ECHO - Revision history

JAumasson: /* Building blocks */ added Sasaki et al.

2010-12-08T12:43:58Z

‎Building blocks: added Sasaki et al.

JAumasson: /* Cryptanalysis */ added Naya-Plasencia result

2010-12-07T13:39:02Z

‎Cryptanalysis: added Naya-Plasencia result

JAumasson: /* Cryptanalysis */

2010-12-07T13:26:24Z

‎Cryptanalysis

JAumasson: added eprint 2010/569

2010-11-08T14:26:17Z

added eprint 2010/569

Fmendel at 12:52, 5 July 2010

2010-07-05T12:52:41Z

Fmendel: Subspace Distinguisher for 5/8 Rounds of the ECHO-256 Hash Function

2010-07-05T12:34:16Z

Subspace Distinguisher for 5/8 Rounds of the ECHO-256 Hash Function

JAumasson at 07:13, 29 April 2010

2010-04-29T07:13:25Z

JAumasson: correct placement of rec sec par

2010-04-29T07:04:53Z

correct placement of rec sec par

JAumasson: Added Peyrin results

2010-04-29T06:54:02Z

Added Peyrin results

Mschlaeffer at 19:07, 17 February 2010

2010-02-17T19:07:21Z

@@ Line 67: / Line 67: @@
 | distinguisher || permutation || 256 || 8 rounds || 2<sup>151</sup> || 2<sup>67</sup> || [http://eprint.iacr.org/2010/607.pdf Naya-Plasencia]
 |-
 | distinguisher<sup>(1)</sup> (chosen salt) || compression function || 256 || 7 rounds || 2<sup>160</sup> || 2<sup>128</sup> || [http://eprint.iacr.org/2010/588.pdf Schläffer]
 |-
@@ Line 101: / Line 103: @@
      url = {http://eprint.iacr.org/2010/607.pdf},
      abstract = {Rebound attacks are a state-of-the-art analysis method for hash functions. These cryptanalysis methods are based on a well chosen differential path and have been applied to several hash functions from the SHA-3 competition, providing the best known analysis in these cases. In this paper we study rebound attacks in detail and find for a great number of cases, that complexities of existing attacks can be improved. This is done by determining problems that adapt optimally to the cryptanalytic situation, and by using better algorithms to follow the differential path. These improvements are essentially based on merging big lists in a more efficient way, as well as on new ideas on how to reduce the complexities. As a result, we introduce general purpose new algorithms for enabling further rebound analysis to be as performant as possible. We illustrate our new algorithms for real hash functions and demonstrate how to reduce the complexities of the best known analysis on five hash functions: JH, Grøstl, ECHO, Luffa and Lane (the first four are round two SHA-3 candidates).},
+}
 </bibtex>

@@ Line 64: / Line 64: @@
 |- style="background:#efefef;"
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | distinguisher<sup>(1)</sup> (chosen salt) || compression function || 256 || 7 rounds || 2<sup>160</sup> || 2<sup>128</sup> || [http://eprint.iacr.org/2010/588.pdf Schläffer]
@@ Line 89: / Line 91: @@
 <sup>(1)</sup> In this attack some problems in the [http://eprint.iacr.org/2010/321.pdf previous attacks] (pointed out by [http://eprint.iacr.org/2010/569.pdf Jean,Fouque]) have been corrected.
 <bibtex>

@@ Line 28: / Line 28: @@
 == Cryptanalysis ==
@@ Line 44: / Line 48: @@
 | Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements ||   Reference
 |-
-| distinguisher || 256 || 5 rounds || 2<sup>96</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/321.pdf Schläffer]
+| collision<sup>(1)</sup> || 256 || 5 rounds || 2<sup>112</sup> || 2<sup>85.3</sup> || [http://eprint.iacr.org/2010/588.pdf Schläffer]
 |-
 |}
@@ Line 63: / Line 65: @@
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | semi-free-start collision || compression function || 256 || 4 rounds || 2<sup>52</sup> || 2<sup>16</sup> || [http://eprint.iacr.org/2010/569.pdf Jean,Fouque]
 |-
 | semi-free-start collision || compression function || 256 || 3 rounds || 2<sup>64</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/223.pdf Peyrin]
 |-
@@ Line 89: / Line 87: @@
 |}
 <bibtex>

@@ Line 63: / Line 63: @@
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | distinguisher (chosen salt) || compression function || 256 || 7 rounds || 2<sup>107</sup> || 2<sup>64</sup> || [http://eprint.iacr.org/2010/321.pdf Schläffer]
 |-
@@ Line 87: / Line 89: @@
 |}
-−
 <bibtex>
@@ Line 133: / Line 158: @@
 rounds of the AES block cipher and the internal permutation used in
 ECHO.}
 </bibtex>

@@ Line 40: / Line 40: @@
 Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 | Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements ||   Reference
@@ Line 59: / Line 59: @@
 Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference

@@ Line 34: / Line 34: @@
 A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].
-Recommended security parameters: '''8''' rounds (n=224,256); '''10''' rounds (n=384,512)
+Recommended security parameter: '''8''' rounds (n=224,256); '''10''' rounds (n=384,512)
 === Hash function ===

@@ Line 55: / Line 55: @@
 Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
 {| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
@@ Line 66: / Line 64: @@
 | distinguisher || permutation || all || 7 rounds || 2<sup>384</sup> || 2<sup>64</sup> || [http://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=110408 Mendel,Peyrin,Rechberger,Schläffer]
 |-
-| distinguisher || permutation || all || 7 rounds || 2<sup>896</sup> || 2<sup>896</sup> || [http://crypto.rd.francetelecom.com/echo/doc/echo_description_1-5.pdf submission document]
+| distinguisher || permutation || all || 7 rounds || 2<sup>896</sup> || - || [http://crypto.rd.francetelecom.com/echo/doc/echo_description_1-5.pdf submission document]
 |-
 |}