Prof El Safwan

Prof Mohamad Assad

Prof Khalil

Oli

Dr René Lozi

Dr Maroun Cha- Moun

Dr Ali Hamie

Mi Cnn

Kmi-

Kmi-1 Cnn

Mi Kmi

) Modified

) Cnn-Miyaguchi-Preneel

O Hmi

security analysis of keyed chaotic neural network hash functions based on the Merkle-D åmgard construction

Keywords:

I would like also to thank IETR lab

INTRODUCTION Preface, Motivation and Objectives

Cryptography is the art and science of secret communication. It involves the transformation of information in such a way that it is not possible for people separate from the legitimate source and destination to access the information while it is stored or transferred over insecure networks. This goal is achieved by designing cryptographic algorithms. Indeed, cryptographic algorithms are, in general, classified into three : hash functions, symmetric-key algorithms, and asymmetric-key algorithms. Unlike symmetric and asymmetric algorithms that are revertible, hash functions are one-way functions that produce output values, which are invertible. So, it is impossible to compute the input from its output.

A hash function can be used to map a message of arbitrary length into an output value of fixed length.

The values returned by a hash function are called hash values, hash codes, digests, or simply hashes. Basically, the hash functions are used in the construction of hash tables. Additionally, hash functions are used to find similar stretches in the DNA sequences.

Moreover, hash functions are also one of the most useful primitives in cryptography. Indeed, they play an important role in different applications such as Data Integrity [START_REF] Sk Hafizul | Provably secure dynamic identity-based three-factor password authentication scheme using extended chaotic maps[END_REF], Message Authentication [START_REF]Secure hash standard[END_REF],

Digital Signature [3,[START_REF] Kai | A new digital signature scheme based on chaotic maps[END_REF], Password Protection, Generation of Pseudorandom Numbers, and Authenticated Encryption [START_REF] Guido | Duplexing the sponge : single-pass authenticated encryption and other applications[END_REF]. In such cases, hash functions are known as cryptographic hash functions.

A secure cryptographic hash function H (addressed as hash functions in the rest of thesis) must verify, in addition to the three main security properties mentioned below, the two implementation properties :

Compression and ease of computation.

1. Preimage resistance (one-way).

2. Second preimage resistance (weak collision resistance).

Collision resistance (strong collision resistance).

At the highest level, cryptographic hash functions are categorized into two main categories : unkeyed hash functions, called Message Detection Codes (MDCs), and keyed hash functions, named Message 15

Introduction

Authentication Codes (MACs). An unkeyed hash function uses an initial value IV to hash a message M and produce a hash value h. On the other hand, a keyed hash function uses, additionally, a secret key K which should be distributed between the sender and the receiver.

MDCs confirm that an input message M has not been tampered with by an attacker or a noisy channel in transition, while MACs confirm that an input message M has not changed and has been sent by a known source to a receiver that shares the same secret key K with the sender. Hence, MDCs verify the integrity of M while MACs verify both the integrity and the authenticity of M. MACs are originally proposed for Data Integrity, Message Authentication, Digital Signature applications, and so on.

As a consequence of the publication of some attacks against many classical hash functions of the MD-SHA family [START_REF] Martinus | Attacks on hash functions and applications[END_REF], the American National Institute of Standards and Technology (NIST) initiated a public competition in 2008 called the SHA-3 contest. This was to determine a new standard for hash functions [START_REF] Nist | standard : Permutation-based hash and extendable-output functions[END_REF]. This competition ended on August 5, 2015 with the announcement of the winning algorithm, the KECCAK function.

Different from conventional cryptography, a new direction in cryptography has been widely developed in the past decade. Many researchers used chaotic dynamic systems and neural network structures, for their important properties, to build new hash functions that achieve the necessary security requirements mentioned above, called Chaotic Neural Network (CNN) hash functions [START_REF] Ali | Efficient neural chaotic generator for image encryption[END_REF][START_REF] Xinbin | Energy-efficient and secure transmission scheme based on chaotic compressive sensing in underwater wireless sensor networks[END_REF]. In fact, Chaotic Systems are suitable to be used in cryptographic hash algorithms due to their security features, such as sensitivity to minute changes in initial conditions, random-like behavior, unstable periodic orbits, and confusion diffusion properties. On the other hand, Neural Networks exhibit, by construction, many suitable properties to be used in cryptographic hash algorithms, such as non-linearity, parallel implementation, data diffusion, flexibility, one-way, and compression function. It should be noted that the CNN acronym is used for Cellular Neural Network and Convolutional Neural Network, but in our study it is an abbreviation of Chaotic Neural Network.

Thus, the design of secure hash functions is crucial.

Thesis Outline and Contributions

This thesis is organized as follows :

Chapter 1 explains the fundamental characteristics of hash functions. First, we present the diverse classification, the main properties, the essential features and the different applications of hash functions. Second, we introduce the two major categories of hash functions, mainly unkeyed and keyed hash functions. Subsequently, we present the different methods for building hash functions. Then, we briefly describe the standard SHA-2 based on the Merkle-D åmgard construction with its three output schemes used to produce the final hash value h. Finally, we describe the general model of the Sponge construction and the standard SHA-3.

Chapter 2 introduces the two chaotic maps, namely Discrete Skew Tent map (DSTmap) and Discrete Piecewise Linear Chaotic map (DPWLCmap), used in this thesis and their main cryptographic properties. Then, we present the principle of neural networks and their characteristics. These two components are used to construct new hash functions, named Chaotic Neural Network (CNN) hash functions. So, we present the related work on chaotic neural network hash functions in the literature, which are based on the two previous components [START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF][START_REF] Di | A combined hash and encryption scheme by chaotic neural network[END_REF][START_REF] Sze | A chaos-based cryptographic hash function for message authentication[END_REF][START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF][START_REF] Xun | Hash function based on chaotic tent maps[END_REF][START_REF] Shiguo | Secure hash function based on neural network[END_REF][START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF][START_REF] Jiashu | Chaotic keyed hash function based on feedforward-feedback nonlinear digital filter[END_REF][START_REF] Yong | One-way hash function construction based on 2D coupled map lattices[END_REF][START_REF] Xiangdong | Hysteresis modeling based on the hysteretic chaotic neural network[END_REF][START_REF] Arumugam | Study of chaos functions for their suitability in generating message authentication codes[END_REF][START_REF] Di | Parallel keyed hash function construction based on chaotic neural network[END_REF][START_REF] Shaojiang | A novel combined cryptographic and hash algorithm based on chaotic control character[END_REF][START_REF] Shaojiang | Analysis and improvement of a chaos-based Hash function construction[END_REF][START_REF] Huaqian | One-way hash function construction based on chaotic map network[END_REF][START_REF] Di | Improving the security of a parallel keyed hash function based on chaotic maps[END_REF][START_REF] Mohamed | Chaos-based hash function (CBHF) for cryptographic applications[END_REF][START_REF] Li | Secure hash function based on chaotic tent map with changeable parameter[END_REF][START_REF] Jiandong | A Fast New Cryptographic Hash Function Based on Integer Tent Mapping System[END_REF][START_REF] Bo | A method for designing hash function based on chaotic neural network[END_REF][START_REF] Sen | Parallel chaotic hash function based on the shuffle-exchange network[END_REF][START_REF] Asgari | A novel keyed parallel hashing scheme based on a new chaotic system[END_REF]. Some works was realized as hashing schemes based only on chaotic maps such as logistic map, high-dimensional discrete map, piecewise linear chaotic map, tent map, sine map and Lorenz map or on 2D coupled map lattices. Other researchers proposed combined hashing and encryption schemes based on chaotic neural network. Furthermore, many scientists have been working on developing hash functions using feed forward-feedback nonlinear filter, shuffle-exchange network, changeable-parameter and self-synchronization, and so on.

Chapter 3 presents our first contribution [START_REF] Nabil | Hash Function based on Efficient Chaotic Neural Network[END_REF][START_REF] Nabil | Secure hash algorithm based on efficient chaotic neural network[END_REF][START_REF] Nabil | Design and implementation of robust Keyed Hash functions based on Chaotic Neural Network[END_REF][START_REF] Nabil | Design and security analysis of two robust keyed hash functions based on chaotic neural networks[END_REF]. It consists of designing and implementing two KCNN hash functions based on the Merkle-D åmgard construction. First, we realize the two keyed hash function structures based on chaotic maps and neural networks (KCNN). These two structures use the same padding rule, which is applied to the input message of arbitrary length, to obtain a message of fixed size (multiple of 2048 bits), the same chaotic system and chaotic neural network. The proposed chaotic system is composed of a Discrete Skew Tent map (DSTmap) with one recursive cell (delay equal to 1). This chaotic system takes as input a secret key K of 160-bit length and calculates the necessary samples used to initialize the parameters of the CNN layers. For the first proposed structure, the CNN is formed of a two-layered neural network of eight neurons each. The proposed activation function of the CNN used two coupled chaotic maps, DSTmap and DPWLCmap, connected in parallel. For the second proposed structure, the CNN is composed of a one-layered neural network of eight neurons, followed by a combination of non-linear functions. These non-linear functions, used in the standard SHA-2, improve the hash throughput while maintaining the necessary security requirements by iterating n r times the output layer. After many experimental tests, we chose the number of rounds n r equal to 24 for more robustness and equal to 8 for a compromise between robustness and hash throughput.

For these two structures, we implement the three output schemes : CNN-Matyas-Meyer-Oseas, Modified CNN-Matyas-Meyer-Oseas, and CNN-Miyaguchi-Preneel that precede the generation of the final Introduction output hash value h. Finally, we evaluate the performance of the two proposed KCNN hash functions in terms of security (statistical tests, cryptanalytical attacks) and computation time. The proposed hash functions are as well secure as the other chaos-based hash functions presented in the literature, including the standard Secure Hash Algorithm SHA-2. On the other hand, the NCpB of structure 2 is better than those of the literature, but a little inferior to that of SHA-2.

Chapter 4 presents our second contribution [START_REF] Nabil | New keyed chaotic neural network hash function based on sponge construction[END_REF]. In the first part of this chapter, we introduce the general model of the unkeyed-Sponge, and we present the three methods used to transform the Sponge function to a keyed-Sponge construction such as Outer keyed-Sponge (OKS), Inner keyed-Sponge (IKS), and Full-State Keyed Sponge (FKS). Second, we describe in detail the two proposed structures of hash functions based on the Sponge construction (KSCNN). For the two proposed structures of KSCNN, we realized two variants of hash value lengths : 256 bits and 512 bits. The bitrate r, the capacity c and the width b are the main characteristics of hash functions that must be initialized right at the beginning. The width b, equal to 1600 bits, determines the length of the intermediate hash values, while the bitrate r and the capacity c specify the lengths of the hash value h : 256 bits (r = 1088, c = 512) and 512 bits (r = 576, c = 1024). These KSCNN use the same chaotic system of chapter 3. The first structure KCNN is composed of two-layer CNN containing five and eight neurons, respectively. The second structure is formed of a one-layer CNN of five neurons followed by a combination of non-linear functions. For the second KSCNN, from many experimental tests, we chose a number of rounds n r equal to 8 and 24 rounds for the same reasons as elucidated in chapter 3.

In general, the functioning of these two hash functions comprises three phases : Initialization phase, Absorbing phase, and Squeezing phase. In the initialization phase and after adding a suffix 01, a multirate padding rule is applied to the input message. Then, the message is divided into blocks of size r bits. In the absorbing phase, the entire message is absorbed block by block. This phase generates a hash value of length 1600 bits. When the value of the desired length is greater than 1600 bits, the proposed hash functions enters the squeezing phase. The squeezing phase generates the final desired hash value by extracting r-bit from the intermediate hash values, each time. Finally, whatever the used structure, the output layer is iterated seven times to generate the intermediate hash values of 1600-bit length.

In the second part of this chapter, we estimate the performance of two proposed KSCNN hash functions in terms of security and computational time. For this purpose, we first perform several statistical tests such as collision resistance, distribution of hash value, sensitivity of hash value to the message, sensitivity of hash value to the secret key, and the diffusion effect. Then, we study the immunity of the proposed KSCNN hash functions against many attacks such as preimage, second preimage, collision resistance, length extension, and meet-in-the-middle preimage attacks. Furthermore, we measure the average hashing time, the hash throughput and the number of needed cycles to hash one byte (NCpB). We observed that, globally, the obtained performance is close to those of the standard SHA-3.

Chapter 5 concerns the Duplex construction. For this purpose, we are currently working on the design of a CNN-DUPLEX structure which allows the alternation of input and output blocks at the same rate as the Sponge construction, similar to a full-duplex communication (one call to the chaotic function per input block). This will later be adapted for using in Authenticated Encryption with Associated Data (AEAD).

Finally, we conclude the manuscript by giving a summary of the main new ideas and the contributions of our work in the domain of keyed Chaotic Neural Network hash functions. Moreover, we present future research issues related to our work and the scope to work on them.

Chapter 1

A brief review of standard hash functions SHA-2 and SHA-3

Introduction

We dedicate this chapter to explain the fundamental concepts of cryptography primitives. Then, we start by providing the generalities, properties, and classification of cryptographic hash functions, namely keyed and unkeyed hash functions. We introduce the general model of Merkle-D åmgard construction, which was used in the design of many popular hash algorithms such as MD5, SHA-1 and SHA-2. Next, we explain the current standard hash function SHA-2 briefly. Furthermore, we introduce the general model of the Sponge function, that was used in the construction of the new standard hash function SHA-3.

Then, we explain the standard hash function SHA-3 shortly. Finally, we conclude this first chapter.

Cryptography : foundation and basic concepts

Since the beginning of the writing language, it was necessary to find ways to hide valuable information [START_REF] Simon | The code book. The science of secrecy from ancient Egypt to quantum cryptography[END_REF]. Cryptography is the science that concerns the transformation of information so that it is not possible to other people different from the legitimate source and destination to access this information.

The Cryptology process requires two different and complementary stages. The first step is cryptography which presents selection of the tools and the framework which guide the concealing of the information.

The second one is cryptanalysis which means the evaluation of the transformation system.

Cryptography has mainly been used by the governments and military for the confidentiality of information. The modern cryptography begins with the Shannon theory [START_REF] Elwood | A mathematical theory of communication[END_REF], in which three fundamental goals 22 Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3 must be achieved [START_REF] Eiichiro | Secure integration of asymmetric and symmetric encryption schemes[END_REF][START_REF] Gustavus | Symmetric and asymmetric encryption[END_REF][START_REF] Yogesh | Comparison of symmetric and asymmetric cryptography with existing vulnerabilities and countermeasures[END_REF] :

1. Confidentiality : it ensures that information is not made available or disclosed to an adversary excepting the authorized persons.

2. Integrity : it is the assurance that the information is trustworthy and accurate.

3. Availability : it ensures that information are available to authorized people when it is needed.

Authenticity and Non-Repudiation are also essential parts of a secure system. These two terms are explained as follows :

1. Authenticity : it confirms that both parties involved are who they claim they are.

2. Non-repudiation : it refers to the ability to prove that the sender really sent the message, so the recipient cannot claim that the message was not sent.

There are several ways of classifying cryptographic algorithms. They can be categorized based on the number of keys that are employed, and further defined by their application and use. The three types of cryptographic algorithms are represented as follows :

1. Secret Key Cryptography (SKC) : Uses a single key for both encryption and decryption ; also called symmetric encryption. Primarily used for confidentiality.

2. Public Key Cryptography (PKC) : Uses one key for encryption and another for decryption ; also called asymmetric encryption. Primarily used for authentication, non-repudiation, and key exchange.

3. Hash Functions : Uses a mathematical transformation to irreversibly hash information, providing a digital fingerprint. Primarily used for message integrity and authentication.

Generalities of hash functions

A hash function usually means a function that compresses an input data to produce an output value h called hash value or hash-code, shorter than the input [START_REF] William | Cryptography and Network Security : Principles and Practice, International Edition : Principles and Practice[END_REF][START_REF] Alfred | Handbook of applied cryptography[END_REF] . Often, such a function or algorithm takes an input of arbitrary length to generate an output of fixed length. It's kind of generating a signature of this input. When it comes to web development for example, it's common to encounter a scenario where you need to compare if 2 files have the same content [START_REF] Phillip | Cryptographic hash-function basics : Definitions, implications, and separations for preimage resistance, second-preimage resistance, and collision resistance[END_REF]. Also, suppose that you have to compare those files frequently. Without hash functions, you probably would need to read all content from the first file and all content from the second file to compare if they match. But you can generate a signature for each file using a hash function and then compare the two signatures. Consequently, this way is more faster due to small size of the generated signatures. Another example, the hashing process used for indexing and locating items in databases accelerate the speed of research because it is easier to find the shorter hash value than the longer original string.

In general, hash functions are divided into two large categories : Non-cryptographic hash functions are used in many parts of life like hash table, a kind of data structure that is used to store key/value pairs. These types of hash functions is out of study in this thesis. On the other hand, cryptographic hash function are used in cryptography and information security, and there are many different types of hash functions, with various security properties. A classical application of cryptographic hash functions is to store the hash value of password instead of the password itself, in databases. In the next sub-section, we bring out the importance of cryptographic hash functions, and explain their implementation and security properties.

Cryptographic hash functions

Cryptographic hash functions play a fundamental role in modern cryptography. The basic idea of cryptographic hash functions is that a hash-value h serves as a compact representative image (sometimes called an imprint, digital fingerprint, or message digest) of an input message M and is used as an uniquely identifiable element (see Fig. 1.1) [START_REF] William | Cryptography and Network Security : Principles and Practice, International Edition : Principles and Practice[END_REF]. For example, computing the hash of a downloaded file from the Internet, and comparing the result to a previously published hash value, can show whether the download has been modified or tampered with. So, the receiver can verify the integrity of the received data sent by the sender. Precisely, a cryptographic hash function H, that requires to be a deterministic process, maps bit-strings of arbitrary finite length |M| to strings of fixed length (u bits), where |M| > u [START_REF] Alfred | Handbook of applied cryptography[END_REF]. So, every time if the same input message M is hashed by H, the same hash value h is obtained. H is many-to-one relationship that implies the existence of unavoidable collisions (pairs of input message with identical output hash value) with very small probabilities.

A cryptographic hash function H aims to guarantee a number of properties, which makes it very useful for information security. H must verify at least the following two implementation properties [START_REF] Phillip | Cryptographic hash-function basics : Definitions, implications, and separations for preimage resistance, second-preimage resistance, and collision resistance[END_REF] :

1. Compression : H maps an input message M of arbitrary finite bit-length to a hash value h of fixed bit-length u bits.

2. Ease of computation : given H and an input message M, H(M) is easy to compute. Nevertheless, two important requirements are needed to realize the cryptographic hash functions : the hardness to find collisions and the appearance of randomness. Also, H has the following three security properties (see Fig. 1.2) :

1. Preimage resistance (one-way) : for all the pre-specified hash values h, it is computationally infeasible to find any message input that is hashed to the chosen hash value.

Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3 2. Second preimage resistance (weak collision resistance) : it is computationally infeasible to find any second input that has the same hash value as a specified input message M.

3.

Collision resistance (strong collision resistance) : it is computationally infeasible to find any two distinct message inputs (M, M ) hashed to the same hash value, such that H(M) = H(M ). It should be noted that, the users are free to choose both input messages.

We should mention that the notion of computationally infeasible depends on the relationship between the amount of work the designer has to do to secure the system in comparison to the amount of work that the attacker has to do to break it.

At the highest level, cryptographic hash functions are classified into two classes (see Fig. 1.3) :

1. Modification Detection Codes (MDCs) or unkeyed hash functions.

Message Authentication Codes (MACs) or keyed hash functions.

The MDCs confirm that an input message M has not been tampered by an attacker or a noisy channel in transition, while MACs confirm that an input message M has not changed and has been sent by a known source to a receiver that shares the same secret key K with the sender. So, MDCs verify the integrity of M, while MACs verify both the integrity and authenticity of M [START_REF] Lee | Key-dependent 3D model hashing for authentication using heat kernel signature[END_REF]. The MACs, originally proposed to generate the Digital Signature (DS) application, are nowadays used in various information security applications to achieve Authenticated Encryption [START_REF] Mihir | Authenticated encryption : Relations among notions and analysis of the generic composition paradigm[END_REF].

In this thesis, our work is restricted to keyed cryptographic hash functions (simply called hash functions in the rest of this paper) that are originally proposed to generate the inputs of Digital Signature (DS) application. Later, these hash functions are designed to achieve certain security properties, such as message authentication useful for building cryptosystems. In general, a keyed hash function [START_REF] Mihir | Keying hash functions for message authentication[END_REF] uses a secret key K. The Merkle-D åmgard structure, which is unkeyed hash function that uses initial values IV, can be transformed to a keyed hash function by appending a secret key K to the input message M to produce the hash value h.

Merkle-D åmgard construction

In cryptography, many structures are used to construct different hash functions [START_REF] Denton | Modern Hash Function Construction[END_REF], such as Merkle-D åmgard [START_REF] Charles | Secrecy, authentication, and public key systems[END_REF][START_REF] Bjerre | A design principle for hash functions[END_REF], Wide Pipe [START_REF] Stefan | Design Principles for Iterated Hash Functions[END_REF], Fast Wide Pipe [START_REF] Mridul | Speeding up the wide-pipe : Secure and fast hashing[END_REF], HAIFA [START_REF] Orr | A framework for iterative hash functions : Haifa[END_REF], and Sponge construction [START_REF] Guido | Sponge functions[END_REF].

Indeed, a number of these structures are essential in the design of several popular hash functions. The Merkle-D åmgard construction was used in the design of MD5 [START_REF] Ronald | The MD5 message-digest algorithm[END_REF], SHA-1 [START_REF]Secure hash standard[END_REF], and SHA-2 [3] standards. The Sponge construction was used in the design of a new secured standard hash algorithm SHA-3 [START_REF] Nist | standard : Permutation-based hash and extendable-output functions[END_REF], which will be used when the current standard SHA-2 will be inevitably compromised. In the following, we introduce the Merkle-D åmgard construction (Fig. C takes as inputs a chaining or state variable h i , (i = 0, ..., q -1) of size l bits and a message block M i , (i = 1, ..., q) of size |M i | bits, to produce the updated chaining variable h i , (i = 1, ..., q) of size l bits. Thus, to allow the usage of input messages of arbitrary length, the Merkle-D åmgard structure needs a padding, which transforms the input message into a padded message M of length multiple of |M i | bits. Indeed, a simple padding is insufficient because, in this case, the generated hash value is vulnerable to different attacks due to collision between the latest blocks. We will consider the Strengthened Merkle-D åmgard padding with length strengthening (see Fig. 1.5). It uses a padding function named "is-pad", which appends the binary value of the message length L at the end of the message to generate the padded The Strengthened Merkle-D åmgard hash function SMD C (M) is defined as follow :

Algorithm 1 The Strengthened Merkle-D åmgard hash function SMD C (M) M 1 M 2 ... M q ← "is-pad(M)" h 0 ← IV for i = 1 to q do h i ← C(h i-1 , M i ) end for h ← O(h q ) Return h.

Three one-way compression functions

In general, the one-way compression functions are often built from block ciphers. Block ciphers take two fixed size inputs (the key and the plaintext) and return one single output which is the same size as the input plaintext. Thus to turn any normal block cipher into a one-way compression function, some methods are used such as, Davies-Meyer, Matyas-Meyer-Oseas, Miyaguchi-Preneel (see Fig. 1.6). These methods are then used with the Merkle-D åmgard construction to build the hash function.

These methods are described in detail in the next paragraphs.

