Nabil Abdoun
email: nabil.abdoun@etu.univ-nantes.fr

Safwan El Assad
email: safwan.elassad@univ-nantes.fr

Olivier Déforges

Rima Assaf
email: rima.assaf@ul.edu.lb

Mohamad Khalil
email: mohamad.khalil@ul.edu.lb

Safwan El

Olivier Deforges
email: olivier.deforges@insa-rennes.fr

Mi Cnn

Kmi-

Kmi-1 Cnn

Mi Kmi

) Modified

) Cnn-Miyaguchi-Preneel

O Hmi

Design and security analysis of two robust keyed hash functions based on chaotic neural networks

Keywords: Keyed hash functions, Chaotic Neural Networks, Chaotic activation function, Merkle-Dåmgard, Statistical tests, Brute force attacks, Cryptanalytical attacks, Speed analysis

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

During the last decade, information security has become a hot issue. Developers are usually concerned about five main services regarding information exchange over non-secure channels (e.g., Internet): confidentiality, authenticity, integrity, non-repudiate, and availability. Hash functions are one of the most useful primitives in cryptography that play an important role in data security. They can achieve data integrity, message authentication [START_REF] Islam | Provably secure dynamic identity-based three-factor password authentication scheme using extended chaotic maps[END_REF], and digital signature [START_REF] Chain | A new digital signature scheme based on chaotic maps[END_REF]. Hash function is a one-way function that maps an arbitrary finite large message data into a fixed-length hash value. It should achieve some security properties, such as message sensitivity, key sensitivity, confusion-diffusion, preimage, second preimage, and collision resistance. Also, it should be immune against brute force and cryptanalytical attacks. Nowadays, the most popular standard secure hash functions are unkeyed Secure Hash Algorithms SHA-2 [3] and SHA-3 [START_REF] Sha | standard: Permutation-based hash and extendable-output functions[END_REF], commonly used by many SSL certificate authorities, whereas keyed hash functions include: Very fast Message Authentication Code-VMAC, Keyed-Hash MAC -HMAC, Galios / Counter Mode-GCM, Cipher-based MAC -CMAC, Destination MAC -DMAC, Cipher Block Chaining Message Authentication Code-CBC-MAC and BLAKE 2. Alternatively, a new direction in the construction of chaos-based hash functions appeared in 2002. Due to the strong non-linearity of chaotic systems and neural network structures, some designers usually combine these two systems to build robust hash functions. Indeed, a chaotic system is characterized by important security features, such as sensitivity to initial conditions, random-like behavior, and unstable periodic orbits. Also, a neural network is characterized by its confusion-diffusion and compression properties that are required to design secure hash functions. However, many researchers developed hashing schemes based on simple chaotic maps, such as logistic map, high-dimensional discrete map, piecewise linear chaotic map, tent map, and Lorenz map or on 2D coupled map lattices [START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF][START_REF] Kwok | A chaos-based cryptographic hash function for message authentication[END_REF][START_REF] Xiao | One-way hash function construction based on the chaotic map with changeable-parameter[END_REF][START_REF] Yi | Hash function based on chaotic tent maps[END_REF][START_REF] Arumugam | Study of chaos functions for their suitability in generating message authentication codes[END_REF][START_REF] Wang | One-way hash function construction based on 2d coupled map lattices[END_REF][START_REF] Wang | Parallel hash function construction based on coupled map lattices[END_REF][START_REF] Amin | Chaos-based hash function (cbhf) for cryptographic applications[END_REF][START_REF] Li | Secure hash function based on chaotic tent map with changeable parameter[END_REF][START_REF] Liu | A fast new cryptographic hash function based on integer tent mapping system[END_REF][START_REF] Maqableh | New hash function based on chaos theory (cha-1)[END_REF][START_REF] Wang | One-way hash function construction based on iterating a chaotic map[END_REF][START_REF] Akhavan | Hash function based on piecewise nonlinear chaotic map[END_REF][START_REF] Zhang | One-way hash function construction based on conservative chaotic systems[END_REF]. In 2007, Zhang et al., [START_REF] Zhang | Chaotic keyed hash function based on feedforwardfeedback nonlinear digital filter[END_REF] proposed a novel chaotic keyed hash algorithm using a feed forward-feedback nonlinear filter. Other researchers proposed combined hashing and encryption schemes based on chaotic neural network [START_REF] Xiao | A combined hash and encryption scheme by chaotic neural network[END_REF][START_REF] Lian | Secure hash function based on neural network[END_REF][START_REF] Lian | Hash function based on chaotic neural