AURORA - Revision history

JAumasson: Unorangized key-recovery

2009-03-27T09:26:48Z

Unorangized key-recovery

JAumasson: Added Sasaki's attack on HMAC-AURORA-512

2009-03-20T15:11:53Z

Added Sasaki's attack on HMAC-AURORA-512

Mschlaeffer: color changed after clarifying classification

2009-03-11T13:44:07Z

color changed after clarifying classification

Fmendel: /* Cryptanalysis */

2009-03-11T10:13:27Z

‎Cryptanalysis

JAumasson: More consistent complexities for AURORA

2009-03-11T09:49:32Z

More consistent complexities for AURORA

Fmendel at 07:52, 11 March 2009

2009-03-11T07:52:18Z

Fmendel: added 2nd preiamge and collision attack on AURORA-512

2009-03-11T07:51:17Z

added 2nd preiamge and collision attack on AURORA-512

JAumasson: Minor fix

2009-02-20T07:09:17Z

Minor fix

JAumasson: Added AURORA's website

2009-02-20T07:07:45Z

Added AURORA's website

Mschlaeffer at 13:14, 11 December 2008

2008-12-11T13:14:57Z

@@ Line 33: / Line 33: @@
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>236</sup> || 2<sup>236</sup> || [http://eprint.iacr.org/2009/106.pdf Sasaki]
 |-
-|  style="background:orange" | key-recovery || HMAC || 512 ||  || 2<sup>259</sup> || - || [http://eprint.iacr.org/2009/125.pdf Sasaki]
+|  | key-recovery || HMAC || 512 ||  || 2<sup>259</sup> || - || [http://eprint.iacr.org/2009/125.pdf Sasaki]
 |-
 |}

@@ Line 33: / Line 33: @@
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>236</sup> || 2<sup>236</sup> || [http://eprint.iacr.org/2009/106.pdf Sasaki]
 |-
 |}
@@ Line 71: / Line 73: @@
      url ={http://eprint.iacr.org/2009/106.pdf},
      abstract = { In this note, we present a collision attack on AURORA-512, which is one of the candidates for SHA-3. The attack complexity is approximately $2^{236}$ AURORA-512 operations, which is less than the birthday bound of AURORA-512, namely, $2^{256}$. Our attack exploits some weakness in the mode of operation.},
+}
 </bibtex>

@@ Line 25: / Line 25: @@
 |  style="background:orange" | 2nd preimage || hash || 512 ||  || 2<sup>291</sup> || 2<sup>31.5</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
-|  style="background:orange" | collision || hash || 512 ||  || 2<sup>249</sup> || - || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
+|  style="background:greenyellow" | collision || hash || 512 ||  || 2<sup>249</sup> || - || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>234.5</sup> || 2<sup>229.6</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]

@@ Line 24: / Line 24: @@
 |-
 |  style="background:orange" | 2nd preimage || hash || 512 ||  || 2<sup>291</sup> || 2<sup>31.5</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>234.5</sup> || 2<sup>229.6</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]

@@ Line 27: / Line 27: @@
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>234.5</sup> || 2<sup>229.6</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
-|  style="background:yellow" | 2nd preimage || hash || 512 ||  || 2<sup>290</sup> || 2<sup>288</sup> || [http://eprint.iacr.org/2009/112.pdf Sasaki]
+|  style="background:yellow" | 2nd preimage || hash || 512 ||  || 2<sup>291</sup> || 2<sup>288</sup> || [http://eprint.iacr.org/2009/112.pdf Sasaki]
 |-
 |  style="background:yellow" | collision || hash || 512 ||  || 2<sup>236</sup> || 2<sup>236</sup> || [http://eprint.iacr.org/2009/106.pdf Sasaki]

@@ Line 23: / Line 23: @@
 |    Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
-|  style="background:orange" | 2nd preimage || hash || 512 ||  || 2<sup>291</sup> || 2<sup>31.5</sup> || [http://eprint.iacr.org/2009/113.pdf} Ferguson, Lucks]
+|  style="background:orange" | 2nd preimage || hash || 512 ||  || 2<sup>291</sup> || 2<sup>31.5</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
-|  style="background:yellow" | collision || hash || 512 ||  || 2<sup>234.5</sup> || 2<sup>229.6</sup> || [http://eprint.iacr.org/2009/113.pdf} Ferguson, Lucks]
+|  style="background:yellow" | collision || hash || 512 ||  || 2<sup>234.5</sup> || 2<sup>229.6</sup> || [http://eprint.iacr.org/2009/113.pdf Ferguson, Lucks]
 |-
-|  style="background:yellow" | 2nd preimage || hash || 512 ||  || 2<sup>290</sup> || 2<sup>288</sup> || [http://eprint.iacr.org/2009/112.pdf} Sasaki]
+|  style="background:yellow" | 2nd preimage || hash || 512 ||  || 2<sup>290</sup> || 2<sup>288</sup> || [http://eprint.iacr.org/2009/112.pdf Sasaki]
 |-
-|  style="background:yellow" | collision || hash || 512 ||  || 2<sup>236</sup> || 2<sup>236</sup> || [http://eprint.iacr.org/2009/106.pdf} Sasaki]
+|  style="background:yellow" | collision || hash || 512 ||  || 2<sup>236</sup> || 2<sup>236</sup> || [http://eprint.iacr.org/2009/106.pdf Sasaki]
 |-
 |}

