SHA-256/224 - Revision history

KMatusiewicz: /* Best Known Results */

2009-09-18T08:08:24Z

‎Best Known Results

KMatusiewicz: /* Preimage Attacks */

2009-09-18T08:07:13Z

‎Preimage Attacks

KMatusiewicz: /* Best Known Results */

2009-09-18T08:02:00Z

‎Best Known Results

KMatusiewicz: added ref to collision attacks from SAC 2008

2009-09-18T07:59:33Z

added ref to collision attacks from SAC 2008

Fmendel: /* Collision Attacks */

2008-11-10T12:36:03Z

‎Collision Attacks

Fmendel: /* Collision Attacks */

2008-11-10T11:57:09Z

‎Collision Attacks

Fmendel: /* Collision Attacks */

2008-11-10T09:22:52Z

‎Collision Attacks

Fmendel: SHA-256 moved to SHA-256/224

2008-11-03T09:33:37Z

SHA-256 moved to SHA-256/224

Crechberger at 16:27, 21 March 2008

2008-03-21T16:27:33Z

Fmendel: /* Collision Attacks */

2008-03-11T13:14:27Z

‎Collision Attacks

@@ Line 11: / Line 11: @@
 === Best Known Results ===
 Collision attacks up to 24 out of 64 steps. Other non random behavior up to 31 steps. Both results are due to Indesteege et al (SAC 2008).
+Preimages on up to 24 steps due to Isobe and Shibutani (FSE 2009).
 ----

@@ Line 186: / Line 186: @@
 === Preimage Attacks ===
+<bibtex>
 ----
 === Others ===

@@ Line 10: / Line 10: @@
 === Best Known Results ===
-Collision attacks up to 21 out of 64 steps. Other non random behavior up to 25 steps. Both results are due to Nicolic and Biryukov.
+Collision attacks up to 24 out of 64 steps. Other non random behavior up to 31 steps. Both results are due to Indesteege et al (SAC 2008).
 ----

← Older revision		Revision as of 07:59, 18 September 2009
Line 19:		Line 19:

	=== Collision Attacks ===		=== Collision Attacks ===
		+	<bibtex>
		+	@INPROCEEDINGS{sacIndesteegeMPC08,
		+	author = {Sebastiaan Indesteege and Florian Mendel and Bart Preneel and Christian
		+	Rechberger},
		+	title = {Collisions and other Non-Random Properties for Step-Reduced SHA-256},
		+	booktitle = {Selected Areas in Cryptography -- SAC 2008},
		+	year = {2008},
		+	volume = {5381},
		+	series = {LNCS},
		+	pages = {276-293},
		+	publisher = {Springer},
		+	abstract = {We study the security of step-reduced but otherwise unmodified SHA-256.
		+	We show the first collision attacks on SHA-256 reduced to 23 and
		+	24 steps with complexities $2^{18}$ and $2^{28.5}$, respectively.
		+	We give example colliding message pairs for 23-step and 24-step SHA-256.
		+	The best previous, recently obtained result was a collision attack
		+	for up to 22 steps. We extend our attacks to 23 and 24-step reduced
		+	SHA-512 with respective complexities of 2^{44.9} and 2^{53.0}. Additionally,
		+	we show non-random behaviour of the SHA-256 compression function
		+	in the form of free-start near-collisions for up to 31 steps, which
		+	is 6 more steps than the recently obtained non-random behaviour in
		+	the form of a semi-free-start near-collision. Even though this represents
		+	a step forwards in terms of cryptanalytic techniques, the results
		+	do not threaten the security of applications using SHA-256.},
		+	doi = {10.1007/978-3-642-04159-4_18},
		+	url = {http://dx.doi.org/10.1007/978-3-642-04159-4_18},
		+	}
		+
		+	</bibtex>