networks[END_REF][START_REF] Liu | Hysteresis modeling based on the hysteretic chaotic neural network[END_REF][START_REF] Xiao | Parallel keyed hash function construction based on chaotic neural network[END_REF][START_REF] Deng | A novel combined cryptographic and hash algorithm based on chaotic control character[END_REF][START_REF] Deng | Analysis and improvement of a chaos-based hash function construction[END_REF][START_REF] Yang | One-way hash function construction based on chaotic map network[END_REF][START_REF] Xiao | Improving the security of a parallel keyed hash function based on chaotic maps[END_REF][START_REF] Li | A novel hash algorithm construction based on chaotic neural network[END_REF][START_REF] Li | Parallel hash function construction based on chaotic maps with changeable parameters[END_REF][START_REF] Li | Improvement and performance analysis of a novel hash function based on chaotic neural network[END_REF][START_REF] He | A method for designing hash function based on chaotic neural network[END_REF]. Since 2010, there has been a real turning point in building new secure hash algorithms based on chaotic maps and neural network. Huang [START_REF] Huang | A more secure parallel keyed hash function based on chaotic neural network[END_REF] proposed an enhancement of Xiao's parallel keyed hash function based on chaotic neural network [START_REF] Xiao | Parallel keyed hash function construction based on chaotic neural network[END_REF]. Indeed, in Xiao's scheme, the secret keys are not nonce numbers, which might produce a potential security flaw. Jiteurtragool et al. [START_REF] Jiteurtragool | A topologically simple keyed hash function based on circular chaotic sinusoidal map network[END_REF], proposed a topologically simple keyed hash function based on circular chaotic sinusoidal map network that uses more complex map, i.e., the Sine map. In 2014, Teh et al., [START_REF] Teh | Parallel chaotic hash function based on the shuffle-exchange network[END_REF] introduced a parallel chaotic hash function based on the shuffle-exchange network that runs in parallel to improve hashing speed. In 2015, Abdoun et al., [START_REF] Abdoun | Hash function based on efficient chaotic neural network[END_REF][START_REF] Abdoun | Secure hash algorithm based on efficient chaotic neural network[END_REF] proposed a new efficient structure that consists of two parts: an efficient chaotic generator and a three or two-layer neural network. Chenaghlu et al., [START_REF] Chenaghlu | A novel keyed parallel hashing scheme based on a new chaotic system[END_REF] published a new keyed parallel hashing scheme based on a new hyper sensitive chaotic system with compression ability. High-dimensional chaotic maps have also been used in hash functions for higher complexity and better mixing [START_REF] Akhavan | A novel parallel hash function based on 3d chaotic map[END_REF][START_REF] Nouri | A dynamic chaotic hash function based upon circle chord methods[END_REF][START_REF] Guesmi | A novel chaos-based image encryption using dna sequence operation and secure hash algorithm sha-2[END_REF]. Xiao et al., [START_REF] Xiao | Parallel keyed hash function construction based on chaotic maps[END_REF] designed a parallel keyed chaos-based hash function, where a mechanism of both changeable-parameter and self-synchronization is used to establish a close relation of the keystream with the algorithm key, the content, and the order of each message block. This paper proposes two robust keyed CNN hash functions based on Merkle-Dåmgard construction, that having better hash throughput as compared to the other chaos-based hash functions in literature. Indeed, the structures of the proposed CNN hash functions are based on neural network layer(s) and non-linear layer functions. Each neuron uses a chaotic activation function based on an efficient chaotic generator using Discrete Skew Tent map (DSTmap) and a Discrete Piecewise Linear Chaotic map (DPWLCmap) [START_REF] Assad | Generator of chaotic sequences and corresponding generating system[END_REF][START_REF] Assad | Chaos based information hiding and security[END_REF]. The rest of this paper is organized as follows: Sect. 2 presents the generalities, properties, and classification of cryptographic hash functions. The section also introduces the general model of Merkle-Dåmgard construction formed by preprocessing and compression phases. Sect. 3 introduces in detail the structures of the two proposed keyed CNN hash functions based on MD with their components i.e., chaotic generator, output schemes, neural network, and non-linear functions. Sect. 4 presents the obtained results, in terms of security and computational performance, of the proposed hash functions and compares their performance with other hash functions found in literature. Sect. 5 concludes our contribution and outlines the direction of future work.

