LASH-n - Revision history

Fmendel: /* Best Known Results */

2008-11-10T10:34:29Z

‎Best Known Results

Fmendel: /* Collision Attacks */

2008-11-10T09:31:21Z

‎Collision Attacks

Mschlaeffer at 09:21, 11 March 2008

2008-03-11T09:21:39Z

Tnad: /* Spezification */

2008-03-10T15:00:30Z

‎Spezification

Mschlaeffer at 14:31, 10 March 2008

2008-03-10T14:31:36Z

Mschlaeffer at 14:11, 10 March 2008

2008-03-10T14:11:40Z

Mschlaeffer at 09:09, 10 March 2008

2008-03-10T09:09:43Z

Mschlaeffer at 09:08, 10 March 2008

2008-03-10T09:08:50Z

Mschlaeffer at 09:08, 10 March 2008

2008-03-10T09:08:17Z

Mschlaeffer at 09:07, 10 March 2008

2008-03-10T09:07:25Z

← Older revision		Revision as of 10:34, 10 November 2008
Line 23:		Line 23:

	=== Best Known Results ===		=== Best Known Results ===
		+	LASH-n is vulnerable to attacks that trade time for memory, including collision attacks as fast as 2<sup>(4n/11)</sup> and preimage attacks as fast as 2<sup>(4n/7)</sup>.

	----		----

← Older revision		Revision as of 09:31, 10 November 2008
Line 32:		Line 32:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{fseSteinfeldCMPGLW08,
		+	author = {Ron Steinfeld and Scott Contini and Krystian Matusiewicz and Josef Pieprzyk and Jian Guo and San Ling and Huaxiong Wang},
		+	title = {Cryptanalysis of LASH},
		+	booktitle = {FSE},
		+	year = {2008},
		+	pages = {207-223},
		+	abstract = {We show that the LASH-x hash function is vulnerable to attacks that trade time for memory, including collision attacks as fast as 2(4x/11) and preimage attacks as fast as 2^(4x/7). Moreover, we briefly mention heuristic lattice based collision attacks that use small memory but require very long messages that are expected to find collisions much faster than 2^x/2. All of these attacks exploit the designers’ choice of an all zero IV. We then consider whether LASH can be patched simply by changing the IV. In this case, we show that LASH is vulnerable to a 2^(7x/8) preimage attack. We also show that LASH is trivially not a PRF when any subset of input bytes is used as a secret key. None of our attacks depend upon the particular contents of the LASH matrix - we only assume that the distribution of elements is more or less uniform. Additionally, we show a generalized birthday attack on the final compression of LASH which requires $O\left(x2^{\frac{x}{2(1+\frac{107}{105})}}\right) \approx O(x2^{x/4})$ time and memory. Our method extends the Wagner algorithm to truncated sums, as is done in the final transform in LASH.},
		+	url = {http://dx.doi.org/10.1007/978-3-540-71039-4_13},
		+	editor = {Kaisa Nyberg},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5086},
		+	isbn = {978-3-540-71038-7},
		+	}
		+	</bibtex>

	----		----

@@ Line 4: / Line 4: @@
 * max. message length: arbitrary length
 * compression function: 640,1024,1536,2048-bit message blocks and 640,1024,1536,2048-bit state size
 * Specification: http://csrc.nist.gov/groups/ST/hash/documents/SAARINEN_lash4-1_ORIG.pdf
 <bibtex>

← Older revision		Revision as of 15:00, 10 March 2008
Line 1:		Line 1:
−	== ~~Spezification~~ ==	+	== Specification ==

	* digest size: 160,256,384,512 bits		* digest size: 160,256,384,512 bits

@@ Line 1: / Line 1: @@
 == Spezification ==
-* digest size: 160 bits
+* digest size: 160,256,384,512 bits
-* max. message length: < 2<sup>64</sup> bits
+* max. message length: arbitrary length
-* compression function: 512-bit message block, 160-bit chaining variable
+* compression function: 640,1024,1536,2048-bit message blocks and 640,1024,1536,2048-bit state size
 * Specification: http://csrc.nist.gov/groups/ST/hash/documents/SAARINEN_lash4-1_ORIG.pdf

@@ Line 7: / Line 7: @@
 * Specification:
 -->
 == Cryptanalysis ==

@@ Line 17: / Line 17: @@
    url = {http://csrc.nist.gov/groups/ST/hash/second_workshop.html} }
 <\bibtex>
 ----