	<bibtex>		<bibtex>

← Older revision		Revision as of 12:36, 10 November 2008
Line 19:		Line 19:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{iswSanadhyaS08,
		+	author = {Somitra Kumar Sanadhya and Palash Sarkar},
		+	title = {Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family},
		+	booktitle = {ISC},
		+	year = {2008},
		+	pages = {244-259},
		+	abstract = {Recently, at FSE ’08, Nikolic and Biryukov introduced a new technique for analyzing SHA-2 round function. Building on their work, but using other differential paths, we construct two different deterministic attacks against 21-step SHA-2 hash family. Since the attacks are deterministic, they are actually combinatorial constructions of collisions. There are six free words in our first construction. This gives exactly 2^192 different collisions for 21-step SHA-256 and exactly 2^384 different collisions for 21-step SHA-512. The second construction has five free words. The best previous result, due to Nikolic and Biryukov, for finding collisions for 21-step SHA-256 holds with probability 2-^19. No results on 21-step SHA-512 are previously known. Further, we provide evidence that the Nikolic-Biryukov differential path is unlikely to yield 21-step collisions for SHA-512.},
		+	url = {http://dx.doi.org/10.1007/978-3-540-85886-7_17},
		+	editor = {Tzong-Chen Wu and Chin-Laung Lei and Vincent Rijmen and Der-Tsai Lee},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5222},
		+	isbn = {978-3-540-85884-3},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

← Older revision		Revision as of 11:57, 10 November 2008
Line 19:		Line 19:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{acispSanadhyaS08,
		+	author = {Somitra Kumar Sanadhya and Palash Sarkar},
		+	title = {Non-linear Reduced Round Attacks against SHA-2 Hash Family},
		+	booktitle = {ACISP},
		+	year = {2008},
		+	pages = {254-266},
		+	abstract = {Most of the attacks against (reduced) SHA-2 family in literature have used local collisions which are valid for linearized version of SHA-2 hash functions. Recently, at FSE 2008, an attack against reduced round SHA-256 was presented by Nikolic and Biryukov which used a local collision which is valid for the actual SHA-256 function. It is a 9-step local collision which starts by introducing a modular difference of 1 in the two messages. It succeeds with probability roughly 1/3. We build on the work of Nikolic and Biryukov and provide a generalized nonlinear local collision which accepts an arbitrary initial message difference. This local collision succeeds with probability 1. Using this local collision we present attacks against 18-step SHA-256 and 18-step SHA-512 with arbitrary initial difference. Both of these attacks succeed with probability 1. We then present special cases of our local collision and show two different differential paths for attacking 20-step SHA-256 and 20-step SHA-512. One of these paths is the same as presented by Nikolic and Biryukov while the other one is a new differential path. Messages following both these differential paths can be found with probability 1. This improves on the previous result where the success probability of 20-step attack was 1/3. Finally, we present two differential paths for 21-step collisions for SHA-256 and SHA-512, one of which is a new path. The success probabilities of these paths for SHA-256 are roughly 2-^15 and 2^-17 which improve on the 21-step attack having probability 2^-19 reported earlier. We show examples of message pairs following all the presented differential paths for up to 21-step collisions in SHA-256. We also show first real examples of colliding message pairs for up to 20-step reduced SHA-512. },
		+	url = {http://dx.doi.org/10.1007/978-3-540-70500-0_19},
		+	editor = {Yi Mu and Willy Susilo and Jennifer Seberry},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5107},
		+	isbn = {978-3-540-69971-2},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

@@ Line 21: / Line 21: @@
 <bibtex>
+@inproceedings{fseNikolicB08,
    author    = {Ivica Nikolic and Alex Biryukov},
-   title = {Collisions for Step-Reduced SHA-256},
+   title     = {Collisions for Step-Reduced SHA-256},
    booktitle = {FSE},
-   year = {2008},
+   year      = {2008},
-   editor = {Kaisa Nyberg},
+   pages     = {1-15},
-   series = {LNCS},
+  abstract  = {In this article we find collisions for step-reduced SHA-256. We develop a differential that holds with high probability if the message satisfies certain conditions. We solve the equations that arise from the conditions. Due to the carefully chosen differential and word differences, the message expansion of SHA-256 has little effect on spreading the differences in the words. This helps us to find full collision for 21-step reduced SHA-256, semi-free start collision, i.e. collision for a different initial value, for 23-step reduced SHA-256, and semi-free start near collision (with only 15 bit difference out of 256 bits) for 25-step reduced SHA-256.},
    publisher = {Springer},
-   note = {To appear},
+   series    = {LNCS},
+}
 </bibtex>
 <bibtex>

← Older revision	Revision as of 09:33, 3 November 2008
(No difference)

@@ Line 19: / Line 19: @@
 === Collision Attacks ===
 <bibtex>
 @inproceedings{fseMendelPRR06,