BAO, Feng

DENG, Robert H.

WU, Hongjun

Institutional Knowledge at Singapore Management University

Cryptanalysis of Some Hash Functions Based on Block Ciphers and Codes

Deng, Robert Huijie

Singapore Management UniversityInstitutional Knowledge at Singapore Management UniversityResearch Collection School Of Information Systems School of Information Systems9-2002Cryptanalysis of some Hash Functions based onBlock Ciphers and CodesHongjun WULaboratories for Information Technology, SingaporeFeng BAOLaboratories for Information Technology, SingaporeRobert Huijie DengSingapore Management University, robertdeng@smu.edu.sgFollow this and additional works at: https://ink.library.smu.edu.sg/sis_researchPart of the Information Security CommonsThis Conference Paper is brought to you for free and open access by the School of Information Systems at Institutional Knowledge at SingaporeManagement University. It has been accepted for inclusion in Research Collection School Of Information Systems by an authorized administrator ofInstitutional Knowledge at Singapore Management University. For more information, please email libIR@smu.edu.sg.CitationWU, Hongjun; BAO, Feng; and Deng, Robert Huijie. Cryptanalysis of some Hash Functions based on Block Ciphers and Codes.(2002). 2002 International Workshop on Cryptology and Network Security. 221-224. Research Collection School Of InformationSystems.Available at: https://ink.library.smu.edu.sg/sis_research/1101Cryptanalysis of Some Hash Functions Based on Block Ciphers and CodesHongjun Wu Feng Bao Robert H. DengLaboratories for Information Technology21 Heng Mui Keng Terrace, Singapore 119613E-mail:  hongjun,baofeng,deng@lit.a-star.edu.sgAbstractAt PKC 2000, Inoue and Sakurai proposed some meth-ods to design hash functions from block ciphers and codes(block codes and convolutional codes). They claimed thattheir hash functions are secure:      encryptions arenecessary to find a collision, where   and  are the mini-mal distance of the code and the block size of block cipher,respectively. However, we show in this paper that a colli-sion could be found with about      encryptions, where is a small number.1 IntroductionA hash function is a one-way function that maps anarbitrary-length message into a fixed-length quantity. Itplays important roles in integrity protection, authenticationand signature generation. There are two basic requirementson a secure hash function, namely, the collision resistanceproperty (that it is hard to find two messages with the samehash result) and the preimage resistance property (that it ishard to find a message corresponding to a given hash result).There are two approaches to design hash functions. Oneapproach is to design customised hash functions, such as theMD4 [10], MD5 [11] and SHA [3]. Another approach is todesign hash functions based on some existing secure cryptoalgorithms (most likely, some block ciphers). A number ofhash functions based on block ciphers have been proposed.The construction of single-block-length hash functions (thesize of the hash result is the same as the block size of theblock cipher) has been studied extensively and a syntheticstudy on this issue was done by Preneel, Govaerts and Van-dewalle [9]. The drawback of this design is that for blockcipher with small block size , the hash function is not se-cure since a collision could be found with only about  operations due to the birthday attack. The multiple-block-length hash functions are thus needed. But it is not easyto design a secure and efficient multiple-block-length hashfunction. Some proposed multiple-block-length hash func-tions are proved to be insecure: the MDC-4 [1] were brokenby Knudsen and Preneel [8]; the Parallel-DM [4] was bro-ken by Knudsen and Lai [6]. Some multiple-block-lengthhash functions remain secure but with relatively poor per-formance [7, 8]. Inoue and Sakurai recently proposed somemultiple-block-length hash functions and claimed that theirhash functions are secure and efficient [5]. However, as willbe shown in this paper, their hash functions are not as secureas they claimed.We believe that with the emergence of large block sizeblock ciphers, such as the Rijndael with flexible block sizeup to 256 bits [2], the design of secure and efficient blockcipher based hash functions could eventually be simplified.This paper is organised as follows. Section 2 gives anintroduction to Inoue and Sakurai’s hash functions. Thecryptanalysis of Inoue and Sakurai’s block code based hashfunctions and convolutional code based hash functions aregiven in Section 3 and Section 4, respectively. Section 5concludes this paper.2 Inoue and Sakurai’s Hash FunctionsMost of the hash functions are in iterated form, i.e., theyare based on the iterative computations of an easily com-putable compression function    . The function    compresses two binary sequences of respective lengths and an  into a binary sequence of length . The message is denoted as  -bit blocks,           (Incase the length of  is not multiple of , padding is used).The hash result   is obtained by computing itera-tively   	            where is a