.v2021.i1.316-336

2021-03-19

IACR Transactions on Symmetric Cryptology

Abstract:Recently, Hosoyamada and Sasaki (EUROCRYPT 2020), and Xiaoyang Dong et al. (ASIACRYPT 2020) proposed quantum collision attacks against AES-like hashing modes AES-MMO and AES-MP. Their collision attacks are based on the quantum version of the rebound attack technique exploiting the differential trails whose probabilities are too low to be useful in the classical setting but large enough in the quantum setting. In this work, we present dedicated quantum free-start collision attacks on Hirose’s double block length compression function instantiated with AES-256, namely HCF-AES-256. The best publicly known classical attack against HCF-AES-256 covers up to 9 out of 14 rounds. We present a new 10-round differential trail for HCF-AES-256 with probability 2−160, and use it to find collisions with a quantum version of the rebound attack. Our attack succeeds with a time complexity of 285.11 and requires 216 qRAM in the quantum-attack setting, where an attacker can make only classical queries to the oracle and perform offline computations. We also present a quantum free-start collision attack on HCF-AES-256 with a time complexity of 286.07 which outperforms Chailloux, Naya-Plasencia, and Schrottenloher’s generic quantum collision attack (ASIACRYPT 2017) in a model when large qRAM is not available.
Snowball: Another View on Side-Channel Key Recovery Tools.

Jiangshan Long,Changhai Ou,Zhu Wang,Shihui Zheng,Fei Yan,Fan Zhang,Siew-Kei Lam

2022-01-01

Abstract:The performance of Side-Channel Attacks (SCAs) decays rapidly when considering more sub-keys, making the full-key recovery a very challenging problem. Limited to independent collision information utilization, collision attacks establish the relationship among sub-keys but do not signiﬁcantly slow down this trend. To solve it, we ﬁrst exploit the samples from the previously attacked S-boxes to assist attacks on the targeted S-box under an assumption that similar leakage occurs in program loop or code reuse scenarios. The later considered S-boxes are easier to be recovered since more samples participate in this assist attack, which results in the “snowball” eﬀect. We name this scheme as Snowball, which signiﬁcantly slows down the attenuation rate of attack performance. We further introduce confusion coeﬃcient into the collision attack to construct collision confusion coeﬃcient, and deduce its relationship with correlation coeﬃcient. Based on this relationship, we give two optimizations on our Snowball exploiting the “values” information and “rankings” information of collision correlation coeﬃcients named Least Deviation from Pearson correlation coeﬃcient (PLD) and Least Deviation from confusion coeﬃcient (CLD). Experiments show that the above optimizations signiﬁcantly improve the performance of our Snowball.
Time-Space Lower Bounds for Finding Collisions in Merkle–Damgård Hash Functions

Akshima,Siyao Guo,Qipeng Liu

DOI: https://doi.org/10.1007/s00145-024-09491-9

2024-02-16

Journal of Cryptology

Abstract:We revisit the problem of finding B -block-long collisions in Merkle–Damgård Hash Functions in the auxiliary-input random oracle model, in which an attacker gets a piece of S -bit advice about the random oracle and makes T oracle queries. Akshima, Cash, Drucker and Wee (CRYPTO 2020), based on the work of Coretti, Dodis, Guo and Steinberger (EUROCRYPT 2018), showed a simple attack for (with respect to a random salt). The attack achieves advantage where n is the output length of the random oracle. They conjectured that this attack is optimal. However, this so-called STB conjecture was only proved for and . Very recently, Ghoshal and Komargodski (CRYPTO 2022) confirmed the STB conjecture for all constant values of B and provided an bound for all choices of B . In this work, we prove an bound for every . Our bound confirms the STB conjecture for and is optimal up to a factor of S for (note as is always at most , otherwise finding a collision is trivial by the birthday attack). Our result subsumes all previous upper bounds for all ranges of parameters except for and . We obtain our results by adopting and refining the technique of Chung, Guo, Liu and Qian (FOCS 2020). Our approach yields more modular proofs and sheds light on how to bypass the limitations of prior techniques. Along the way, we obtain a considerably simpler and illuminating proof for , recovering the main result of Akshima, Cash, Drucker and Wee.

computer science, theory & methods,engineering, electrical & electronic,mathematics, applied
Hash Function Based on Quantum Walks

Yu-Guang Yang,Jing-Lin Bi,Dan Li,Yi-Hua Zhou,Wei-Min Shi

DOI: https://doi.org/10.1007/s10773-019-04081-z

2019-03-13

International Journal of Theoretical Physics

Abstract:Higher security and lower collision rate have always been people's pursuits in the construction of hash functions. We consider a quantum walk where a walker is driven by two coins alternately. At each step, a message bit decides whether to swap two coins. In this way, a keyed hash function is constructed. Theoretically infinite possibilities of the initial parameters as the key ensure the security of the proposed hash function against the unforgery and collision resistance. Finally, we establish a generic quantum walk-based hash function model and give a guide in constructing hash functions in quantum walk architecture. It also provides a clue for the construction of other quantum walk-based cryptography protocols.

physics, multidisciplinary

Efficient collision search attacks on SHA-0

Efficient collision search attacks on SHA-0.

How to Break MD5 and Other Hash Functions

Cryptanalysis on SHA 1

Search framework for neutral bits and boomerangs in SHA-1 collision attacks.

22-Step Collisions for SHA-2

Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

SHA-256 Collision Attack with Programmatic SAT

A Lightweight Detection Algorithm for Collision-Optimized Divide-and-Conquer Attacks

MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

An Attack on Hash Function HAVAL-128

Cryptanalysis of the full HAVAL with 4 and 5 passes

Cryptanalysis of the Hash Functions MD4 and RIPEMD

The NISQ Complexity of Collision Finding

CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Improved 2-round collision attack on IoT hash standard ASCON-HASH

Partial Key Recovery Attack on SHA-0-MAC

Quantum Free-Start Collision Attacks on Double Block Length Hashing with Round-Reduced AES-256

Snowball: Another View on Side-Channel Key Recovery Tools.

Time-Space Lower Bounds for Finding Collisions in Merkle–Damgård Hash Functions

Hash Function Based on Quantum Walks