TY - GEN
T1 - Security analysis of the mode of JH hash function
AU - Bhattacharyya, Rishiraj
AU - Mandal, Avradip
AU - Nandi, Mridul
PY - 2010
Y1 - 2010
N2 - Recently, NIST has selected 14 second round candidates of SHA3 competition. One of these candidates will win the competition and eventually become the new hash function standard. In TCC'04, Maurer et al introduced the notion of indifferentiability as a generalization of the concept of the indistinguishability of two systems. Indifferentiability is the appropriate notion of modeling a random oracle as well as a strong security criteria for a hash-design. In this paper we analyze the indifferentiability and preimage resistance of JH hash function which is one of the SHA3 second round candidates. JH uses a 2n bit fixed permutation based compression function and applies chopMD domain extension with specific padding. We show under the assumption that the underlying permutations is a 2n-bit random permutation, JH mode of operation with output length 2n - s bits, is indifferentiable from a random oracle with distinguisher's advantage bounded by where σ is the total number of blocks queried by distinguisher. We show that the padding rule used in JH is essential as there is a simple indifferentiablity distinguisher (with constant query complexity) against JH mode of operation without length padding outputting n bit digest. We prove that a little modification (namely chopping different bits) of JH mode of operation enables us to construct a hash function based on random permutation (without any length padding) with similar bound of sponge constructions (with fixed output size) and with same efficiency. On the other hand, we improve the preimage attack of query complexity 2510.3 due to Mendel and Thompson. Using multicollisions in both forward and reverse direction, we show a preimage attack on JH with n = 512,s = 512 in 2 507 queries to the permutation.
AB - Recently, NIST has selected 14 second round candidates of SHA3 competition. One of these candidates will win the competition and eventually become the new hash function standard. In TCC'04, Maurer et al introduced the notion of indifferentiability as a generalization of the concept of the indistinguishability of two systems. Indifferentiability is the appropriate notion of modeling a random oracle as well as a strong security criteria for a hash-design. In this paper we analyze the indifferentiability and preimage resistance of JH hash function which is one of the SHA3 second round candidates. JH uses a 2n bit fixed permutation based compression function and applies chopMD domain extension with specific padding. We show under the assumption that the underlying permutations is a 2n-bit random permutation, JH mode of operation with output length 2n - s bits, is indifferentiable from a random oracle with distinguisher's advantage bounded by where σ is the total number of blocks queried by distinguisher. We show that the padding rule used in JH is essential as there is a simple indifferentiablity distinguisher (with constant query complexity) against JH mode of operation without length padding outputting n bit digest. We prove that a little modification (namely chopping different bits) of JH mode of operation enables us to construct a hash function based on random permutation (without any length padding) with similar bound of sponge constructions (with fixed output size) and with same efficiency. On the other hand, we improve the preimage attack of query complexity 2510.3 due to Mendel and Thompson. Using multicollisions in both forward and reverse direction, we show a preimage attack on JH with n = 512,s = 512 in 2 507 queries to the permutation.
KW - chop-MD
KW - Indifferentiability
KW - JH
KW - random permutation
KW - SHA-3 candidate
UR - http://www.scopus.com/inward/record.url?scp=77954740517&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-13858-4_10
DO - 10.1007/978-3-642-13858-4_10
M3 - Conference contribution
AN - SCOPUS:77954740517
SN - 3642138578
SN - 9783642138577
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 168
EP - 191
BT - Fast Software Encryption - 17th International Workshop, FSE 2010, Revised Selected Papers
T2 - 17th International Workshop on Fast Software Encryption, FSE 2010
Y2 - 7 February 2010 through 10 February 2010
ER -