People had developed some attack methods to attack hash function. These methods need to choose some  differential pattern [Dau05]. We present a way to restrict the collisions that hold the  differential pattern . At the same time, to build a hash function that meet the different needs, we propose a construction

Ke Xu

ZiJie Xu

Cryptology ePrint Archive

 Ways to restrict the differential path ZiJie Xu    and    Ke Xu xuzijiewz@gmail.com xukezp@gmail.com  Abstract: People had developed some attack methods to attack hash function. These methods need to choose some "differential pattern"[Dau05]. We present a way to restrict the collisions that hold the "differential pattern". At the same time, to build a hash function that meet the different needs, we propose a construction.   Key Words: differential path, differential cryptanalysis, hash function, data-depend function  1. Introduction Magnus Daum[Dao05] had presentation hash function and the attack methods Dobbertin’s method[Dob95, Dob96a, Dob96c, Dob97, Dob98a], Chabaud and Joux’s method [CJ98] and Wang’s method[WYY05]. These attack methods include two parts[Dao05].  One part is choosing "differential pattern" [Dao05]. The work in this part is use modular difference, xor-difference and bitwise deference define all differences in the calculation. Dobbertin’s method uses mainly modular divergences, Chabaud and Joux’s method uses xor-difference, and Wang’s method uses modular divergences, xor-difference and bitw ise  de ference .   In Wang’s method, when "differential pattern" is determined, it can build sufficient conditions[EUROCRYPT’05] that hold the "differential pattern". The collision must satisfy the sufficient conditions. In a way, the sufficient conditions astrict the messages that will hold "differential pattern". But the sufficient conditions is for the chain values. In different attack, the messages that conform the "differential pattern" maybe different. If there is some measures can be used to astrict the messages, then it can control the collision that attacker can get. We will present ways to astrict the conditions in section 2 and section 3.  Because the hash function is a map that compress arbitrary long messages to fixed length values[Dao05]. So there always exists collisions, there always exists viable  "differential pattern". M. Schläffer and E. Oswald[1], P.-A. Fouque, G. Leurent, and P. Nguyen[1] had developed an algorithm to construct the differential path. The algorithm will determine the defference at every step operation in order. It can think of the algorithm as a search technology. The complexity of the algorithm depends on the size of difference space. If the calculation has more step operation, it will raise the size of difference space. But it will raise the calculation at the same time. We find a construction. With the construc-tion, it can build hash function that user can regulate the number of the step operations to meet his requirement.   We will expound the ways that can be used restrict the differential path in section 2 and sec-tion 3. And then we will expound the construction in section 4. We will discuss the shift of n-bits word, where ln 2 .   2. Modular Difference And Bitwise Deference The modular difference is the difference of x, x’ that are elements of the ring of integers modulo n2  as[Dao05]: 'xxx   And the bitwise deference is bitstrings difference of x, x’ that are elements of the vector space nF2 as[Dao05]:   ),...,,(:)',...,','(:)',(:021002211xxxxxxxxxxxxnnnnnn  Where }1,0,1{ix . Because there exists: 10102''2niiiniiixxxx So there exists: )1.2(22)'(2'2'10101010 niiiniiiiniiiniiixxxxxxxx  To given x , (2.1) maybe has many roots. That means there maybe are many bitwise differences has same modular difference. We find a way to strict the number of the bitwise differences that has same modular difference. Let constant 01...01...010212/02xCnii  . And let hash function has two variable x and x1. And x and x1 satisfy:  )2.2(2112/02niixx  Then in the "differential pattern", there will be two differences as follow:  )3.2(2'2'1112'12/0212/0210niiniiniiixxxxxxxxx There exists: 12/02210221''111niiiniiixxCxCxxxx There is a proposition about the reration between modular differences ( x 1, x ) and bitwise deference x  as follows: Proposition 2.1: There is sole one bitwise deference x  has the given modular dif-ferences ( x 1, x ) that satisfy (2.3) and 0 x . Proof: It can compute the bitwise difference x  from the given modular differences ( x  1, x ) as follow steps: 1. Let i=0. 