MD6 - Revision history

Crechberger: 33 rounds of the MD6 permutation

2009-03-03T15:16:29Z

33 rounds of the MD6 permutation

2009-03-03T11:27:11Z

Added Khazaei/Meier results

2009-01-11T11:43:15Z

added new distinguisher

2008-12-29T20:07:10Z

2008-12-11T09:25:18Z

‎The algorithm

2008-11-25T14:15:12Z

2008-11-04T20:11:36Z

2008-11-02T12:41:45Z

‎Cryptanalysis

2008-11-02T12:27:42Z

‎Cryptanalysis

2008-10-31T15:57:13Z

‎Cryptanalysis

@@ Line 27: / Line 27: @@
 |  | key-recovery || reduced compression ||  || 15 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Dinur,Shamir]
 |-
-|   | non-randomness || reduced compression ||  || 30 rounds || ? || ? || [http://www.dagstuhl.de/Materials/index.en.phtml?09031#Khovratovich,%20Dimitry Khovratovich]
+|   | non-randomness || reduced permutation||  || 30 rounds || ? || ? || [http://www.dagstuhl.de/Materials/index.en.phtml?09031#Khovratovich,Dimitry Khovratovich]
 |-
 |   | collision || reduced compression ||  || 16 rounds || 2<sup>30</sup> || - || [http://ehash.iaik.tugraz.at/uploads/9/91/Khazaei_md6.txt Khazaei,Meier]
@@ Line 80: / Line 82: @@
 I will also show how it worked in practice in a GUI-tool.},
+}
 </bibtex>

@@ Line 22: / Line 22: @@
 |- style="background:#efefef;"
 |    Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 |   | non-randomness || reduced compression ||  || 18 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Aumasson,Meier]
 |-
 |  | key-recovery || reduced compression ||  || 15 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Dinur,Shamir]
 |-
 |}
@@ Line 78: / Line 80: @@
 I will also show how it worked in practice in a GUI-tool.},
+}
 </bibtex>

@@ Line 23: / Line 23: @@
 |    Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
 |   | non-randomness || reduced compression ||  || 18 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Aumasson,Meier]
 |-
 |  | key-recovery || reduced compression ||  || 15 rounds || ? || ? || [http://groups.csail.mit.edu/cis/md6/supmitted-2008-10-27/Supporting_Documentation/md6_report.pdf Dinur,Shamir]
 |-
@@ Line 49: / Line 51: @@
    howpublished = {Reported in the supporting documentation},
    year      = {2008},
+}
 </bibtex>

@@ Line 4: / Line 4: @@
 * Website: [http://groups.csail.mit.edu/cis/md6/ http://groups.csail.mit.edu/cis/md6/]
 * NIST submission package: [http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/documents/MD6.zip MD6.zip]
-* Specification:
 <bibtex>
@@ Line 15: / Line 15: @@
+}
 </bibtex>
 == Cryptanalysis ==
 <bibtex>
@@ Line 27: / Line 41: @@
+}
 </bibtex>
 <bibtex>

@@ Line 3: / Line 3: @@
 * Authors: Ron Rivest, Benjamin Agre, Daniel V. Bailey, Christopher Crutchfield, Yevgeniy Dodis, Kermin Elliott Fleming, Asif Khan, Jayant Krishnamurthy, Yuncheng Lin, Leo Reyzin, Emily Shen, Jim Sukha, Drew Sutherland, Eran Tromer, Yiqun Lisa Yin
 * Website: [http://groups.csail.mit.edu/cis/md6/ http://groups.csail.mit.edu/cis/md6/]
 * Specification:
@@ Line 14: / Line 15: @@
+}
 </bibtex>
 == Cryptanalysis ==

@@ Line 18: / Line 18: @@
 == Cryptanalysis ==
-* J.-Ph. Aumasson, W. Meier, cited in the supporting documentation. Nonrandomness observed on a reduced version of the compression function with 18 rounds in about 2^17 operations (MD6 has 96/104/136/168 rounds for output sizes 224/256/384/512 bits).
+<bibtex>
-* I. Dinur, A. Shamir , cited in the supporting documentation. Cube attack on a reduced version of the compression function with 15 rounds.
+@misc{md6AM08,

← Older revision		Revision as of 12:41, 2 November 2008
Line 18:		Line 18:
	== Cryptanalysis ==		== Cryptanalysis ==

		+	* Aumasson, Meier (mentioned in original proposal text): nonrandomness observed on a reduced version of the compression function with 18 rounds (about 2^17 operations).
		+	* Dinur, Shamir (mentioned in original proposal text): cube attack on a reduced version of the compression function with 15 rounds.

−	* Aumasson, Meier (~~mentioned in original proposal text): nonrandomness observed on a reduced version of the compression function with 18~~ rounds~~, instead of at least 80 in the original MD6~~.	+	(MD6 has 96/104/136/168 rounds for output sizes 224/256/384/512 bits.)
−	* Dinur, Shamir (mentioned in original proposal text)~~: cube attack on a reduced version of the compression function with 15 rounds, instead of at least 80 in the original MD6.~~

← Older revision		Revision as of 12:27, 2 November 2008
Line 19:		Line 19:


−	* Aumasson, Meier: nonrandomness on the ~~18-round~~ compression function ~~(mentioned~~ in original ~~proposal text)~~.	+	* Aumasson, Meier (mentioned in original proposal text): nonrandomness observed on a reduced version of the compression function with 18 rounds, instead of at least 80 in the original MD6.
−	* Dinur, Shamir: cube attack on the ~~15-round~~ compression function ~~(mentioned~~ in original ~~proposal text)~~.	+	* Dinur, Shamir (mentioned in original proposal text): cube attack on a reduced version of the compression function with 15 rounds, instead of at least 80 in the original MD6.

← Older revision		Revision as of 15:57, 31 October 2008
Line 19:		Line 19:


−	* Aumasson, Meier: nonrandomness on the 18-round compression function (mentioned in original proposal text).	+	* Aumasson, Meier: nonrandomness on the 18-round compression function (mentioned in original proposal text).
−	* Dinur, Shamir: cube attack on the 15-round compression function (mentioned in original proposal text).	+	* Dinur, Shamir: cube attack on the 15-round compression function (mentioned in original proposal text).