Davies-Meyer compression function :

The Davies-Meyer compression function feeds each block of the message M i as a key to the block cipher (Fig. 1.6-a). It feeds the previous hash value h i-1 as the plaintext. Then, the output value is xored with h i-1 to produce the new intermediate hash value h i . In the first round when there is no previous hash value, it uses an initial value IV. In mathematical notation, the Davies-Meyer compression function is represented by the following equation :

h i = C M i (h i-1 ) ⊕ h i-1 (1.2)
Matyas-Meyer-Oseas compression function : The Matyas-Meyer-Oseas feeds each block of the message M i as the plaintext (Fig. 1.6-b). Then, the output value is xored with M i to produce the new intermediate hash value h i . The previous intermediate hash value h i-1 is fed as the key to the block cipher. In the first round when there is no previous hash value, it uses an initial value IV. If the block cipher has different block and key sizes, h i-1 will have the wrong size for use as the key. So, it is first fed through the function O to be converted/padded to fit as key for the cipher. In mathematical notation, the Matyas-Meyer-Oseas compression function is represented as follows :

h i = C O(h i-1 ) (M i ) ⊕ M i (1.3)
Miyaguchi-Preneel compression function : The Miyaguchi-Preneel feeds each block of the message M i as the plaintext (Fig. 1.6-c). Then, the output value is xored with M i and with the previous intermediate hash value h i-1 to produce the new hash value h i . h i-1 is fed as the key to the block cipher. In the first round when there is no previous hash value, it uses an initial value IV. If the block cipher has different block and key sizes, h i-1 will have the wrong size for use as the key. So, it is first fed through the function O to be converted/padded to fit as key for the cipher. In mathematical notation, the Miyaguchi-Preneel compression function is represented by the following equation : The SHA-256 operates in the manner of MD4, MD5, and SHA-1. The message to be hashed is first padded with its length in such a way that the result is a multiple of 512 bits long, and then parsed into 512-bit message blocks M (1) , M (2) , ..., M (N) . The message blocks are processed one at a time : Beginning with a fixed initial hash value H (0) , sequentially compute the following equation :

h i = C O(h i-1 ) (M i ) ⊕ h i-1 ⊕ M i (1.
H (i) = H (i-1) +C M (i) (H (i-1) ) (1.6)
where C is the SHA-256 compression function and + means word-wise addition mod 2 32 . H (N) is the hash of M. The SHA-256 compression function operates on a 512-bit message block and a 256-bit intermediate hash value. Hence, there are two main components to describe :

1. SHA-256 compression function.

2. SHA-256 message schedule.

The initial hash value H (0) is the following sequence of 32-bit words, which are obtained by taking the fractional parts of the square roots of the first eight primes :

H (0) 1 = 6a09e667, H (0)
2 = bb67ae85, H (0)
3 = 3c6e f 372, H (0) 4 = a54 f f 53a, H (0) 5 = 510e527 f , H (0) 6 = 9b05688c, H (0) 7 = 1 f 83d9ab and H (0) 8 = 5be0cd19.
The computation of the hash of a message begins by preparing the message. First, the message is padded in this way : Suppose the length of the message M, in bits, is l. Append the bit 1 to the end of the message, and then v zero bits, where v is the smallest non-negative solution to the equation :

l + 1 + v ≡ 448 mod 512 (1.7)
To this append the 64-bit block which is equal to the length l written in binary. For example, the (8-bit ASCII) message "abc" has a length equal to 8 x 3 = 24 bits. So, it is padded with a one, then 448 -(24 + 1) = 423 zero bits, and then its length to become the 512-bit padded message. The length of the padded message should now be a multiple of 512 bits. Second, parse the message into N 512-bit blocks M (1) , M (2) , ..., M (N) . The first 32 bits of message block i are denoted M (i) 0 , the next 32 bits are denoted

M (i)
1 , and so on up to M (i) [START_REF] Shiguo | Secure hash function based on neural network[END_REF] . The big-endian convention throughout is used, so within each 32-bit word, the left-most bit is stored in the most significant bit position. Then, The hash computation proceeds as follows :

Algorithm 2 The Secure Hash Algorithm SHA-256 compression function

for i = 1 to N do
Initialize registers a, b, c, d, e, f , g, h with the (i -1) st intermediate hash value (= the initial hash

value when i = 1) a ← H (i-1) 1 b ← H (i-1) 2 ... h ← H (i-1) 8
Apply the SHA-256 compression function to update registers a, b, ..., h for j = 0 to 63 do Compute Ch(e, f , g), Ma j(a, b, c), Σ0(a), Σ1(e), and W j (see definitions below)

T 1 ← h + Σ1(e) +Ch(e, f , g) + K j +W j T 2 ← Σ0(a) + Ma j(a, b, c) h ← g g ← f f ← e e ← d + T 1 d ← c c ← b b ← a a ← T 1 + T 2 end for
Compute the i th intermediate hash value

H (i) H (i) 1 ← a + H (i-1) 1 H (i) 2 ← b + H (i-1) 2 ... H (i) 8 ← h + H (i-1) 8
end for

H (N) = (H (N) 1 , H (N) 2 , ..., H (N) 8
) is the hash of the message M.

Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3

Six logical functions are used in SHA-256. Each of these functions operates on 32-bit words and produces a 32-bit word as output. Each function is defined as follows :

                           Ch(x, y, z) = (x ∧ y) ⊕ (¬x ∧ z) Ma j(x, y, z) = (x ∧ y) ⊕ (x ∧ z) ⊕ (y ∧ z) Σ0(x) = S 2 (x) ⊕ S 13 (x) ⊕ S 22 (x) Σ1(x) = S 6 (x) ⊕ S 11 (x) ⊕ S 25 (x) σ 0(x) = S 7 (x) ⊕ S 18 (x) ⊕ R 3 (x) σ 1(x) = S 17 (x) ⊕ S 19 (x) ⊕ R 10 (x) (1.8)
where ∧ : AND logic, ¬ : NOT logic, ⊕ : XOR logic, ∨ : OR logic, R n : right shi f t by n bits, S n : right rotation by n bits. All of these operators act on 32-bit words.

The expanded message blocks W 0 ,W 1 , ...,W 63 are computed via the SHA-256 message schedule as represented in Algorithm 3.

Algorithm 3

The Secure Hash Algorithm SHA-256 message schedule for j = 0 to 15 do

W j = M (i) j
end for for j = 16 to 63 do W j ← σ 1(W j-2 ) +W j-7 + σ 0(W j-15 ) +W j-16 end for A sequence of constant words K 0 , K 1 , ..., K 63 is used in SHA-256. In hexadecimal, these constants are given by : 428a2f98 71374491 b5c0fbcf e9b5dba5 3956c25b 59f111f1 923f82a4 ab1c5ed5 d807aa98 12835b01 243185be 550c7dc3 72be5d74 80deb1fe 9bdc06a7 c19bf174 e49b69c1 efbe4786 0fc19dc6 240ca1cc 2de92c6f 4a7484aa 5cb0a9dc 76f988da 983e5152 a831c66d b00327c8 bf597fc7 c6e00bf3 d5a79147 06ca6351 14292967 27b70a85 2e1b2138 4d2c6dfc 53380d13 650a7354 766a0abb 81c2c92e 92722c85 a2bfe8a1 a81a664b c24b8b70 c76c51a3 d192e819 d6990624 f40e3585 106aa070 19a4c116 1e376c08 2748774c 34b0bcb5 391c0cb3 4ed8aa4a 5b9cca4f 682e6ff3 748f82ee 78a5636f 84c87814 8cc70208 90befffa a4506ceb bef9a3f7 c67178f2 These are the first thirty-two bits of the fractional parts of the cube roots of the first sixty-four primes.

The SHA-256 compression function is given in Fig. 1

Sponge construction

In cryptography, a Sponge function or Sponge construction is any of a class of algorithms with finite internal state that take an input bit stream of any length and produce an output bit stream of any desired length [START_REF] Guido | Keccak specifications[END_REF]. Sponge functions have both theoretical and practical uses. They can be used to model or implement many cryptographic primitives, including Cryptographic Hashes, Message Authentication Codes, Mask Generation Functions, Stream Ciphers, Pseudo-Random Number Generators, and Authenticated Encryption.

In the following, we introduce the Sponge construction (Fig. 1.8), the model of Keyed-Sponge construction (Fig. 1.9), and the detailed structure of the standard Secure Hash Algorithm SHA-3 (section 1.6).

Sponge construction : initialization, absorbing and squeezing

In Fig. 1.8, we give the general structure of the unkeyed Sponge construction, which splits into three phases : the Initialization phase, the Absorbing phase, and the Squeezing phase. The unkeyed Sponge construction builds a hash function, which operates on a state HM i , (i ≥ 0) of size b bits. These states are split into an inner part C of c-bit size named capacity, which is hidden, and an outer part R of r-bit size named bitrate, which is accessible externally. The size of these states named width b-bit is given by b = r + c. In the initialization phase of this construction, the initial value IV = HM 0 of b-bit size is initialized to 0, and the input message M is padded then divided into q blocks of r-bit size. Next, the q blocks of the entire message are absorbed message block M i by message block M i , (i = 1, ..., q) in the absorbing phase, and the hash value h is squeezed out r-bit block by r-bit block in the squeezing phase.

It should be noted that, the speed of the construction relies partially on the bitrate r, while the security depends partially on the capacity c. Precisely, the absorption process consists of xoring each message block M i , (i = 1, ..., q) with r-bit size of HM i , (i = 0, ..., q -1), which forms the input of the function f to obtain HM i , (i = 1, ..., q) of b-bit size. Therefore, it is necessary to pad each message block M i , (i = 1, ..., q) by 0 of c-bit size. If the bitrate r is increased, then more bits are absorbed at once and the construction runs faster. However, the increase of the bitrate r implies decrease in the capacity c, and so there is a trade-off between speed and security.

Thus, a padding rule Pad is needed to ensure that the input message of arbitrary length is padded to a bit-string with length multiple of r bits. Indeed, a simple padding rule with 0 is insufficient because the generated hash value will be vulnerable to different attacks due to the collision between all-zero latest message blocks. Then, as we have already seen from the Sponge construction structure's, the padded message is divided into q blocks and processed as a sequence of message blocks M 1 M 2 ... M q .

The Sponge construction algorithm's is defined as follow :

Algorithm 4 The Sponge construction Sponge[f,Pad,r] Require : r < b Interface : h = Sponge[ f , Pad, r](M, u) with M ∈ Z * 2 , integer u > 0, and h ∈ Z u 2 M 1 ||M 2 ||...||M q = M||Pad[r](|M|) HM 0 = 0 b for i = 1 to q do h i-1 = HM i-1 ⊕ (M i ||0 b-r ) HM i = f (h i-1 ) end for h = ( HM q ) r while |h| < u do HM q+1 = f (h q ) h = h||( HM q+1 ) r end while Return ( h ) u .

From unkeyed Sponge to keyed-Sponge construction

Without any structural changes, the unkeyed Sponge hash functions, which use an initial value IV, are transformed to keyed-Sponge hash functions by adding a secret key K, as an additional input to the structure. Three types of keyed-Sponge functions [START_REF] Bart | Key Prediction Security of Keyed Sponges[END_REF] are used in the literature (see Fig. 1.9) :

1. The Outer keyed-Sponge (OKS) [START_REF] Guido | On the security of the keyed sponge construction[END_REF] : The secret key K is prepended to the message M, i.e., the obtained input message is K M (Fig. 1.9-a).

2. The Inner keyed-Sponge (IKS) [START_REF] Donghoon | A keyed sponge construction with pseudorandomness in the standard model[END_REF] : The secret key K is put in the inner part of the initial value IV (Fig. 1.9-b).

3. The Full-State Keyed Sponge (FKS) [START_REF] Bart | Security of full-state keyed sponge and duplex : applications to authenticated encryption[END_REF] : The secret key K is put in the inner part of the initial value IV as IKS, but the input message M is absorbed over the entire b-bit state instead of absorbing it in the r-bit outer part only (Fig. 1.9-c).

The first two types of keyed-Sponge were analyzed by Andreeva et al. [START_REF] Elena | Security of keyed sponge constructions using a modular proof approach[END_REF], and Naito and Yasuda [START_REF] Yusuke | New bounds for keyed sponges with extendable output : Independence between capacity and message length[END_REF].

The idea of the third type appeared first in the donkeySponge [START_REF] Guido | Permutation-based encryption, authentication and authenticated encryption[END_REF], and an analysis for only one output block was given by Gaži et al. [START_REF] Peter | The exact PRF security of truncation : tight bounds for keyed sponges and truncated CBC[END_REF]. Then, a complete security analysis of the FKS was given by Mennink et al. [START_REF] Bart | Security of full-state keyed sponge and duplex : applications to authenticated encryption[END_REF] and Daemen et al. [START_REF] Joan | Full-state keyed duplex with built-in multi-user support[END_REF]. From a security perspective, the three modes achieve approximately the same security level of c bits, and there is no reason to take a key K of size |K| bits greater than the capacity c (|K| > c) [START_REF] Bart | Key Prediction Security of Keyed Sponges[END_REF]. However, in terms of the number of permutation evaluations, FKS is more efficient than OKS and IKS : the absorption of b-bit input data at a time rather than r bits (r < b). Intrinsically, FKS has made IKS obsolete : both require adaptation of the unkeyed Sponge algorithm, both take one processing of the permutation function f to absorb the key K, both are approximately equally secure, but FKS is more efficient. The FKS does not necessarily make OKS obsolete, although it is less efficient, OKS does not require an adaptation of the unkeyed Sponge algorithm. So, we restrict our focus to FKS hash functions.

The keyed-Sponge hash functions are used in several applications such as, MAC generation and Bitstream encryption.

For the MAC generation application, the MAC function is given by :

MAC K,IV [M] : Z |K| 2 × Z b 2 × Z L 2 → Z u 2 (1.9)
where K is the secret key, IV is the initial value, Z 2 is a binary sequence, and |K|, b, L, and u are the lengths of the secret key K, the initial value IV, the message M, and the desired hash value h, respectively.

For the Bitstream encryption application, the STREAM function is given by :

ST REAM K,IV : Z |K| 2 × Z b 2 → Z ∞ 2 (1.10)
In the next section, we explain the Secure Hash Algorithm SHA-3.

Secure Hash Algorithm SHA-3

The Secure Hash Algorithm SHA-3 is the latest member of the SHA family of standards, released by NIST on August 5, 2015 [START_REF] Morris | SHA-3 standard : Permutation-based hash and extendable-output functions[END_REF]. SHA-3 is internally different from the MD5, SHA-1 and SHA-2. SHA-3 is a subset of the cryptographic primitive family KECCAK-f designed by Bertoni et al. [START_REF] Baum | NIST selects winner of secure hash algorithm (SHA-3) competition[END_REF]. The KECCAK-p family of permutations is the specialization of the KECCAK-f family :

KECCAK -p[b, n r ] = KECCAK -f [b] (1.11)
where b is the width and n r is the number of rounds. Consequently, the KECCAK family is denoted by KECCAK[c](N, d), given as follows :

KECCAK[c](N, d) = SPONGE[KECCAK -p[1600, 24], pad10 * 1, 1600 -c](N, d) (1.12)
where N is the concatenation of the initial message M with the suffix 01 (N = M 01), d is the hash value length (u = d), and pad10 * 1 is the used padding rule. As we can see, this equation is restricted to the case b = 1600 bits and n r = 24 rounds, for a given input message M [START_REF] Nist | standard : Permutation-based hash and extendable-output functions[END_REF]. In the future, additional modes of KECCAK-p may be specified and approved in FIPS publications or NIST special publications.

In particular, the four variants of SHA-3 hash functions are defined from the KECCAK[c](N, d) function as follows :

SHA3 -224(M) = KECCAK[448](M 01, 224) SHA3 -256(M) = KECCAK[512](M 01, 256) SHA3 -384(M) = KECCAK[768](M 01, 384) SHA3 -512(M) = KECCAK[1024](M 01, 512)
In each case, the capacity c is double the hash value length u, i.e., c = 2 x u, and the suffix 01 supports the domain separation ; it distinguishes the SHA-3 hash functions from the Extendable-Output Functions (XOFs), such as SHAKE128 and SHAKE256 [START_REF] Morris | SHA-3 standard : Permutation-based hash and extendable-output functions[END_REF], where its suffix is 1111 (N = M 1111).

The four SHA-3 hash functions specified in FIPS 202 supplement the hash functions specified in FIPS 180-4 [START_REF]Secure hash standard (SHS)[END_REF] : SHA-1 family and SHA-2 family. For XOFs, the length of the output can be chosen to meet the requirements of user applications. Keccak's authors have proposed additional uses for the function, not (yet) standardized by NIST, including a stream cipher, an authenticated encryption system, a tree hashing scheme for faster hashing on certain architectures [START_REF] Bertoni | The Keccak sponge function family[END_REF], and authenticated encryption with associated data algorithms Keyak and Ketje [START_REF] Guido | CAESAR submission : Ketje v1[END_REF][START_REF] Guido | CAESAR submission : Keyak v1[END_REF]. SHA-3 uses the Sponge construction, in which data is absorbed into the sponge, then the result is squeezed out. In the absorbing phase, message blocks are xored into a subset of the state equal to r, which is then transformed as a whole using a permutation function f. In the squeezing phase, output blocks are read from the same subset of the state equal to c, alternated with the state transformation function f. The maximum security level is half the capacity [START_REF] Bertoni | The Keccak sponge function family[END_REF].

Given an input bit string N, a padding function Pad, a permutation function f that operates on bit blocks of width b, a rate r and an output length u, we have the Sponge construction :

Z = Sponge[ f , pad, r](N, u) (1.13)
yielding a bit string Z of length u, works as described in the Algorithm 4.

In SHA-3, the state S consists of a 5 × 5 array of w-bit words. With w = 64, b is equal to 5 × 5 × w = 1600 bits. The KECCAK-f family is also defined for small and intermediate state sizes. Small state sizes (w = 1) can be used to test cryptanalytic attacks, and intermediate state sizes (from w = 8 to w = 32) can be used in practical to design lightweight applications.

For SHA-3-224, SHA-3-256, SHA-3-384, and SHA-3-512 instances, r is greater than u, so there is no need for additional block permutations in the squeezing phase ; the leading u bits of the state are the desired hash. However, SHAKE128 and SHAKE256 allow an arbitrary output length, which is useful in applications such as optimal asymmetric encryption padding.

To ensure that the message can be evenly divided into r-bit blocks, padding is required. SHA-3 uses the pattern pad10*1 in its padding function Pad (multi-rate padding) : a 1 bit, followed by zero or more 0 bits (maximum r -1) and a final 1 bit. In Table 1.1, we give the essential parameters of the SHA-3.

SHA-3 Iteration Function f

For the internal processing within f, the input state variable s is organized as a 5 * 5 * 64 array a. The The specification of θ (A) step mapping is provided in Algorithm 5 and shown in Fig. 1.11.

Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3

Algorithm 5 Specification of θ (A)

Input state array A.

Output state array A .

Steps for all pairs (x, z) such that 0 ≤ x ≤ 5 and 0 ≤ z ≤ w do

C[x, z] = A[x, 0, z] ⊕ A[x, 1, z] ⊕ A[x, 2, z] ⊕ A[x, 3, z] ⊕ A[x, 4, z] end for for all pairs (x, z) such that 0 ≤ x ≤ 5 and 0 ≤ z ≤ w do D[x, z] = C[(x -1) mod 5, z] ⊕C[(x + 1) mod 5, (z -1) mod w]
end for for all triples (x, y, z) such that 0 ≤ x ≤ 5, 0 ≤ y ≤ 5, and 0 ≤ z ≤ w do

A [x, y, z] = A[x, y, z] ⊕ D[x, z]. end for x y z x y z FIGURE 1.11 -Illustration of θ applied to a single bit

Specification of ρ(A) :

The specification of ρ(A) step mapping is provided in Algorithm 6 and shown in Fig. 1.12.

1.6. Secure Hash Algorithm SHA-3

Algorithm 6 Specification of ρ(A)

Input state array A.

Output state array A .

Steps for all z such that 0 ≤ z ≤ w do Steps for all triples (x, y, z) such that 0 ≤ x ≤ 5, 0 ≤ y ≤ 5, and 0

A [0, 0, z] = A[0, 0, z] end for (x, y) = (1, 0) for t = 0 to 23 do for all z such that 0 ≤ z ≤ w do A [x, y, z] = A[x, y, (z -(t + 1)(t + 2)/2)mod w] end for
≤ z ≤ w do A [x, y, z] = A[x, y, z] ⊕ ((A[(x + 1)mod 5, y, z] ⊕ 1) . A[(x + 2)mod 5, y, z]) end for Return A .

Specification of ι(A) :

The ι mapping is parameterized by the round index, i r , whose values are specified in Step 2 of Algorithm

Algorithm 9 rc(t)

Input integer t.

Output bit rc(t).

Steps if t mod 255 = 0 then Return 1.

end if Let R = 10000000 for i = 1 to t mod 255 do R = 0||R R[0] = R[0] ⊕ R[8] R[4] = R[4] ⊕ R[8] R[5] = R[5] ⊕ R[8] R[6] = R[6] ⊕ R[8] R = Trunc 8 [R] end for Return R[0]. Algorithm 10 ι(A, i r ) Input state array A.
Input round index i r .

Output state array A .

Steps for all triples (x, y, z) such that 0 ≤ x ≤ 5, 0 ≤ y ≤ 5, and 0 ≤ z ≤ w do

A [x, y, z] = A[x, y, z] end for Let RC = 0 w for j = 0 to l do RC[2 j -1] = rc( j + 7i r ) end for for all z such that 0 ≤ z ≤ w do A [0, 0, z] = A [0, 0, z] ⊕ RC[z] end for Return A .

KECCAK-p[b, n r ] :

Given a state array A and a round index i r , the round function Rnd is the transformation that results from applying the step mappings θ , ρ, π, χ, and ι, in that order, i.e., :

Rnd(A, i r ) = ι(χ(π(ρ(θ (A)))), i r ) (1.14)
The KECCAKp[b, n r ] permutation consists of n r iterations of Rnd, as specified in Algorithm 11.

Algorithm 11 KECCAKp[b, nr](S)

Input string S of length b.

Input number of rounds n r .

Output string S of length b.

Steps

Convert S into a state array A for i r = 12 + 2ln r to 12 + 2l -1 do

A = Rnd(A, i r ). end for Convert A into a string S of length b Return S .

Conclusion

In this chapter, we introduced briefly the fundamentals concepts of cryptographic hash functions : generalities, properties and classification (unkeyed and keyed hash functions). First, we presented the current standard hash function SHA-2 based on Merkle-D åmgard construction. Then, we described the future standard SHA-3 based on the Sponge function.

Chapter 2

Main chaos-based hash functions of the literature

Introduction

In this chapter, first we introduce the main properties of chaotic signals and neural networks. Then, we describe briefly the two discrete chaotic maps used in this thesis, the Discrete Skew Tent map (DSTmap) and the Discrete Piece Wise Linear Chaotic map (DPWLCmap). Next, we present briefly the state-ofthe-art of some chaos-based hash functions of the literature. Finally, we conclude this chapter.

Chaos properties

Many complex systems can be better understood through Chaos Theory. Henri Poincaré, a mathematician, laid the groundwork for Chaos Theory [START_REF] Christian | A history of chaos theory[END_REF]. He was the first to point out that many deterministic systems display a "sensitive dependence on initial conditions". Poincaré described this concept in the following way : "It may happen that small differences in the initial conditions produce very great ones in the final phenomena. A small error in the former will produce an enormous error in the latter. Prediction becomes impossible".

Later, in the 1900s, Edward Lorenz, MIT meteorologist, discovered by chance what would be called the Chaos Theory. Lorenz studied the phenomenon of Chaos Theory in the context of weather systems [START_REF] Edward | Deterministic nonperiodic flow[END_REF].

When making weather predictions, he noticed that his calculations were significantly impacted by the extent to which he rounded his numbers. The end result of the calculation was significantly different when he used a number rounded to three digits as compared to a number rounded to six digits. His observations on Chaos Theory in weather systems led to his famous talk, which he entitled, "Predictability : 47 Does the Flap of a Butterfly's Wings in Brazil set off a Tornado in Texas ?" [START_REF] Edward | Predictability : does the flap of a butterfly's wings in Brazil set off a tornado in Texas ?[END_REF]. In reference to this talk, Chaos Theory has also been described as the "butterfly effect". Lorenz had discovered the chaotic behavior of a nonlinear system, that of the weather, but the term Chaos Theory was only later given to the phenomenon by the mathematician James A. Yorke, in 1975 [START_REF] Tien-Yien | Period three implies chaos[END_REF]. Lorenz also gave a graphic description of his findings using his computer. The figure that appeared was his second discovery : the attractors.