2. The bit value of the )12(  i -th bit of C is 0, then 0112ix  3. Compute 1202221)2mod1(ijjjixxz . Then 22222212122mod22121iiiiiixxz  Because 0112ix , then ,...2,1,02212222kkzxiii i) If 22  iz , there has 12/1 22  iizx  ii) If 0z , there has 02/1 22 iizx  iii) If 223iz , there has 12/)2)1((1 2222 iiizx  4. If i<n/2, let i=i+1, turn to step 2. 5.  Let i=0 6.  Compute jjijiiixxxz 22)2mod(20222232  . Then  323212122mod22iiiixz  Then ,...2,1,022321212kkzxiii i) If 122  iz , there has 12/ 1212  iizx  ii) If 0z , there has 02/ 1212 iizx  iii) If 1223  iz , there has 12/)2)1(( 123212  iiizx  7. If i<n/2, let i=i+1, turn to step 6 It will compute out the only one bitwise difference x  with given modular differences ( x 1, x ) by mention steps. So there is only one bitwise deference x  has the given  modular differences ( x 1, x ) that satisfy (2.3) and 0 x .                     □  So it can use (2.2) to make there is only one bitwise difference satisfy some modular differences in the "di fferent ia l pa t te rn" .  3. Data-depend function In this section, we will expound a way that can restrict the message data con-form the "different ia l pa t te rn" .   3.1 A System of Equation At first, let hash function has two variables x, y1 and y2. And x, y1, y2 satisfy the system of equation as follows: )1.3(1022)(11nrrxyrnxyrn where r depends on message. (3.1) can be  d ivided,  fo r  fur ther  ana lys is ,  i n  two cases : 'rr   and 'rr  .    3.2 case 1: 'rr   To two computes with (x,r) and (x’,r’), there is the differences as follow: )2.3(''2)'(')(1'rxrxyrnxrnxyxxx There is a proposition as follows: Proposition 3.1: To given differences 2,1, yyx   , if 00  rx , (3.2) will has: )/)122((log2xyynrn   Proof: Let: )3.3()',....,'(:')',....,'(:'),....,(:),....,(:)',....,'(:'),....,(:0110110101xxxrxxxlxxxrxxxlxxxxxxrrnrrnnn There will exist:  )4.3(2212)'()'(xlyxryxrxlxxrxrxrxlxlxlrnr  Then: )5.3(122222yyxrxlxnrnnrn If 0 x , there exists: )/)122((log2xyynrn                              □ So in "differential pattern", if there exist the given differences ( 2,1, yyx   ) that 00 rx , the parameter r will be fixed and cannot be modified.  3.3 case 2: 'rr   Let 'rrr  . We use bitwise differences analyses (3.1). Denote x, y1, y2 as follows: )6.3()2,....,2(:2)1,....,1(:1),....,(:010101yyyyyyxxxnnn Then there has: ).2.7.3(2).2.7.3(002).1.7.3(01).1.7.3(10111)()(bniryxairnrnixybriyxarnirninirnxyriiriirniirnii To two computes with (x, y1,y2,r) and (x’ ,y1’,y2’,r’), there exist differences as follows: )8.3('222'1110'iiiiiiiiiyyyyyynixxx  We suppose r>r’, then there exists: )9.3('02101irnyrniyii  Because r>r’, by (3.7.1.a) and (3.7.2.a), there has: )10.3(1'1110'11111111rnrnrnrnrnyyyyy Because 1'0  nrr , there exists 110  nrn . By (3.9), if i<n-r-1, there exists 01 iy . Then to given difference 1y , there exist: )11.3(}11|min{1 iyinr  Because 'rrr   , there exists rrr ' . Now r and r’ are computed out, it can compute the message from given differences. We will divide x and x’ to two parts and compute as follow two sections.  3.3.1 compute ),...,(01xxr  and )',...,'(01'xxr  If we study (3.7.1.a)~(3.9), we will find that )(1rniixy  and 01 ' iy  ( 'rnirn  ). It can compute )( rnix, then it can compute )('rnix by )()()('rnirnirnixxx , then there exists )()'(')'('''1rnirnrrirrixxy  and )(')'(1rnrrirrixy  turn to  )(')()'()'()'(''111rnirrrnirrirrirrixxyyy  to compute ')( rrrnix  …. If repeat these steps, it will compute bits )'()( rrkrnix. Then it can compute ),...,(01xxr  and )',...,'(01'xxr  as follows steps: 1. Let j=0. 