Finding collisions in the full SHA-1

Xiaoyun Wang,Yiqun Lisa Yin,Hongbo Yu

DOI: https://doi.org/10.1007/11535218_2

2005-01-01

Abstract:In this paper, we present new collision search attacks on the hash function SHA-1. We show that collisions of SHA-1 can be found with complexity less than 269 hash operations. This is the first attack on the full 80-step SHA-1 with complexity less than the 280 theoretical bound.

What problem does this paper attempt to address?

Efficient collision search attacks on SHA-0

Xiaoyun Wang,Hongbo Yu,Yiqun Lisa Yin

DOI: https://doi.org/10.1007/11535218_1

2005-01-01

Abstract:In this paper, we present new techniques for collision search in the hash function SHA-0. Using the new techniques, we can find collisions of the full 80-step SHA-0 with complexity less than 239 hash operations.
Cryptanalysis on SHA 1

Xiaoyun Wang,Andrew C Yao,Frances Yao

2005-01-01

Abstract:Page 1. Cryptanalysis on SHA-1 Xiaoyun Wang, Andrew C Yao, and Frances Yao Xiaoyun Wang Tsinghua University & Shandong Unversity Andrew C Yao Tsinghua University Frances Yao City University of Hong Kong Page 2. Outline ∎ Obstacles for further improvement on SHA-1 attack ∎ New collision path for SHA-1 (First iteration path) ∎ Comparing new collision path with previous path ∎ Strategies for message modification ∎ Details of message modification ∎ The complexity of searching for collisions Page 3. Obstacles for Further Improvement on SHA-1 Attack ∎ Unlike SHA-0 and MD5, many message conditions and chaining variable conditions must co-exist in each step of differential path Page 4. Obstacles for Further Improvement on SHA-1 Attack (continued) ∎ Difficult, because message space available is tight: -- 50 message conditions in steps 17-80 -- hence 50 message conditions in steps 12-16 …
How to Break MD5 and Other Hash Functions

Xiaoyun Wang,Hongbo Yu

DOI: https://doi.org/10.1007/11426639_2

2005-01-01

Abstract:MD5 is one of the most widely used cryptographic hash functions nowadays. It was designed in 1992 as an improvement of MD4, and its security was widely studied since then by several authors. The best known result so far was a semi free-start collision, in which the initial value of the hash function is replaced by a non-standard value, which is the result of the attack. In this paper we present a new powerful attack on MD5 which allows us to find collisions efficiently. We used this attack to find collisions of MD5 in about 15 minutes up to an hour computation time. The attack is a differential attack, which unlike most differential attacks, does not use the exclusive-or as a measure of difference, but instead uses modular integer subtraction as the measure. We call this kind of differential a modular differential. An application of this attack to MD4 can find a collision in less than a fraction of a second. This attack is also applicable to other hash functions, such as RIPEMD and HAVAL.
SHA-256 Collision Attack with Programmatic SAT

Nahiyan Alamgir,Saeed Nejati,Curtis Bright

2024-06-29

Abstract:Cryptographic hash functions play a crucial role in ensuring data security, generating fixed-length hashes from variable-length inputs. The hash function SHA-256 is trusted for data security due to its resilience after over twenty years of intense scrutiny. One of its critical properties is collision resistance, meaning that it is infeasible to find two different inputs with the same hash. Currently, the best SHA-256 collision attacks use differential cryptanalysis to find collisions in simplified versions of SHA-256 that are reduced to have fewer steps, making it feasible to find collisions. In this paper, we use a satisfiability (SAT) solver as a tool to search for step-reduced SHA-256 collisions, and dynamically guide the solver with the aid of a computer algebra system (CAS) used to detect inconsistencies and deduce information that the solver would otherwise not detect on its own. Our hybrid SAT + CAS solver significantly outperformed a pure SAT approach, enabling us to find collisions in step-reduced SHA-256 with significantly more steps. Using SAT + CAS, we find a 38-step collision of SHA-256 with a modified initialization vector -- something first found by a highly sophisticated search tool of Mendel, Nad, and Schläffer. Conversely, a pure SAT approach could find collisions for no more than 28 steps. However, our work only uses the SAT solver CaDiCaL and its programmatic interface IPASIR-UP.