Preliminaries

Generalities of cryptographic hash functions

Cryptographic hash functions play a fundamental role in modern cryptography. The basic idea of cryptographic hash functions is that a hash-value h serves as a compact representative image (sometimes called an imprint, digital fingerprint, or message digest) of an input message M and is used as an uniquely identifiable element (Fig. 1) [START_REF] Stallings | Cryptography and Network Security: Principles and Practice, International Edition: Principles and Practice[END_REF][START_REF] Menezes | Handbook of applied cryptography[END_REF][START_REF] Liu | Local and global structure preserving hashing for fast digital fingerprint tracing[END_REF][START_REF] Lee | Polyline curvatures based robust vector data hashing[END_REF][START_REF] Kim | File similarity evaluation scheme for multimedia data using partial hash information[END_REF]. Precisely, a cryptographic hash function H, that requires to be a deterministic process, maps bit-strings of arbitrary finite length |M| to strings of fixed length (u bits), where |M| > u. So, every time if the same input message M is hashed by H, the same hash value h is obtained. H is many-to-one relationship that implies the existence of unavoidable collisions (pairs of input message with identical output hash value) with very small probabilities. A cryptographic hash function H aims to guarantee a number of properties, which makes it very useful for information security. H must verify at least the following two implementation properties:

1. Compression: H maps an input message M of arbitrary finite bit-length to a hash value h of fixed bit-length u bits. 2. Ease of computation: given H and an input message M, H(M) is easy to compute.

Nevertheless, two important requirements are needed to realize the cryptographic hash functions: the hardness to find collisions and the appearance of randomness.

Also, H has the following three security properties (Fig. 2):

H Hash value h

Message M Fig. 1: Hash function 1. Preimage resistance (one-way): for all the pre-specified hash values h, it is computationally infeasible to find any message input that is hashed to the chosen hash value. 2. Second preimage resistance (weak collision resistance): it is computationally infeasible to find any second input that has the same hash value as a specified input message M.

Collision resistance (strong collision resistance): it is computationally infeasi-

ble to find any two distinct message inputs (M, M ) hashed to the same hash value, such that H(M) = H(M ). It should be noted that, the users are free to choose both input messages.

We should mention that the notion of computationally infeasible depends on the relationship between the amount of work the designer has to do to secure the system in comparison to the amount of work that the attacker has to do to break it. At the highest level, cryptographic hash functions are classified into two classes: Unkeyed and Keyed hash functions that are presented in Fig. 3. In this paper, our work is restricted to keyed cryptographic hash functions (simply called hash functions in the rest of this paper) that are originally proposed to generate the inputs of Digital Signature (DS ) application. Later, these hash functions are designed to achieve certain security properties, such as message authentication useful for building cryptosystems. In general, a keyed hash function [START_REF] Bellare | Keying hash functions for message authentication[END_REF] uses a secret key K.

The Merkle-Dåmgard structure, which is unkeyed hash function that uses initial values IV, can be transformed to a keyed hash function by appending a secret key K to the input message M to produce the hash value h. Table 1 presents the two primary types of keyed hash functions (MAC, DS ) with their realized security goals and the kind of their used keys.

H

Hash value h

Message ?

Message ? H In cryptography, many structures are used to construct different hash functions [START_REF] Denton | Modern hash function construction[END_REF], such as Merkle-Dåmgard [52,53], Wide Pipe [START_REF] Lucks | Design principles for iterated hash functions[END_REF], Fast Wide Pipe [START_REF] Nandi | Speeding up the wide-pipe: Secure and fast hashing[END_REF], HAIFA [START_REF] Dunkelman | A framework for iterative hash functions: Haifa[END_REF], and Sponge construction [START_REF] Bertoni | Sponge functions[END_REF]. The Merkle-Dåmgard construction was used in the design of many popular hash algorithms, such as MD5 [START_REF] Rivest | The md5 message-digest algorithm[END_REF], SHA-1 [START_REF] Pub | Secure hash standard[END_REF], and SHA-2 [3]. The Sponge construction was used in the design of SHA-3 [START_REF] Sha | standard: Permutation-based hash and extendable-output functions[END_REF]. This paper proposes novel hash functions based on Chaotic System and Neural Network. The proposal uses the structure of Merkle-Dåmgard with a proposed compression function based on Chaotic Neural Network (CNN ). To understand the proposed hash functions, it is necessary to introduce the Merkle-Dåmgard construction (Fig. 4) and the model of Strengthened Merkle-Dåmgard (Fig. 5).