Chaos theory is a branch of mathematics that focused on the behaviour of complex dynamic systems [START_REF] Richards | Is strategic decision making chaotic ?[END_REF]. In chaos theory, a chaotic system is a simple, non-linear dynamic process that reflects completely unpredictable behaviour, and hence randomness. Moreover, it is a deterministic system and highly sensitive to initial conditions, such that, if two identical chaotic systems are in two slightly different initial conditions, they will evolve toward amazingly different results [START_REF] David | Chaos theory and strategy : Theory, application, and managerial implications[END_REF]. Chaos theory has many applications in several disciplines, including meteorology, physics, computer science, engineering, politics, business, social sciences, economics, philosophy, and biology [START_REF] Hua | Bifurcation control of chaotic dynamical systems[END_REF]. Since 1980s, the idea of using chaotic systems to design crypto-systems has attracted more and more attention. It can be traced to Shanon's classical paper on theory of secrecy systems [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. The good dynamical properties of chaotic systems implies good cryptographical properties of crypto-systems. For that, chaotic sequences has been used in the design of cryptographic primitives including image encryption, pseudo-random number generators, watermarking, steganography, and hash functions [START_REF] Amir | A symmetric image encryption scheme based on combination of nonlinear chaotic maps[END_REF]. In the following sub-sections, we give the main characteristics of chaotic signals and neural networks suitable to build secure hash functions, and a brief description of DSTmap and DPWLCmap.

Main characteristics of chaotic systems suitable to build hash functions

A chaotic system is characterized by the following important security features [START_REF] Robert | On the derivation of a "chaotic" encryption algorithm[END_REF][START_REF] René | Emergence of randomness from chaos[END_REF][START_REF] Oleg | How useful randomness for cryptography can emerge from multicore-implemented complex networks of chaotic maps[END_REF][START_REF] Qiaolun | A novel reversible robust watermarking algorithm based on chaotic system[END_REF][START_REF] Sergio | Nonlinearity, chaos, and complexity : the dynamics of natural and social systems[END_REF]

Chaotic maps

In mathematics, a chaotic map is a function which exhibits some sort of chaotic behaviour. It often takes the form of iterated function and occurs in the study of dynamical systems. Chaotic maps may be parametrized by a continuous-time or a discrete-time parameter. According to Alligood et al. [START_REF] Kathleen | Chaos : An Introduction to Dynamical Systems[END_REF],

Chaos properties

a chaotic map is a function of its domain onto itself, the starting point of the trajectory (the sate from which the system starts) is called the initial condition [START_REF] Gregory | Chaotic dynamics : an introduction[END_REF].

Several chaotic maps with one-dimension (1-D), two-dimensions (2-D) and three-dimensions (3-D) are proposed in the literature. In this subsection, we will give a brief description of the two chaotic maps Discrete Skew Tent map and Discrete Piecewise Linear Chaotic Map that will be used in this thesis.

Discrete Skew Tent map

The Discrete Skew Tent map is a one dimensional piecewise map, exhibiting chaotic dynamics. It is a non invertible transformation of the input interval onto itself [START_REF] Yoshida | Analytic study of chaos of the tent map : band structures, power spectra, and critical behaviors[END_REF].

The equation of the Discrete Skew Tent function is defined as follows :

X(n) = DST map(X(n -1), P) =            2 N × X(n-1) P i f 0 < X(n -1) < P 2 N -1 i f X(n -1) = P 2 N × 2 N -X(n-1) 2 N -P i f P < X(n -1) < 2 N (2.1)
where the dynamical variable X(n) and the control parameter P take an integer value that belongs to the interval ]0, 2 N -1].

Discrete Piecewise Linear Chaotic Map

The Discrete Piecewise Linear Chaotic map is another one dimensional piecewise map, exhibiting chaotic dynamics [START_REF] Hong | A design methodology of chaotic stream ciphers and the realization problems in finite precision[END_REF]. The DPWLCmap has been often used in data encryption [START_REF] Stergios | A probabilistic symmetric encryption scheme for very fast secure communication based on chaotic systems of difference equations[END_REF].

The equation of the Discrete Piecewise Linear Chaotic function is defined as follows :

X(n) = DPW LCmap(X(n -1), P) =                          2 N × X(n-1) P i f 0 < X(n -1) ≤ P 2 N × X(n-1)-P 2 N-1 -P i f P < X(n -1) ≤ 2 N-1 2 N × 2 N -X(n-1)-P 2 N-1 -P i f 2 N-1 < X(n -1) ≤ 2 N -P 2 N × 2 N -X(n-1) P i f 2 N -P < X(n -1) ≤ 2 N -1 2 N -1 -P otherwise (2.2)
where X(n) ∈ [1, 2 N -1] and P is the discrete control parameter and satisfies 0 < P < 2 N-1 .

Chapter 2 -Main chaos-based hash functions of the literature

Neural Networks

Neural Networks are built from simple units called neurons, which work in concurrent manner to realize complex functions in different areas : classification, identification, pattern recognition, speech recognition, automation, and so on.

These units are mimic human nerve system. These units are connected by connections (synapses). Every connection has some weight. Neural networks were learned by modifying the values of weights between units. Learning is realized by presenting a set of inputs and a set of target outputs and the adjusting is based on a comparison between computed output and expected target. This process is repeated until the difference is less than a specify threshold.

The most known architecture of neural network is a perceptron. A lot of architectures of perceptron were proposed by Rosenblatt [START_REF] Frank | The perceptron : a probabilistic model for information storage and organization in the brain[END_REF]. The simple one is a single layer perceptron. The structure of feed-forward neural network can consist of one or several hidden layers of neurons with activation function and one output layer as seen in Fig. 2.1. Hidden layers with nonlinear activation functions realized the confusion and diffusion process between input and output sets. At the beginning, input values are applied to the input neurons. Each neuron computes his output. Computed values are sent to the hidden layer. The output value is obtained after calculation layer by layer and the process is finished when the output layer is achieved. The detailed structure of a neuron i is shown in Fig. 2.2. The output of this neuron is given by the following equation :

C i = F(( n ∑ k=0 W i,k × P k ) + B i ) (2.3)

Main characteristics of Neural Network suitable to build hash functions

The neural networks are suitable to use in cryptographic hash functions thanks to its interesting properties [START_REF] Hunt | Neural networks for nonlinear internal model control[END_REF] :

1. Nonlinear structure : complex relationships between inputs and outputs and consequently ensure the confusion property by using a nonlinear function as a transfer function.

Diffusion property :

The mixing process is applied at each neuron, while the output is in relation to all the elements of the input as seen in figure 2.2.

3. Parallel implementation : the structure of neural networks permit naturally a parallel implementation. Normally, this lead to reduce the execution time.

4. Flexibility : the size of input/output (n elements) can be changed, which allows to ensure a flexible size of data block.

5. One-way compression function.

Hash functions based on Chaotic maps

Many researchers developed hashing schemes based on simple chaotic maps, such as logistic map, high-dimensional discrete map, piecewise linear chaotic map, tent map, and Lorenz map or on 2D coupled map lattices [START_REF] Sze | A chaos-based cryptographic hash function for message authentication[END_REF][START_REF] Li | Secure hash function based on chaotic tent map with changeable parameter[END_REF].

In 2002, Wong [START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF] generalized the chaotic cryptographic scheme based on iterating a logistic map with the look-up table updated dynamically. So, that it can perform encryption and hashing to produce the cipher text and the hash value for a given message. In another work, Xiao et al. [START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF] present an algorithm for one-way hash function construction based on the piecewise linear chaotic map with changeable parameter P. The Cipher Block Chaining (CBC) mode is introduced to ensure that the parameter P in each iteration is dynamically decided by the last-time iteration value and the corresponding message bit In 2005, Yi [START_REF] Xun | Hash function based on chaotic tent maps[END_REF] proposed a new 2l-bit iterated hash function based on chaotic tent maps. In 2007, Zhang et al. [START_REF] Jiashu | Chaotic keyed hash function based on feedforward-feedback nonlinear digital filter[END_REF] proposed a novel chaotic keyed hash algorithm using a feed forward-feedback nonlinear filter. Arumugam et al. [START_REF] Arumugam | Study of chaos functions for their suitability in generating message authentication codes[END_REF] presented a new approach of applying chaos functions for generating Message Authentication Code with higher security but with smaller key size. They designed an algorithm by using variable Initialization Vectors (IVs) instead of a constant IV. They proved that the algorithm satisfies the expected properties of the MAC to provide security. Also, they show that their proposed algorithm would be useful for authenticating very sensitive information in the areas of military, banking and financial transaction.

In 2007, Wang et al. [START_REF] Yong | One-way hash function construction based on iterating a chaotic map[END_REF] designed an algorithm for one-way hash function construction based on iterating a chaotic map. The total chaotic space is divided into some subspace based on the density distribution function of the chaotic map. Each subspace is associated with a unique bit in a bit sequence. The value of the chaotic map is dynamically decided by the last-time value and the corresponding message bit in different positions. When the chaotic value is in one subspace, changes the corresponding bit. Finally, the bit sequence is used as the hash value.

In their paper, Wang et al. [START_REF] Yong | One-way hash function construction based on 2D coupled map lattices[END_REF] proposed an algorithm for constructing one-way hash function based on spatiotemporal chaos. A two-dimensional coupled map lattices (2D CML) with parameters leading to the largest Lyapunov exponent is employed. The state of the 2D CML is dynamically determined by its previous state and the message bit at the corresponding positions. The hash value is obtained by a linear transform on the final state of the 2D CML.

In 2008, Maqableh et al. [START_REF] Mahmoud | New hash function based on chaos theory (CHA-1)[END_REF] proposed a new hash function (CHA-1) based on the Logistic Map. The proposed new hash algorithm (CHA-1) produce hash value of 160-bit, accept any message length less than 2 80 bits, and having security factor of 2 80 . Akhavan et al. [START_REF] Akhavan | Hash function based on piecewise nonlinear chaotic map[END_REF] proposed an algorithm for one-way hash function construction based on piecewise nonlinear chaotic map. In his proposed hash algorithm, message is totally connected to the all parameters, so that the generated hash value is highly sensitive to the message. Also, in order to achieve high security in hash function, they are combining a piecewise nonlinear chaotic map and a one-dimensional chaotic map. Although the combination of these two maps leads to the increased complexity of the hash function. Also, they studied their proposed algorithm in terms of security and speed.

In 2009, Amin et al. [START_REF] Mohamed | Chaos-based hash function (CBHF) for cryptographic applications[END_REF] investigated an algorithm for one-way hash function construction based on chaos theory. A chaotic tent map is chosen, for certain parameter values, this system can display highly complex behaviour and even chaotic phenomena. The hash value is obtained by iterating the tent map.

In addition to statistical tests, they studied the immunity of their proposed algorithm against birthday attack and meet-in-the-middle attack. Zhang et al. [START_REF] Zhang | One-way hash function construction based on conservative chaotic systems[END_REF] proposed an algorithm for one-way hash function construction based on conservative chaotic system. They use the conservative systems to perform iteration operation instead of dissipative system to overcome the traditional defects, which makes this method of hash function construction has a high security. In their algorithm, the two initial inputs and steps of iterations are generated by last round of iteration. Wang et al. [START_REF] Yong | Parallel hash function construction based on coupled map lattices[END_REF] proposed a parallel structure of hash function based on the coupled map lattices. Not only the message block but also its position in the whole message block chain are used as the input of the hash round function. The output of round function is generated by iterating the CML. The final hash value is the mixed result of all the hash round values.

In 2011, Liu [START_REF] Jiandong | A Fast New Cryptographic Hash Function Based on Integer Tent Mapping System[END_REF] proposes a novel one-way Hash function which is based on the Coupled Integer Tent Mapping System and termed as THA (THA-160, THA-256). The algorithm adopts a piecewise message expansion scheme. In his algorithm, the message expansion scheme has enhanced the degree of nonlinear diffusion of the message expansion, and thus increased the computation efficiency.

Hash functions based on Chaotic maps and Neural Networks

In the literature, other researchers proposed to combine chaotic maps and neural networks to build new Chaotic Neural Network hash functions.

In 2004, Xiao and Liao [START_REF] Di | A combined hash and encryption scheme by chaotic neural network[END_REF] proposed a combined hashing and encryption scheme by using chaotic neural network. With random chaotic sequences, the weights of neural network are distributed and the permutation matrix P is generated.

In 2006, Lian et al. [START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF][START_REF] Shiguo | Secure hash function based on neural network[END_REF], based on chaotic neural networks, construct a hash function, which makes use of neural networks' diffusion property and chaos' confusion property. This function encodes the plaintext of arbitrary length into the hash value of fixed length. Then, its security against statistical attack, birthday attack and meet-in-the-middle attack is analyzed in detail. Xiao et al. [START_REF] Di | Parallel keyed hash function construction based on chaotic maps[END_REF] analyzed the cause of vulnerability of their original parallel keyed hash function based on chaotic maps [START_REF] Di | Improving the security of a parallel keyed hash function based on chaotic maps[END_REF] in detail, and then proposed the corresponding enhancement measures. Liu and Xiu [START_REF] Xiangdong | Hysteresis modeling based on the hysteretic chaotic neural network[END_REF] introduced the hysteresis activation function, and proposed a novel hysteretic chaotic neuron model by the function. It is shown that the model may exhibit a complex dynamic behaviour. On the basis of this neuron model, they construct a novel neural network, which can be applied to hysteresis system modeling.

In 2008, Yang et al. [START_REF] Huaqian | One-way hash function construction based on chaotic map network[END_REF] designed a novel chaotic hash algorithm based on a network structure formed by 16 chaotic maps. The original message is first padded with zeros to make the length a multiple of four. Then, it is divided into a number of blocks each contains 4 bytes. In the hashing process, the blocks are mixed together by the chaotic map network since the initial value and the control parameter of each tent map are dynamically determined by the output of its neighbors. To enhance the confusion and diffusion effect, the cipher block chaining (CBC) mode is adopted in the algorithm.

In 2009, Xiao er al. [START_REF] Di | Parallel keyed hash function construction based on chaotic neural network[END_REF] proposed an algorithm for parallel keyed hash function construction based on chaotic neural network. The mechanism of changeable-parameter and self-synchronization establishes a close relation between the hash value bit and message, and the algorithm structure ensures the uniform sensitivity of the hash value to the message blocks at different positions. In the same year, Deng et al. [START_REF] Shaojiang | A novel combined cryptographic and hash algorithm based on chaotic control character[END_REF] proposed a novel combined cryptographic and hash algorithm based on chaotic control character.

The control character is generated by chaotic iteration. The plaintext is pre-processed in terms of control character, and then encrypted by the look-up index table. At the same time, the chaotic trajectory is changed continuously according to the control character, which can avoid the dynamical degradation of chaos. Besides, the look-up index table is updated by utilizing the control character continuously, and the index item of the final look-up index table can be considered as the hash value of the whole paragraph of plaintext. Therefore, the proposed algorithm can perform both encryption/decryption and hash in a combined manner.

Deng et al. [START_REF] Shaojiang | Analysis and improvement of a chaos-based Hash function construction[END_REF] analyzed in detail the potential flaws in the algorithm proposed in the paper "A chaosbased cryptographic Hash function for message authentication" [START_REF] Sze | A chaos-based cryptographic hash function for message authentication[END_REF]. Then, the corresponding improving measures are proposed. They enhance the influence that each bit of the final Hash value is closely related to all the bits of the message or key and a single bit change in message or key results in great changes in the final hash value. Li et al. [START_REF] Yantao | A novel Hash algorithm construction based on chaotic neural network[END_REF] proposed an algorithm for constructing a one-way novel hash function based on two-layer chaotic neural network structure. The Piecewise Linear Chaotic Map (PWLCM) is utilized as transfer function, and the 4-dimensional and One-Way Coupled Map Lattices (4D OWCML) is employed as key generator of the chaotic neural network.

Since 2010, there has been a real turning point in building new secure hash algorithms based on chaotic maps and neural network. Huang [START_REF] Zhongquan | A more secure parallel keyed hash function based on chaotic neural network[END_REF] proposed an enhancement of Xiao's parallel keyed hash function based on chaotic neural network [START_REF] Di | Parallel keyed hash function construction based on chaotic neural network[END_REF]. Indeed, in Xiao's scheme, the secret keys are not nonce numbers, which might produce a potential security flaw.

In 2011, Li et al. [START_REF] Yantao | Parallel Hash function construction based on chaotic maps with changeable parameters[END_REF] proposed and analyzed in their paper a parallel Hash algorithm construction based on chaotic maps with changeable parameters. The two main characteristics of the proposed algorithm are parallel processing mode and message expansion. The algorithm translates the expanded message blocks into the corresponding ASCII code values as the iteration times, iterates the chaotic asymmetric tent map and then the chaotic piecewise linear map, continuously, with changeable parameters dynamically obtained from the position index of the corresponding message blocks, to generate decimal fractions, then rounds the decimal fractions to integers, and finally cascades these integers to construct intermediate Hash value. The final hash value with the length of 128-bit is generated by logical xor operation of intermediate Hash values.

In 2013, He et al. [START_REF] Bo | A method for designing hash function based on chaotic neural network[END_REF] designed an algorithm for constructing one-way hash function based on chaotic neural network. The neural network model is initialized by two chaotic maps. Then, the message are divided into blocks with fixed length and inputted to neural network one by one. Since the output feedback model is employed, its output not only depends on the input and parameters of the neural network, but also on its status. This dependence is enhanced by iterating the chaotic map, which is very useful to improve the performance of hash function. The final hash value is extracted from status value of output layer cells. Li et al. [START_REF] Yantao | Improvement and performance analysis of a novel hash function based on chaotic neural network[END_REF] reconsider and analyze their previous paper "A novel hash algorithm construction based on chaotic neural network" [START_REF] Yantao | A novel Hash algorithm construction based on chaotic neural network[END_REF]. Then, they present equal-length and unequal-length forgery attacks against its security in detail. Finally, they propose a significantly improved approach by utilizing a method of complicated nonlinear computation to enhance the security of the original hash algorithm.

In 2015, Abdoun et al. [START_REF] Nabil | Hash Function based on Efficient Chaotic Neural Network[END_REF] proposed an efficient algorithm for constructing a secure Hash function based on Chaotic Neural Network structure. The proposed Hash function includes two main operations : Generation of Neural Network parameters using fast and efficient Chaotic Generator and Iteration of the message through the three-layer Chaotic Neural Network.

Specific chaos-based hash functions

In the literature, high-dimensional chaotic maps have also been used in hash functions for higher complexity and better mixing.

Xiao et al. [START_REF] Di | Parallel keyed hash function construction based on chaotic maps[END_REF] designed a parallel keyed chaos-based hash function, where a mechanism of both changeable-parameter and self-synchronization is used to establish a close relation of the keystream with the algorithm key, the content, and the order of each message block.

In their paper, Nouri et al. [START_REF] Mahdi | A dynamic chaotic hash function based upon circle chord methods[END_REF] proposed and analyzed a dynamic Hash algorithm construction based on chaotic maps with controllable parameters. Based on simplest 2-D chaotic maps, a new hash function has been proposed and analyzed. Moreover in this paper, an algorithm for one way hash function construction based on chaos theory is introduced. The proposed hash function operates on messages with arbitrary length to produce 128 bits hash value and can be easily implemented in both hardware and software. The two core characteristics of the recommended algorithm are chaotic behaviours and parallel processing mode. The proposed algorithm contains controllable parameters dynamically obtained from the position index of the corresponding message blocks.

In their paper, Akhavan et al. [START_REF] Amir | A novel parallel hash function based on 3D chaotic map[END_REF] proposed a new efficient scheme for parallel hash function based on high-dimensional chaotic map. In the proposed scheme, the confusion as well as the diffusion effect is enhanced significantly by utilizing two nonlinear coupling parameters.

Jiteurtragool et al. [START_REF] Jiteurtragool | A topologically simple keyed hash function based on circular chaotic sinusoidal map network[END_REF] proposed a topologically simple keyed hash function based on circular chaotic sinusoidal map network that uses more complex map, i.e., the Sine map. In 2014, Teh et al. [START_REF] Sen | Parallel chaotic hash function based on the shuffle-exchange network[END_REF] introduced a parallel chaotic hash function based on the shuffle-exchange network that runs in parallel to improve hashing speed. Chenaghlu et al. [START_REF] Asgari | A novel keyed parallel hashing scheme based on a new chaotic system[END_REF] published a new keyed parallel hashing scheme based on a new hyper sensitive chaotic system with compression ability. In 2015, Guesmi et al. [START_REF] Guesmi | A novel chaos-based image encryption using DNA sequence operation and Secure Hash Algorithm SHA-2[END_REF] proposed a novel image encryption algorithm based on a hybrid model of deoxyribonucleic acid (DNA) masking, a Secure Hash Algorithm SHA-2 and the Lorenz system. In 2016, Li et al. [START_REF] Yantao | Chaotic hash function based on circular shifts with variable parameters[END_REF] proposed a chaotic hash algorithm based on circular shifts with variable parameters. They exploit piecewise linear chaotic map and one-way coupled map lattice to produce initial values and variable parameters. In their paper, circular shifts are introduced to improve the randomness of hash values.

Conclusion

In this chapter, we presented the main characteristics of chaos theory and neural networks suitable to build hash functions. Then, we gave an overview of DSTmap and DPWLCmap used in our contributions.

Finally, we presented three categories of some chaos-based hash functions of the literature.

Chapter 3

Design and security analysis of keyed chaotic neural network hash functions based on the Merkle-D åmgard construction

Introduction

This chapter proposes two keyed hash functions based on Chaotic Neural Network (CNN), and for each one, three output schemes are suggested as presented in Fig. 3.1. The first CNN hash function uses two-layer neural network structure (named Structure 1), whereas the second hash function uses onelayer neural network followed by a combination of Non-Linear (NL) functions (named Structure 2).

The obtained results of several statistical tests and cryptanalytic analysis highlight the robustness of the proposed keyed CNN hash functions, which is fundamentally due to the strong non-linearity of both the chaotic systems and the neural networks. The comparison of the performance analysis with some chaosbased hash functions of the literature and with standard hash functions make the proposed hash functions suitable for data integrity, message authentication, and digital signature applications.

Chaotic Neural Network structure of the proposed keyed hash functions

In the next sub-sections, we explain the padding rule, the three suggested output schemes based on Matyas-Meyer-Oseas [START_REF] Stephen | Generating strong one-way functions with cryptographic algorithm[END_REF][START_REF] Timo | Building Hash Functions from Block Ciphers, Their Security and Implementation Properties[END_REF][START_REF] Bruno | Data authentication using modification detection codes based on a public one way encryption function[END_REF] and Miyaguchi-Preneel [START_REF] Shoji | New 128-bit hash function[END_REF][START_REF] Bart | Hash Functions Based on Block Ciphers : A Synthetic Approach[END_REF][START_REF] Shoji | Confirmation that some hash functions are not collision free[END_REF][START_REF] Prencel | Collision-free hashfunctions based on blockcipher algorithms[END_REF]. Next, we describe 59

Padding rule

The message M is padded with the bit pattern 00...0 of length v bits, as shown in equation (3.1) (see Fig. 3.2). The remaining 64 bits is used by the padding function "is-pad" to denote L (see sub-section

1.3.1). v = |M i | -mod[(L + 64), |M i |] (3.1)
It should be noted that, if L exceeds 2 64 , then L mod 2 64 is taken as the message length instead of L [START_REF] Alfred | Handbook of applied cryptography[END_REF].

In general, we have 3 cases of padding :

case a : mod(|M|, |M i |) < |M i | -64. case b : mod(|M|, |M i |) = 0. case c : mod(|M|, |M i |) > |M i | -64.