pre-specified initial value.The compression function of a block cipher based hashfunction is constructed from a block cipher. In the rest ofthis paper, we consider only the block cipher with equal keylength and block size since Inoue and Sakurai’s construc-tions are based on this kind of block cipher. To construct acompression function     with -bit output from a blockcipher with -bit block size, the following Davies-Mayerfunction could be used:       where both and are -bit binary sequences. Toconstruct a hash function with   -bit    hash resultfrom a block cipher with -bit block size, the followingmultiple Davies-Meyer function could be used.Definition 1(Multiple Davies-Meyer Function). Let  be a block cipher with -bit block size and key length.Let          be different instantiations of the Davies-Meyer function, i.e.,       , obtainedby fixing log key bits to different values. The and are expanded by an affine mapping to the  pairs . The output is the concatenation of the outputs ofthe function          .To construct a compression function based on the multipleDavies-Meyer function, the main task is to design the affinemapping. In Knudsen and Preneel’s work [7, 8], non-binarycodes are used. Recently Inoue and Sakurai introduced theblock codes as well as the convolutional codes in design-ing the affine mapping [5]. In Inoue and Sakurai’s affinemapping, the input are  -bit message blocks () and -bit blocks of the previous iteration output  but onlythe message blocks are encoded. Their design are givenin the following two subsections.2.1 Construction with block codesThe input to the affine mapping are the  -bit messageblocks () and  -bit blocks of previous hashed value . The -block is encoded into  -bit blocks, de-noted as , with the use of an     error correctioncode. From  and , form  input pairs to those different Davies-Meyer functions.A typical example in [5] is given below:Example 1. Consider the (7,4,3) Hamming code with thefollowing generator matrix:                          Let  				, where 	is an -bitblock. is encoded as  	 	        	, where		for       , and													Let    	  	         	 and 	 	        	. is obtained as follows:	  	 	             The other block codes with higher error correction capa-bility could also be used. It was claimed in [5] that for ahash function constructed from an     code in this way,about      encryptions are required to find a collision.2.2 Construction with convolutional codesLet the convolutional code be with parameters   	, where , ,   and  denote the outputsize, input size, minimum distance and constraint length,respectively. The length of a message is padded tomultiple of  bits. Then    zero bits arepadded to the message. The message after paddingis denoted as        , where each is a-bit block. The input to the compression function    are          and the -block  . The         is encoded into an -block code word, 	 	      	 with the use of an    	convolutional code. From  and , form  input pairsto the  different Davies-Meyer functions. The final hashresult is the concatenation of the last  iterations’ outputs           .We give a simple example below to illustrate the opera-tion of this kind of hash function.Example 2. Consider a simple (2,1,3;3) binary convolu-tional code. For each output, the following generator matrixis used:   ~~  ~~     is encoded into 	 	where	   	    is obtained as follows:	  	 	     The concatenation of the outputs of the last three iterationsare the final hash result.It was claimed in [5] that for a hash function constructedfrom an    	 convolutional code in this way, about     encryptions are needed to find a collision.3 Attack on the Hash Functions Based onBlock CodesInoue and Sakurai claimed that about      encryp-tions are needed to find a collision of their hash functionsbased on block codes [5]. In this section, we give an attackto find a collision with only about       encryptions. Theflaw in Inoue and Sakusai’s design is that the differencesintroduced into the -block hash output do not affect oneanother in the following iterations, i.e., there is no differ-ence propagation. It allows us to deal with those differencesseparately.Our attack is based on the following assumption:Assumption 1. Consider a Davies-Mayer function       , where   is a block cipherwith -bit block size and -bit key length. For tworandomly chosen  and   with    , an  satisfying    exits with probability 0.368.The following attack is to find two different messages and   satisfying    , where thehash function is based on an     block code.1. Find a -block so that     blocks of its-block code word are with value zero. The posi-tions of those non-zero blocks are denoted as            , where    .2. Randomly chooseand let . Then and they differ at   blocks indicated by theset .3. In this step, we try to find  that eliminatesthe difference at the th block of the hash output, i.e.,we aim at achieving 	  	 (a) Find an -bit  such that  	    	  , i.e., 	  	 . In case such acollision could not be found, go to step 2, selecta different and repeat the attack.(b) Choose such the th block of its code wordis , i.e., 	  .