2. Let i=0. 3. Compute )()'()()'()()'()'('111rnrrijrnrrijrnrrijrrijyyyx by (3.7.1.b) and (3.9).  4. Compute )'()'()'('rrijrrijrrijxxx  by (3.8), and if ')'( rrrij  , compute )'()'('1rnrrijy  by (3.7.1.a) as follows:  )'()'()'()()'()1(''1'1rrijrnrrijrnrrijxyy   5. Let i=i+1. 6. If rrrij  )'( , turn to step 3.  7. Let j=j+1. 8. If 'rrj  , turn to step 2. From above-mentioned compute steps, it is easy know that there is sole bits)',...,',,...,(01'01xxxxrr  will satisfy (3.8).   3.3.2 compute ),...,(1 rnxx and )',...,'('1 rnxx If we study (3.7.1.a)~(3.9), we will find that '''2riixy  and 02 iy  ( 'rnirn  ). It can compute ''rix, then it can compute 'rix by ''''riririxxx , then there exists ')'(2rirrixy  and )'('')'()'('''2rrrirrrirrixxy turn to )'()'()'('222rrirrirriyyy  to compute )'(''rrkrix…. If repeat these steps, it will compute bits )'(' rrkrix  . Then it can compute ),...,(1 rnxx and )',...,'('1 rnxx as follows steps: We will compute ),...,(1 rnxx and )',...,'('1 rnxx as follows steps: 1. Let j=0. 2. Let i=0. 3. Compute ')'(1')'(1')'(1)'(122'2'rrrijnrrrijnrrrijnrrijnyyyx by (3.9.2.b) and (3.10). 4. Compute )'(1)'(1)'(1'rrijnrrijnrrijnxxx  by (3.10), and if 0')'()1(1  rrrijn , compute ')'()1(12 rrrijny   by (3.9.2.a) as fol-lows:  )'(1)'(1')'()1(122rrijnrrrijnrrrijnxyy   5. Let i=i+1. 6. If 0')'(1  rrrijn , turn to step 3.  7. Let j=j+1. 8. If 'rrj  , turn to step 2. From above-mentioned compute steps, it is easy know that there is sole bits)',...,',,...,('11 rnrnxxxx will satisfy (3.8).   So there exists proposition as follows: Proposition 3.2: To given differences 2,1, yyx   , if 0 r , there is sole pair (x,x’) satisfy (3.8). Proof: Let r>r’, then it can compute ),...,(01xxr  and )',...,'(01'xxr  by the steps given in section 3.3.1. And it can compute the sole ),...,(1 rnxx and )',...,'('1 rnxx by the steps given in section 3.3.2. So there is only one pair (x,x’) satisfy (3.8)                   □ By proposition 3.2, we will know that if 0 r , there is only one collision will hold given differences. So it can modify the input.  In section 3, we discuss a system of equation (3.1) in two cases. And we get proposition 3.1 and proposition 3.2. By proposition 3.1, if the input difference 0 x , the parameter r will be fixed. By proposition 3.2, if the parameter difference does not equal to zero, then there is only collision will conform the given differences.  By the way, the proposition 3.2 use bitwise differences to analyze, and the modular dif-ferences is the mainly differences that used to analyses hash function. So the proposition 3.2 maybe not works. But it can use (2.2) to strict the differences.    4. Alterable Iteration Mix Construction (AIMC) The compression function construction of some hash functions as follows:      Figure. 1 original co mpr e s s io n  fu nc t io n  co ns t r uc t io n :  M is  t he  me s sa ge  da t a  t o  be  has h ed ,  E M is  e xt e nd ed  wo r ds ,  ih  a nd  1ih  a r e  has h c ha in  va lu e   With the construction shown in figure 1, it will use simple and high efficiency core function to build compression function. But if the ways that build the viable differential path is found, it is not easy to change the system. At the same time, hash function is used in different scene, user maybe has different requirement, to meet these requirements, it need hash function are flexible. M. Schläffer and E. Oswald[0], P.-A. Fouque, G. Leurent, and P. Nguyen[2] had developed an algorithm to build the differential path. Because it need determine all the differences that appear in the differential path. It can treat the algorithm as search technology. The complexity of the algorithm depend on the number of the step operation. So if the hash function has more step operations, it will increaseed complexity of the algorithm.          Figure. 