Suggested output schemes

Matyas-Meyer-Oseas (MMO) output scheme

In this output scheme, the message block M i is xored with the chaining variable HM i , which is the output of the CNN that takes as inputs M i and the output of the Chaotic System (Fig. 3.1-a). The state value KM i-1 is the key of the Chaotic System. Due to the possible different bit-length, an output function O precedes the generation of the final output KM i , which represents the key of the next block, which is as follows :

KM i = O(HM i ⊕ M i ) (3.2)
where i : the block index ; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K : the secret key.

f or i = q : KM q = h : the final hash value.

Modified Matyas-Meyer-Oseas (MMMO) output scheme

This output scheme is similar to MMO output scheme except for the xor operation. Indeed in this case, HM i is xored with KM i-1 (Fig. 3.1-b), where the final output KM i is defined by :

KM i = O(HM i ⊕ KM i-1 ) (3.3)
where i : the block index ; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K : the secret key.

f or i = q : KM q = h : the final hash value.

Miyaguchi-Preneel (MP) output scheme

This output scheme can be considered as an extension of the MMO output scheme, where KM i-1 is also added to the xor operation between M i and HM i (Fig. 3.1-c). The final output KM i is defined by :

KM i = O(HM i ⊕ M i ⊕ KM i-1 ) (3.4)
where i : the block index ; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K : the secret key.

f or i = q : KM q = h : the final hash value.

Detailed description of the proposed Chaotic System

The proposed Chaotic System is used to generate the parameters concerning the CNN compression function (Fig. 3.1). It comprises the DSTmap with one recursive cell (delay equal to 1) (Fig. 3.3). Its outputs are defined as follows : where KSs(n) and KSs(n-1) are the outputs of DSTmap at the n th and (n -1) th iterations, respectively. Q1 is the control parameter of DSTmap, and N is the finite precision equal to 32 bits. KSs(n), KSs(n-1), and Q1 range between 1 to 2 N -1.

KSs(n) = DST map(KSs(n -1), Q1) =            2 N × KSs(n-1) Q1 i f 0 < KSs(n -1) < Q1 2 N -1 i f KSs(n -1) = Q1 2 N × 2 N -KSs(n-1) 2 N -Q1 i f Q1 < KSs(n -1) < 2 N
The secret key K, used for the first message block M 1 , is composed of the necessary parameters and initial conditions of the simplified version of the Chaotic Generator patent [START_REF] Safwan | Generator of chaotic sequences and corresponding generating system[END_REF] and it is given by the following equation :

K = {KSs1(0), Ks1, KSs1(-1),Us, Q1} (3.6)
where KSs1(0) and KSs1(-1) are the initial values, Us is an additional initial value used only to generate the first sample, Ks1 is the coefficient, and Q1 is the control parameter of the Chaotic System. The components of K are samples of 32 bits length and its size is given as follows :

|K| = |KSs(0)| + |Ks| + |KSs(-1)| + |U s | + |Q1| = 160 bits (3.7) DSTmap Z -1 X KSsi(n) Ks1 kSsi(n-1)
Us Q1

KSp(n) = DPW LCmap(KSp(n -1), Q2) =                          2 N × KSp(n-1) Q2 i f 0 < KSp(n -1) ≤ Q2 2 N × KSp(n-1)-Q2 2 N-1 -Q2 i f Q2 < KSp(n -1) ≤ 2 N-1 2 N × 2 N -KSp(n-1)-Q2 2 N-1 -Q2 i f 2 N-1 < KSp(n -1) ≤ 2 N -Q2 2 N × 2 N -KSp(n-1) Q2 i f 2 N -Q2 < KSp(n -1) ≤ 2 N -1 2 N -1 -Q2 otherwise (3.8)
where KSp(n) and KSp(n-1) are the outputs of DPWLCmap at the n th and (n-1) th iterations, respectively. Q2 is the control parameter. N is the finite precision and is equal to 32 bits. KSp(n), KSp(n-1), and Q2

range between 1 to 2 N-1 .

It should be noted that in the proposed structures, the padded message M is divided into q blocks, where M i , (1 ≤ i ≤ q) is the i th input block of the message M, KM i , (0 ≤ i ≤ q -1) is the i th key, and HM i , (1 ≤ i ≤ q) is the i th hash value of block M i , (1 ≤ i ≤ q). For the first block M 1 , K = KM 0 is the secret key [START_REF] Safwan | Chaos based information hiding and security[END_REF]. For the final block M q , h is the final hash value of the entire message M (Fig. The detailed structure of the i th block in the proposed two-layer CNN hash function using Miyaguchi-Preneel output scheme, as an example, is given in Fig. 3.5. Each of the input and output layers has 8 neurons. For each block M i at the input layer, each neuron has 8 input-data : P j , ( j = 0, ..., 7) for neuron 0, P j , ( j = 8, ..., 15) for neuron 1 and so on until reaching P j , ( j = 56, ..., 63) for neuron 7. Each P j , ( j = 0, ..., 63) is weighted by W I j , ( j = 0, ..., [START_REF] Guido | Permutation-based encryption, authentication and authenticated encryption[END_REF], where both are the samples (integer values) of 32 bits length. The Chaotic System generates the necessary samples (Key Stream (KS)) to supply the CNN of each block i, which is as follows :

KS = {W I, BI, QI,WO, BO, QO} (3.9)
and its size is written as : The chaotic activation function of each neuron k(k = 0, ..., 7) for the input layer is now explained as an example, (the activation function for the output layer has similar description). As we can see in Fig. 3.7, the first four inputs P j , ( j = 8k, ..., 8k + 3) are weighted by the W I j , ( j = 8k, ..., 8k + 3) and then added together with the bias BI k (weighted by 1) to form the input of DSTmap. The second four inputs P j , ( j = 8k + 4, ..., 8k + 7) are weighted by W I j , ( j = 8k + 4, ..., 8k + 7) and then added together with the same bias BI k to form the input of DPWLCmap. QI k,1 and QI k,2 are the control parameters of DSTmap and DPWLCmap, respectively. The biases BI k are necessary in case the input message is constant.

|KS| = |W I| + |BI| + |QI| + |WO| + |BO| + |QO| = 176 samples (3.
The outputs of the chaotic activation function are denoted C k for the input layer, which is given by equation 3.11, and H k for the output layer, which is given by equation 3.12.

C k = mod{[F1 + F2], 2 N } where        F1 = DST map{mod([ 8k+3 ∑ j=8k (W I j × P j )] + BI k , 2 N ), QI k,1 } F2 = DPW LCmap{mod([ 8k+7 ∑ j=8k+4 (W I j × P j )] + BI k , 2 N ), QI k,2 } (3.11)
H k = mod{[G1 + G2, 2 N ]} where        G1 = DST map{mod([ 3 ∑ j=0 (WO k, j ×C j )] + BO k , 2 N ), QO k,1 } G2 = DPW LCmap{mod([ 7 ∑ j=4 (WO k, j ×C j )] + BO k , 2 N ), QO k,2 } (3.12)
where k = 0, 1, ..., 7.

The outputs C k of the input layer, weighted by WO k,k , (k = 0, ..., 7), and the output biases BO k , (k = 0, ..., 7), weighted by 1, are the inputs of the activation function of the output layer. Both WO k,k and BO k are samples of 32 bits length. For each neuron, DSTmap and DPWLCmap are iterated once. The output HM i , (i = 1, ..., q) of each block is the concatenation vector of H k , (k = 0, ..., 7) (Fig. 3.6). Then, the final hash value of length 256 bits is given by the following equation :

h = O[KM q-1 ⊕ HM q ⊕ M q ] = O[(KM q-2 ⊕ HM q-1 ⊕ M q-1 ) ⊕ HM q ⊕ M q ] = ... = O[(K ⊕ HM 1 ⊕ M 1 ) ⊕ HM 2 ⊕ M 2 ⊕ ... ⊕ HM q ⊕ M q ] (3.13)
where O is the Least Significant Bit (LSB) output function.

3.2.5 Keyed hash functions based on one-layer CNN with Non-Linear output layer (Structure 2)

Thus, to efficiently increase the hash throughput while keeping the necessary security requirements, we replace the output layer neural network of Fig. 3.5 by a combination of non-linear functions used in the standard SHA-2. However in our implementation, the round constant K i , (i = 0, ..., 63) and the message schedule array W i , (i = 0, ..., 63) are not useful (Fig. 3.8). As we can see in the figure 3.8, the non-linear functions take 8 32-bit inputs D k , (k = 0, ..., 7) and generates 8 32-bit outputs H k , (k = 0, ..., 7).

The four boxes (Ch, Maj, Σ0, and Σ1) combine the input data in non-linear ways to generate H 0 and Chapter 3 -Design and security analysis of keyed chaotic neural network hash functions based on the Merkle-D åmgard construction H 4 , while the other outputs H k (k = 1, 2, 3, 5, 6, 7) are connected directly to D k , which is as follows :

H k = D k-1 (k = 1, 2, 3, 5, 6, 7
). These non-linear functions are defined as follow [3] : The structure of the proposed CNN is given in Fig. 3.9. To supply the CNN, the Chaotic System generates the necessary samples (Key Stream (KS)) of each block i, which are as follows :

                     Ch(D 4 , D 5 , D 6 ) = (D 4 ∧ D 5 ) ⊕ (¬D 4 ∧ D 6 ) Ma j(D 0 , D 1 , D 2 ) = (D 0 ∧ D 1 ) ⊕ (D 0 ∧ D 2 ) ⊕ (D 1 ∧ D 2 ) Σ0(D 0 ) = ROT R 2 (D 0 ) ⊕ ROT R 13 (D 0 ) ⊕ ROT R 22 (D 0 ) Σ1(D 4 ) = ROT R 6 (D 4 ) ⊕ ROT R 11 (D 4 ) ⊕ ROT R 25 (D 4 ) ROT R n (x) = (x n) ∨ (x (32 -n)) (3
KS = {W I, BI, QI,WO} (3.15)
and its size is given as follows : given by equation 3.17.

|KS| = |W I| + |BI| + |QI| + |WO| = 96
               H 0 = Ch(D 4 , D 5 , D 6 ) ⊕ D 7 ⊕ Σ1(D 4 ) ⊕ Ma j(D 0 , D 1 , D 2 ) ⊕ Σ0(D 0 ) H 1 = D 0 , H 2 = D 1 , H 3 = D 2 H 4 = Ch(D 4 , D 5 , D 6 ) ⊕ D 7 ⊕ Σ1(D 4 ) ⊕ D 3 H 5 = D 4 , H 6 = D 5 , H 7 = D 6 (3.17)
We iterate the non-linear functions until the necessary security requirements are met. From experimental results (given in performance analysis paragraph), the number of rounds n r equals to 8, which is sufficient. The final hash value h of length 256 bits is given in equation 3.13.

Performance analysis

To evaluate the performance, in terms of cryptanalysis and hash throughput, of the two proposed structures for each suggested output schemes, we perform the following experiments and analysis. Then, we compare their performance with most chaos-based hash functions in the literature and SHA-2. First, the one-way property (preimage resistance) is showed and then the statistical tests, the brute force, and cryptanalytical attacks of the proposed hash functions are analyzed (Fig. 3.10).

One-way property

In the two proposed structures, we will show that it is extremely difficult to compute the message M and the secret key K when only the hash value h is known. For the first structure, the hash H is written in a general form, which is as follows (equations 3.11 and 3.12) : For the second structure, the hash H can be written as follows :

H = G[(WO ×C + BO), QO] = G[(WO × F((W I × P + BI), QI), QO)] (3.18)
H = NL r (WO ×C) = NL r [WO × F((W I × P + BI), QI)] (3.19)
A brute force attack, as defined in sub-section 3.3.3.1, tries for a given secret key K to find a message M, of which its hash is equal to a given hash value. The attacker needs to try, on average, 2 u-1 values of M, to find the desired hash value h. As u is the length of the hash value equal to 256 bits in the two proposed structures, then according to today's computing ability, this attack is infeasible [START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF][START_REF] Xun | Hash function based on chaotic tent maps[END_REF][START_REF] Shiguo | Secure hash function based on neural network[END_REF][START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF].

Statistical tests

This paragraph lists down the analysis of the following tests : Collision resistance, Distribution of hash value, Sensitivity of hash value h to the message M, Sensitivity of hash value h to the secret key K, and Diffusion effect.

Analysis of collision resistance

This test is usually conducted to evaluate the quantitative analysis of collision resistance [START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF][START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF].

First, the hash value h of a random message is generated and stored in the ASCII format. Next, a bit in the message is randomly selected, toggled, and then a new hash value h is generated and stored in the ASCII format. The two hash values are represented by : h = {c 1 , c 2 , ..., c s } and h = {c 1 , c 2 , ..., c s }, where c i and c i are the i th ASCII character of the two hash values h and h , respectively. The size s of the hash value in the ASCII code is equal to s = u k=8 = 32 characters. The two hash values are compared with each other and the number of characters with the same value at the same location, namely the number of hits ω, is counted according to the following :

ω = s=32 ∑ i=1 f (T (c i ), T (c i )) where f (x, y) = 1 if x = y 0 if x = y (3.20)
where the function T (.) converts the entries to their equivalent decimal values.

For J independent experiments and under the assumption of uniform and random distribution of hash value, the theoretical number of tests denoted by W J (ω) with a number of hits ω = 0, 1, 2, ..., s, is given by [START_REF] Jiashu | Chaotic keyed hash function based on feedforward-feedback nonlinear digital filter[END_REF] :

W J (ω) = J × Prob{ω} = J s! ω!(s -ω)! ( 1 2 k ) ω (1 - 1 2 k ) s-ω (3.21)
Thus, to find the optimal number of round n r for Structure 2, we calculate, using the equation 3.20, the number of hits ω according to n r (n r = 1, 2, 4, 8, 16, 24) in the worst case, where the number of tests J = 2048 tests.

As we can see from the results obtained in Table 3.1, with MMO output scheme, as an example, for n r = 8 rounds, there are zero hits for 1825 tests, one hit for 207 tests, two hits for 15 tests, and three hits for 1 test. For n r = 24 rounds, there are zero hits for 1817 tests, one hit for 225 tests, and two hits for 6 tests. Similar results are obtained for other output schemes as well. The number of rounds n r equals 8, whereas 24 seems to be adequate for the three output schemes. We choose n r = 24, for more robustness and the number n r = 8 is a compromise between robustness and hash throughput.

Table 3.2 represents the number of obtained hits ω, for the proposed structures for the three output schemes, with J = 2048 tests and for n r = 8, 24 rounds for Structure 2. We remark that, for n r = 8 rounds, the obtained results with Structure 2 are similar to the results obtained with Structure 1, irrespective of the considered output scheme. For n r = 24 rounds, the obtained results with Structure 2, as are slightly bit better than that of Structure 1.

Thus, to evaluate the influence of the test number J (J = 512, 1024, and 2048 tests) on the number of hits, we calculate ω for the proposed structures with MP output scheme, and for n r = 8, 24 rounds for the second structure. The obtained results presented in Table 3.3 for Structures 1 and 2 with n r = 8 rounds are similar, while with n r = 24 rounds of Structure 2, the number of hits is smaller than that of the other cases. We remark that the number of hits increases with the number of tests J. These results are in sync with the theoretical values of W J (ω) calculated from equation 3.21 and are represented in Table 3.4.

The collision resistance is also quantified by the absolute difference d of two hash values given by equation 3.22. We evaluated and presented the mean, mean/character, minimum, and maximum of d for the two proposed hash functions in Tables 3.5 and 3.6.

d = s=32 ∑ i=1 |T (c i ) -T (c i )| (3.22)
From the results given in Table 3 [START_REF] Bart | Analysis and design of cryptographic hash functions[END_REF] :

E[T (c i ) -T (c i )] = 1 3 × L = 85. 3 (3.23)
where T (c i ) and T (c i ) ∈ {0, 1, 2, ..., 255} and L = 256 (L is the number of levels).

Distribution of hash value

A hash function H should produce uniform distribution of hash value h. To verify this property, we perform the following test : for a given message M, "With the wide application of Internet and computer technique, information security becomes more and more important. As we know, hash function is one of the cores of cryptography and plays an important role in information security.

Hash function takes a message as input and produces an output referred to as a hash value. A hash value serves as a compact representative image (sometimes called digital fingerprint) of input string and can be used for data integrity in conjunction with digital signature schemes.", we calculate its hash value h, for the proposed Structure 1 with MP output scheme, before drawing two-dimensional graphs. The first graph shows the ASCII values of the message according to their index positions (Fig.

3.11a

). The second graph exhibits the hexadecimal values of the hash value h according to their index positions (Fig. 3.11b). As we can see, the distribution of original message is mostly localized around a small area, while the distribution of hexadecimal values spreads around the entire area. This property of hash value h must be true under the worst case of constant input message such as "00...0" (Figures 3.11c

Sensitivity of hash value h to the message M

An efficient hash function H should be extremely sensitive to any input message M, which means that any slight change in the input message should produce a completely different hash value h i . To verify this property, we calculate, for a given secret key K, the hash value h i in hexadecimal format, the number of bits changed B i (h, h i ) (bits), and the sensitivity of the hash value h to the original message M measured by Hamming Distance HD i (h, h i )(%) is given as follows :

B i (h, h i ) = |h| ∑ k=1 [h(k) ⊕ h i (k)] bits (3.24) HD i (h, h i ) % = B i (h, h i ) |h| × 100% (3.25)
The message variants are obtained under the following conditions : Hash function takes a mes", with the second message block M 2 , "sage as input and produces an output referred to as a hash value. A hash value serves as a compact representative image (sometimes called digital fingerprint) of input string and can be used for data integrity in conjunction with digital signature schemes".

In Tables 3.7, 3.8, and 3.9, we present the obtained results of h i , B i , and HD i (%) under each condition for the two proposed hash functions with their output schemes, i.e., MMO, MMMO, and MP. In Table 3.10, we reassessed the obtained results and even for a single test, the results were inside the normal range. Therefore, the proposed hash functions have high message sensitivity. These results were in sync with precision in the diffusion test, which was realized over a large number of tests.

Sensitivity of hash value h to the secret key K

Thus, to evaluate the sensitivity of hash value h to the secret key K, hash simulation experiments were conducted under five different conditions (the original input message M is fixed), which are as follows : Condition 1 : The original secret key K is used.

In each of these conditions, we flip the LSB in the afore-mentioned initial conditions and parameters. Condition 2 : We change the initial condition KSs(0) in the secret key. In Tables 3.11, 3.12, and 3.13, we present the obtained results of h i , B i , and HD i (%) under each condition for the two proposed structures with their output schemes, i.e., MMO, MMMO, and MP.

In Table 3.14, we reassessed the obtained results and even for a single test, the results are inside the normal range. Therefore, the proposed hash functions have high key sensitivity.

Statistical analysis of diffusion effect

Since confusion and diffusion were first proposed by Shannon [START_REF] Kai | A new digital signature scheme based on chaotic maps[END_REF] in 1949, they have been extensively used to evaluate the security of cryptographic primitives. In the context of hash functions, confusion is defined as the complexity of the relation between the secret key K and the hash value h for a given message M, whereas diffusion is defined as the complexity of the relationship between the message M and the hash value h for a given key K. The confusion effect is naturally obtained in hash functions and it is very strong in chaos-based hash functions, due to the inherent properties of chaos. In cryptographic hash functions, strong diffusion is required. The ideal diffusion effect is obtained when any single bit change in the message causes a change with a 50% probability for each bit of a hash value (binary format). This is often referred to the avalanche effect in literature [START_REF] Horst | Cryptography and computer privacy[END_REF].

To evaluate the performance of the two proposed structures with different output schemes, i.e., MMO, MMMO, and MP, we performed the following diffusion test :

the previous defined message M is chosen and a hash value h is generated. Next, a bit in the message is randomly selected and toggled and a new hash value is generated. Then, the number of bits changed B i between the two hash values is calculated. This test is performed at J-time, where J = 512, 1024, and 2048 tests. The six statistical values concerning this test are calculated as follows :

1. Minimum number of bits changed :

B min = min({B i } i=1,...,
∆B = 1 J-1 ∑ J i=1 (B i -B) 2
6. Standard variance of the changed probability :

∆P = 1 J-1 ∑ J i=1 ( B i 256 -P) 2 × 100 %
The obtained statistical results of diffusion presented in Table 3.15 with 2048 tests demonstrates that the diffusion effect is close to the expected one. Indeed, irrespective of the used structure and the output schemes, both B and P are very close to the ideal values (128 bits and 50%, respectively), while ∆B and ∆P are very low, which indicates that the diffusion is extremely stable. These results, presented in Table 3.16, are also confirmed through the tests with J = 512 and 1024, for Structures 1 and 2 with MP output scheme.

In addition, we draw the histogram B i (Fig. 3.12) of Structure 1 with MP output scheme to show that the values of B i are centered on the ideal value 128 bits. Similar results are obtained for the other proposed hash functions as well.

Cryptanalysis

The attackers make use of some general attack methods that are available to them, which can be applied to any Unkeyed or Keyed hash functions (Fig. 3.10). These attacks depend only on the hash value length u for the unkeyed hash function and on the hash value length u and the secret key length |K| for the keyed hash function. If the cryptanalyst can find a method to retrieve K, the system is entirely compromised (during the key life time) [START_REF] Stefan | Design Principles for Iterated Hash Functions[END_REF][START_REF] Ilya | Hash functions : Theory, attacks, and applications[END_REF].

Brute force attacks

A brute-force attack on a keyed hash function is more difficult than a brute-force attack on an unkeyed hash function. There are two possible types of attacks, which are as follows :

1. Attacks on the hash value h, namely Preimage attack, second preimage attack, and collision resistance attack.

Attack on the secret key K, namely

Exhaustive key search attack.

For the first type of attacks, for a given secret key K, the fastest way to compute a first or second preimages and collision resistance is through a brute force attack that consists of randomly selecting values of M and try each value until a collision occurs. For exhaustive key search attack, the attacker requires known {message, hash} pairs.

Preimage and second preimage attacks [START_REF] Kazumaro | Preimage attacks on one-block MD4, 63-step MD5 and more[END_REF] In a preimage attack, given only the hash value h, the attacker tries to find the original message M in a way such that H(M) = h without attempting to recover the secret key K. For example, in an authentication security service, a website stores {username, H(password)} in its database instead of {username, pass-word}. When a user tries to access the website in question, the website verifies the authenticity of the user by comparing H(input) with the stored hash H(password) (Fig. 3.13). Now, suppose this database is compromised and an attacker succeeds in accessing a given hash value, then he can try to generate the corresponding message using a preimage attack.

In a second preimage attack, the adversary has more information. Specifically, he knows the hash value h for a given message M and he tries to find another message M that produces the same hash value h. For example, in digital signature scheme for data integrity security service, the attacker has access to both document M and its hash h and tries to find a new document M , such that H(M ) = h, so that he can send the signed new document M as the original signed document M (Fig. 3.14).

For the first and second preimage attacks, the adversary would have to try, on average, 2 u-1 values of M to find one that generates the given hash value h. Our proposed structures produce hash values of length 256 bits, so that the minimum amount of work required by an attacker to violate the preimage or second preimage resistance property should be 2 256-1 operations, which is considered very high. Thus, the proposed hash functions are robust against first and second preimage attacks.

Collision resistance attack (Birthday attack) [START_REF] Philippe | Birthday paradox, coupon collectors, caching algorithms and self-organizing search[END_REF] In the collision resistance attack, the attacker tries to find two messages (M, M ) that collide with the same hash value h. The minimum amount of work required by an attacker to violate the collision resistance property is approximately 2 u/2 operations. This required effort is proven by a mathematical result referred to as the birthday paradox, which is detailed in the example below.

Let us take the situation whether any two students in a class have the same birthday. Suppose that the 365 (23) ) = 50.73%. Birthday attack is widely exploited for finding any two messages M and M , such that H(M) = H(M ), then the couple (M, M ) is named a collision. If the length of h is u and hash values are random with a uniform distribution, an adversary can expect to find a collision (M, M ) with a 50% probability within √ 2 u = 2 u/2 attempts.

Yuval [START_REF] Gideon | How to swindle Rabin[END_REF] proposed the following strategy in DS application (Fig. 3.14) to exploit the birthday paradox in a collision resistant attack without attempting to recover the secret key K :

1. The sender is prepared to sign a legitimate message M by appending the appropriate ciphered u-bit hash code using its private key.

2. The attacker generates 2 u/2 minor variations δ M of the message M, where all of them essentially convey the same meaning along with storing these messages and their hash values in a table.

3. The attacker tries to find a fraudulent message M that has the same sender's signature which was generated using the second preimage attack. 5. Then, the attacker gives the valid fraudulent message δ M to the sender for signature and this signature can then be attached to the fraudulent message for transmission to the intended receiver.

Thus, the attacker is assured of success even though the encryption key is not known.

Another practical example is when the attacker finds a collision between a valid Microsoft Windows security patch and a malware. Then, the attacker sends his malware to sign it, in any certificate company, and ship it to Microsoft Windows users around the world. Later, when a user tries to download the new patch, his computer gets infected.

Also, for collision resistance attack, the length of hash value h determines the security and the proposed hash functions are secure against these kinds of attacks because an attacker needs, on average, 2 128-1 tries.

Exhaustive key search attack [START_REF] Bart | Analysis and design of cryptographic hash functions[END_REF][START_REF] Shahram | Cryptographic hash functions : A survey[END_REF] In keyed CNN hash functions, if the attacker has access to a pair (message, digest), then normally the key can be found by exhaustive searching and, on average, the attacker needs 2 |K|-1 tries, where |K| is the length of the secret key K. Thus, the level of effort for brute force attack on keyed hash functions can be expressed as min(2 |K| , 2 u ). As |K| = 160 bits, consequently, the proposed hash functions are immune against these kinds of attacks.

Cryptanalytical attacks

Cryptanalytic attacks seek to exploit some properties of the keyed hash function to perform some attacks other than brute force attacks. An ideal keyed hash function should require a cryptanalytic effort greater than or equal to the brute force effort. Far less research has been conducted on developing such attacks. A useful survey of some methods for specific keyed hash functions is developed in [START_REF] Bart | On the security of two MAC algorithms[END_REF]. In the following paragraphs, we apply the main cryptanalytic attacks of the literature on the proposed hash functions, which are listed below :

1. Length extension attack (Padding attack)

2. Meet-in-the-middle preimage attack

Joux attack (Multi-collision attack)

4. Long message second preimage attack

Herding attack

Length extension attack [START_REF]Hash Length Extension Attacks | Java Code Geeks[END_REF][START_REF]MD5 Length Extension Attack Revisited | Vũ's Inner Peace[END_REF] In cryptography and computer security, a length extension attack is a type of attack where an attacker can use H(M) and the length of M to calculate H(M||EM) for an attacker-controlled extended message EM. The following attack is applied on Merkle -D åmgard structure that is transformed on keyed hash functions by adding the secret key K in the beginning of the message M (MAC). This attack allows the inclusion of extra message (EM) into a signed message, but needs to know the length of secret key K.

Algorithms like MD5, SHA-1, and SHA-2 that are based on the Merkle -D åmgard construction are vulnerable to these kinds of attacks. However, HMAC is not vulnerable to the length extension attacks [START_REF]Stop using unsafe keyed hashes, use HMAC | rdist[END_REF].

The attacker can perform the following steps. Suppose Alice sends (message M, hash value h) as a pair to Bob. Let us assume that the attacker has access to the message and its hash, then, he can easily calculate, from this pair, a new hash value h , which is as follows :

1. Pad the message M with an arbitrary extended message EM with a length equal or multiple of a size block.

2. Set the digest h as the secret key.

Calculate the new hash value h corresponding to (M||EM).

This means that h is used as the key for the added block(s) of (M||EM).

Substitute (M, h) pair by (M||EM, h

) and send it to Bob as a valid signature (Fig. 3.15).

In our proposed hash functions, the secret key K is not pre-pended to the message M but used as an input for the Chaotic System to produce the necessary supplies to CNN. Then, such an attack can not be conducted.

FIGURE 3.15 -Hash length extension attack

Meet-in-the-middle preimage attack (MITM) [START_REF] Lei | Improved meet-in-the-middle cryptanalysis of KTANTAN (poster)[END_REF][START_REF] Kazumaro | Meet-in-the-middle preimage attacks against reduced SHA-0 and SHA-1[END_REF] The meet-in-the-middle preimage attack is a generic cryptanalytic approach that is originally applied to the cryptographic systems based on block ciphers (Chosen plain-text attack). In 2008, Aoki and Sasaki [START_REF] Kazumaro | Meet-in-the-middle preimage attacks against reduced SHA-0 and SHA-1[END_REF] noticed that the MITM attack could be applied to hash functions, to find preimage, second preimage, or collision for intermediate hash chaining values instead of the hash value h. This attack has successfully broken several designs : the MD hash family includes MD5 [START_REF] Sasaki | Finding Preimages in Full MD5 Faster Than Exhaustive Search[END_REF], round-reduced SHA-0, and SHA-1 [START_REF] Kazumaro | Meet-in-the-middle preimage attacks against reduced SHA-0 and SHA-1[END_REF], round-reduced SHA-2 [START_REF] Kazumaro | Preimages for Step-Reduced SHA-2[END_REF], some Davies-Meyer hash constructions, e.g., Tiger [START_REF] Jian | Advanced meet-in-the-middle preimage attacks : first results on full Tiger, and improved results on MD4 and SHA-2[END_REF],

reduced HAS-160 [START_REF] Deukjo | Improved Preimage Attack for 68-Step HAS-160[END_REF] and HAVAL [START_REF] Sasaki | Preimage attacks on 3, 4, and 5-pass HAVAL[END_REF]. The steps of MITM attack, illustrated in Fig. 3.16 for a given secret key K, can be explained as follows :

1. Use the hash function H to calculate the hash value h of a message M that is divided into q fixed-size blocks.

2. Split the chain hash function in two parts, where the first part includes q-2 blocks and the second part includes the last two blocks q-1 and q.

3. Choose a message Q of length q-2 in the form

{Q 1 , Q 2 , ..., Q q-2 }.
4. Compute the hash value KQ q-2 of the chosen message using H.

5. Generate 2 u/2 random blocks B X . For each generated block B X i (instead of M q-1 ), start computing (from the splitting point) to generate the chaining hash value : KQ q-1,i = C(B X i , KQ q-2 ), i = 1, 2, ..., 2 u/2 , which forms a list L B X containing all the computed chaining values (KQ q-1,i ) X , i = 1, 2, ..., 2 u/2 at the matching point.

6. Generate 2 u/4 random blocks B Y . For each generated block B Y j , j = 1, ..., 2 u/4 (instead of M q ), start calculating KQ q,k (k = 1, 2, ..., 2 u/4 ) with KQ q,k = C(B Y j , KQ q-1,k ) (k = 1, 2, ..., 2 u/4 ). Then form a list L B Y j,k containing the chaining values of (KQ q-1, j,k ) Y (k = 1, 2, ..., 2 u/4 ). Then, L B Y is compared to L B X to find a collision at the matching point.

7. If a collision is found, then form the message {Q 1 , Q 2 , ..., Q q-2 , B X i , B Y j } that gives the desired hash value h and, therefore, use it to produce the same digital signature. Otherwise, repeat the above six steps with a different chosen message

{Q 1 , Q 2 , ..., Q q-2 }.
The probability that one element

{KQ q-1, j,k } Y from L B Y matches one element {KQ q-1,k } X from L B X is equal to 1 2 u/2 . Otherwise, the probability is (1 -1 2 u/2
). For all the elements of L B Y , the probability that none of them are equal to an element of B X , is (1 -1 2 u/2 ) 2 u/2 . Given that, (1x) ≤ e -x , the previous expression can be approximated by : (e -1/2 u 2 ) 2 u/2 = e -1 . Then, the probability that one intermediate matching value occurs is :

P = 1 -e -1 = 0.632 (3.26)
As our hash functions are preimage resistant, the effort to succeed the meet-in-the-middle attack with probability 0.632 is 2 u/2 . Joux attack [START_REF] Antoine | Multicollisions in iterated hash functions. Application to cascaded constructions[END_REF] A collision attack takes time of order 2 u/2 (sec. 3.3.3.1). A multi-collision attack means that a set of messages that all have the same hash value h. In 2004, Joux showed that searching multi-collisions is not so hard when it comes to finding ordinary collision. Indeed, he demonstrated that finding 2 t collisions cost only about t times a single collision attack, t ×2 u/2 instead of 2 u(2 t -1)/2 t evaluations [START_REF] Stefan | Design Principles for Iterated Hash Functions[END_REF]. To illustrate this relation, let we show how 4 collisions (t = 2) can be obtained with only two calls of a collision finding machine. This collision finding machine uses birthday attack algorithm. For a given secret key K, a first call to the collision finding machine generates two different blocks M 1 and M 1 that yield a collision :

KM 1 = C(M 1 , K) = C(M 1 , K).
Then, a second call to the same collision finding machine locates two other blocks M 2 and M 2 such that C(M 2 , KM 1 ) = C(M 2 , KM 2 ). When putting these two steps together, we obtain the following 4 collisions :

C(M 2 ,C(M 1 , K)) = C(M 2 ,C(M 1 , K)) = C(M 2 ,C(M 1 , K)) = C(M 2 ,C(M 1 , K)).
Joux claimed that this basic idea can be extended to much larger collisions by using more calls to the collision finding machine. More precisely, using t calls, we can build 2 t -collision for a given hash function H. All of the 2 t hashing processes go through KM 1 , KM 2 , ..., KM t . A schematic representation of these 2 t blocks together with their common intermediate hash values is drawn in Fig. 3.17. Furthermore, Joux observed that, for two independent hash functions H and G and a given message M with H(M) = h and G(M) = g, the concatenation of the two obtained hash values (h||g) is not more secure against collision attacks, preimage resistance attack, and second preimage attack than any of the two hash functions taken separately. The Long message second preimage attack [START_REF] John | Second preimages on n-bit hash functions for much less than 2 n work[END_REF] and the Herding attack [START_REF] John | Herding hash functions and the Nostradamus attack[END_REF] are closely related to the Joux attack. For the first kind of attack, the attacker can find a second preimage for a message M of 2 b blocks with b × 2 u/2+1 + 2 u-b+1 effort. For the second attack, the needed work by the attacker to find 2 t collisions is 2 u-t-1 + 2 u/2+t/2+2 + t × 2 u/2+1 .

Speed analysis

We evaluated the computing performance of the two proposed hash functions with their output schemes for different message lengths. For this purpose, we calculated the average hashing time HT (micro second), the average hashing throughput HTH (MBytes/second) and the needed number of cycles to hash one Byte NCpB (cycles/Byte).

HT H (MBytes/s) = Message size(MBytes) Average hashing time(s)

NCpB (cycles/Byte) = CPUspeed(Hz) HT H(Byte/s)

We used a computer with a 2.6 GHZ Intel core i5-4300M CPU with 4 GB of RAM running Ubuntu Linux 14.04.1 (32-bit). In Tables 3.17, 3.18, and 3.19, the average HT, the average HTH, and the average NCpB for the two structures with their output schemes are presented. It was observed that, irrespective of the output schemes, the computing performance of Structure 2 is approximately twice better than the computing performance of Structure 1, even for n r = 24 rounds. To focus more on these results, the HTH for the two structures with their output schemes 3.18 were drawn in figure 3.18.

The variation of computing performance according to the size of the message is due to the transition phase of both chaotic system and chaotic activation function of a neuron. Indeed, the cost of the transition phase is approximately equal 2× tr ×4 = 240 Bytes for Structure 1 (tr = 30) and 160 Bytes for Structure 2 (tr = 20) in our implementation. We compared the performance of the proposed hash functions with some hash functions of literature in terms of statistical analysis and NCpB. Table 3.20 presents the comparison with chaos-based hash function in terms of collision resistance for MP output scheme with 2048 tests. As we can see, except Li et al. [START_REF] Yantao | Parallel Hash function construction based on chaotic maps with changeable parameters[END_REF] our obtained results are more close to the expected values. Table 3.21, additionally, presents the comparison of statistical results of diffusion. We observed that the obtained results for all cited references are closed to the expected values. It should be noted that besides the two references [START_REF] Jiteurtragool | A topologically simple keyed hash function based on circular chaotic sinusoidal map network[END_REF][START_REF] Asgari | A novel keyed parallel hashing scheme based on a new chaotic system[END_REF], all the other references in Tables 3.20 and 3.21 present structures that work with hash value h = 128 bits. For comparison purposes, we took the 128 LSB hash values. The speed performance, in terms of the number of cycles to hash one Byte (NCpB), of the proposed 3.20 -Comparison in terms of collision resistance of the proposed structures with MP output scheme with some chaos-based hash functions keyed chaos-based hash functions is compared to that of some chaos-based hash functions of literature and with the main standards of the unkeyed and keyed hash functions, which are presented in Tables 3.24

and 3.25, respectively. We observed that the NCpB of the Structure 2 is approximately twice as fast as the best NCpB obtained by [START_REF] Sen | Parallel chaotic hash function based on the shuffle-exchange network[END_REF], but it is a little bit slower than the SHA-2's NCpB and approximately four times slower than the main keyed hash functions.

Conclusion

We realized and analyzed the security and computation performance of the two keyed chaotic neural network hash functions, based on Merkle-D åmgard construction with three output schemes MMO, MMMO, and MP. The obtained results quantified the robustness of the proposed hash functions for using them in data integrity, message authentication, and digital signature applications. The very good performance is due to the strong one-way property of the combined chaotic system with neural network structure. Indeed, the neuron's activation functions are based on a secure and efficient chaotic generator.

Compared to some chaos-based hash functions of literature, the proposed CNN hash functions are more robust and show good results in terms of computation performance. 256 bits [START_REF] Andrey | SPONGENT : A lightweight hash function[END_REF]. However, each of the three lightweight functions has unique characteristics, and none seems to dominate on all aspects [START_REF] Tolga | On the implementation aspects of sponge-based authenticated encryption for pervasive devices[END_REF]. For example, PHOTON and SPONGENT build the permutation function f on highly optimized block cipher, and have slightly lower memory footprints. Whereas, QUARK is inspired by the stream cipher GRAIN, and the block cipher KATAN. However, SPONGENT has a significantly lower throughput than QUARK and PHOTON, while PHOTON appears to have a lower security margin. Thus, the necessity of a new hash function based on Sponge construction, with strong level security and high throughput, has arisen [START_REF] Nabil | New keyed chaotic neural network hash function based on sponge construction[END_REF]. With Sponge construction, hash value length can vary, based on user demand [START_REF] Guido | Cryptographic sponge functions[END_REF].

Hash function

In this chapter, we propose two robust keyed hash functions based on Sponge construction that contains a Chaotic System (CS) and a CNN, where the input message M is hashed to a hash value h of fixed bit In the next sub-section, we describe the general structure of the two proposed keyed-Sponge CNN hash functions.

Description of the general structure of the two proposed keyed-Sponge CNN hash functions

The general architecture of the proposed keyed-Sponge CNN hash functions (KSCNN[c](M 01, u))

is composed of three phases : Initialization phase, Absorbing phase, and Squeezing phase (see Fig. 4.1).

Initialization phase

This phase determines the values of r and c according to Table 4.1, and initializes the initial value IV = HM 0 to 0, and the secret key K = KM 0 . Also, in this phase, the input message M is appended by the suffix 01, padded using the function Pad (explained below), and divided into q blocks M i , (i = 1, ..., q)

of r-bit size, each block.

For both structures (1 and 2), we adopt the same values of r and c as the standard SHA-3 : for 256-bit hash value, c equal to 512 bits (like SHA3-256), and for 512-bit hash value, c equal to 1024 bits (like SHA3-256).

HM 0 ← 0 b for i = 1 to q do h i-1 ← HM i-1 ⊕ (M i 0 c )) HM i ← C f i (KM i-1 , h i-1 ) end for Return ( h q ) u .

Squeezing phase

When the desired hash value length u is greater than the width b (u > b), the squeezing phase is used. In this case, the hash value h q of b-bit size produced by the absorbing phase is used as a unique input to the squeezing phase, and the obtained hash values HM i , (i ≥ q) are sequentially forwarded to C f i , (i ≥ q + 1).

For each HM i , (i ≥ q), the Most Significant r bits are extracted to Z j , ( j ≥ 1), and the Least Significant 128 bits are extracted to form the key KM i , (i ≥ q) for the CS of each C f i , (i ≥ q + 1). Finally, the concatenation of all obtained values Z j , ( j ≥ 1) of r-bit size constitute the final hash value h of the desired length u bits, as given by the following equation :

h = Z 1 ||Z 2 ||Z 3 ||... = ( HM q ) r ||( HM q+1 ) r ||( HM q+2 ) r ||... (4.3)
Below, we give the pseudo-code of the squeezing phase :

Algorithm 13 The squeezing phase

Require : u > b Z 1 ← ( HM q ) r j ← 2 h ← Z 1 for i = q+1, ... do while u > |h| do h i-1 ← HM i-1 HM i ← C f i (KM i-1 , h i-1 ) Z j ← ( HM i ) r h ← h Z j j ← j + 1 end while end for Return ( h ) u .
In the next sub-section, we describe the proposed CS used in the Chaotic functions C f i , (i ≥ 1) to generate the necessary parameters and initial conditions for CNN. Indeed, the neurons of the two layers adopt the same activation function with different inputs. For each h i , (i = 0, ..., q -1) at the input layer, each input neuron has 10 input data (Fig. 4.3 and Fig. 4.4). For each neuron (k = 0, ..., 4), the first five inputs P j , ( j = 10k, ..., 10k + 4) are weighted by the W I j , ( j = 10k, ..., 10k + 4) and then added together with the bias BI k (weighted by 1) to form the input of DSTmap.

The second five inputs P j , ( j = 10k + 5, ..., 10k + 9) are weighted by W I j , ( j = 10k + 5, ..., 10k + 9) and then added together with the same bias BI k to form the input of DPWLCmap. All inputs P j , weights W I j and biases BI k are samples (integer values) of 32 bits length. The biases BI k , (k = 0, ..., 4) are necessary in case the input message is constant (see Fig. 4.4). QI k,1 and QI k,2 are the control parameters of DSTmap and DPWLCmap, that are defined by equations 3.5 and 3.8 in chapter 3, respectively.

After computation, the two outputs of chaotic maps DSTmap and DPWLCmap are xored together to generate the output of neuron denoted by C k , (k = 0, ..., 4), which is given by equation (4.6) :

C k = mod{[F1 + F2], 2 N } where        F1 = DST map{mod([ 10k+4 ∑ j=10k (W I j × P j )] + BI k , 2 N ), QI k,1 } F2 = DPW LCmap{mod([ 10k+9 ∑ j=10k+5 (W I j × P j )] + BI k , 2 N ), QI k,2 } (4.6)
For the output layer, each neuron has 5 input data : WO k, j ×C j , (k = 0, ..., 7; j = 0, ..., 4), where k represents the index of output neuron, j represents the index of input neuron, C j , ( j = 0, ..., 4) are the outputs of input layer, and WO k, j , (k = 0, ..., 7; j = 0, ..., 4) are the weights associated with the connections between input and output layers. C j , ( j = 0, ..., 4) and WO k, j , (k = 0, ..., 7; j = 0, ...

H k = mod{[G1 + G2, 2 N ]} where        G1 = DST map{mod([ 2 ∑ j=0 (WO k, j ×C j )] + BO k , 2 N ), QO k,1 } G2 = DPW LCmap{mod([ 4 ∑ j=3 (WO k, j ×C j )] + BO k , 2 N ), QO k,2 } (4.7)
Here also, the biases BO k , (k = 0, ...

                                 H 0 = D 0 ⊕ t1 ⊕ Ma j(D 1 , D 2 , D 3 ) ⊕ Σ0(D 1 ) H 1 = t1 ⊕ D 0 H 2 = D 0 ⊕ D 1 , H 3 = D 1 ⊕ D 2 , H 4 = D 2 ⊕ D 3 H 5 = D 0 ⊕ D 1 ⊕ t1 H 6 = D 1 ⊕ D 2 ⊕ t1 H 7 = D 2 ⊕ D 3 ⊕ t1 where t1 = Ch(D 1 , D 2 , D 3 ) ⊕ D 4 ⊕ Σ1(D 3 ) (4.10)
D k , (k = 0, ..., 4) are truncated to 32-bit length and and H k , (k = 0, ..., 7) are values of 32-bit length.

The four NL functions (Ch, Maj, Σ0 and Σ1) are defined as follows :

                     Ch(D 1 , D 2 , D 3 ) = (D 1 ∧ D 2 ) ⊕ (¬D 1 ∧ D 3 ) Ma j(D 1 , D 2 , D 3 ) = (D 1 ∧ D 2 ) ⊕ (D 1 ∧ D 3 ) ⊕ (D 2 ∧ D 3 ) Σ0(D 1 ) = ROT R 2 (D 1 ) ⊕ ROT R 13 (D 1 ) ⊕ ROT R 22 (D 1 ) Σ1(D 3 ) = ROT R 6 (D 3 ) ⊕ ROT R 11 (D 3 ) ⊕ ROT R 25 (D 3 ) ROT R n (x) = (x n) ∨ (x (32 -n)) (4.11)
where ∧ : AND logic, ¬ : NOT logic, ⊕ : XOR logic, ∨ : OR logic, : Binary Shi f t Right operation and : Binary Shi f t Le f t operation.

Performance analysis

In order to evaluate the performance in terms of security and number of needed cycles per Byte of KSCNN[512] and KSCNN[1024], we applied the same required experiments and analysis as done in chapter 3. Also, the obtained performances are compared with the standard SHA-3. First, the one-way property (preimage resistance) of the proposed structures is analyzed. Then, statistical tests such as, the collision resistance, the distribution of hash value, the sensitivity of hash value to the message and to the secret key, and the diffusion effect are evaluated. Also, the immunity of these structures against the bruteforce and cryptanalytical attacks is studied. A detailed description of these tests is provided in chapter 3.

For that, in this section we just resume the necessary test description to interpret its obtained results.

One-way property

On average, an attacker needs 2 u-1 values of the message, to retrieve the hash value h of length u equal to 256 or 512 bits. With such lengths, nowadays, this attack is infeasible [START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF][START_REF] Xun | Hash function based on chaotic tent maps[END_REF][START_REF] Shiguo | Secure hash function based on neural network[END_REF][START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF].

Statistical tests

In this sub-section, we perform and analyze the following statistical tests.

Analysis of collision resistance

The theoretical number of tests with a number of hits ω = 0, 1, 2, ..., s, are represented in Tables 4.2 and 4.3 for 256 and 512 bits hash value lengths, respectively.

The obtained results in Table 4.4, for the two lengths of hash values, the number of rounds n r = 8 and n r = 24 give the best results. Indeed, for 256-bit hash value length with n r = 8, there are zero hits for 1787 tests, one hit for 244 tests, and two hits for 17 tests. For n r = 24, there are zero hits for 1824 tests, one hit for 213 tests, and two hits for 11 tests. Similar behavior is obtained for 512-bit hash value length with a slight increase in the number of hits. In Table 4.5, we resume the obtained number of hits ω = 0, 1, 2, 3, 4 for the two proposed structures. As expected, we obtain comparable results. From the obtained results, we observe that the mean/character values are close to the expected values that are equal to 85.33 for 256-bit hash value length (L = 256) and equal to 170.66 for 512-bit hash value length [START_REF] Bart | Analysis and design of cryptographic hash functions[END_REF].

Distribution of hash value

We evaluate the hash value h of the same message given in chapter 3, for Structures 1 and 2 with 256-bit and 512-bit hash value lengths. In Fig. 4.8, we show the ASCII values of the message M (Fig. 4.8a), and its hexadecimal hash value h (Fig. 4.8b) according to their index positions.

As expected, the distribution of hexadecimal hash value looks like a mess, while the distribution of the original message is located around a small area. Even under the worst case of constant input message such as "00...0" (Fig. 4.8c), the distribution of the hash value h (Fig. 4.8d) is also verified. Similar results are obtained for the two proposed structures with their two variant hash output lengths. To quantify the performance of the two proposed structures with their variants of hash output lengths 256, and 512 bits, we compute the six following statistical tests :

Number of hits

1. Minimum number of bits changed (bits).

2. Maximum number of bits changed (bits).

3. Mean number of bits changed (bits).

4. Mean changed probability (mean of HD i (%)) (%).

5. Standard variance of the changed bit number. Additionally, we can observe that the diffusion is extremely stable, whatever the hash value length and the used structure, because both B and P are very close to the ideal values ( B = 128 bits for 256-bit hash value length, B = 256 bits for 512-bit hash value length, and P = 50% for all structures), while ∆B and ∆P are very small. For different number of tests (J = 512, 1024, and so on), similar results are obtained for the two structures with their different hash value lengths. Also, to show that the values of B i are centered on the ideal values 128 bits and 256 bits (for u = 256 bits and u = 512 bits, respectively), we draw the two histograms B i (see Fig. 4.9 and Fig. 4.10) of Structure 1. We obtain similar results for Structure 2.

Cryptanalysis

In the literature, exist known attacks, which can be applied to unkeyed or keyed hash functions.

Bertoni et al. [START_REF] Guido | Sponge functions[END_REF] demonstrate the dependency of these attacks on the hash value length u for the unkeyed hash function and on the hash value length u and the secret key length |K| for the keyed hash function. In the Second preimage attack, the attacker knows the hash value h for a given message M, and tries to find another message M that generates the same hash value h. For these two attacks, the smaller expected workload required by an attacker to break the collision resistance property is approximately 2 u .

In conclusion, to realize the attack on the hash value for the two proposed structures with the minimum length used (u = 256 bits), the minimum workload required by an attacker is 2 128 attempts, which is infeasible.

Cryptanalytical attacks

The cryptanalytical attacks try to find specific weaknesses in the structure of a hash function, and perform on it some attacks, with an amount of effort less than the brute force attack. In the following paragraphs, we consider the two most common cryptanalytic attacks of the literature on the proposed hash functions [START_REF] Bart | On the security of two MAC algorithms[END_REF][START_REF] Deniz | Cryptanalysis of Hash Functions[END_REF]

Herding attack

Length extension attack [START_REF]Hash Length Extension Attacks | Java Code Geeks[END_REF][START_REF]MD5 Length Extension Attack Revisited | Vũ's Inner Peace[END_REF] In our proposed hash functions, the secret key K is not pre-pended to the message M, but used as an input for the CS to produce the necessary supplies to CNN. Then, such an attack cannot be conducted.

Meet-in-the-middle preimage attack (MITM) [START_REF] Lei | Improved meet-in-the-middle cryptanalysis of KTANTAN (poster)[END_REF][START_REF] Kazumaro | Meet-in-the-middle preimage attacks against reduced SHA-0 and SHA-1[END_REF] The Meet-in-the-middle preimage attack is a generic cryptanalytic approach, originally applied to the cryptographic systems based on block ciphers (chosen-plaintext attack). In 2008, Aoki and Sasaki [START_REF] Kazumaro | Meet-in-the-middle preimage attacks against reduced SHA-0 and SHA-1[END_REF] noticed that the MITM attack could be applied to hash functions, to find preimage, second preimage, or collision for intermediate hash chaining values instead of the hash value h. This attack has successfully broken several designs. As our hash functions are preimage resistant, the minimum effort (with u = 256 bits) to succeed the Meet-in-the-middle attack with probability 0.632 is 2 u/2 = 2 128 tries.

Joux attack [START_REF] Antoine | Multicollisions in iterated hash functions. Application to cascaded constructions[END_REF] Joux claimed that, using t calls, we can build 2 t -collision for a given hash function H. Furthermore, Joux observed that, for two independent hash functions H and G and a given message M with H(M) = h and G(M) = g, the concatenation of the two obtained hash values (h||g) is not more secure against collision attacks, preimage resistance attack, and second preimage attack than any of the two hash functions taken separately. For the Long message second preimage attack [START_REF] John | Second preimages on n-bit hash functions for much less than 2 n work[END_REF], the attacker can find a second preimage for a message M of 2 b blocks with b × 2 u/2+1 + 2 u-b+1 effort. For the Herding attack [START_REF] John | Herding hash functions and the Nostradamus attack[END_REF], the needed work by the attacker to find 2 t collisions is 2 u-t-1 + 2 u/2+t/2+2 + t × 2 u/2+1 .

Speed analysis

We estimate the computing performance of the two proposed structures with their hash value lengths for different message lengths. Then, the average hashing throughput HTH (MBytes/second) and the needed number of cycles to hash one Byte NCpB (cycles/Byte) are calculated as follows :

HT H (MBytes/s) = |M|(MBytes) HT (s) (4.12)

NCpB (cycles/Byte) = CPUspeed(Hz) HT H(Byte/s) (

where HT (second) is the average hashing time.

The calculation is done in C code, using a computer with a 2.9 GHZ Intel core i7-4910MQ CPU with 4 GB of RAM running Ubuntu Linux 14.04.1 (64-bit) operating system. We give in Tables 4.12, and 4.13, the average HT, the average HTH, and the average NCpB for the two structures with their hash value lengths. When the overhead related to the structures becomes negligible (from 10000 data bytes), we observe that whatever the length of the hash values (256 or 512 bits), the hash throughput of Structure 2 is just over twice compared to Structure 1. Also, we remark that whatever the structure, the hash throughput with 256-bit hash value length (in this case r = 1088 bits) is approximately twice with 512bit hash value length (in this case r = 576 bits). Indeed, when r is increased the hash time of the absorbing phase is decreased. Additionally, we show in Fig. 4.11 the HTH for the two structures with their hash value lengths. We give below the computing performance comparison of our proposed hash functions with the standard hash function SHA-3 in terms of robustness and speed. To the best of our knowledge, we mention that we do not find until now any work about chaos-based hash function using Sponge construction in the literature. In Tables 4.14, 4.15, 4.16, 4.17, and 4.18, we compare the obtained statistical results (collision resistance, diffusion, and message sensitivity) of our proposed chaos-based hash functions with the standard SHA-3 for the two hash output lengths 256 and 512 bits. After carefully analyzing the values of these tables, we can conclude that all our obtained statistical results are close to those of standard SHA-3.

In Table 4.19, we give a comparison in terms of the needed number of cycles to hash one byte (NCpB) of the proposed chaos-based hash functions with the standard SHA-3 for 2048 tests. We observe that globally the performance of SHA-3 in terms of NCpB is better than that obtained by the proposed chaosbased hash functions. For example, for the long messages (1 MB), the NCpB obtained by SHA-3, whatever the hash length value, is 7 times less than the NCpB of the structure 1, but is only less than 3 times of the NCpB obtained by Structure 2n r = 8. However, our simulations were done in sequential implementation without optimization. So, with a parallel implementation (with 50 output neurons) using optimized calculation, the performance computing will be at least similar to that of SHA-3. It can be even better than that of SHA-3 when using Structure 2n r = 8.

Hash function

Conclusion

We designed, implemented and analyzed the security and computing performance of the two proposed keyed CNN hash functions based on Sponge construction with two hash output lengths 256 and 512 bits. The obtained results, in terms of statistical analyses and cryptanalytical attacks, are similar to those obtained by the standard SHA-3. For the computing performance, the obtained results of our proposed structures are less than the standard SHA-3 due to the sequential implementation. In parallel implementation, using 50 output neurons, the computing performance of Structure 2n r = 8 will be better than the standard SHA-3. Then, the proposed keyed-Sponge CNN hash functions can be used in data integrity, message authentication, and digital signature applications. Our future work will focus on the XOFs, based on the the keyed-Sponge CNN (CNN-SHAKE), where the hash output length will be variable. Also, we will implement a new duplex construction based on CNN (CNN-DUPLEX) that will be used in authenticated encryption application.

Chapter 5

Duplex construction-based chaotic neural networks for authenticated encryption

Work under construction

In this chapter, we are currently working on the design of a CNN-DUPLEX structure (see Fig. 5.1) which allows the alternation of input and output blocks at the same rate as the Sponge construction, similar to a full-duplex communication (one call to the chaotic function per input block) [START_REF] Guido | Permutation-based encryption, authentication and authenticated encryption[END_REF][START_REF] Guido | Cryptographic sponge functions[END_REF]. This work will be adapted for using in Authenticated Encryption with Associated Data (AEAD) applications, and will be published as a new research paper in a journal with impact factor. été préparé (opération pad), est divisé en q blocs M j , ( j = 1, . . . , q) de taille fixe |M j | bits chacun (dans notre cas, nous avons choisi |M j | = 2048 bits). La fonction de compression de la structure Merkle-D åmgard est représentée par la fonction C qui prend en entrée un couple de deux variables la valeur d'état h i , (i = 0, . . . , q -1) (appelée variable de chaînage ou haché intermédiaire) et le bloc de message M j , ( j = 1, . . . , q) de taille 2048 bits. Pour i=0, h0 est une valeur initiale, notée IV (pour Initial Value en anglais).

Pour chaque couple d'entrée (h i , M j ) où i = 0, . . . , q -1 et j = 1, . . . , q, la fonction de compression C, calcule de manière itérative une nouvelle variable d'état h j , ( j = 1, . . . , q) de taille 256 bits.

Une fois tous les blocs du message traités, la dernière valeur de chaînage h q désignera le haché du message M. Il est aussi possible d'appliquer à h q une fonction de finalisation O afin d'obtenir la valeur du haché final h.

Analyse des Performances

Nous avons estimé les performances de deux fonctions de hachage à clé proposées, en termes de sécurité et de débit, et nous présentons ci-dessous quelques résultats obtenus par les deux structures proposées.

Dans les Tables A.3 et A.4, nous donnons le nombre de collisions w (hits) et les résultats statistiques de la diffusion respectivement pour la première structure avec les deux longueurs de hachage. Dans la figure A.10, nous montrons les distributions du haché du message entier et du message constant "00...0", pour la première structure avec une longueur de hachage égale à 512. Enfin, nous avons comparé les résultats obtenus à d'autres fonctions de hachage de la littérature, ainsi qu'au standard SHA-3.

Output schemes

Number

  Conclusions and PerspectivesA Synthèse des travaux réalisés : Conception, mise en oeuvre et analyse de fonctions de hachage avec clé basées sur des cartes chaotiques et des réseaux neuronaux A.1 Contexte et objectifs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2.1 1 ère contribution : conception, mise en oeuvre et analyse de fonctions de hachage basées sur des cartes chaotiques et des réseaux neuronaux utilisant la construction de Merkle-D åmgard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2.1.1 Fonction de hachage chaotique CNN à clé construite avec deux couches A.2.1.2 Fonction de hachage chaotique CNN à clé construite avec une couche neuronal suivie par une couche formée d'une combinaison des fonctions non-linéaires . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2.2 2ème contribution : conception, mise en oeuvre et analyse de fonctions de hachage avec clé basées sur des cartes chaotiques et des réseaux neuronaux en utilisant la construction d'Éponge . . . . . . . . . . . . . . . . . . . . . . . . . A.2.2.1 Fonction de hachage chaotique CNN à clé basée sponge construite avec deux couches . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2 . 2 8 109 4. 4 110 4. 5 110 4. 6 112 4. 7 113 4. 8 118 4. 9 123 5. 1 127 A. 1 135 A. 2 136 A. 3 137 A. 4 138 A. 5 99 4. 1 104 4. 2 114 4. 3 114 4. 4 115 4. 5 116 4. 7 116 4. 9

 228109411051106112711381189123112711352136313741385991104211431144115511671169 scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8 Sensitivity of hash value to the message for the proposed structures with MMMO output scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9 Sensitivity of hash value to the message for the proposed structures with MP output scheme 3.10 A comparison of average B i and HD i (%) for message sensitivity . . . . . . . . . . . . . 3.11 Sensitivity of hash value to the secret key for the proposed structures with MMO output scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12 Sensitivity of hash value to the secret key for the proposed structures with MMMO output scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13 Sensitivity of hash value to the secret key for the proposed structures with MP output scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.14 A comparison of average B i and HD i (%) for key sensitivity . . . . . . . . . . . . . . . . 3.15 Diffusion statistical-results for the two proposed structures . . . . . . . . . . . . . . . . 3.16 Diffusion statistical-results for the two proposed structures with MP output scheme . . .

1. 2 .

 2 Cryptography : foundation and basic concepts 1. Non-cryptographic hash functions including Cyclic Redundancy Checks (CRC) and checksum functions such as, CRC-64, sum32, Adler-32, ... 2. Cryptographic hash functions including keyed and unkeyed hash function such as, Message Digest MD5, Secure Hash Algorithms SHA-2 and SHA-3, Cipher Block Chaining Message Authentication Code CBC-MAC, Hash Message Authentication Code HMAC, ...

1 . 4 )

 14 and the model of Strengthened Merkle-D åmgard (Fig. 1.5).

FIGURE 1 . 2 -

 12 FIGURE 1.1 -Hash function

FIGURE 1 . 3 -

 13 FIGURE 1.3 -Classification of cryptographic hash functions

FIGURE 1 . 4 -FIGURE 1 . 5 -

 1415 FIGURE 1.4 -Strengthened Merkle-D åmgard construction

4 )FIGURE 1 . 6 -

 416 FIGURE 1.6 -The three methods of one-way compression function

FIGURE 1 . 7 -

 17 FIGURE 1.7 -One iteration in a SHA-2 family compression function

Chapter 1 -FIGURE 1 . 8 -FIGURE 1 . 9 -

 11819 FIGURE 1.8 -General structure of the Sponge construction

64 -

 64 bit units are referred to as lanes. The notation a [x, y, z] refers to an individual bit with the state array. (Note that the first index x designates a column and the second index y designates a row). Within a lane are labeled z = 0 through z = 63. The mapping between the bits of s and those of a is s [64(5y + x) + z] = a [x, y, z] (see Fig. 1.10). The block transformation f, which is Keccak-f [1600] for SHA-3, is a permutation that uses XOR, AND and NOT operations, and is designed for easy implementation in both software and hardware. The basic block permutation function consists of 12 + 2l rounds of five steps. The five step mappings that comprise a round of KECCAKp[b, n r ] are denoted by θ , ρ, π, χ, and ι. The algorithm for each step mapping takes a state array, denoted by A, as an input and returns an updated state array, denoted by A , as the output. The size of the state is a parameter that is omitted from the notation, because b is always specified when the step mappings are invoked. The ι mapping i r has a second input : an integer called the round index, denoted by i r . The other step mappings do not depend on the round index.

FIGURE 1 . 10 -

 110 FIGURE 1.10 -Parts of the state array, organized by dimension

  (x, y) = (y, (2x + 3y)mod 5) end for Return A .

FIGURE 1 . 12 -

 112 FIGURE 1.12 -Illustration of ρ for b = 200

Chapter 1 - 3 Algorithm 7

 137 A brief review of standard hash functions SHA-2 and SHA-Specification of π(A) Input state array A. Output state array A . Steps for all triples (x, y, z) such that 0 ≤ x ≤ 5, 0 ≤ y ≤ 5, and 0 ≤ z ≤ w do A [x, y, z] = A[(x + 3y)mod 5, x, z] end for Return A .

FIGURE 1 . 13 -Algorithm 8

 1138 FIGURE 1.13 -Illustration of π applied to a single slice

FIGURE 1 . 14 -

 114 FIGURE 1.14 -Illustration of χ applied to a single row

FIGURE 2 . 1 -

 21 FIGURE 2.1 -General structure of neural networks

F

FIGURE 2 . 2 -

 22 FIGURE 2.2 -Mathematical model of a neuron i

FIGURE 3 . 1 -

 31 FIGURE 3.1 -The proposed Merkle-D åmgard compression functions based on CNN with output schemes

3. 2 .FIGURE 3 . 2 -

 232 FIGURE 3.2 -The padding of input message in the proposed hash functions

(3. 5 ) 3 . 2 .

 532 Chaotic Neural Network structure of the proposed keyed hash functions 63

FIGURE 3 . 3 -

 33 FIGURE 3.3 -The structure of the Chaotic System

FIGURE 3 . 4 -FIGURE 3 . 5 -FIGURE 3 . 6 - 1 FIGURE 3 . 7 -

 343536137 FIGURE 3.4 -The structure of the i th block in the proposed keyed hash function based on two-layer CNN with MP output scheme

  10) where |W I| = 64 samples, |BI| = 8 samples, |QI| = 16 samples, |WO| = 64 samples, |BO| = 8 samples, and |QO| = 16 samples, each of the 32 bits length.

. 14 )FIGURE 3 . 8 -

 1438 FIGURE 3.8 -Non-linear functions

  samples (3.16) where |W I| = 64 samples, |BI| = 8 samples, |QI| = 16 samples, and |WO| = 8 samples, each of 32 bits length. The outputs C k , (k = 0, ..., 7) of the chaotic activation function given by equation 3.11 are weighted by WO k,k , (k = 0, ..., 7) to form the inputs of the NL layer. The outputs H k , (k = 0, ..., 7) are

Chapter 3 -FIGURE 3 . 9 -FIGURE 3 . 10 -

 339310 FIGURE 3.9 -The proposed keyed hash function based on one-layer NL CNN with MP output scheme

and 3 .TABLE 3 . 1 -

 331 schemes.

FIGURE 3 . 11 -Condition 5 :Condition 6 :

 31156 FIGURE 3.11 -Distribution of hash value for Structure 1 with MP output scheme

Condition 3 :Condition 4 :Condition 5 :

 345 We change the parameter Ks in the secret key. We change the initial condition KSs(-1) in the secret key. We change the control parameter Q1 in the secret key.

FIGURE 3 . 12 -

 312 FIGURE 3.12 -Histogram of B i

Chapter 3 -FIGURE 3 . 13 -

 3313 FIGURE 3.13 -General scheme of hash authentication

4 .FIGURE 3 . 14 -

 4314 FIGURE 3.14 -Second preimage attack on Digital Signature scheme

1 FIGURE 3 .

 13 FIGURE 3.16 -Meet-in-the-middle preimage attack

Chapter 3 -FIGURE 3 . 18 -

 3318 FIGURE 3.18 -Comparison of HTH for Structure 1 and Structure 2n r = 24 rounds with MMO, MMMO, and MP output schemes

Tables 3 .

 3 22 and 3.23 present the comparison of the proposed chaos-based hash functions with standard hash function in terms of collision resistance and diffusion. Aside the values of Structure 2 -n r = 8 rounds, the obtained results are similar to those obtained by standard hash functions.

4. 2

 2 Proposed keyed-Sponge Chaotic Neural Network hash functionsThe proposed keyed-Sponge hash functions introduce the Chaotic functions C f i , (i ≥ 1) that contain a CS and a CNN. These Chaotic functions use a padded block message M i 0 c , (i = 1, ..., q) of size b-bit, a secret key KM 0 of length |K| = 160 bits and subkeys KM i , (i ≥ 1) of length 128 bits to produce hash values with two variant lengths 256 and 512 bits, depending on the values of r and c (see Fig. 4.1). In these structures, we use the CS proposed in section 3.2.3 of chapter 3. The first CNN hash function uses two-layered Neural Network named Structure 1, whereas the second hash function uses one-layered Neural Network followed by a combination of Non-Linear (NL) functions named Structure 2.

FIGURE 4 . 1 -

 41 FIGURE 4.1 -General structure of the two proposed keyed-Sponge CNN hash functions

4. 2 . 2

 22 Keyed-Sponge hash functions based on two-layer CNN structure (Structure 1) The structure of the Chaotic function C f i for KSCNN[512] and KSCNN[1024] is shown in Fig. 4.3. It contains a CNN input layer of five neurons, and a CNN output layer of eight neurons. To supply both these layers, the CS generates the necessary samples (Key Stream (KS)), composed as follows : KS = {W I, BI, QI,WO, BO, QO} (4.4) Its size must be : |KS| = |W I| + |BI| + |QI| + |WO| + |BO| + |QO| = 129 samples (4.5) where |W I| = 50 samples, |BI| = 5 samples, |QI| = 10 samples, |WO| = 40 samples, |BO| = 8 samples and |QO| = 16 samples, each of 32 bits length.

  , 4) both are samples (integer values) of 32-bit length. As shown in Fig. 4.5, the first three inputs C 0 , C 1 and C 2 are weighted by WO k, j , (k = 0, ..., 7, j = 0, ..., 2) and then added together with the bias BO k , (k = 0, ..., 7) (weighted by 1) to form the input of DSTmap. The last two inputs C 3 and C 4 are weighted by WO k, j , (k = 0, ..., 7; j = 3, 4) and then added together with the same bias BO k , (k = 0, ..., 7) to form the input of DPWLCmap. After computation, the two outputs of chaotic maps DSTmap and DPWLCmap are xored together to generate the output of neuron, given by equation (4.7) :

, 7 )

 7 and the control parameters QO k,1 , QO k,2 , (k = 0, ..., 7), used by DSTmap and DPWLCmap, are samples of 32 bits length. The output layer is iterated 7 times to generate the intermediate hash values of length b = 7 × 8 × 32 (by concatenating the values of the output vector H k , (k = 0, ..., 7)).

4. 2 . 3 FIGURE 4 . 3 -

 2343 FIGURE 4.3 -Detailed structure of the i th Chaotic function in the proposed keyed-Sponge two-layered CNN hash function

Chapter 4 -FIGURE 4 . 6 -

 446 FIGURE 4.6 -Detailed structure of NL Functions block

FIGURE 4 . 7 -

 47 FIGURE 4.7 -Detailed structure of the i th Chaotic function in the proposed keyed-Sponge hash function based on one-layered NL CNN

Chapter 4 -FIGURE 4 . 8 -

 448 FIGURE 4.8 -Distribution of hash value for Structure 1 with 256-bit hash value length

FIGURE 4 . 9 -

 49 FIGURE 4.9 -Histogram of B i for Structure 1 with 256-bit hash value length, and J = 2048 tests

FIGURE 5 . 1 -

 51 FIGURE 5.1 -General structure of the Duplex construction

FIGURE A. 1 -FIGURE A. 2 -FIGURE A. 4 -FIGURE A. 6 -

 1246 FIGURE A.1 -Construction de la structure de Merkle-D åmgard

  Initial Value, r: rate, c: capacity,

FIGURE A. 10 -FonctionFIGURE A. 11 -

 1011 FIGURE A.10 -Distributions du haché pour le message entier et le message constant pour la structure 1 avec une longueur de valeur de hachage de 256 bits

TABLE OF CONTENTS

 OF

Table of Contents

 of A.2.

TABLE 1 .

 1 Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3 1 -Essential parameters of the Secure Hash Algorithm SHA-3

	Message Digest Size	224	256	384	512
	Message Size	No max. No max. No max. No max.
	Block Size (bitrate r)	1152	1088	832	576
	Word Size	64	64	64	64
	Number of Rounds	24	24	24	24
	Capacity c	448	512	768	1024
	Collision Resistance	2 112	2 128	2 192	2 256
	Second Pre-image Resistance	2 224	2 256	2 384	2 512

  .5 for J = 2048 tests, we observe that the mean/character value with

the MMO output scheme for Structure 1 (mean/character = 85.04) and Structure 2 -n r = 24 rounds (mean/character = 85.81) are close to the expected value 85. 3 given in equation 3.23. The results presented in Table

3

.6 with J (J = 512, 1024, and 2048 tests) show that, when J is increasing, the mean/character converge to the expected value E. For two hash, i.e., h = {c 1 , c 2 , ..., c s } and h = {c 1 , c 2 , ..., c s }, with independent and uniformly distributed ASCII character having equal probabilities, the expected value of the mean/character is calculated by

TABLE 3 .

 3 2 -Number of hits ω regarding the proposed structures with the three output schemes for 2048 tests

		Output schemes	Number of hits ω
					0	1	2
	Structure 1	MMO		1833 200 15
			MMMO		1799 237 12
			MP		1803 232 13
	Structure 2	MMO		1825 207 15
	n r = 8		MMMO		1800 237 10
			MP		1817 215 16
	Structure 2	MMO		1817 225 6
	n r = 24	MMMO		1810 230 7
			MP		1815 226 7
		Number of tests	Number of hits ω
					0	1	2
	Structure 1	512		444	64	4
			1024		905 111 8
			2048		1803 232 13
	Structure 2	512		446	62	4
	n r = 8		1024		899 117 8
			2048		1817 215 16
	Structure 2	512		452	58	2
	n r = 24	1024		905 116 3
			2048		1815 226 7
	TABLE 3.3 -Number of hits ω of the proposed structures with MP output scheme for J = 512, 1024, and
	2048 tests
				ω
		0	1	2	3	32
	J 512	451.72	56.68	3.44 0.13 4.42 × 10 -75
	1024 903.45 113.37 6.89 0.27 8.84 × 10 -75
	2048 1806.91 226.74 13.78 0.54 1.76 × 10 -74

Condition 1 : The original message M is the one given in Section 3.3.2.2.

TABLE 3 .

 3 [START_REF] Kai | A new digital signature scheme based on chaotic maps[END_REF] -Theoretical values of the number of hits ω according to the number of tests J

		Output schemes Mean Mean/character Minimum Maximum
	Structure 1	MMO	2721.43	85.04	3723
		MMMO	2764.05	86.37	3757
		MP	2633.17	82.28	3779
	Structure 2	MMO	2616.94	81.77	3574
	n r = 8	MMMO	2854.76	89.21	4195
		MP	2861.93	89.43	3951
	Structure 2	MMO	2746.07	85.81	3807
	n r = 24	MMMO	2856.03	89.25	3981
		MP	2615.44	81.73	3671

TABLE 3 .

 3 5 -Mean, Mean/character, Minimum, and Maximum of the absolute difference d for the proposed structures with the three output schemes and J = 2048 tests

		Number of tests Mean Mean/character Minimum Maximum
	Structure 1	512	2637.00	82.40	3779
		1024	2637.99	82.43	3779
		2048	2633.17	82.28	3779
	Structure 2	512	2872.23	89.75	3872
	n r = 8	1024	2868.04	89.62	3951
		2048	2861.93	89.43	3951
	Structure 2	512	2603.32	81.35	3671
	n r = 24	1024	2620.85	81.90	3671
		2048	2615.44	81.73	3671
	TABLE 3.6 -Mean, Mean/character, Minimum, and Maximum of the absolute difference d for the pro-
	posed structures with MP output scheme and J = 512, 1024, and 2048 tests

TABLE 3 .

 3

[START_REF] Nist | standard : Permutation-based hash and extendable-output functions[END_REF]

-Sensitivity of hash value to the message for the proposed structures with MMO output scheme

TABLE 3 .

 3 8 -Sensitivity of hash value to the message for the proposed structures with MMMO output scheme

	Message variants	Hexadecimal hash values	B i	HD i %
	Structure 1	a005e50f9673ecee6e80c07c550e53f8a950cb4a91176a2a340b5822ec2f28c4	-	-
		d4ecfadcc796f46d63762eb8f0c7af6233ded0d61ea901541db1f8890f999755	141	55.07
		3f8b28e72a453ad31e798a60ec46b64ab4eb3e95674b28d535a5d2feb8a7cdd8	139	54.29
		b40f8be0ee3c28fc7c76578d6e8b49f56ea25aa0c2944475691746a7c2f23387	129	50.39
		c0f0b6c0fee17303c94ab30ad6d7b1ecd50d9606e4fab176e726b20a3c229b5d	139	54.29
		551eb7f04ec0ae2f0ceec2bb451a2b67682305697a0ffef418e221bdaad4a09c	129	50.39
	Average	-	135.4 52.89
	structure 8	31882869cce69d7734f0078d29f297841b99d3f9786a1cf522688de9561826ee	-	-
	n r = 8	d8da2ae1aacca231e26931237f8ba1388aef0faf2372dde8876d329564bb4f39	129	50.39
		0b43925c8865869e7dde5c67cfd976f839bd8f5c8fda2814c2c61ce4c926b380	130	50.78
		d9e813e6f36a7a960664ab422b1eb1892be71f43a28229399bdcf51a5ab0df8d	131	51.17
		d0f1dcbf0670f8a3ef2771d0f0d8404c6068ab43b303d1aa9e335d9a757ddb6b	149	58.20
		1441805beb1753d9c81bd16d9059f3f2e57752732c1f2e539ec606555f2d9042 137	53.51
	Average	-	135.2 52.81
	Structure 2	a86e4c2ff1450a08a173b2d9ef27d941fcb9a06f76ad1e70108192ce3cd02a16	-	-
	n r = 24	22e2025f1d0bdb5b20098e8f2d81a63b27e722c9e2eb521e87e00943f7af1dbe	132	51.56
		366d73069aa3e7238773a6ba39bbfc29203f28ffd05f8fec06060ececc54fc2e	113	44.14
		cd1fcb9c2c9a1caab20b4c8bf1ff18493533b42004d9f7741f957ab1850831db	128	50.00
		a0ef7aa8c7200a711f30101de786e2450f7a7f1e884a44831aba30c77f46b478	122	47.65
		bbf12b6acb919c42edb035fe0945b414bf0809b666bbb536976139bee4ea9bdd 124	48.43
	Average	-	123.8 48.35

TABLE 3 .

 3 [START_REF] Xinbin | Energy-efficient and secure transmission scheme based on chaotic compressive sensing in underwater wireless sensor networks[END_REF] -Sensitivity of hash value to the message for the proposed structures with MP output scheme

		Output scheme	B i	HD i %
	Structure 1	MMO	126.2 49.29
		MMMO	128.6 50.23
		MP	135.4 52.89
	Structure 2	MMO	131.4 51.32
	n r = 8	MMMO	126.8 49.53
		MP	135.2 52.81
	Structure 2	MMO	129.6 50.62
	n r = 24	MMMO	124.8 48.75
		MP	123.8 48.35

TABLE 3 .

 3 10 -A comparison of average B i and HD i (%) for message sensitivity

		Message variants	Hexadecimal hash values	B i	HD i %
	Structure	1	bedf7967520105d114e2cdf3399f52394a53e276bb104307345bacf93e317ef6	-	-
		2	60f63ae88faea074964bc5e71022d77003f61ed4dddd8b027c7826e8f31725ff	116	45.31
		3	3e7a24001b11a0a5376d55d073e5910e1bb3b98e4736793ca8bcdf4b5da27b41	127	49.60
		4	fd8fe49f2c5013871f1e291d6c74ceefeb9c4eead9a236d6b923bb04da3c7f4b	135	52.73
		5	054c289004f47fde2fd041e5e830cd4a74d9b586ba2b79835fb5ee13c7289717	139	54.29
		Average	-	129.25 50.48
	Structure	1	1d6238873699dd1c252e02c88e1d2a380d9b5ea8e6c09c788fa4d3955b959975	-	-
	n r = 8	2	aab2bfb971b64b4349a5045d277421df6ee299dc209b0bf0ce9bfccff8bbbe8b	138	53.90
		3	c5667f505bcb289ec52be2fce9a168b72ad0de3fae396b7654f34cf419309b0f	123	48.04
		4	54b21e25c1ee818897c54e84eca15d2ddbd7b505ef81ba2c099a5c852db33b51	121	47.26
		5	f6e6702867e3c3ee86a4d86a6153b1266f58847a704665417fbc66fc39d8179f	132	51.56
		Average	-	128.5	50.19
	Structure	1	af5e7ca7c83a72c77f0e9b7d47df11b0f66cadc862d6f522d592dc5ad9bae938	-	-
	n r = 24	2	f922e9e31c36e932ffb098930fa2726b29a1ce91c5c62b1f16981609b9b2453b	125	48.82
		3	3566ab26fff9c3a232368b624267c3397ab1099ba744ff5f6ec97a7cbc483fa5	126	49.21
		4	3b6a773dfe06e246ab3f53c3c9a0af08123346bb8a0e58a17caf6046992e08a7	130	50.78
		5	40ed183aa3cfb41d9d6f7e304d9ab05a0007044b0db84f039f4315c046051641	146	57.03
		Average	-	131.75 51.46

TABLE 3 .

 3 [START_REF] Di | A combined hash and encryption scheme by chaotic neural network[END_REF] -Sensitivity of hash value to the secret key for the proposed structures with MMO output scheme

	Message variants	Hexadecimal hash values	B i	HD i %
	Structure 1	719adf0e0cdf5b149edc54efdbc09bb6df5a0ce3d3ac9bccc39ac5a64ea65531	-	-
		f2d4772a5a605c729e8ad2c3db016a20135f617b98c4366bb9b44cea418afe92	114	44.53
		23c5a8b268979416f80a32c7aa272c23cd293e20fe3547f8a621815276b3ebab	130	50.78
		75c848fa05415217403dbc2235da6d8fa7fa18b7526b376e4fbb89497303c340	120	46.87
		22c9b90204e4522181389ccff6ab7d24547415b87c8cbd3425c83929c3221024	118	46.09
	Average	-	120.50 47.07
	Structure 2	a594a994aa162adca654e889dea0e6344190aa02328302465570df8f0084f5e6	-	-
	n r = 8	96ebc3ab71912e96b77b6c0db2ad2b0b300484abec4c326bbf10e7b5263ba545	127	49.60
		67d10bee9dedd7e06d58ee10aca74ca3336000f1984a54591d4f9e33face2a1a	138	53.90
		d2db99f2d01e0b5933c37fd86f8983577893b03f490abe2683e2e11870d1df69	123	48.04
		6d5b61d74e75cd983b4f0bf3913211dd991aa35f378842bb187d734f708a49db	126	49.21
	Average	-	128.5	50.19
	Structure 2	6abbd825d6b17184a5fc558670f9f78d91b3812c899c8a062ef855507b4a81e5	-	-
	n r = 24	8741188aadde9edba0310e69541c85936202a4c7ef4de93e9906bdd970931948	149	58.20
		e10308d6126ebaef0ed5982b03e0c27a521060a570aa0a2cf692e63d2d149336	137	53.51
		e8818d36b227e849ed6e3a121745f8d8803bf9425384745fba6a2b1b7adbe32c	119	46.48
		26354f0bc5a4e6385ac23c715acccf65c2d2b28785e504a4a2966f21189b8fde	132	51.56
	Average	-	134.25 52.44

TABLE 3 .

 3 [START_REF] Sze | A chaos-based cryptographic hash function for message authentication[END_REF] -Sensitivity of hash value to the secret key for the proposed structures with MMMO output scheme

	Message variants	Hexadecimal hash values	B i	HD i %
	Structure 1	a005e50f9673ecee6e80c07c550e53f8a950cb4a91176a2a340b5822ec2f28c4	-	-
		27de6d91694c777474b94f2a4ec3ed8c5b5b0da8c38fed5b4c75e2e2bf97972f	143	55.85
		3fa8a997b46131a1429d0006b6c03f181898632313a64f3da8143d1cadd66925	122	47.65
		f670f60cfc1daecb0c81988735b736c8c18851cebe5b94a6f1234f49bd4d5209	117	45.70
		7c68bc63287bfe02badbceb99cdde6a0ef5e9e7429d1dc3d2a9bf90b34a6402c	123	48.04
	Average	-	126.25 49.31
	Structure 2	31882869cce69d7734f0078d29f297841b99d3f9786a1cf522688de9561826ee	-	-
	n r = 8	0b840b10ffda4c9feb4dabf4ab2f642ffe55f730386b8d295534368af526fa33	136	53.12
		2f65ed46a3cb9b0ebb1cf7cd52558de58e2ebc7474b01f169a6b30067e20e5a5	134	52.34
		cf524afe65de3a8123e43e61540a28180f0be21669a3ca4b4d62fdca34f538b5	139	54.29
		27d7a12c3a95c9f52148b43d60c7dbd3acd0b774c885d712bf2bb7673b77443e	131	51.17
	Average	-	135	52.73
	Structure 2	a86e4c2ff1450a08a173b2d9ef27d941fcb9a06f76ad1e70108192ce3cd02a16	-	-
	n r = 24	37235dea611e13421ca8545078d0ec3a88654cfbc4e24bd64dd110ce2ed4ea3e	121	47.26
		7f60df23e3570ba37890a0b199e891835757fabc67b96e2cbbd02d0f64629cb7	120	46.87
		d3bd1e2064cecd5851624b61019a097a00eca137bd1cff0d50b1af161185581e	127	49.60
		149bb7e22e3a018254a5cfb711e192471971857c96663e6ec189762548f09ca3	139	54.29
	Average	-	126.75 49.51

TABLE 3 .

 3 [START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF] -Sensitivity of hash value to the secret key for the proposed structures with MP output scheme

		Output scheme	B i	HD i %
	Structure 1	MMO	129.25 50.48
		MMMO	120.50 47.07
		MP	126.25 49.31
	Structure 2	MMO	128.5	50.19
	n r = 8	MMMO	128.5	50.19
		MP	135	52.73
	Structure 2	MMO	131.75 51.46
	n r = 24	MMMO	134.25 52.44
		MP	126.75 49.51

TABLE 3 .

 3 14 -A comparison of average B i and HD i (%) for key sensitivity

TABLE 3 .

 3

	J ) bits
	2. Maximum number of bits changed :
	B max = max({B i } i=1,...,J ) bits
	3. Mean number of bits changed :
	B = 1 J ∑ J i=1 B i bits
	4. Mean changed probability (mean of HD i (%)) :
	P = ( B 256 ) × 100 %
	5. Standard variance of the changed bit number :

[START_REF] Shiguo | Secure hash function based on neural network[END_REF]

-Diffusion statistical-results for the two proposed structures

TABLE 3 .

 3

			Number of tests
			512	1024	2048
	Structure 1 B min	100	100	100
		B max	149	152	154
		B	128.11 128.22 127.95
		P	50.04	50.08	49.98
		∆B	8.11	8.17	8.03
		∆P	3.16	3.19	3.13
	Structure 2 B min	104	104	103
	n r = 8	B max	150	151	157
		B	127.98 127.88 127.97
		P	49.99	49.95	49.99
		∆B	7.92	7.98	8.01
		∆P	3.09	3.12	3.13
	Structure 2 B min	100	100	100
	n r = 24	B max	153	153	157
		B	127.85 127.96 127.88
		P	49.95	49.98	49.95
		∆B	8.22	8.10	7.94
		∆P	3.21	3.16	3.10

[START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF]

-Diffusion statistical-results for the two proposed structures with MP output scheme

HM1 Mt-1 / M t-1 M2 / M

	Message	Structure 1		Structure 2 -n r = 8		Structure 2 -n r = 24
	length	HT	HTH NCpB	HT		HTH NCpB	HT		HTH NCpB
	513	8.60	57.37 43.70	4.47	112.02 22.71	6.73		73.21 34.20
	1024	15.24	64.98 38.75	8.18	124.18 20.79	8.02		124.17 20.30
	2048	27.02	72.66 34.33	13.82	143.44 17.56	15.11		132.90 19.20
	4096	51.13	76.50 32.46	25.73	153.06 16.34	26.99		146.33 17.13
	10 4	122.15	78.18 31.76	60.16	159.42 15.64	62.30		153.79 16.20
	10 5	1211.30 79.14 31.49	590.16 162.70 15.34	626.89 154.21 16.29
	10 6	11972.02 79.73 31.12	5910.81 162.14 15.36	6185.43 155.61 16.08
			2048
		C	M1			M2					Mt-1			Mt
		KM0	O	KM1	Block 2	HM2	O	KM2	KMt-2	Block t-1	HMt-1	O	KMt-1 Block t	HMt	O	KMt
			M			M					M t-1			M t
					FIGURE 3.17 -Joux attack

TABLE 3 .

 3 17 -Hashing time, hashing throughput, and the number of cycles per Byte for Structures 1 and 2 with MMO output scheme and 2048 random testsLong message second preimage and Herding attacks[START_REF] Elena | Herding, Second Preimage and Trojan Message Attacks beyond Merkle-Damgård[END_REF]

TABLE 3 .

 3 18 -Hashing time, hashing throughput, and the number of cycles per Byte for Structures and 2 with MMMO output scheme and 2048 random tests

	3.3. Performance analysis
	Message	Structure 1	Structure 2 -n r = 8	Structure 2 -n r = 24
	length	HT	HTH NCpB	HT	HTH NCpB	HT	HTH NCpB
	513	8.53	57.72 43.34	5.16	99.80 26.21	6.89	71.12 35.02
	1024	15.11	65.65 38.42	7.78	127.88 19.77	8.03	124.46 20.40
	2048	27.21	72.30 34.56	13.47	145.78 17.11	14.32	137.94 18.19
	4096	51.71	75.81 32.83	25.40	154.57 16.13	26.67	147.56 16.93
	10 4	122.50	78.05 31.85	59.71	160.27 15.52	63.25	152.32 16.44
	10 5	1216.68 78.70 31.63	603.15 159.79 15.68	632.82 153.17 16.45
	10 6	11935.23 79.97 31.03	6015.73 160.38 15.64	6272.66 153.96 16.30
	Message	Structure 1	Structure 2 -n r = 8	Structure 2 -n r = 24
	length	HT	HTH NCpB	HT	HTH NCpB	HT	HTH NCpB
	513	8.67	57.19 44.04	4.45	111.99 22.61	6.76	73.19 34.36
	1024	14.77	66.84 37.55	7.72	128.94 19.62	7.94	124.42 20.19
	2048	27.05	72.73 34.35	13.81	143.17 17.55	16.03	127.37 20.36
	4096	51.52	76.12 32.71	27.42	145.93 17.41	28.16	141.84 17.88
	10 4	122.12	78.32 31.75	59.73	160.25 15.53	63.87	151.23 16.60
	10 5	1232.16 78.32 32.03	585.29 163.83 15.21	631.08 153.34 16.40
	10 6	11866.13 80.42 30.85	5864.95 163.29 15.24	6250.05 154.55 16.25

TABLE 3 .

 3 19 -Hashing time, hashing throughput, and the number of cycles per Byte for Structures and 2 with MP output scheme and 2048 random tests

TABLE 3 .

 3 22 -Comparison in terms of collision resistance of the proposed structures with MP output scheme and SHA2-256 Structure 2n r = 24 100 157 127.88 49.95 7.94 3.10

		Number of hits ω			Absolute difference d
		0	1	2 3	Mean		Mean/character Minimum Maximum
	SHA2-256 [3]	1817 220 11 0	2707.10		84.59	1789	3819
	Structure 1	1803 232 13 0	2633.17		82.28	1471	3779
	Structure 2 -n r = 8	1817 215 16 0	2861.93		89.43	1707	3951
	Structure 2 -n r = 24 1815 226 7 0	2615.44		81.73	1540	3671
	Hash function		B min B max	B	P(%) ∆B ∆P %
	SHA2-256 [3]		104 154 128.01 50.00 7.94 3.10
	Structure 1		100 154 127.95 49.98 8.03 3.13
	Structure 2 -n r = 8	103 157 127.97 49.99 8.01 3.13

TABLE 3 .

 3 [START_REF] Shaojiang | Analysis and improvement of a chaos-based Hash function construction[END_REF] -Comparison of the statistical results of diffusion for the two proposed structures with MP output scheme and SHA2-256

	Hash		Structure 1	Structure 2 -n r = 8	Structure 2 -n r = 24	Wang[18] Akhavan[95] Teh[30]
	function MMO MMMO MP MMO MMMO MP MMO MMMO MP
	NCpB	31.12	31.03	30.85 15.36	15.64	15.24 16.08	16.30	16.25	122.4	105.5	28.45

TABLE 3 .

 3 [START_REF] Huaqian | One-way hash function construction based on chaotic map network[END_REF] -Comparison of NCpB of the proposed structures with three output schemes with some chaos-based hash functions

	Hash function		Structure 1		Structure 2 -n r = 8	Structure 2 -n r = 24	SHA2-256
		MMO MMMO	MP	MMO MMMO	MP	MMO	MMMO MP
	NCpB	31.12	31.03	30.85	15.36	15.64	15.24	16.08	16.30	16.25	11.87
	Hash function VMAC HMAC GCM CMAC DMAC CBC-MAC BLAKE 2
	NCpB	0.42	14.42	0.42	4.41	4.40	2.88	2.58

TABLE 3 .

 3 25 -Comparison of NCpB of the proposed hash functions with the unkeyed and keyed standards Aumasson et al. proposed QUARK as a novel design philosophy for lightweight hash functions in order to minimize memory requirements [148]. Guo et al. proposed a lightweight hash function family PHOTON, based on the Advanced Encryption Standard (AES) design with the new mixing layer method [149]. It achieves excellent area/throughput trade-offs and very acceptable performances with simple software implementation. Bogdanov et al. proposed another family of lightweight hash functions called SPONGENT with hash output sizes varying from 88 bits (for preimage resistance only) to

	Chapter 4
	Design and security analysis of keyed
	chaotic neural network hash functions
	based on the sponge construction
	4.1 Introduction
	Since 2009, many researchers have used Sponge construction to build new cryptographic hash func-
	tions. In 2010,

102

  Chapter 4 -Design and security analysis of keyed chaotic neural network hash functions based on the sponge construction length equal to 256 and 512 bits. The combining of CNN with Sponge construction increases the security of the proposed hash function. Our proposed structures use an efficient CS[START_REF] Safwan | Generator of chaotic sequences and corresponding generating system[END_REF], which generates pseudo-chaotic samples used to initialize the parameters of the neural network. Also, the proposed activation function of neural network is composed of two chaotic maps connected parallel to each other. The two introduced elements make our proposed hash functions more secure against different attacks, compared to existing hash functions based on Sponge construction. Indeed, the theoretical analysis, statistical tests and experimental simulations, presented in detail in this chapter, demonstrate that the proposed hash functions have very good statistical properties, strong collision resistance, high message sensitivity, high key sensitivity and are immune against preimage, second preimage and collision attacks.

  To calculate the intermediate hash values, first we iterate the output layer n r times, with n r = 1, 2, 4, 8, 16, 24, depending on the needed security level. The obtained results given in the performance section indicate that n r = 8 is sufficient. Then, with fixed n r , we again iterate the output layer 7 times to obtain the desired length of the intermediate hash values as done in Structure 1.

TABLE 4 .

 4 4 -Number of hits ω according to the number of rounds n r of Structure 2 for 2048 tests

				ω
			0	1	2 3 4
		number of rounds
		n r
	Length of hash values
	256	1	1814 220 14 0 0
		2	1815 224 8 1 0
		4	1802 232 13 1 0
		8	1787 244 17 0 0
		16	1825 214 8 1 0
		24	1824 213 11 0 0
	512	1	1598 396 52 1 1
		2	1552 439 52 5 0
		4	1594 401 44 6 3
		8	1607 371 67 3 0
		16	1602 395 47 4 0
		24	1600 359 46 2 1
	Length of hash values	Number of hits ω
			0	1	2 3 4
	Structure 1	256	1806 229 13 0 0
		512	1572 419 51 6 0
	Structure 2	256	1787 244 17 0 0
	n r = 8	512	1607 371 67 3 0
	Structure 2	256	1824 213 11 0 0
	n r = 24	512	1600 399 46 2 1

TABLE 4 .

 4 5 -Number of hits ω regarding the proposed structures with the two length of hash values for 2048 tests

TABLE 4 .

 4 6. Standard variance of the changed probability (%).and the obtained results given in Table4.11 with 2048 tests demonstrate that the diffusion effect is close to the expected one. 6 -Mean, mean/character, minimum, and maximum of the absolute difference d for the proposed structures with the two lengths of hash values and J = 2048 tests

	Length of hash values Mean Mean/character Minimum Maximum
	Structure 1	256	2715.39	84.85	1695	3831
		512	5414.34	169.19	3911	7062
	Structure 2	256	2584.51	80.76	1654	3759
	n r = 8	512	5478.30	171.19	3874	6871
	Structure 2	256	2665.24	83.28	1642	3784
	n r = 24	512	5233.34	163.54	3767	6606
	Message variants		Hexadecimal hash values		B i	HD i %
	Structure 1	d53280d1f7a652977e7943472ea34a343746f09f6c8ea084f0b9d5009fecf467	-	-
		2081268dee082e8b2a9cbaaa8156fad0595d6fbd83aea9a92a5c649d9e53a82e	139	54.29
		9c0f5327df3f01a4311283caae6051a7780ca06d81d69dbfdfed57dec4a67db4	128	50.00
		c0a1b6e48295f620c2c42e1ed101023cbefecf6eca5d505d3355604fb8bb2db0	142	55.46
		e3edfd704f2befe9b54c6d000b1116316112b98cf0b6432f68ddf0ee6b829fcf	133	51.95
		29f9cf09e3d0764b53c4a67a5450fc828fc78e12af51de43b6b77f978292cdb3	146	57.03
	Average		-			137.60 53.75
	Structure 2	d3a15d8621f3fec42dca5abf7077091f96275130fcef4e21a1521d81470245ae	-	-
	n r = 8	346dd0bf7ac39dd0992e27b4fdef79e6aacda0d29733324ef3f26c1ca4d0b528	133	51.95
		2ae7c91d1e34279fcc90fdee067837028045a922c786c55c0d6e0fb08b539190	133	51.95
		82ed73ae08e2efe8498d795a2fe685a730a5c2fdaec6dd8cc8ad2171d7ee662b	116	45.31
		3bae189d094240cf7ca3a5ffcf9846f056d078b4ba10f76d092b146290632a26	137	53.51
		145759fe7d944ed8adaa126d7d0107cef75326f757812c56872a39f50d7818cc	121	47.26
	Average		-			128.00 50.00
	Structure 2	f39457de07d62bea3fb35b5698ec008e004db03197b77a7e30e821a6a8499119	-	-
	n r = 24	cb5dc81199de92b10ebf54d31185f37676ba5ca36d077d91723dda34150275e1	140	54.68
		9a0d013b3132a1db0ada8a5aa59ce1a49d38137760d7dc81cf91b77ff73545ac	140	54.68
		ef73910049a7a86ace7103c7d8f537fdfab9eab130c81f0d264c2b370400f67b	122	47.65
		2087a2da6dcf4187ad407532ce2207c14673ff0e56d512fa35b76009bde698c6	128	50.00
		006b3905b48157204b5a2c0922cdb1a869a297e3add562abc442ff0a8f2dd941	143	55.85
	Average		-			134.60 52.57

TABLE 4 .

 4 [START_REF] Nist | standard : Permutation-based hash and extendable-output functions[END_REF] -Sensitivity of hash value to the message for the proposed structures with 256-bit length of the hash values

		Length of hash values	B i	HD i %
	Structure 1	256	137.60 53.75
		512	266.00 51.95
	Structure 2	256	128.00 50.00
	n r = 8	512	204.40 39.92
	Structure 2	256	134.60 52.57
	n r = 24	512	254.20 49.64

TABLE 4 .

 4

		Message variants	Hexadecimal hash values	B i	HD i %
	Structure	1	d53280d1f7a652977e7943472ea34a343746f09f6c8ea084f0b9d5009fecf467	-	-
		2	a3614a0d3d7d77cffbde676045f5abf4add0f46ec9ed08e293e2a96118bbb364	124	48.43
		3	9cc68e614f3ce3161ece75dc8474d31f7a080fb30b7edf239334fd485cb5e8ca	131	51.17
		4	5a2502125bc452c8d7ac3c4f20de5ee4f422219839bbfabf1a22923b2a87cb96	130	50.78
		5	ac84f96d784967e643d750f9c15184ab4e6a93c408bf5eca22585f99eb98fa31	146	57.03
		Average	-	132.75 51.85
	Structure	1	d3a15d8621f3fec42dca5abf7077091f96275130fcef4e21a1521d81470245ae	-	-
	n r = 8	2	5e148302c03950dffe19911bd144c5713ed1c8750bee6c8324b338e9cb2635ed	121	47.26
		3	f5d2f5ae0db1c67d5a85f47994ea894db129241c07a361a4c9cc1c90ec0fb1c1	122	47.65
		4	18eae0eac4dcdedc01b8d55e231119e1d5286bb2fa08f107d8a13db82e984feb	124	48.43
		5	b56c8b1b210b34cb5a41948d7e1b16ba90614af2c1c4d64ee59e54790be40831	128	50.00
		Average	-	123.75 48.33
	Structure	1	f39457de07d62bea3fb35b5698ec008e004db03197b77a7e30e821a6a8499119	-	-
	n r = 24	2	d920e5ea9ae97a63fc75bb205733bc329464c5c67f868620d4c081321797f8c6	141	55.07
		3	dce025ba7f9fb1b72d2754eeeafb696740d691fd3129744bf6f549c25cd8b158	115	44.92
		4	c5e3e27affb359a4648039f8201e029213eb9345f730cf66b3aef40c805b65db	119	46.48
		5	182bb7760e4708c3464bbaed011154a9d903f06be1d73d9ea68dd3da7e9f7718	130	50.78
		Average	-	126.25 49.31

8 -A comparison of average B i and HD i (%) for message sensitivity

TABLE 4 .

 4 [START_REF] Xinbin | Energy-efficient and secure transmission scheme based on chaotic compressive sensing in underwater wireless sensor networks[END_REF] -Sensitivity of hash value to the secret key for the proposed structures with 256-bit length of hash values

		Length of hash values	B i	HD i %
	Structure 1	256	132.75 51.85
		512	252.50 49.31
	Structure 2	256	123.75 48.33
	n r = 8	512	265.50 51.85
	Structure 2	256	126.25 49.31
	n r = 24	512	256.00 50.00

TABLE 4 .

 4 10 -A comparison of average B i and HD i (%) for key sensitivity

TABLE 4 .

 4 11 -Diffusion statistical results for the two proposed structures, with the two lengths of hash values, and J = 2048 tests

			Length of hash values
			256	512
	Structure 1 B min	101	217
		B max	155	293
		B	128.10	256.20
		P	50.04	50.04
		∆B	7.96	11.20
		∆P	3.11	2.18
	Structure 2 B min	99	214
	n r = 8	B max	156	291
		B	127.70	255.90
		P	49.88	49.98
		∆B	8.22	11.37
		∆P	3.21	2.22
	Structure 2 B min	99	215
	n r = 24	B max	154	296
		B	127.88	255.53
		P	49.95	49.90
		∆B	8.02	11.41
		∆P	3.13	2.23

: 1 .

 1 Length extension attack (Padding attack) 2. Meet-in-the-middle preimage attack 3. Joux attack (Multi-collision attack) 4. Long message second preimage attack

  Chapter 4 -Design and security analysis of keyed chaotic neural network hash functions based on the sponge construction

	Message		Structure 1	Structure 2 -n r = 8	Structure 2 -n r = 24
	length	HT	HTH NCpB	HT	HTH NCpB	HT	HTH NCpB
	513	0.0058 27.41 124.33	0.0019 104.81 30.24	0.0029 100.65 28.20
	1024	0.0102 49.25 60.68	0.0039 115.78 24.45	0.0039 72.10 51.78
	2048	0.0190 36.90 93.56	0.0078 115.90 24.43	0.0087 102.86 27.08
	4096	0.0336 52.08 53.28	0.0156 104.67 33.38	0.0175 92.64 35.27
	10 4	0.0849 48.84 63.51	0.0371 124.75 22.44	0.0419 101.10 30.71
	10 6	8.2666 55.05 50.30	3.5986 130.45 21.21	4.0537 112.70 24.56

TABLE 4 .

 4 [START_REF] Sze | A chaos-based cryptographic hash function for message authentication[END_REF] -Hashing time, hashing throughput, and number of needed cycles to hash one Byte for Structures 1 and 2 with 256-bit length hash values and 2048 random tests Long message second preimage and Herding attacks[START_REF] Elena | Herding, Second Preimage and Trojan Message Attacks beyond Merkle-Damgård[END_REF]

TABLE 4 .

 4 13 -Hashing time, hashing throughput, and number of needed cycles to hash one Byte for Structures 1 and 2 with 512-bit length hash values and 2048 random tests

TABLE 4 .

 4 Chapter 4 -Design and security analysis of keyed chaotic neural network hash functions based on the sponge construction 14 -Comparison in terms of collision resistance of the proposed structures with the standard SHA-3 for 256-bit hash values length

	S1-256
	S1-512
	S2-256/r=8
	S2-256/r=24
	S2-512/r=8
	S2-512/r=24

TABLE 4 .

 4

15 -Comparison in terms of collision resistance of the proposed structures with the standard SHA-3 for 512-bit hash values length 4.3.5 Performance comparison with the standard hash function SHA-3

TABLE 4 .

 4 [START_REF] Shiguo | Hash function based on chaotic neural networks[END_REF] -Comparison of the statistical results of diffusion for the two proposed structures with the standard SHA-3 for 256-bit hash values length

		B min B max	B	P(%) ∆B ∆P %
	Structure 1	101 155 128.10 50.04 7.96 3.11
	Structure 2 -n r = 8	99	156 127.70 49.88 8.22 3.21
	Structure 2 -n r = 24 99	154 127.88 49.95 8.02 3.13
	SHA3-256 [7]	101 153 128.05 50.02 8.01 3.13
	Hash function	B min B max	B	P(%)	∆B	∆P %
	Structure 1	217 293 256.20 50.04 11.20 2.18
	Structure 2 -n r = 8	214 291 255.90 49.98 11.37 2.22
	Structure 2 -n r = 24 215 296 255.53 49.90 11.41 2.23
	SHA3-512 [7]	221 288 255.82 49.96 11.08 2.16

TABLE 4 .

 4 [START_REF] Jiashu | Chaotic keyed hash function based on feedforward-feedback nonlinear digital filter[END_REF] -Comparison of the statistical results of diffusion for the two proposed structures with the standard SHA-3 for 512-bit hash values length

		Length of hash values	B i	HD i %
	Structure 1	256	137.60 53.75
		512	266.00 51.95
	Structure 2	256	128.00 50.00
	n r = 8	512	204.40 39.92
	Structure 2	256	134.60 52.57
	n r = 24	512	254.20 49.64
	SHA3-512 [7]	256	124.00 48.43
		512	248.00 48.43

TABLE 4 .

 4 18 -Comparison of average B i and HD i (%) for message sensitivity of the two proposed structures with the standard SHA-3 for 256 and 512 bits hash values length

	Message length	Structure 1	Structure 2 -n r = 8 Structure 2 -n r = 24	SHA-3
		256	512	256	512	256	512	256	512
	513	124.33 172.47 30.24	54.61	28.20	75.04	13.53 59.39
	1024	60.68 103.42 24.45	57.64	51.78	78.30	32.12 48.83
	2048	93.56 107.66 24.43	42.32	27.08	57.99	27.10 41.22
	4096	53.28	98.48 33.38	55.19	35.27	54.32	15.92 13.82
	10 4	63.51 101.87 22.44	42.49	30.71	47.82	13.28 13.43
	10 6	50.30	93.67 21.21	40.12	24.56	46.16	6.92 12.95

TABLE 4 .

 4 19 -Comparison of NCpB of the proposed structures with the standard SHA-3 for 256 and 512 bits hash values length Chapter 4 -Design and security analysis of keyed chaotic neural network hash functions based on the sponge construction

TABLE A .

 A 1 -Nombre de collusion ω obtenus par les deux structures proposées avec les trois schémas de sortie pour 2048 tests

	30	0	100	200	300	400	500	600

  FIGURE A.7 -Distributions du haché pour le message entier et le message constant pour la structure 1 avec le schéma de sortie MP

			Output schemes
			MMO MMMO	MP
	Structure 1 B min	98	98	100
		B max	158	158	154
		B	127.98 127.90 127.95
		P	49.99	49.96	49.98
		∆B	8.01	8.12	8.03
		∆P	3.13	3.17	3.13
	Structure 2 B min	99	98	103
	n r = 8	B max	157	154	157
		B	128.31 128.18 127.97
		P	50.12	50.07	49.99
		∆B	8.03	8.17	8.01
		∆P	3.13	3.19	3.13
	Structure 2 B min	101	103	100
	n r = 24	B max	155	156	157
		B	127.81 127.70 127.88
		P	49.92	49.88	49.95
		∆B	8.23	8.06	7.94
		∆P	3.21	3.15	3.10

TABLE A .

 A

2 -Résultats statistiques de la diffusion pour les deux structures proposées

TABLE A .

 A FIGURE A.8 -Schéma général de la construction Éponge 3 -Nombre de collusions w obtenues pour les deux structures proposées avec les deux longueurs de hachage pour 2048 tests

					Length of hash values	Number of hits ω
									0	1	2 3 4
				Structure 1			256		1806 229 13 0 0
							512		1572 419 51 6 0
				Structure 2			256		1787 244 17 0 0
				n r = 8			512		1607 371 67 3 0
				Structure 2			256		1824 213 11 0 0
	30	0	100	n r = 24 200 300	400	500	512 600		1600 399 46 2 1
								Length of hash values
								256	512
				Structure 1 B min	101	217
							B max	155	293
							B	128.10	256.20
							P	50.04	50.04
							∆B	7.96	11.20
							∆P	3.11	2.18
				Structure 2 B min	99	214
					n r = 8		B max	156	291
							B	127.70	255.90
							P	49.88	49.98
							∆B	8.22	11.37
							∆P	3.21	2.22
				Structure 2 B min	99	215
					n r = 24		B max	154	296
							B	127.88	255.53
							P	49.95	49.90
							∆B	8.02	11.41
							∆P	3.13	2.23
	TABLE A.4 -Résultats statistiques de la diffusion pour les deux structures proposées, avec les deux
	longueurs de hachage pour 2048 tests

Chapter 1 -A brief review of standard hash functions SHA-2 and SHA-3

Hash function

B min B max B P(%) ∆B ∆P % Xiao et al. [START_REF] Di | One-way Hash function construction based on the chaotic map with changeable-parameter[END_REF] --63. [START_REF] Sergio | Nonlinearity, chaos, and complexity : the dynamics of natural and social systems[END_REF] In our proposed hash functions, we use the multi-rate padding Pad, which appends a bit sequence 10 * 1 of length v+2 bits (a bit 1 followed by the minimum number v of 0, and a last bit 1), as shown in equation

where L = |M|.

In general, we have 3 cases of padding (Fig. 4.2) :

Now, let's take a look at the three cases of padding where r = 1088 bits, which is as follows : Then, the padded message is divided into q blocks, and processed as a sequence of message blocks :

Absorbing phase

In this phase, the q blocks of the entire message are absorbed message block M i by message block M i , (i = 1, ..., q) of r-bit size. Each block M i , (i = 1, ..., q) is padded by 0 c , and the obtained blocks

b-bit size are xored with the intermediate hash values HM i-1 , (i = 1, ..., q), where HM 0 = IV was defined in the Initialization phase. The obtained values h i-1 , (i = 1, ..., q) of 1600-bit size from the xor operation are the inputs of C f i , (i = 1, ..., q) with the subkeys KM i , (i = 1, ..., q -1) of 128-bit size. The outputs of C f i , (i = 1, ..., q) are the chaining variables HM i , (i = 1, ..., q) of size b bits (b = 1600 bits) for every r-bit input message block M i , (i = 1, ..., q). For the first Chaotic function C f 1 , KM 0 = K is the secret key of size 160 bits [START_REF] Safwan | Chaos based information hiding and security[END_REF]. For the other Chaotic functions C f i , (i ≥ 2), the subkeys KM i , (i = 1, ..., q -1) are obtained from the Least Significant Bit (LSB) of HM i , (i = 1, ..., q -1), (KM i = LSB(HM i ), (i = 1, ..., q -1)). These subkeys are used by the CS, to generate the necessary parameters and initial conditions for CNN. For the final Chaotic function C f q , HM q forms the final hash value h q of b-bit size produced by the absorbing phase for the input message M. The pseudo-code of the absorbing phase is given below :

Sensitivity of hash value h to the message M

Under each condition (see chapter 3), we give in Table 4.7, the obtained results of h i , B i , and HD i (%) for 256-bit hash value length. Similar results are obtained for hash value length equal to 512 bits.

In Table 4.8, we compare the obtained results for the two structures with their two lengths 256 and 512 bits. All these results are close to the expected values, proving the high message sensitivity of the two proposed structures.

Sensitivity of hash value h to the secret key K

We calculate, under each of the five conditions (given in paragraph 3.3.2.4 in chapter 3), for the two proposed structures with their two variants of hash value length 256 and 512 bits, the hash value h i (hexadecimal), the number of bits changed B i (h, h i ) (bits), and the sensitivity of the hash value h to the secret key K measured by Hamming Distance HD i (h, h i )(%). Table 4.9 presents the obtained results of h i , B i , and HD i (%) for 256-bit hash value length. Similar results are obtained for hash value length equal to 512 bits.

In Table 4.10, we compare the obtained results for the two structures with their two lengths 256 and 512 bits. All these results are close to the expected values, demonstrating the high key sensitivity of the two proposed structures.

Statistical analysis of diffusion effect

The optimal value of diffusion effect is obtained when flipping any bit in the message M causes a change of each output bit in the hash value (binary format) with a probability of one half (50%) [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. Normally, if the secret key is compromised, then the system is completely compromised (during the key life time) [START_REF] Stefan | Design Principles for Iterated Hash Functions[END_REF][START_REF] Ilya | Hash functions : Theory, attacks, and applications[END_REF]. In the following, we demonstrate the robustness of the proposed two structures against these known attacks.

Brute force attacks

The brute force attacks are on the hash value h and on the secret key K (namely, Exhaustive key search attack). The attacks on the hash value can be ordered from the easiest one to the hardest one :

1. Collision resistance attack

Preimage attack and Second preimage attack

Exhaustive key search attack [START_REF] Bart | Analysis and design of cryptographic hash functions[END_REF][START_REF] Shahram | Cryptographic hash functions : A survey[END_REF] For the two proposed structures, in the Exhaustive key search attack, the attacker needs 2 |K|-1 = 2 159 tries. So, this attack is ineffective.

Collision resistance attack (Birthday attack) [START_REF] Philippe | Birthday paradox, coupon collectors, caching algorithms and self-organizing search[END_REF] In this case, the attacker tries to find two messages (M, M ), which hit the same hash value h. The smaller expected workload required by an attacker to break the collision resistance property is approximately

Preimage and Second preimage attacks [START_REF] Kazumaro | Preimage attacks on one-block MD4, 63-step MD5 and more[END_REF] In the Preimage attack, for a known value h, the attacker tries to find its original message M : H(M) = h.

CONCLUSIONS AND PERSPECTIVES

In this thesis, we studied the problem of designing, implementing, and analyzing the secure keyed chaotic neural network (KCNN) hash functions based on the Merkle-D åmgard and Sponge constructions. These proposed KCNN hash functions are suitable for data integrity, message authentication, digital signature and authenticated encryption.

In chapter 1, we presented the fundamental concepts of hash function primitives. We began by introducing the foundation principles and basic concepts of hash functions as well as the two major categories of modern unkeyed and keyed hash functions. First, we described the standard SHA-2 that was based on the Merkle-D åmgard construction. Then, we presented the standard SHA-3 that was based on the Sponge construction.

In chapter 2, we introduced the main characteristics of chaotic maps and neural networks that are suitable for building new chaotic neural network hash functions. These main characteristics are sensitivity to minute changes in initial conditions, random-like behavior, non-linearity, data diffusion, one-way, and parallel implementation. Then, we provided the state-of-the-art versions of certain chaos-based hash functions in the literature.

In In order to increase the hash throughput while keeping the necessary security requirements, we replaced the output layer neural network in the two-layer CNN by a combination of non-linear functions used in the standard SHA-2. These non-linear functions are iterated n r times in order to achieve the security requirements. After several experimental tests, we chose the number of rounds n r equal to 24 for more robustness and equal to 8 for a compromise between robustness and hash throughput.

Finally, we studied the performance of the two proposed keyed hash functions in terms of security (statistical tests, cryptanalytical attacks) and speed and, subsequently, compared the obtained results with other chaos-based hash functions from the available literature, as well as with the standard SHA-2.

In Chapter 4, we presented our second contribution. It consists of designing and implementing, in a secure manner, two new KCNN hash functions based on the Sponge construction. First, we introduced the general structure of these two proposed keyed-Sponge CNN hash functions (KSCNN), characterized by the bitrate r, the capacity c, and the intermediate hash values of 1600-bit length. These KSCNN utilize the same chaotic system as described in chapter 3. Second, we presented the three types of keyed-Sponge functions such as Outer keyed-Sponge (OKS), Inner keyed-Sponge (IKS), and Full-State Keyed Sponge (FKS). Third, we described in detail the first proposed structure based on a two-layer CNN and the second structure based on a one-layer CNN, followed by a combination of non-linear functions. For the second KSCNN, after several experiments, we chose a number of rounds n r equal to 8 and 24 rounds for the same reasons as elucidated in chapter 3. The two KSCNN hash functions are composed of three phases : Initialization phase, Absorbing phase, and Squeezing phase. In the initialization phase, we padded the input message M of arbitrary length to a bit-string with a length that is a multiple of the bitrate r. In the absorbing phase, the entire message is absorbed, message block by message block of r-bit size. In the squeezing phase, we squeezed out the hash value h when the desired length hash value is greater than 1600 bits.

The input layer of the two proposed KSCNN is composed of five neurons while the output layer of the first structure is composed of eights neurons. For the two proposed KSCNN, we realized two variants of hash value lengths : 256 bits (r = 1088, c = 512) and 512 bits (r = 576, c = 1024). To produce the intermediate hash values of 1600 bits, the output layer of each structure is iterated seven times. Finally, we provide the statistical and cryptanalytical analysis, and the computing performance measures of the proposed KSCNN. We observed that the obtained performance is close to those of the standard SHA-3.

In Chapter 5, we worked on the structure of the KCNN-DUPLEX, integrating the proposed KCNN-Sponge hash functions for use in an Authenticated Encryption with Associated Data (AEAD) application.

Conclusions and Perspectives

131

In future studies, we plan to further develop the design of the proposed KCNN-DUPLEX schemes and to analyze their performance. Moreover, we also plan to realize a parallel implementation of the proposed hash functions and to design lightweight CNN hash functions. In addition, we intend to realize a library of hash functions based on the proposed structures. Furthermore, a user guide to help developers implement their applications under the proposed chaos-based hash functions will also be developed.

Analyse des Performances

Nous avons évalué les performances de deux fonctions de hachage à clé proposées, en termes de sécurité -Abstract: The hash functions are the most useful primitives in cryptography. They play an important role in data integrity, message authentication, digital signature and authenticated encryption. Thus, the design of secure hash functions is crucial. In this thesis, we designed, implemented, and analyzed the performance of two architectures, each with two keyed hash function structures based on chaotic maps and neural networks (KCNN). The first architecture is based on the Merkle-Dåmgard construction, while the second uses the Sponge function. The first structure of the first architecture consists of two KCNN layers with three different output schemes (CNN-Matyas-Meyer-Oseas, Modified CNN-Matyas-Meyer-Oseas and CNN-Miyaguchi-Preneel).

The second structure is composed of a KCNN layer followed by a combination layer of nonlinear functions. The first structure of the second architecture is formed of two KCNN layers with two hash value lengths 256 and 512. The second structure is similar to that used in the first architecture. The chaotic system is used to generate KCNN parameters. The results obtained by the statistical tests, as well as the cryptanalytical analysis, demonstrate the security of the proposed KCNN hash functions. Finally, we are currently working on the KCNN-DUPLEX structure integrating the proposed KCNN hashing functions (Sponge-based) for use in an authenticated encryption application.