Cryptography and Security,Discrete Mathematics,Logic in Computer Science,Symbolic Computation
Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

Hongbo Yu,Xiaoyun Wang

DOI: https://doi.org/10.1007/978-3-540-76788-6_17

2007-01-01

Abstract:In this paper, we present a new type of multi-collision attack on the compression functions of both MD4 and 3-Pass HAVAL. Different from Joux's multi-collision attack, our method focuses on the multi-collision of the compression function. For MD4, we utilize two different feasible collision differential paths to find a 4-collision with about 2 21 MD4 computations. For 3-Pass HAVAL, we can find a 4-collision with complexity about 2(30) and a 8-near-collision with complexity 2(9).
MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

Haiyan Yu,Xiaoyun Wang

2007-01-01

Abstract:In this paper, we present a new type of MultiCollision attack on the compression functions both of MD4 and 3-Pass HAVAL. For MD4, we utilize two feasible different collision differential paths to find a 4collision with 2 MD4 computations. For 3-Pass HAVAL, we present three near-collision differential paths to find a 8-NearCollision with 2 HAVAL computations.
22-Step Collisions for SHA-2

Somitra Kumar Sanadhya,Palash Sarkar

DOI: https://doi.org/10.48550/arXiv.0803.1220

2008-03-08

Abstract:In this note, we provide the first 22-step collisions for SHA-256 and SHA-512. Detailed technique of generating these collisions will be provided in the next revision of this note.

Cryptography and Security
Cryptanalysis of the full HAVAL with 4 and 5 passes

Hongbo Yu,Xiaoyun Wang,Aaram Yun,Sangwoo Park

DOI: https://doi.org/10.1007/11799313_7

2006-01-01

Abstract:HAVAL is a cryptographic hash function with variable digest size proposed by Zheng, Pieprzyk and Seberry in 1992. It has three variants, 3-, 4-, and 5-pass HAVAL. Previous results on HAVAL suggested only practical collision attacks for 3-pass HAVAL. In this paper, we present collision attacks for 4 and 5 pass HAVAL. For 4-pass HAVAL, we describe two practical attacks for finding 2-block collisions, one with 243 computations and the other with 236 computations. In addition, we show that collisions for 5-pass HAVAL can be found with about 2123 computations, which is the first attack more efficient than the birthday attack.
Cryptanalysis of the Hash Functions MD4 and RIPEMD

Xiaoyun Wang,Xuejia Lai,Dengguo Feng,Hui Chen,Xiuyuan Yu

DOI: https://doi.org/10.1007/11426639_1

2005-01-01

Abstract:MD4 is a hash function developed by Rivest in 1990. It serves as the basis for most of the dedicated hash functions such as MD5, SHAx, RIPEMD, and HAVAL. In 1996, Dobbertin showed how to find collisions of MD4 with complexity equivalent to 220 MD4 hash computations. In this paper, we present a new attack on MD4 which can find a collision with probability 2− 2 to 2− 6, and the complexity of finding a collision doesn’t exceed 28 MD4 hash operations. Built upon the collision search attack, we present a chosen-message pre-image attack on MD4 with complexity below 28. Furthermore, we show that for a weak message, we can find another message that produces the same hash value. The complexity is only a single MD4 computation, and a random message is a weak message with probability 2− 122.The attack on MD4 can be directly applied to RIPEMD which has two parallel copies of MD4, and the complexity of finding a collision is about 218 RIPEMD hash operations.
Efficient collision search attacks on SHA-0.

Tao Qin,Hanli Chen,IF Akyildiz,W Su,Y Sankarasubramaniam,E Cayirci,A Perrig,J Stankovic,D Wagner,R Di Pietro,LV Mancini,C Soriente,A Spognardi,G Tsudik,TS Chen,J Chen,YR Tu,MYI Idris,EM Tamil,NM Noor,Z Razak,KW Fong,S Capkun,JP Hubaux,EO Bla,M Zitterbart,J Albath,S Madria,E Laurent,VD Gligor,H Chan,A Perrig,D Song,M Conti,RD Pietro,LV Mancini,A Mei,M De Soete,P D'Arco,H Ren,X Sun,Z Ruan,B Wang,D Wei,HA Chan,B Silombela,Z Su,C Lin,FJ Feng,X Wang,H Yu,X Wang,H Yu,YL Yin

