Luffa - Revision history

Mschlaeffer: Cryptanalysis updated

2010-12-06T14:08:12Z

Cryptanalysis updated

Mschlaeffer: cryptanalysis results updated

2010-12-06T13:07:04Z

cryptanalysis results updated

Mschlaeffer at 12:55, 5 July 2010

2010-07-05T12:55:07Z

JAumasson: correct placement of rec sec par

2010-04-29T07:19:09Z

correct placement of rec sec par

JAumasson: /* Building blocks */ fixed zero-sum entry

2010-02-21T10:40:47Z

‎Building blocks: fixed zero-sum entry

Mschlaeffer: desingers' analysis added, table sorted

2010-02-15T16:24:52Z

desingers' analysis added, table sorted

Mschlaeffer at 22:18, 29 January 2010

2010-01-29T22:18:08Z

Mschlaeffer: separate cryptanalysis tables

2010-01-29T20:52:30Z

separate cryptanalysis tables

Fmendel: updated link to round 2 submission

2009-11-23T15:19:06Z

updated link to round 2 submission

Mschlaeffer: analysis update

2009-09-14T17:48:25Z

analysis update

@@ Line 80: / Line 80: @@
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | semi-free-start collision || hash || 256 || 7 rounds || 2<sup>104</sup> || 2<sup>102</sup> || [http://online.tugraz.at/tug_online/voe_main2.getVollText?pDocumentNr=163671&pCurrPk=52053 Khovratovich,Naya-Plasencia,Röck,Schläffer]
 |-
@@ Line 102: / Line 106: @@
 |}
 <bibtex>

@@ Line 65: / Line 65: @@
 | Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements ||   Reference
 |-
-| || || || || ||
+| collision || 256 || 4 rounds || 2<sup>90</sup> || - || [http://www.sdl.hitachi.co.jp/crypto/luffa/FindingCollisionsForReducedLuffa-256v2_20101108.pdf Preneel,Yoshida,Watanabe]
 |-
 |}
@@ Line 80: / Line 80: @@
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 | distinguisher || permutation ||  || 8 rounds || 2<sup>82</sup> || - || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
 |-
-| pseudo-2nd preimage || hash || all ||  || 1 || - || [http://eprint.iacr.org/2009/224.pdf Jia]
+| free-start 2nd preimage || hash || all ||  || 1 || - || [http://eprint.iacr.org/2009/224.pdf Jia]
 |-
-| pseudo-preimage || hash || 256 ||  || 2<sup>127</sup> || - || [http://eprint.iacr.org/2009/224.pdf Jia]
+| free-start preimage || hash || 256 ||  || 2<sup>127</sup> || - || [http://eprint.iacr.org/2009/224.pdf Jia]
 |-
-| pseudo-preimage || hash || 512 ||  || 2<sup>171</sup> || - || [http://eprint.iacr.org/2009/224.pdf Jia]
+| free-start preimage || hash || 512 ||  || 2<sup>171</sup> || - || [http://eprint.iacr.org/2009/224.pdf Jia]
 |-
 | semi-free-start collision || hash || all || any || 2<sup>256*(w-1)/w</sup> || - || [http://www.sdl.hitachi.co.jp/crypto/luffa/Luffa_v2_SupportingDocument_20090915.pdf submission document]
@@ Line 97: / Line 103: @@
 <bibtex>

@@ Line 61: / Line 61: @@
 Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 | Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements ||   Reference
@@ Line 76: / Line 76: @@
 Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference

@@ Line 55: / Line 55: @@
 A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].
 === Hash function ===
 Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
 {| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"

@@ Line 81: / Line 81: @@
 | Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
-| distinguisher || permutation ||  || 4 rounds || ? || - || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
+| distinguisher || permutation ||  || 8 rounds || 2<sup>82</sup> || - || [http://www.131002.net/data/papers/AM09.pdf Aumasson,Meier]
 |-
 | pseudo-2nd preimage || hash || all ||  || 1 || - || [http://eprint.iacr.org/2009/224.pdf Jia]

← Older revision		Revision as of 22:18, 29 January 2010
Line 61:		Line 61:

	Recommended security parameter: '''8''' rounds		Recommended security parameter: '''8''' rounds
		+
		+	{\| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
		+	\|- style="background:#efefef;"
		+	\| Type of Analysis \|\| Hash Size (n) \|\| Parameters \|\| Compression Function Calls \|\| Memory Requirements \|\| Reference
		+	\|-
		+	\| \|\| \|\| \|\| \|\| \|\|
		+	\|-
		+	\|}

@@ Line 47: / Line 47: @@
+}
 </bibtex>
 == Cryptanalysis ==
 {| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
@@ Line 65: / Line 83: @@
 |}
-A description of this table is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].

@@ Line 3: / Line 3: @@
 * Author(s): Christophe De Canniere, Hisayoshi Sato, Dai Watanabe
 * Website: [http://www.sdl.hitachi.co.jp/crypto/luffa/ http://www.sdl.hitachi.co.jp/crypto/luffa/]
-* NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/Luffa.zip Luffa.zip], [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/LuffaUpdate.zip LuffaUpdate.zip]
+* NIST submission package:
 <bibtex>
@@ Line 11: / Line 33: @@
    title     = {Hash Function Luffa: Specification},
    url        = {http://ehash.iaik.tugraz.at/uploads/e/ea/Luffa_Specification.pdf},
-   howpublished = {Submission to NIST},
+   howpublished = {Submission to NIST (Round 1)},
    year      = {2008},
+}
 </bibtex>
 <bibtex>
@@ Line 22: / Line 43: @@
    title     = {Hash Function Luffa: Supporting Document},
    url        = {http://ehash.iaik.tugraz.at/uploads/f/fe/Luffa_SupportingDocument.pdf},
-   howpublished = {Submission to NIST},
+   howpublished = {Submission to NIST (Round 1)},
    year      = {2008},
+}

@@ Line 39: / Line 39: @@
 |-
 | pseudo-preimage || hash || 512 ||  || 2<sup>171</sup> || - || [http://eprint.iacr.org/2009/224.pdf Jia]
 |-
 |}
@@ Line 55: / Line 57: @@
      abstract = {In this paper, we show some pseudo-collision and pseudo-second-preimage examples for the SHA-3 candidate algorithm Luffa. The pseudo-collision and pseudo-second-preimage can be obtained easily by the message injection function. At the same time, the pseudo-preimage attacks are shown in this paper. For Luffa-224/256, only two iteration functions is needed to get the pseudo-preimage. We need $2^{127}$ and $2^{171}$ to get the pseudo-preimage for Luffa-384 and Luffa-512 respectively. },
+}
 </bibtex>