Shabal - Revision history

JAumasson: added eprint 2010/434

2010-11-08T15:46:53Z

added eprint 2010/434

2010-10-15T14:46:30Z

2010-09-10T07:23:11Z

Added observation from NIST mailing list

2010-07-27T00:58:34Z

added Novotney distinguisher

2010-07-05T12:54:56Z

2010-04-29T07:21:53Z

correct placement of rec sec par

2010-03-31T10:06:07Z

Added the rotational distinguisher

2010-02-15T11:23:32Z

‎Building blocks

2010-02-15T11:23:21Z

2010-02-15T10:59:06Z

added footnote

@@ Line 69: / Line 69: @@
 |   | non-randomness || permutation || all || || 2<sup>21</sup> || || [http://eprint.iacr.org/2010/398.pdf Novotney]
 |-
-|   | non-randomness || compression function || all || || 1 || || [http://eprint.iacr.org/2010/398.pdf Aumasson]
+|   | non-randomness || compression function || all || || 1 || || [http://ehash.iaik.tugraz.at/uploads/4/4b/Aumasson_shabal.txt Aumasson]
 |-
 |}

@@ Line 68: / Line 68: @@
 |-
 |   | non-randomness || permutation || all || || 2<sup>21</sup> || || [http://eprint.iacr.org/2010/398.pdf Novotney]
 |-
 |}
 <sup>(1)</sup>The Shabal team commented on these analyses and provide an update of their security proofs in [http://eprint.iacr.org/2009/199.pdf this note].
@@ Line 135: / Line 137: @@
      note = {\url{http://eprint.iacr.org/}},
    abstract = {In this note we consider the Shabal permutation function $\mathcal{P}$ as a block cipher with input $A_p$,$B_p$ and key $C$,$M$ and describe a distinguisher with a data complexity of $2^{23}$ random inputs with a given difference. If the attacker can control one chosen bit of $B_p$, only $2^{21}$ inputs with a given difference are required on average. This distinguisher does not appear to lead directly to an attack on the full Shabal construction. },
+}
 </bibtex>

@@ Line 66: / Line 66: @@
 |-
 |   | non-randomness || permutation || all || || 2<sup>159</sup> || || [http://gva.noekeon.org/papers/ShabalRotation.pdf Van Assche]
 |-
 |}
@@ Line 122: / Line 124: @@
    year      = {2010},
    abstract = {In this short note, we apply a rotational distinguisher to the keyed permutation of the SHA-3 candidate Shabal. We then discuss its applicability in the scope of Shabal's mode of operation and its impact on the security proofs.},
+}
 </bibtex>

@@ Line 41: / Line 41: @@
 Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 | Type of Analysis || Hash Size (n) || Parameters || Compression Function Calls || Memory Requirements ||   Reference
@@ Line 55: / Line 55: @@
 Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
-{| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
+{| border="1" cellpadding="4" cellspacing="0" class="wikitable sortable" style="text-align:center"
 |- style="background:#efefef;"
 |   Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference

@@ Line 35: / Line 35: @@
 A description of the tables is given [http://ehash.iaik.tugraz.at/wiki/Cryptanalysis_Categories#Individual_Hash_Function_Tables here].
 === Hash function ===
 Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
 {| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"
@@ Line 55: / Line 54: @@
 Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
 {| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"

@@ Line 67: / Line 67: @@
 |-
 |   | non-randomness<sup>(1)</sup> || permutation || all || || 2 || || [http://131002.net/data/papers/AMM09.pdf Aumasson,Mashatan,Meier]
 |-
 |}
@@ Line 112: / Line 114: @@
    howpublished = {OFFICIAL COMMENT},
    year      = {2009},
+}
 </bibtex>

← Older revision		Revision as of 11:23, 15 February 2010
Line 55:		Line 55:

	Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).		Note that these results assume more direct control or access over some internal variables (aka. free-start, pseudo, compression function, block cipher, or permutation attacks).
		+
		+	Recommended security parameters: (p,r)='''(3,12)'''

	{\| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"		{\| border="1" cellpadding="4" cellspacing="0" class="wikitable" style="text-align:center"

@@ Line 38: / Line 38: @@
 === Hash function ===
-Here we list results on the actual hash function. The only allowed modification is to change the security parameter.
+Here we list results on the hash function according to the NIST requirements. The only allowed modification is to change the security parameter.
 Recommended security parameters: (p,r)='''(3,12)'''
@@ Line 48: / Line 48: @@
 | || || || || ||
 |-
 |}
 === Building blocks ===

@@ Line 61: / Line 61: @@
 |   Type of Analysis || Hash Function Part || Hash Size (n) || Parameters/Variants || Compression Function Calls || Memory Requirements ||   Reference
 |-
-|   | non-randomness || permutation || all || || 2<sup>12</sup> || || [http://131002.net/data/papers/Aum09.pdf Aumasson]
+|   | non-randomness<sup>(1)</sup> || permutation || all || || 2<sup>12</sup> || || [http://131002.net/data/papers/Aum09.pdf Aumasson]
 |-
-|   | non-randomness || permutation || all || || 1 || || [http://www.mat.dtu.dk/people/S.Thomsen/shabal/shabal.pdf Knudsen,Matusiewicz,Thomsen]
+|   | non-randomness<sup>(1)</sup> || permutation || all || || 1 || || [http://www.mat.dtu.dk/people/S.Thomsen/shabal/shabal.pdf Knudsen,Matusiewicz,Thomsen]
 |-
-|   | non-randomness || permutation || all || || 2 || || [http://131002.net/data/papers/AMM09.pdf Aumasson,Mashatan,Meier]
+|   | non-randomness<sup>(1)</sup> || permutation || all || || 2 || || [http://131002.net/data/papers/AMM09.pdf Aumasson,Mashatan,Meier]
 |-
 |}
+<sup>(1)</sup>The Shabal team commented on these analyses and provide an update of their security proofs in [http://eprint.iacr.org/2009/199.pdf this note].