Merkle-Dåmgard construction: preprocessing and compression : Fig. 4 shows the structure of Merkle-Dåmgard construction where the compression function is defined by

C : {0, 1} l × {0, 1} |M i | → {0, 1} l .
C takes as inputs a chaining or state variable h i (i = 0, ..., q -1) of size l bits and a message block M i (i = 1, ..., q) of size |M i | bits, to produce the updated chaining variable h i (i = 1, ..., q) of size l bits. Thus, to allow the usage of input messages of arbitrary length, the Merkle-Dåmgard structure needs a padding, which transforms the input message into a padded message M of length multiple of |M i | bits. Indeed, a simple padding is insufficient because, in this case, the generated hash value is vulnerable to different

M 1 M 2 ... M q ← "is-pad(M)" h 0 ← IV f or i = 1, ..., q do h i ← C(h i-1 , M i ) h ← O(h q ) return h.
M is padded with the bit pattern 00...0 of length v bits, as shown in equation ( 1). The remaining 64 bits is used by "is-pad" function to denote L.

v = |M i |-mod[(L + 64), |M i |] (1)
It should be noted that, if L exceeds 2 64 , then L mod 2 64 is taken as the message length instead of L [START_REF] Menezes | Handbook of applied cryptography[END_REF]. In general, we have 3 cases of padding:

Last Message Part

case a : mod(|M |, |M i |) < |M i |-64. case b : mod(|M |, |M i |) = 0. case c : mod(|M |, |M i |) > |M i |-64.
Now, let's take a look at the three cases of padding where |M i |= 2048 bits (Fig. 6), which is as follows: Then, the padded message is processed as a sequence of message blocks M 1 M 2 ... M q .

Suggested output schemes

Matyas-Meyer-Oseas (MMO) output scheme: In this output scheme, the message block M i is xored with the chaining variable HM i , which is the output of the CNN that takes as inputs M i and the output of the Chaotic System (Fig. 7-a). The state value KM i-1 is the key of the Chaotic System. Due to the possible different bitlength, an output function O precedes the generation of the final output KM i , which represents the key of the next block, which is as follows:

KM i = O(HM i ⊕ M i ) (2)
where i: the block index; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K: the secret key. f or i = q : KM q = h: the final hash value.

Modified Matyas-Meyer-Oseas (MMMO) output scheme: This output scheme is similar to MMO output scheme except for the xor operation. Indeed in this case, HM i is xored with KM i-1 (Fig. 7-b), where the final output KM i is defined by:

KM i = O(HM i ⊕ KM i-1 ) (3)
where i: the block index; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K: the secret key. f or i = q : KM q = h: the final hash value.

Miyaguchi-Preneel (MP) output scheme: This output scheme can be considered as an extension of the MMO output scheme, where KM i-1 is also added to the xor operation between M i and HM i (Fig. 7-c). The final output KM i is defined by:

KM i = O(HM i ⊕ M i ⊕ KM i-1 ) (4)
where i: the block index; 1 ≤ i ≤ q. f or i = 1 : KM 0 = K: the secret key. f or i = q : KM q = h: the final hash value.

Chaotic System

The proposed Chaotic System is used to generate the parameters concerning the CNN compression function (Fig. 7). It comprises the DSTmap with one recursive cell (delay equal to 1) (Fig. 8). Its outputs are defined as follows:

KSs(n) = DST map(KSs(n -1), Q1) =          2 N × KSs(n-1) Q1 if 0 < KSs(n -1) < Q1 2 N -1 if KSs(n -1) = Q1 2 N × 2 N -KSs(n-1) 2 N -Q1 if Q1 < KSs(n -1) < 2 N (5)
where Q1, the control parameter, and KSs(n) range from 1 to 2 N -1. N is the finite precision and is equal to 32 bits. The secret key K, used for the first block M 1 , is composed of the necessary parameters and initial conditions of the simplified version of the Chaotic Generator patent [START_REF] Assad | Generator of chaotic sequences and corresponding generating system[END_REF] and it is given by the following equation:

K = {KSs(0), Ks, KSs(-1), U s , Q1} (6)
where KSs(0) and KSs(0) are the initial values, U s is an additional initial value used only to generate the first sample, Ks is the coefficient, and Q1 is the control parameter of the Chaotic System. The components of K are samples of 32 bits length and its size is given as follows: The general architecture of the proposed keyed hash function is composed of the defined Chaotic System and two-layer CNN (Fig. 9) [START_REF] Abdoun | Secure hash algorithm based on efficient chaotic neural network[END_REF]. Each layer is composed of 8 neurons, where each one uses a chaotic activation function (Figures 10 and11).

|K| = |KSs(0)|+|Ks|+|KSs(-1)|+|U s |+|Q1| = 160 bits (7)
The chaotic activation function consists of two xored chaotic maps: a Discrete Skew Tent map (DSTmap) and a Discrete Piecewise Linear Chaotic map (DPWLCmap) [START_REF] Assad | Generator of chaotic sequences and corresponding generating system[END_REF][START_REF] Assad | Chaos based information hiding and security[END_REF][START_REF] Desnos | Efficient multicore implementation of an advanced generator of discrete chaotic sequences[END_REF]. Each map is iterated T times (by experiment, we choose the transient phase tr = 30 for Structure 1 and tr = 20 for Structure 2), before generating the first useful sample for maintaining the randomness of the output. The outputs of the DPWLCmap are defined as follows:

KSp(n) = DP W LCmap(KSp(n -1), Q2) =                      2 N × KSp(n-1) Q2 if 0 < KSp(n -1) ≤ Q2 2 N × KSp(n-1)-Q2 2 N -1 -Q2 if Q2 < KSp(n -1) ≤ 2 N -1 2 N × 2 N -KSp(n-1)-Q2 2 N -1 -Q2 if 2 N -1 < KSp(n -1) ≤ 2 N -Q2 2 N × 2 N -KSp(n-1) Q2 if 2 N -Q2 < KSp(n -1) ≤ 2 N -1 2 N -1 -Q2 otherwise ( 8
)
where Q2 is the control parameter of DPWLCmap and ranges from 1 to 2 N -1 (N=32 bits).

It should be noted that in the proposed structures, the padded message M is divided into q blocks, where M i (1 ≤ i ≤ q) is the i eme input block of the message M , KM i (0 ≤ i ≤ q -1) is the i eme key, and HM i (1 ≤ i ≤ q) is the i eme hash value of block M i (1 ≤ i ≤ q). For the first block M 1 , K = KM 0 is the secret key [START_REF] Assad | Chaos based information hiding and security[END_REF]. For the final block M q , h is the final hash value of the entire message M (Fig. 12).

Detailed description of the two-layer CNN hash function: The detailed structure of the i eme block in the proposed two-layer CNN hash function using Miyaguchi-Preneel output scheme, as an example, is given in Fig. 10. Each of the input and output layers has 8 neurons. For each block M i at the input layer, each neuron has 8 input-data: P j (j = 0, ..., 7) for neuron 0, P j (j = 8, ..., 15) for neuron 1 and so on

and its size is written as:

|KS| = |W I|+|BI|+|QI|+|W O|+|BO|+|QO| = 176 samples (10
C k = mod{[F 1 + F 2], 2 N } where                      F 1 = DST map{mod([ 8k+3 j=8k (W I j × P j )] + BI k , 2 N ), QI k,1 } F 2 = DP W LCmap{mod([ 8k+7 j=8k+4 (W I j × P j )] + BI k , 2 N ), QI k,2 } (11)
DSTmap DPWLCmap + + QIk,1 QIk,2 P8k WI8k P8k+1 P8k+4 P8k+7 WI8k+1 WI8k+4 WI8k+7 Ck P8k+2 P8k+3 WI8k+2 WI8k+3 P8k+5 P8k+6 WI8k+5 WI8k+6 F1 F2 BIi 1
Fig. 11: A detailed structure of the k eme neuron in input layer of the two proposed hash functions

H k = mod{[G1 + G2, 2 N ]} where                      G1 = DST map{mod([ 3 j=0 (W O k,j × C j )] + BO k , 2 N ), QO k,1 } G2 = DP W LCmap{mod([ 7 j=4 (W O k,j × C j )] + BO k , 2 N ), QO k,2 } (12)
where k = 0, 1, ..., 7.

The outputs C k of the input layer, weighted by W O k,k (k = 0, ..., 7), and the output biases BO k (k = 0, ..., 7), weighted by 1, are the inputs of the activation function of the output layer. Both W O k,k and BO k are samples of 32 bits length. For each neuron, DSTmap and DPWLCmap are iterated once. The output HM i (i = 1, ..., q) of each block is the concatenation vector of H k (k = 0, ..., 7) (Fig. 12). Then, the final hash value of length 256 bits is given by the following equation:

(13) h = O[KM q-1 ⊕ HM q ⊕ M q ] = O[(KM q-2 ⊕ HM q-1 ⊕ M q-1 ) ⊕ HM q ⊕ M q ] = ... = O[(K ⊕ HM 1 ⊕ M 1 ) ⊕ HM 2 ⊕ M 2 ⊕ ... ⊕ HM q ⊕ M q ]
where O is the Least Significant Bit (LSB ) output function. Thus, to efficiently increase the hash throughput while keeping the necessary security requirements, we replace the output layer neural network of Fig. 10 by a combination of non-linear functions used in the standard SHA-2. However in our implementation, the round constant K i (i = 0, ..., 63) and the message schedule array W i (i = 0, ..., 63) are not useful (Fig. 13). As we can see in the figure 13, the non-linear functions take 8 32-bit inputs D k (k = 0, ..., 7) and generates 8 32-bit outputs H k (k = 0, ..., 7). The four boxes (Ch, Ma, Σ0, and Σ1) combine the input data in non-linear ways to generate H 0 and H 4 , while the other outputs H k (k = 1, 2, 3, 5, 6, 7) are connected directly to D k , which is as follows:

H k = D k-1 (k = 1, 2, 3, 5, 6, 7
). These non-liner functions are defined as follow [3]:

               Ch(D 4 , D 5 , D 6 ) = (D 4 ∧ D 5 ) ⊕ (¬D 4 ∧ D 6 ) M a(D 0 , D 1 , D 2 ) = (D 0 ∧ D 1 ) ⊕ (D 0 ∧ D 2 ) ⊕ (D 1 ∧ D 2 ) Σ0(D 0 ) = ROT R 2 (D 0 ) ⊕ ROT R 13 (D 0 ) ⊕ ROT R 22 (D 0 ) Σ1(D 4 ) = ROT R 6 (D 4 ) ⊕ ROT R 11 (D 4 ) ⊕ ROT R 25 (D 4 ) ROT R n (x) = (x n) ∨ (x (32 -n)) (14)
where ∧ : AN D logic, ¬ : N OT logic, ⊕ : XOR logic, ∨ : OR logic, : Binary Shif t Right operation, and : Binary Shif t Lef t operation.

Detailed description of One-Layer CNN followed by NL functions: The structure of the proposed CNN is given in Fig. 14. To supply the CNN, the Chaotic System generates the necessary samples (Key Stream (KS )) of each block i, which are as follows:

KS = {W I, BI, QI, W O} (15)
and its size is given as follows:

|KS| = |W I|+|BI|+|QI|+|W O| = 96 samples (16)
where

               H 0 = Ch(D 4 , D 5 , D 6 ) ⊕ D 7 ⊕ Σ1(D 4 ) ⊕ M a(D 0 , D 1 , D 2 ) ⊕Σ0(D 0 ) H 1 = D 0 , H 2 = D 1 , H 3 = D 2 H 4 = Ch(D 4 , D 5 , D 6 ) ⊕ D 7 ⊕ Σ1(D 4 ) ⊕ D 3 H 5 = D 4 , H 6 = D 5 , H 7 = D 6 (17)
We iterate the non-linear functions until the necessary security requirements are met. From experimental results (given in performance analysis paragraph), the number of rounds r equals to 8, which is sufficient. The final hash value h of length 256 bits is given in equation 13. To evaluate the performance, in terms of cryptanalysis and hash throughput, of the two proposed structures for each suggested output schemes, we perform the following experiments and analysis. Then, we compare their performance with most chaos-based hash functions in the literature and SHA-2. First, the one-way property (preimage resistance) is showed and then the statistical tests, the brute force, and cryptanalytical attacks of the proposed hash functions are analyzed (Fig. 15).

One-way property:

In the two proposed structures, we will show that it is extremely difficult to compute the message M and the secret key K when only the hash value h is known. For the first structure, the hash H is written in a general form, which is as follows (equations 11 and 12): For the second structure, the hash H can be written as follows:

(18) H = G[(W O × C + BO), QO] = G[(W O × F ((W I × P + BI), QI), QO)]
(19) H = N L r (W O × C) = N L r [W O × F ((W I × P + BI), QI)]
A brute force attack, as defined in sub-section 4.3.1, tries for a given secret key K to find a message M, of which its hash is equal to a given hash value. The attacker needs to try, on average, 2 u-1 values of M, to find the desired hash value h. As u is the length of the hash value equal to 256 bits in the two proposed structures, then according to today's computing ability, this attack is infeasible [START_REF] Xiao | One-way hash function construction based on the chaotic map with changeable-parameter[END_REF][START_REF] Yi | Hash function based on chaotic tent maps[END_REF][START_REF] Lian | Secure hash function based on neural network[END_REF][START_REF] Lian | Hash function based on chaotic neural networks[END_REF].

Statistical tests

This paragraph lists down the analysis of the following tests: Collision resistance, Distribution of hash value, Sensitivity of hash value h to the message M, Sensitivity of hash value h to the secret key K, and Diffusion effect.

Analysis of collision resistance

This test is usually conducted to evaluate the quantitative analysis of collision resistance [START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF][START_REF] Xiao | One-way hash function construction based on the chaotic map with changeable-parameter[END_REF]. First, the hash value h of a random message is generated and stored in the ASCII format. Next, a bit in the message is randomly selected, toggled, and then a new hash value h is generated and stored in the ASCII format. The two hash values are represented by: h = {c 1 , c 2 , ..., c s } and h = {c 1 , c 2 , ..., c s }, where c i and c i are the i th ASCII character of the two hash values h and h , respectively. The size s of the hash value in the ASCII code is equal to s = u k=8 = 32 characters. The two hash values are compared with each other and the number of characters with the same value at the same location, namely the number of hits ω, is counted according to the following:

ω = s=32 i=1 f (T (c i ), T (c i )) where f (x, y) = 1 if x = y 0 if x = y (20)
where the function T (.) converts the entries to their equivalent decimal values. For J independent experiments and under the assumption of uniform and random distribution of hash value, the theoretical number of tests denoted by W J (ω) with a number of hits ω = 0, 1, 2, ..., s, is given by [START_REF] Zhang | Chaotic keyed hash function based on feedforwardfeedback nonlinear digital filter[END_REF]:

W J (ω) = J × P rob{ω} = J s! ω! (s -ω)! ( 1 2 k ) ω (1 - 1 2 k ) s-ω (21)
Thus, to find the optimal number of round r for Structure 2, we calculate, using the equation 20, the number of hits ω according to r (r = 1, 2, 4, 8, 16, 24) in the worst case, where the number of tests J = 2048 tests.

As we can see from the results obtained in Table 2, with MMO output scheme, as an example, for r = 8 rounds, there are zero hits for 1825 tests, one hit for 207 tests, two hits for 15 tests, and three hits for 1 test. For r = 24 rounds, there are zero hits for 1817 tests, one hit for 225 tests, and two hits for 6 tests. Similar results are obtained for other output schemes as well. The number of rounds r equals 8, whereas 24 seems to be adequate for the three output schemes. We choose r = 24, for more robustness and the number r = 8 is a compromise between robustness and hash throughput. Table 3 represents the number of obtained hits ω, for the proposed structures for the three output schemes, with J = 2048 tests and for r = 8, 24 rounds for Structure 2. We remark that, for r = 8 rounds, the obtained results with Structure 2 are similar to the results obtained with Structure 1, irrespective of the considered output scheme. For r = 24 rounds, the obtained results with Structure 2, as are slightly bit better than that of Structure 1. Thus, to evaluate the influence of the test number J (J = 512, 1024, and 2048 tests) on the number of hits, we calculate ω for the proposed structures with MP output scheme, and for r = 8, 24 rounds for the second structure. The obtained results presented in Table 4 for Structures 1 and 2 with r = 8 rounds are similar, while with r = 24 rounds of Structure 2, the number of hits is smaller than that of the other cases. We remark that the number of hits increases with the number 5.