2 Alt e r a b le  I t e r a t io n M ix  Co ns t r uc t io n( AI M C) :  RT is  se t  by us e r  The direct idea is let user adjust the number of step operations to meet his requirement. EM c o r e  f u n c t i o n    /  Message extension function M ih  1ih  EM no yes c o r e  f u n c t i o n   /  Message extension function M ih  1ih  j>RT Modification j=j+1 j=1  We find a construction Alterable Iteration Mix Construction (AIMC) . The new construc-tion as figure 2:  In construction AIMC, the core functions are put into a circle. To avoid just simple repeat the core functions, it should modify the extended message words, constants or core function every circle. In construction AIMC, if the parameter RT is turned up, it will lead to: 1. The number of the step operation will be raise. Because the complexity of the algorithm that build the differential path depends on the number of the step opera-tion. So the complexity of the algorithm that build the differential path will be raise. 2. If the hash function is build with some appropriate constructions, when there are more step operations, more bits in message will be fixed.  This will make it harder to build the differential path, and the differential path will fix more bits in message.  5. Conclusions In this paper, we propose use (2.2) and (3.1) to strict differential path. By proposition 2.1, proposition 3.1 and proposition 3.1, equation (2.2) and (3.1) will strict the differences and the input that conform given differences. In fact, we find another simple nonlinear operation multiplication can be used to strict the variable to given difference. But multiplication needs multiplication operation.  To build a flexible hash function to satify different requirement, we propose construction AIMC that user can change the number of the step operations. We just give out preliminary construction, some details depend on the concrete hash function.  To design economic hash function with (2.2), (3.1) and construction AIMC, it need study core function and some construction to reduce system calculation. To reduce system calcu-lation, it need some way to make there are many bits is fixed in possible lower step opera-tions. Line codes are simple and well researched. It can use the min-Hamming weight of a line code to make there will have many differences in a differential path. We had find a line code when we design DDHA[2]. The min-Hamming Weight of the line code in DDHA[2] is 8. To find out the effect and the way to improve, it need find out some character about the line code. We will work on it.  References: [EUROCRYPT’05] Xiaoyun Wang and Hongbo Yu. How to break MD5 and other hash func-tions. In Cramer [Cra05], pages 19–35. [Dau05] Magnus Daum. Cryptanalysis of Hash Functions of the MD4-Family. PhD thesis, Ruhr-Universität at Bochum, 2005. [Dob95] H. Dobbertin. Alf swindles Ann. CryptoBytes, 1(3):5, 1995 [Dob96a] H. Dobbertin. Cryptanalysis of MD4. In Fast Software Encryption – Cambridge Workshop, volume 1039 of LNCS, pages 53–69. Springer-Verlag, 1996. [Dob96c] H. Dobbertin. The status of MD5 after a recent attack. Crypto-Bytes, 2(2):1–6, 1996 [Dob97] H. Dobbertin. RIPEMD with two-round compress function is not collision-free. Journal of Cryptology, 10:51–68, 1997. [Dob98a] H. Dobbertin. Cryptanalysis of MD4. Journal of Cryptology, 11:253–274, 1998. [CJ98] F. Chabaud and A. Joux. Di?erential Collisions in SHA-0. InAdvances in Cryptology – CRYPTO’98, volume 1462 of LNCS, pages 56–71. Springer-Verlag, 1998. [WYY05] X. Wang, Y. L. Yin, and H. Yu. Collision Search Attacks on SHA1. preprint, Febru-ary 2005. (http://www.infosec.sdu.edu.cn/paper/sha-attack-note.pdf).  [0] P.-A. Fouque, G. Leurent, and P. Nguyen. Automatic search of differential path in md4. ECRYPT Hash Workshop 2007.   http://events.iaik.tugraz.at/HashWorkshop07/papers/Leurent_MD4.pdf [1] M. Schläffer and E. Oswald. Searching for differential paths in md4. In M. J. B.Robshaw, editor, FSE, volume 4047 of Lecture Notes in Computer Science, pages 242{261. Springer, 2006 [2] ZiJie Xu and Ke Xu, Data-Depend Hash Algorith,  http://eprint.iacr.org/2009/618.  

Ways to restrict the differential path

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive