This document is an addendum to the submission document of Grøstl, which was selected for the second round of NIST's SHA-3 competition. We stress that we do not change the specification of Grøstl. In other words, Grøstl is defined exactly as specified in the original submission document. In this document we mention a few alternative descriptions of our SHA-3 candidate Grøstl and describe recent analysis results on Grøstl

Archives, The Pennsylvania State University CiteSeerX

Gauravaram, Praveen

Knudsen, Lars R.

Matusiewicz, Krystian

Mendel, Florian

Rechberger, Christian

Schläffer, Martin

Thomsen, Søren S.

Queensland University of Technology ePrints Archive

Grøstl Addendum

This document is an addendum to the submission document of Grøstl, which was selected for the second round of NIST’s SHA-3 competition [18]. We stress that we do not change the specification of Grøstl. In other words, Grøstl is defined exactly as specified in the original submission document [8]. In this document we mention a few alternative descriptions of our SHA-3 candidate Grøstl an

Online Research Database In Technology

                       General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.  • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal   If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.     Downloaded from orbit.dtu.dk on: Dec 20, 2017Grøstl AddendumGauravaram, Praveen; Knudsen, Lars Ramkilde; Matusiewicz , Krystian; Mendel, Florian; Rechberger,Christian; Schläffer, Martin; Thomsen, Søren Steffen; Archives, The Pennsylvania State UniversityCiteSeerXPublication date:2009Document VersionPublisher's PDF, also known as Version of recordLink back to DTU OrbitCitation (APA):Gauravaram, P., Knudsen, L. R., Matusiewicz, K., Mendel, F., Rechberger, C., Schläffer, M., ... Archives, T. P.S. U. C. (2009). Grøstl AddendumGrøstl AddendumPraveen Gauravaram Lars R. Knudsen Krystian Matusiewicz Florian MendelChristian Rechberger Martin Schla¨ffer Søren S. ThomsenSeptember 15, 20091 IntroductionThis document is an addendum to the submission document of Grøstl, which was selected for thesecond round of NIST’s SHA-3 competition [18]. We stress that we do not change the specification ofGrøstl. In other words, Grøstl is defined exactly as specified in the original submission document [8].In this document we mention a few alternative descriptions of our SHA-3 candidate Grøstl anddescribe recent analysis results on Grøstl.We briefly recall that the Grøstl compression function is based on two large and distinct `-bit permutations P and Q (where ` ≥ 2n, n being the output size of the hash function), and isdefined as f(h,m) = P (h ⊕ m) ⊕ Q(m) ⊕ h, where h is the chaining value and m is the messageblock. The permutations P and Q are built using the wide trail design strategy. A Merkle-Damg˚arditeration [6, 17] of the compression function is applied, and it is followed by an output transformationdefined as ω(x) = truncn(P (x) ⊕ x), where truncn indicates truncation to n bits. When n ≤ 256, wehave ` = 512, and when n > 256 we have ` = 1024.2 Analysis resultsIn this section, we describe the current state of the art with respect to the analysis of Grøstl.2.1 Rebound attacksRecently, a new attack method for the cryptanalysis of hash functions has been proposed: the reboundattack [16]. It gives the best known results for a number of AES-based hash functions [12], includingmany SHA-3 candidates [13–15, 21]. In general, the rebound attack works with any differential ortruncated differential. However, the diffusion properties of AES based hash functions allow a verysimple construction of good truncated differential paths, which facilitates the analysis.The rebound attack is most successful if a high number of degrees of freedom is available. Therefore,attacks on hash functions with a key schedule to the underlying block cipher or other sources of freedomare more likely to succeed (see the recent attacks on Whirlpool [12] or LANE [13]). However, Grøstlhas been designed to limit the degrees of freedom available to an attacker. Moreover, in attacks on thehash function, much fewer degrees of freedom are available (compared to an attack on the