← Older revision		Revision as of 07:51, 11 March 2009
Line 19:		Line 19:
	== Cryptanalysis ==		== Cryptanalysis ==

−	* None yet	+	{\| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
		+	\|- style="background:#efefef;"
		+	\| Type of Analysis \|\| Hash Function Part \|\| Hash Size (n) \|\| Parameters/Variants \|\| Compression Function Calls \|\| Memory Requirements \|\| Reference
		+	\|-
		+	\| style="background:orange" \| 2nd preimage \|\| hash \|\| 512 \|\| \|\| 2<sup>291</sup> \|\| 2<sup>31.5</sup> \|\| [http://eprint.iacr.org/2009/113.pdf} Ferguson, Lucks]
		+	\|-
		+	\| style="background:yellow" \| collision \|\| hash \|\| 512 \|\| \|\| 2<sup>234.5</sup> \|\| 2<sup>229.6</sup> \|\| [http://eprint.iacr.org/2009/113.pdf} Ferguson, Lucks]
		+	\|-
		+	\| style="background:yellow" \| 2nd preimage \|\| hash \|\| 512 \|\| \|\| 2<sup>290</sup> \|\| 2<sup>288</sup> \|\| [http://eprint.iacr.org/2009/112.pdf} Sasaki]
		+	\|-
		+	\| style="background:yellow" \| collision \|\| hash \|\| 512 \|\| \|\| 2<sup>236</sup> \|\| 2<sup>236</sup> \|\| [http://eprint.iacr.org/2009/106.pdf} Sasaki]
		+	\|-
		+	\|}
		+
		+	A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].
		+
		+
		+	<bibtex>
		+	@misc{cryptoeprint:2009:113,
		+	author = {Niels Ferguson and Stefan Lucks},
		+	title = {Attacks on AURORA-512 and the Double-Mix Merkle-Damgaard Transform},
		+	howpublished = {Cryptology ePrint Archive, Report 2009/113},
		+	year = {2009},
		+	note = {\url{http://eprint.iacr.org/}},
		+	url = {http://eprint.iacr.org/2009/113.pdf},
		+	abstract = {We analyse the Double-Mix Merkle-Damgaard construction (DMMD) used in the AURORA family of hash functions. We show that DMMD falls short of providing the expected level of security. Specifically, we are able to find 2nd pre-images for AURORA-512 in time 2^{291}, and collisions in time 2^{234.4}. A limited-memory variant finds collisions in time 2^{249}.},
		+	}
		+	</bibtex>
		+
		+	<bibtex>
		+	@misc{cryptoeprint:2009:112,
		+	author = {Yu Sasaki},
		+	title = {A 2nd-Preimage Attack on AURORA-512},
		+	howpublished = {Cryptology ePrint Archive, Report 2009/112},
		+	year = {2009},
		+	note = {\url{http://eprint.iacr.org/}},
		+	url = {http://eprint.iacr.org/2009/112.pdf},
		+	abstract = {In this note, we present a 2nd-preimage attack on AURORA-512, which is one of the candidates for SHA-3. Our attack can generate 2nd-preimages of any given message, in particular, the attack complexity becomes optimal when the message length is 9 blocks or more. In such a case, the attack complexity is approximately $2^{290}$ AURORA-512 operations, which is less than the brute force attack on AURORA-512, namely, $2^{512-\log_2{9}}\approx2^{508}$. Our attack exploits some weakness in the mode of operation.},
		+	}
		+	</bibtex>
		+
		+	<bibtex>
		+	@misc{cryptoeprint:2009:106,
		+	author = {Yu Sasaki},
		+	title = {A Collision Attack on AURORA-512},
		+	howpublished = {Cryptology ePrint Archive, Report 2009/106},
		+	year = {2009},
		+	note = {\url{http://eprint.iacr.org/}},
		+	url ={http://eprint.iacr.org/2009/106.pdf},
		+	abstract = { In this note, we present a collision attack on AURORA-512, which is one of the candidates for SHA-3. The attack complexity is approximately $2^{236}$ AURORA-512 operations, which is less than the birthday bound of AURORA-512, namely, $2^{256}$. Our attack exploits some weakness in the mode of operation.},
		+	}
		+	</bibtex>

@@ Line 2: / Line 2: @@
 * Author(s): Tetsu Iwata, Kyoji Shibutani, Taizo Shirai, Shiho Moriai, Toru Akishita
-* Website: [http://www.sony.net/Products/cryptography/aurora/?j-short=aurora http://www.sony.net/Products/cryptography/aurora/?j-short=aurora]
+* Website: [http://www.sony.net/aurora/ http://www.sony.net/aurora/]
 * NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/AURORA.zip AURORA.zip]

@@ Line 17: / Line 17: @@
+}
 </bibtex>
 == Cryptanalysis ==
 * None yet