150 research outputs found

    Practical free-start collision attacks on 76-step SHA-1

    Get PDF
    In this paper we analyze the security of the compression function of SHA-1 against collision attacks, or equivalently free-start collisions on the hash function. While a lot of work has been dedicated to the analysis of SHA-1 in the past decade, this is the first time that free-start collisions have been considered for this function. We exploit the additional freedom provided by this model by using a new start-from-the-middle approach in combination with improvements on the cryptanalysis tools that have been developed for SHA-1 in the recent years. This results in particular in better differential paths than the ones used for hash function collisions so far. Overall, our attack requires about 2502^{50} evaluations of the compression function in order to compute a one-block free-start collision for a 76-step reduced version, which is so far the highest number of steps reached for a collision on the SHA-1 compression function. We have developed an efficient GPU framework for the highly branching code typical of a cryptanalytic collision attack and used it in an optimized implementation of our attack on recent GTX 970 GPUs. We report that a single cheap US\$ 350 GTX 970 is sufficient to find the collision in less than 5 days. This showcases how recent mainstream GPUs seem to be a good platform for expensive and even highly-branching cryptanalysis computations. Finally, our work should be taken as a reminder that cryptanalysis on SHA-1 continues to improve. This is yet another proof that the industry should quickly move away from using this function

    Effets de lisière et sex-ratio de rongeurs forestiers dans un écosystème fragmenté en République Démocratique du Congo (Réserve de Masako, Kisangani)

    Get PDF
    Edge Effects and Sex Ratio of Forest Rodents in a Fragmented Ecosystem in the Democratic Republic of the Congo (Masako Reserve, Kisangani). A study of edge effects on the sex ratios of six species of rodents was undertaken in the Masako reserve located at 15 km from Kisangani in the DRC. 1789 individuals collected during two years were used to analyze the sex ratio in a fallow land, a secondary forest and in the edge zone between the fallow land and the secondary forest. The results were compared with a uniform distribution using a χ² test. Males were more captured for all species except for Lophuromys dudui. An overall sex ratio significantly in favor of males is observed from one year to another. Overall, the sex ratio is not statistically different from 1/1 for Deomys, Hybomys and Lophuromys but significantly greater than 1/1 for Hylomyscus and Stochomys. For Praomys, it is significantly greater than 1/1 in 2010 but not in 2011. The males of Hylomyscus, Praomys and Stochomys and the females of Lophuromys were more frequent in the three habitats. The edge habitat was characterized by a predominance of females of Deomys and sex ratios not different from 1/1 for Hylomyscus but significantly different from 1/1 for Praomys and Stochomys. The differences in sex ratio recorded between the edge zone and its adjacent habitats for Hylomyscus, Stochomys and Praomys prove an edge effect

    KLEIN: A New Family of Lightweight Block Ciphers

    Get PDF
    Resource-efficient cryptographic primitives become fundamental for realizing both security and efficiency in embedded systems like RFID tags and sensor nodes. Among those primitives, lightweight block cipher plays a major role as a building block for security protocols. In this paper, we describe a new family of lightweight block ciphers named KLEIN, which is designed for resource-constrained devices such as wireless sensors and RFID tags. Compared to the related proposals, KLEIN has advantage in the software performance on legacy sensor platforms, while in the same time its hardware implementation can also be compact

    Cube Testers and Key Recovery Attacks On Reduced-Round MD6 and Trivium

    Get PDF
    CRYPTO 2008 saw the introduction of the hash function MD6 and of cube attacks, a type of algebraic attack applicable to cryptographic functions having a low-degree algebraic normal form over GF(2). This paper applies cube attacks to reduced round MD6, finding the full 128-bit key of a 14-round MD6 with complexity 2^22 (which takes less than a minute on a single PC). This is the best key recovery attack announced so far for MD6. We then introduce a new class of attacks called cube testers, based on efficient property-testing algorithms, and apply them to MD6 and to the stream cipher Trivium. Unlike the standard cube attacks, cube testers detect nonrandom behavior rather than performing key extraction, but they can also attack cryptographic schemes described by nonrandom polynomials of relatively high degree. Applied to MD6, cube testers detect nonrandomness over 18 rounds in 2^17 complexity; applied to a slightly modified version of the MD6 compression function, they can distinguish 66 rounds from random in 2^24 complexity. Cube testers give distinguishers on Trivium reduced to 790 rounds from random with 2^30 complexity and detect nonrandomness over 885 rounds in 2^27, improving on the original 767-round cube attack

    On twisted Fourier analysis and convergence of Fourier series on discrete groups

    Full text link
    We study norm convergence and summability of Fourier series in the setting of reduced twisted group CC^*-algebras of discrete groups. For amenable groups, F{\o}lner nets give the key to Fej\'er summation. We show that Abel-Poisson summation holds for a large class of groups, including e.g. all Coxeter groups and all Gromov hyperbolic groups. As a tool in our presentation, we introduce notions of polynomial and subexponential H-growth for countable groups w.r.t. proper scale functions, usually chosen as length functions. These coincide with the classical notions of growth in the case of amenable groups.Comment: 35 pages; abridged, revised and update

    Correlation Cube Attacks: From Weak-Key Distinguisher to Key Recovery

    Get PDF
    In this paper, we describe a new variant of cube attacks called correlation cube attack. The new attack recovers the secret key of a cryptosystem by exploiting conditional correlation properties between the superpoly of a cube and a specific set of low-degree polynomials that we call a basis, which satisfies that the superpoly is a zero constant when all the polynomials in the basis are zeros. We present a detailed procedure of correlation cube attack for the general case, including how to find a basis of the superpoly of a given cube. One of the most significant advantages of this new analysis technique over other variants of cube attacks is that it converts from a weak-key distinguisher to a key recovery attack. As an illustration, we apply the attack to round-reduced variants of the stream cipher Trivium. Based on the tool of numeric mapping introduced by Liu at CRYPTO 2017, we develop a specific technique to efficiently find a basis of the superpoly of a given cube as well as a large set of potentially good cubes used in the attack on Trivium variants, and further set up deterministic or probabilistic equations on the key bits according to the conditional correlation properties between the superpolys of the cubes and their bases. For a variant when the number of initialization rounds is reduced from 1152 to 805, we can recover about 7-bit key information on average with time complexity 2442^{44}, using 2452^{45} keystream bits and preprocessing time 2512^{51}. For a variant of Trivium reduced to 835 rounds, we can recover about 5-bit key information on average with the same complexity. All the attacks are practical and fully verified by experiments. To the best of our knowledge, they are thus far the best known key recovery attacks for these variants of Trivium, and this is the first time that a weak-key distinguisher on Trivium stream cipher can be converted to a key recovery attack

    Polytopic Cryptanalysis

    Get PDF
    Standard differential cryptanalysis uses statistical dependencies between the difference of two plaintexts and the difference of the respective two ciphertexts to attack a cipher. Here we introduce polytopic cryptanalysis which considers interdependencies between larger sets of texts as they traverse through the cipher. We prove that the methodology of standard differential cryptanalysis can unambiguously be extended and transferred to the polytopic case including impossible differentials. We show that impossible polytopic transitions have generic advantages over impossible differentials. To demonstrate the practical relevance of the generalization, we present new low-data attacks on round-reduced DES and AES using impossible polytopic transitions that are able to compete with existing attacks, partially outperforming these
    corecore