compressionfunction). As shown in Table 1, the best attacks on the hash function for Grøstl-256 and Grøstl-512are for 4 and 5 rounds (out of 10 and 14), respectively.On the other hand, in Table 2 we show recent results for the Grøstl compression function. Thebest (collision) attack on the compression function is for 7 rounds of Grøstl-256 and Grøstl-512. Anextension of these attacks to more rounds seems unlikely, since the remaining degrees of freedom inthe attacks are close to zero. Therefore, Grøstl still enjoys a comfortable security margin.1Table 1: Summary of rebound analysis for the round-reduced Grøstl hash functions.Target Rounds Time Memory Type ReferenceGrøstl-256 3/10 264 - collision [9]hash function 4/10 264 264 collision [9]Grøstl-512 4/14 264 264 collision [9]hash function 5/14 2176 264 collision [9]Table 2: Summary of rebound analysis for the round-reduced Grøstl compression function. Semi-free-start collision is a collision in the compression function of the form (h,m), (h,m∗), where m 6= m∗.Target Rounds Time Memory Type ReferenceGrøstl-256compression function5/10 264 264 semi-free-start collision [16]6/10 264 264 semi-free-start collision [14]7/10 2120 264 semi-free-start collision [9]Grøstl-512 6/14 296 264 semi-free-start collision [9]compression function 7/14 2152 264 semi-free-start collision [9]2.2 Kelsey’s observationsKelsey [11] noted that without truncation, the Grøstl hash function does not protect against lengthextension attacks, and he argues that the “P (x) ⊕ x” part of the output transformation thereforeaccomplishes little security. In the following, as well as in Section 3.1, we argue why the “P (x) ⊕ x”part in the output transformation still serves an important purpose.If the output of the last iteration of the compression function is merely truncated to form the outputof the hash function, then Wagner’s generalized birthday attack [20] on the compression function wouldextend to the hash function, and it would have a complexity of 2n/3 since it can be applied to thetruncated (n-bit) hash value. With the “P (x)⊕ x” part, Wagner’s generalized birthday attack has tobe applied on an internal `-bit value, and since ` ≥ 2n, the attack has complexity above the birthdayattack on the hash function.2.3 Consideration of recent attacks on AESRecently, a number of surprisingly effective cryptanalytic results on AES-256 and AES-192 have beenpublished [2–4]. These results exploit non-ideal properties of the AES-256 and AES-192 key schedules.Grøstl has no key schedule, and therefore the attacks are of no relevance to Grøstl. In fact, Grøstlwas designed to be permutation based to allow for simple analysis, and to entirely avoid attacksmounted on the key schedule. When a hash function is based on a block cipher, such attacks are oftendifficult to mount, but also difficult to exclude.3 Alternative descriptions of GrøstlAlternative descriptions of a function serve several purposes. They potentially bring greater insightsinto its security, and may also lead to more efficient implementations. In the standard descriptionof Grøstl, the hash function iterates a permutation-based compression function, and then applies anoutput transformation to form the final hash of a message. However, as we shall see in this section,there are other ways of describing Grøstl.23.1 The output transformation as a compression function callThe output transformation is defined as ω(x) = truncn(P (x)⊕x). Notice that ω(x) = truncn(f(x, 0`)⊕Q(0`)). Hence, if H is the Grøstl hash function, H˜ is Grøstl without the output transformation andM is the already padded message, then H(M) = truncn(H˜(M‖0`)⊕Q(0`)), which is also illustrated byFigure 1. Since the XOR with Q(0`) has no cryptographic significance, we may ignore it and considerthe description truncn(H˜(M‖0`)). The suffix 0` can be seen as an additional padding block.iv f f--- -m2m1. . . f--mtf--0`-Q(0`)?