2002-01-01

Information Technology Journal

Abstract:Node capture is a severe threat to data security in Wireless Sensor Networks(WSNs). This paper aimed to design an enhanced and efficient scheme against node capture attack using hash-chain in wireless sensor networks. Key management is the fundamental security mechanism in wireless sensor networks, but existing schemes based on probability have poor resistance to node capture attack. In order to improve the resilience against node capture attack, a hash-chain based scheme to resist node capture attack was presented. The main idea of the proposed consisted of applying a hash function on the initial preloaded keys before deployment. During the key pre-distribution, the selected keys were hashed according to certain rules and the hashed results were as communication key. Theoretical analysis and simulation results show that, key exposal probability and average insecure degree decrease by 56 and …
An Attack on Hash Function HAVAL-128

Wang Xiaoyun,Feng Dengguo,Yu Xiuyuan

DOI: https://doi.org/10.1360/122004-107

2005-01-01

Abstract:In this paper, we give a fast attack against hash function—HAVAL-128. HAVAL was presented by Y. L. Zheng et al. at Auscrypto’92. It can be processed in 3, 4 or 5 passes, and produces 128, 160, 192, or 224-bit fingerprint. We break the HAVAL with 128-bit fingerprint. The conclusion is that, given any 1024-bit message m, we just make some modifications about m, and the modified message m can collide with another message m′ only with probability 1/27, where m′=m+Δm, in which Δm is a fixed difference selected in advance. In addition, two collision examples for HAVAL-128 are given in this paper.
Search framework for neutral bits and boomerangs in SHA-1 collision attacks.

Degang Li,Yang Yang,Guang Zeng

DOI: https://doi.org/10.1049/ise2.12122

2023-01-01

Abstract:AbstractNeutral bits and boomerangs are key techniques for accelerating collision search in SHA‐1 attacks. The current acceleration techniques for SHA‐1 near‐collision attacks are reviewed and a generic search framework for neutral bits and boomerangs is presented. The framework can efficiently construct auxiliary paths for a given differential path and message bit relations and find and store ideal boomerangs. The framework was applied to free‐start attacks for 76‐step SHA‐1, and the complexity was reduced from to . Relaxing the boomerang's restrictions on message words, the authors propose an accelerating technique termed semi‐boomerangs, combined with the search framework of boomerangs, which increases the speed of collision search by 3.48 times in a free‐start attack for 80‐step SHA‐1 and the complexity for 80‐step attack was reduced from to .
The NISQ Complexity of Collision Finding

Yassine Hamoudi,Qipeng Liu,Makrand Sinha

2024-02-28

Abstract:Collision-resistant hashing, a fundamental primitive in modern cryptography, ensures that there is no efficient way to find distinct inputs that produce the same hash value. This property underpins the security of various cryptographic applications, making it crucial to understand its complexity. The complexity of this problem is well-understood in the classical setting and $\Theta(N^{1/2})$ queries are needed to find a collision. However, the advent of quantum computing has introduced new challenges since quantum adversaries $\unicode{x2013}$ equipped with the power of quantum queries $\unicode{x2013}$ can find collisions much more efficiently. Brassard, Höyer and Tapp and Aaronson and Shi established that full-scale quantum adversaries require $\Theta(N^{1/3})$ queries to find a collision, prompting a need for longer hash outputs, which impacts efficiency in terms of the key lengths needed for security. This paper explores the implications of quantum attacks in the Noisy-Intermediate Scale Quantum (NISQ) era. In this work, we investigate three different models for NISQ algorithms and achieve tight bounds for all of them: (1) A hybrid algorithm making adaptive quantum or classical queries but with a limited quantum query budget, or (2) A quantum algorithm with access to a noisy oracle, subject to a dephasing or depolarizing channel, or (3) A hybrid algorithm with an upper bound on its maximum quantum depth; i.e., a classical algorithm aided by low-depth quantum circuits. In fact, our results handle all regimes between NISQ and full-scale quantum computers. Previously, only results for the pre-image search problem were known for these models by Sun and Zheng, Rosmanis, Chen, Cotler, Huang and Li while nothing was known about the collision finding problem.

Quantum Physics,Computational Complexity,Cryptography and Security,Data Structures and Algorithms
Time-Space Lower Bounds for Finding Collisions in Merkle–Damgård Hash Functions

Akshima,Siyao Guo,Qipeng Liu

DOI: https://doi.org/10.1007/s00145-024-09491-9

2024-02-16

Journal of Cryptology

Abstract:We revisit the problem of finding B -block-long collisions in Merkle–Damgård Hash Functions in the auxiliary-input random oracle model, in which an attacker gets a piece of S -bit advice about the random oracle and makes T oracle queries. Akshima, Cash, Drucker and Wee (CRYPTO 2020), based on the work of Coretti, Dodis, Guo and Steinberger (EUROCRYPT 2018), showed a simple attack for (with respect to a random salt). The attack achieves advantage where n is the output length of the random oracle. They conjectured that this attack is optimal. However, this so-called STB conjecture was only proved for and . Very recently, Ghoshal and Komargodski (CRYPTO 2022) confirmed the STB conjecture for all constant values of B and provided an bound for all choices of B . In this work, we prove an bound for every . Our bound confirms the STB conjecture for and is optimal up to a factor of S for (note as is always at most , otherwise finding a collision is trivial by the birthday attack). Our result subsumes all previous upper bounds for all ranges of parameters except for and . We obtain our results by adopting and refining the technique of Chung, Guo, Liu and Qian (FOCS 2020). Our approach yields more modular proofs and sheds light on how to bypass the limitations of prior techniques. Along the way, we obtain a considerably simpler and illuminating proof for , recovering the main result of Akshima, Cash, Drucker and Wee.

computer science, theory & methods,engineering, electrical & electronic,mathematics, applied
Distinguishing Attack On Secret Prefix Mac Instantiated With Reduced Sha-1

Siyuan Qiao,Wei Wang,Keting Jia

DOI: https://doi.org/10.1007/978-3-642-14423-3_23

2010-01-01

Abstract:In this paper, we present a new distinguishing attack which works for secret prefix MAC based on 65-step (12-76) SHA-1. By birthday paradox, we first guarantee the existence of an internal collision at the output of the first iteration, then identify it by choosing the second message block smartly, and finally distinguish the specific MAC from a random function by making use of a near-collision differential path. The complexity of our new distinguisher is 2(80.9) queries with success probability 0.51. In comparison, we also present a distinguisher on secret prefix MAC instantiated with 63-step (8-70) SHA-1 according to Wang's method introduced at FSE 2009 [21], which needs about 2(157) queries with success probability 0.70.
CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Changhai Ou,Debiao He,Kexin Qiao,Shihui Zheng,Siew-Kei Lam,Fan Zhang

DOI: https://doi.org/10.1109/tcad.2023.3288512

IF: 2.9

2023-01-01

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

Abstract:By introducing collision information into divide-and-conquer distinguishers, the existing collision-optimized side-channel attacks transform the given candidate space into a significantly smaller collision space, thus achieving more efficient key recovery. However, the candidates of the first several subkeys shared by collision chains are still repeatedly detected, which happens very frequently and brings huge computational overhead. To alleviate this, we propose a highly efficient collision-optimized attack named collision tree (CoTree). This collision detection tool exploits tree structure to store the chains created from the same subchain on the same branch, thus significantly reducing the storage requirements. It then benefits from the properties of both tree and collisions and exploits a top-down tree building procedure and traverses each node only once when detecting their collisions with a candidate of the subkey currently under consideration. Finally, unlike the traditional top-down node removal, CoTree launches a bottom-up branch removal procedure to remove the chains unsatisfying the collision conditions from the tree after traversing all the considered candidates of this subkey, thus avoiding the traversal of the branches satisfying the collision condition. These strategies make our CoTree significantly alleviate the repetitive collision detection, and our experiments verify that it significantly outperforms the existing works.
Meaningful Collision Attack on MD4

贾珂婷,王小云

DOI: https://doi.org/10.3778/j.issn.1673-9418.2010.03.002

2010-01-01

Abstract:In Eurocrypt'05,Wang et al.presented new techniques to find collisions of the hash function MD4.The techniques are not only efficient to find random collisions,but also applicable to find meaningful collisions on MD4.This paper reports a further research on the meaningful collisions of plain text of MD4,and provides how to construct meaningful collisions of ASCII text on MD4 according to Wang's techniques with probability 2-33.77 in general.In FSE'96,Dobbertin gave a meaningful collision in his paper on cryptanalysis of MD4,which contains meaningless words at the beginning of the text.Furthermore,a complete meaningful collisions on MD4 based on Latin-1 character set is shown.
A Lightweight Detection Algorithm for Collision-Optimized Divide-and-Conquer Attacks

Changhai Ou,Siew-Kei Lam,Chengju Zhou,Guiyuan Jiang,Fan Zhang

DOI: https://doi.org/10.1109/tc.2020.3002795

IF: 3.183

2020-01-01

IEEE Transactions on Computers

Abstract:By introducing collision information into divide-and-conquer attacks, several existing works transform the original candidate space, which may be too large to enumerate, into a significantly smaller collision space, thus making key recovery possible. However, the inefficient collision detection algorithms and fault tolerance mechanisms make them time-consuming and their success rate low. Moreover, they may still leave very huge chain spaces that makes it difficult for key recovery. In this article, we exploit collision attack to optimize Template Attack (TA), and propose a Lightweight Collision Detection (LCD) algorithm. The proposed method exploits a jump detection mechanism to efficiently reduce the repetitive collision detections on chains with the same prefix sub-chains. We then introduce guessing theory to reorder the collision detection of the sub-keys according to their guessing lengths, and provide us with an evaluation tool. Finally, we design a highly efficient fault tolerance mechanism for our LCD to allow flexible thresholds adjustment, and further optimize sieving mechanism to efficiently extract the best chains with the largest number of collisions. Experimental results fully demonstrate LCD's superiority.
A New Non-MDS Hash Function Resisting Birthday Attack and Meet-in-the-middle Attack

Shenghui Su,Tao Xie,Shuwang Lu

DOI: https://doi.org/10.48550/arXiv.1408.5999

2017-04-30

Abstract:To examine the integrity and authenticity of an IP address efficiently and economically, this paper proposes a new non-Merkle-Damgard structural (non-MDS) hash function called JUNA that is based on a multivariate permutation problem and an anomalous subset product problem to which no subexponential time solutions are found so far. JUNA includes an initialization algorithm and a compression algorithm, and converts a short message of n bits which is regarded as only one block into a digest of m bits, where 80 <= m <= 232 and 80 <= m <= n <= 4096. The analysis and proof show that the new hash is one-way, weakly collision-free, and strongly collision-free, and its security against existent attacks such as birthday attack and meet-in-the- middle attack is to O(2 ^ m). Moreover, a detailed proof that the new hash function is resistant to the birthday attack is given. Compared with the Chaum-Heijst-Pfitzmann hash based on a discrete logarithm problem, the new hash is lightweight, and thus it opens a door to convenience for utilization of lightweight digital signing schemes.

Cryptography and Security
Study the function of building blocks in SHA Family

A. Arul Lawernce Selvakumar,R. S. Ratastogi,A.Arul Lawernce Selvakumar,R.S.Ratastogi

DOI: https://doi.org/10.48550/arXiv.1402.1314

2014-02-06

Cryptography and Security

Abstract:In this paper we analyse the role of some of the building blocks in SHA-256. We show that the disturbance correction strategy is applicable to the SHA-256 architecture and we prove that functions $\Sigma$, $\sigma$ are vital for the security of SHA-256 by showing that for a variant without them it is possible to find collisions with complexity 2 64 hash operations. As a step towards an analysis of the full function, we present the results of our experiments on Hamming weights of expanded messages for different variants of the message expansion and show that there exist low-weight expanded messages for XOR-linearised variants.

Finding collisions in the full SHA-1

Efficient collision search attacks on SHA-0

Cryptanalysis on SHA 1

How to Break MD5 and Other Hash Functions

SHA-256 Collision Attack with Programmatic SAT

Multi-Collision Attack On The Compression Functions Of Md4 And 3-Pass Haval

MultiCollision Attack on the Compression Functions of MD4 and 3-Pass HAVAL.

22-Step Collisions for SHA-2

Cryptanalysis of the full HAVAL with 4 and 5 passes

Cryptanalysis of the Hash Functions MD4 and RIPEMD

Efficient collision search attacks on SHA-0.

An Attack on Hash Function HAVAL-128

Search framework for neutral bits and boomerangs in SHA-1 collision attacks.

The NISQ Complexity of Collision Finding

Time-Space Lower Bounds for Finding Collisions in Merkle–Damgård Hash Functions

Distinguishing Attack On Secret Prefix Mac Instantiated With Reduced Sha-1

CoTree: A Side-Channel Collision Tool to Push the Limits of Conquerable Space

Meaningful Collision Attack on MD4

A Lightweight Detection Algorithm for Collision-Optimized Divide-and-Conquer Attacks

A New Non-MDS Hash Function Resisting Birthday Attack and Meet-in-the-middle Attack

Study the function of building blocks in SHA Family