SHA-512/384 - Revision history

Fmendel: /* Collision Attacks */

2008-11-10T12:36:22Z

‎Collision Attacks

Fmendel: /* Collision Attacks */

2008-11-10T11:57:29Z

‎Collision Attacks

Fmendel: SHA-512 moved to SHA-512/384

2008-11-03T09:34:07Z

SHA-512 moved to SHA-512/384

Crechberger: /* Specification */

2008-03-17T08:56:25Z

‎Specification

Npramstaller: /* Collision Attacks */

2008-03-11T05:57:35Z

‎Collision Attacks

Npramstaller: /* Specification */

2008-03-11T05:56:46Z

‎Specification

Npramstaller at 05:54, 11 March 2008

2008-03-11T05:54:01Z

New page

== Specification ==



== Cryptanalysis ==

=== Best Known Results ===

----

=== Generic Attacks ===
* [[GenericAttacksMerkleDamgaard| Generic Attacks on the Merkle-Damgaard Construction ]]

----

=== Collision Attacks ===

----

=== Second Preimage Attacks ===

----

=== Preimage Attacks ===

----

=== Others ===

← Older revision		Revision as of 12:36, 10 November 2008
Line 19:		Line 19:

	=== Collision Attacks ===		=== Collision Attacks ===
		+
		+	<bibtex>
		+	@inproceedings{iswSanadhyaS08,
		+	author = {Somitra Kumar Sanadhya and Palash Sarkar},
		+	title = {Deterministic Constructions of 21-Step Collisions for the SHA-2 Hash Family},
		+	booktitle = {ISC},
		+	year = {2008},
		+	pages = {244-259},
		+	abstract = {Recently, at FSE ’08, Nikolic and Biryukov introduced a new technique for analyzing SHA-2 round function. Building on their work, but using other differential paths, we construct two different deterministic attacks against 21-step SHA-2 hash family. Since the attacks are deterministic, they are actually combinatorial constructions of collisions. There are six free words in our first construction. This gives exactly 2^192 different collisions for 21-step SHA-256 and exactly 2^384 different collisions for 21-step SHA-512. The second construction has five free words. The best previous result, due to Nikolic and Biryukov, for finding collisions for 21-step SHA-256 holds with probability 2-^19. No results on 21-step SHA-512 are previously known. Further, we provide evidence that the Nikolic-Biryukov differential path is unlikely to yield 21-step collisions for SHA-512.},
		+	url = {http://dx.doi.org/10.1007/978-3-540-85886-7_17},
		+	editor = {Tzong-Chen Wu and Chin-Laung Lei and Vincent Rijmen and Der-Tsai Lee},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {5222},
		+	isbn = {978-3-540-85884-3},
		+	}
		+	</bibtex>

	<bibtex>		<bibtex>

@@ Line 19: / Line 19: @@
 === Collision Attacks ===
 <bibtex>
 @inproceedings{sacryptGilbertH03,

@@ Line 1: / Line 1: @@
 == Specification ==
-* digest size: 512 bits
+* digest size: 512 bits, truncation to 384 bits also specified
 * max. message length: < 2<sup>128</sup> bits
 * compression function: 1024-bit message block, 512-bit chaining variable

← Older revision		Revision as of 05:57, 11 March 2008
Line 19:		Line 19:

	=== Collision Attacks ===		=== Collision Attacks ===
		+	<bibtex>
		+	@inproceedings{sacryptGilbertH03,
		+	author = {Henri Gilbert and Helena Handschuh},
		+	title = {Security Analysis of SHA-256 and Sisters},
		+	booktitle = {Selected Areas in Cryptography},
		+	year = {2003},
		+	pages = {175-193},
		+	url = {http://springerlink.metapress.com/openurl.asp?genre=article{\&}issn=0302-9743{\&}volume=3006{\&}spage=175},
		+	editor = {Mitsuru Matsui and Robert J. Zuccherato},
		+	publisher = {Springer},
		+	series = {LNCS},
		+	volume = {3006},
		+	isbn = {3-540-21370-8},
		+	abstract = {This paper studies the security of SHA-256, SHA-384 and SHA-512 against collision attacks and provides some insight into the security properties of the basic building blocks of the structure. It is concluded that neither Chabaud and Joux's attack, nor Dobbertin-style attacks apply. Differential and linear attacks also don't apply on the underlying structure. However we show that slightly simplified versions of the hash functions are surprisingly weak: whenever symmetric constants and initialization values are used throughout the computations, and modular additions are replaced by exclusive or operations, symmetric messages hash to symmetric digests. Therefore the complexity of collision search on these modified hash functions potentially becomes as low as one wishes.},
		+	}
		+	</bibtex>

	----		----

← Older revision	Revision as of 09:34, 3 November 2008
(No difference)