-trunc- H(M)Figure 1: An alternative description of the Grøstl hash function.This description more clearly shows the validity of John Kelsey’s observation on the output trans-formation. What precludes an attack based on this observation is the truncation from ` to n bits.Since at least n bits are dropped in this truncation, the probability of correctly guessing those bitsis about 2−n. The alternative description can also be seen as an indication that Grøstl is in fact aninstance of the chop-MD construction, which prevents extension attacks [5].Some implementations of Grøstl might benefit from this alternative description. It shows that onedoes not have to specifically implement an output transformation function; the compression functioncan be used instead. Although this is not likely to improve the speed of implementations, it mightreduce code size or area.Finally, the alternative description shows that the “P (x) ⊕ x” part of the output transformationdoes not have unexpected negative side effects. Hence, it does not lead to attacks that would not bepossible with mere truncation. Since, as mentioned in Section 2.2, mere truncation leads to attacksthat are not possible with the true definition of the Grøstl output transformation, we can concludethat the “P (x)⊕ x” part strictly improves the security of the hash function.3.2 Tessaro’s observationSimilar to the above description of Grøstl, Stefano Tessaro [19] observed that H(M) =truncn(Hˆ(M‖Q−1(0`))⊕Q−1(0`)), where Hˆ is the MDP iteration [10] of Grøstl’s compression func-tion, with permutation pi(x) = x⊕Q−1(0`).3.3 Barreto’s observationPaulo Barreto observed [1] that the Grøstl compression function can be seen as an Even-Mansourcipher [7] in Davies-Meyer mode, which is defined as f(h,m) = Em(h)⊕h for a block cipher E keyed viam. In the case of Grøstl, the block cipher is defined as Ek(x) = P (k⊕x)⊕Q(k), where Q can be seenas a key schedule. In other words, the key is XORed with the plaintext (pre-whitening), the resultingvalue is permuted, and the output is XORed with a permuted version of the key (post-whitening).4 ConclusionA good amount of analysis has been carried out on Grøstl since its submission to the SHA-3 com-petition. Most of this analysis was done by the design team, and this analysis was initiated before3the submission. Some improvements to the analysis have been made since then, but these have forthe most part consisted in finding ways of exploiting more available degrees of freedom. As a result,the best current attacks on round-reduced Grøstl leave only few remaining degrees of freedom for theattacker.External (as well as internal) analysis has provided alternative descriptions of the Grøstl hashfunction and the Grøstl compression function. Such alternative descriptions might provide newinsights into the security of the hash function (e.g., new security proofs) and improved implementationsin some settings.Finally, we acknowledge John Kelsey’s observations on the role of P (x)⊕x in the output transfor-mation, but we point out that the output transformation serves other important purposes than merelyprotection against length extension attacks.AcknowledgementsWe would like to thank all the people that have contributed to the analysis of Grøstl.References[1] P. S. L. M. Barreto. An observation on Grøstl. Comment submitted to the NIST hash functionmailing list, hash-forum@nist.gov. Available: http://www.larc.usp.br/~pbarreto/Grizzly.pdf (2009/08/07), 2008.[2] A. Biryukov, O. Dunkelman, N. Keller, D. Khovratovich, and A. Shamir. Key Recovery Attacksof Practical Complexity on AES Variants With Up To 10 Rounds. Cryptology ePrint Archive,Report 2009/374, 2009. http://eprint.iacr.org/.[3] A. Biryukov and D. Khovratovich. Related-key Cryptanalysis of the Full AES-192 and AES-256.In M. Matsui, editor, Advances in Cryptology – ASIACRYPT 2009, Proceedings, Lecture Notesin Computer Science. Springer, 2009. To appear.[4] A. Biryukov, D. Khovratovich, and I. Nikolic´. Distinguisher and Related-Key Attack on the FullAES-256. In S. Halevi, editor, Advances in Cryptology – CRYPTO 2009, Proceedings, volume5677 of Lecture Notes in Computer Science, pages 231–249. Springer, 2009.[5] J.-S. Coron, Y. Dodis, C. Malinaud, and P. Puniya. Merkle-Damg˚ard Revisited: How to Constructa Hash Function. In V. Shoup, editor, Advances in Cryptology – CRYPTO 2005, Proceedings,volume 3621 of Lecture Notes in Computer Science, pages 430–448. Springer, 2005.