(c) Let   . Clearly,  	  	  .Thus 	  	 , i.e., and  are thedesired message blocks.4. Similar to step 2, find  so that the differenceat the th block of the output is eliminated. Repeatthe similar attacks until all those   differences in thehash output are eliminated.5. The  and   (with only  ) constructedabove are with the same hash result.We note that according to Assumption 1, the Step 3 in theattack could succeed with about   encryptions. Thus thetotal amount of computations required in this attack is about     .4 Attack on the Hash Functions Based onConvolutional CodesInoue and Sakurai claimed that about      encryp-tions are needed to find a collision of their hash functionsbased on convolutional codes [5]. In this section, we givean attack to find such a collision with only about      en-cryptions. Similar to the attack in Section 3, our attack inthis section is to eliminate the differences in the hash outputseparately.The following attack is to find two different messages and   satisfying    , wherethe hash function is based on an    	 convolutionalcode.1. Randomly select two -block and  with .2. Randomly set the values of    	  . Letfor 	            , i.e., at the beginningof the    th iteration, the message blocks in thememory are the same for  and  .3. At the   th iteration, the only difference we needto consider is that  . In this step, we tryto eliminate the difference between the first blocks ofand  .(a) Find an -bit  such that 	  	 . In case such collision could notbe found, go to step 2, select a different and repeat the attack.(b) Choose such that the first block of the   th code word is , i.e., 	 .(c) Let   . Then  		  since  for 	              . Thus 	 	.The and  are the desired messageblocks.4. Carry out the similar attack to eliminate the remainingdifferences at those    blocks of the hash outputin the next   iterations.5. At the end of the   th iteration, . And there is no difference in the memory.Let for 	  ~~          ~~.6. From the    th iteration on, any final hash out-puts (the concatenation of the last  hash outputs)would be the same.We note that according to Assumption 1, the Step 3 in theattack could succeed with about   encryptions. Thus thetotal amount of computations required in this attack is about    .In addition, we point out here that the claim in [5] that“this (the convolutional codes based hash function) reducesthe circuit complexity of the hardware-implementationtimes in terms of the number of Davies-Mayers’s modulefunction than that based on block error correcting codes”is misleading. The hash function, no matter it is based onblock codes or convolutional codes, could be implementedwith only one Davies-Mayer’s module function in the hard-ware implementation. The reason is that those Davies-Mayer functions are all based on the same block cipher.5 ConclusionsIn this paper, we show that only about     encryptionsare needed to find a collision of Inoue and Sakurai’s hashfunctions based on the block codes and convolutional codes.The claim that a collision could only be found with about     encryptions is incorrect.References[1] B.O. Brachtl, D. Coppersmith, M.M. Hyden, S.M.Matyas, C.H. Meyer, J. Oseas, S. Pilpel, M. Schilling,“Data Authentication Using Modification DetectionCodes Based on a Public One Way Encryption Func-tion”, U.S. Patent Number 4,908,861, March 13, 1990.[2] J. Daeman, and V. Rijmen, “AES Proposal: Rijndael”,available at http://www. nist.gov/aes .[3] FIPS180, “Secure Hash Standard”, Federal Informa-tion Processing Standard (FIPS), Publication 180, Na-tional Institute of Standards and Technology, US De-partment of Commerce, Washington D.C., May 1993.[4] W. Hohl, X. Lai, T. Meier, and C. Waldvogel, “Se-curity of Iterated Hash Functions Based on Block Ci-phers”, in Advances in Cryptology - Crypto93, LNCS773, Springer-Verlag, pp. 379-390, 1994.[5] T. Inoue, and K. Sakurai, “Making Hash Functionsfrom Block Ciphers Secure and Efficient by UsingConvolutional Codes”, in Public Key Cryptography- PKC 2000, LNCS 1751, Springer-Verlag, pp. 391-404, 2000.[6] L.R. Knudsen, and X. Lai, “New Attacks on All Dou-ble Block Length Hash Functions of Hash Rate 1, in-cluding the Parallel-DM”, in Advances in Cryptology- Eurocrypt’94, LNCS 959, Springer-Verlag, pp. 410-418, 1995.[7] L.R. Knudsen, and B. Preneel, “Hash Functions Basedon Block Ciphers and Quaternary Codes”, in Ad-vances in Cryptology - Asiacrypto’96, LNCS 1163,Springer-Verlag, pp. 77-90, 1996.[8] L.R. Knudsen, and B. Preneel, “Fast and Secure Has-ing Based on Codes”, in Advances in Cryptology -Crypto’97, LNCS 1294, Springer-Verlag, pp. 485-498, 1997.[9] B. Preneel, R. Govaerts, J. Vandewalle, “Hash Func-tions Based on Block Ciphers: A Synthetic Ap-proach”, in Advances in Cryptology - Crypto’93,LNCS 773, Springer-Verlag, pp. 368-378, 1994.[10] R.L. Rivest, “The MD4 Message Digest Algorithm”,in Advances in Cryptology - Crypto’90, LNCS 537,Springer-Verlag, pp. 303-331, 1991.[11] R.L. Rivest, “The MD5 Message Digest Algorithm”,Request for Comments (RFC) 1321, Internet ActivitiesBoard, Internet Privacy Task Force, April 1992.