[6] I. Damg˚ard. A Design Principle for Hash Functions. In G. Brassard, editor, Advances in Cryp-tology – CRYPTO ’89, Proceedings, volume 435 of Lecture Notes in Computer Science, pages416–427. Springer, 1990.[7] S. Even and Y. Mansour. A Construction of a Cipher from a Single Pseudorandom Permutation.Journal of Cryptology, 10(3):151–162, 1997.[8] P. Gauravaram, L. R. Knudsen, K. Matusiewicz, F. Mendel, C. Rechberger, M. Schla¨ffer, andS. S. Thomsen. Grøstl – a SHA-3 candidate. Submission to NIST, 2008. Available online athttp://www.groestl.info.[9] P. Gauravaram, L. R. Knudsen, K. Matusiewicz, F. Mendel, C. Rechberger, M. Schla¨ffer, andS. S. Thomsen. Cryptanalysis Results on Grøstl, 2009. In preparation.4[10] S. Hirose, J. H. Park, and A. Yun. A Simple Variant of the Merkle-Damg˚ard Scheme with aPermutation. In K. Kurosawa, editor, Advances in Cryptology – ASIACRYPT 2007, Proceedings,volume 4833 of Lecture Notes in Computer Science, pages 113–129. Springer, 2007.[11] J. Kelsey. Some notes on Grøstl. Comment submitted to the NIST hash function mail-ing list, hash-forum@nist.gov. Available: http://ehash.iaik.tugraz.at/uploads/d/d0/Grostl-comment-april28.pdf (2009/08/07), 2009.[12] M. Lamberger, F. Mendel, C. Rechberger, V. Rijmen, and M. Schla¨ffer. Rebound Distinguishers:Results on the Full Whirlpool Compression Function. In M. Matsui, editor, Advances in Cryp-tology – ASIACRYPT 2009, Proceedings, Lecture Notes in Computer Science. Springer, 2009. Toappear.[13] K. Matusiewicz, M. Naya-Plasencia, I. Nikolic´, Y. Sasaki, and M. Schla¨ffer. Rebound Attackon the Full LANE Compression Function. In M. Matsui, editor, Advances in Cryptology – ASI-ACRYPT 2009, Proceedings, Lecture Notes in Computer Science. Springer, 2009. To appear.[14] F. Mendel, T. Peyrin, C. Rechberger, and M. Schla¨ffer. Improved Cryptanalysis of the ReducedGrøstl Compression Function, ECHO Permutation and AES Block Cipher. In M. J. Jacobson,V. Rijmen, and R. Safavi-Naini, editors, Selected Areas in Cryptography 2009, Proceedings, Lec-ture Notes in Computer Science. Springer, 2009. To appear.[15] F. Mendel, C. Rechberger, and M. Schla¨ffer. Cryptanalysis of Twister. In M. Abdalla,D. Pointcheval, P.-A. Fouque, and D. Vergnaud, editors, Applied Cryptography and NetworkSecurity 2009, Proceedings, volume 5536 of Lecture Notes in Computer Science, pages 342–353.Springer, 2009.[16] F. Mendel, C. Rechberger, M. Schla¨ffer, and S. S. Thomsen. The Rebound Attack: Cryptanalysisof Reduced Whirlpool and Grøstl. In O. Dunkelman, editor, Fast Software Encryption 2009,Proceedings, volume 5665 of Lecture Notes in Computer Science, pages 260–276. Springer, 2009.[17] R. C. Merkle. One Way Hash Functions and DES. In G. Brassard, editor, Advances in Cryptology– CRYPTO ’89, Proceedings, volume 435 of Lecture Notes in Computer Science, pages 428–446.Springer, 1990.[18] National Institute of Standards and Technology. The SHA-3 competition website. Available:http://csrc.nist.gov/groups/ST/hash/sha-3/index.html (2009/08/26).[19] S. Tessaro. Personal communication, August 2009.[20] D. Wagner. A Generalized Birthday Problem. In M. Yung, editor, Advances in Cryptology –CRYPTO 2002, Proceedings, volume 2442 of Lecture Notes in Computer Science, pages 288–303.Springer, 2002.[21] S. Wu, D. Feng, and W. Wu. Cryptanalysis of the LANE Hash Function. In M. J. Jacob-son, V. Rijmen, and R. Safavi-Naini, editors, Selected Areas in Cryptography 2009, Proceedings,Lecture Notes in Computer Science. Springer, 2009. To appear.5

This document is an addendum to the submission document of\ud
Grøstl, which was selected for the second round of NIST's SHA-3 competition. We stress that we do not change the specification of Grøstl. In other words, Grøstl is defined exactly as specified in the original submission document. In this document we mention a few alternative\ud
descriptions of our SHA-3 candidate Grøstl and describe recent analysis results on Grøstl

Name not available

http://orbit.dtu.dk/ws/files/12279412/10.1.1.208.642_1.pdf

Grøstl Addendum

Abstract

Similar works

Full text

Available Versions

Queensland University of Technology ePrints Archive

Online Research Database In Technology

Name not available