The collision resistance is also quantified by the absolute difference d of two hash values given by equation 22. We evaluated and presented the mean, mean/character, minimum, and maximum of d for the two proposed hash functions in Tables 6 and7.

d = s=32 i=1 |T (c i ) -T (c i )| (22)
From the results given in Table 6 for J = 2048 tests, we observe that the mean/character value with the MMO output scheme for Structure 1 (mean/character = 85.04) and Structure 2 -r = 24 rounds (mean/character = 85.81) are close to the expected value 85. 3 given in equation 23. The results presented in Table 7 with J (J = 512, 1024, and 2048 tests) show that, when J is increasing, the mean/character converge to the expected value E. For two hash, i.e., h = {c 1 , c 2 , ..., c s } and h = {c 1 , c 2 , ..., c s }, with independent and uniformly distributed ASCII character having equal probabilities, the expected value of the mean/character is calculated by [START_REF] Preneel | Analysis and design of cryptographic hash functions[END_REF]:

E[T (c i ) -T (c i )] = 1 3 × L = 85. 3 (23)
where T (c i ) and T (c i ) ∈ {0, 1, 2, ..., 255} and L = 256 (L is the number of levels).

Distribution of hash value

A hash function H should produce uniform distribution of hash value h. and can be used for data integrity in conjunction with digital signature schemes., we calculate its hash value h, for the proposed Structure 1 with MP output scheme, before drawing two-dimensional graphs. The first graph shows the ASCII values of the message according to their index positions (Fig. 16a). The second graph exhibits the hexadecimal values of the hash value h according to their index positions (Fig. 16b). As we can see, the distribution of original message is mostly localized around a small area, while the distribution of hexadecimal values spreads around the entire area. This property of hash value h must be true under the worst case of null input message (Figures 16c and16d). Similar results are obtained for the two proposed hash functions with their different output schemes.

Sensitivity of hash value h to the message M

An efficient hash function H should be extremely sensitive to any input message M, which means that any slight change in the input message should produce a completely different hash value h i . To verify this property, we calculate, for a given secret key K, the hash value h i in hexadecimal format, the number of bits changed B i (h, h i ) (bits), and the sensitivity of the hash value h to the original message M measured by Hamming Distance HD i (h, h i )(%) is given as follows:

B i (h, h i ) = |h| k=1 [h(k) ⊕ h i (k)] bits (24)
HD i (h, h i ) % = B i (h, h i ) |h| × 100% (25)
The message variants are obtained under the following conditions: Condition 6 : We exchange the first message block M 1 , With the wide application of Internet and computer technique, information security becomes more and more important. As we know, hash function is one of the cores of cryptography and plays an important role in information security. Hash function takes a mes, with the second message block M 2 , sage as input and produces an output referred to as a hash value. A hash value serves as a compact representative image (sometimes called digital fingerprint) of input string and can be used for data integrity in conjunction with digital signature schemes. In Tables 8,9, and 10, we present the obtained results of h i , B i , and HD i (%) under each condition for the two proposed hash functions with their output schemes, i.e., MMO, MMMO, and MP. In Table 11, we reassessed the obtained results and even for a single test, the results were inside the normal range. Therefore, the proposed hash functions have Table 9: Sensitivity of hash value to the message for the proposed structures with MMMO output scheme high message sensitivity. These results were in sync with precision in the diffusion test, which was realized over a large number of tests.

Sensitivity of hash value h to the secret key K

Thus, to evaluate the sensitivity of hash value h to the secret key K, hash simulation experiments were conducted under five different conditions (the original input message M is fixed), which are as follows: Condition 1 : The original secret key K is used.

In each of these conditions, we flip the LSB in the afore-mentioned initial conditions and parameters. In Tables 12,13, and 14, we present the obtained results of h i , B i , and HD i (%) under each condition for the two proposed structures with their output schemes, i.e., MMO, MMMO, and MP.

In Table 15, we reassessed the obtained results and even for a single test, the results are inside the normal range. Therefore, the proposed hash functions have high key sensitivity.

Statistical analysis of diffusion effect

Since confusion and diffusion were first proposed by Shannon [START_REF] Sha | standard: Permutation-based hash and extendable-output functions[END_REF] in 1949, they have been extensively used to evaluate the security of cryptographic primitives. In the context of hash functions, confusion is defined as the complexity of the relation between the secret key K and the hash value h for a given message M, whereas diffusion is defined as the complexity of the relationship between the message M and the hash value h for a given key K. The confusion effect is naturally obtained in hash functions and it is very strong in chaos-based hash functions, due to the inherent properties of chaos. In cryptographic hash functions, strong diffusion is required. The ideal diffusion effect is obtained when any single bit change in the message causes a change with a 50% probability for each bit of a hash value (binary format). This is often referred to the avalanche effect in literature [START_REF] Feistel | Cryptography and computer privacy[END_REF].

To evaluate the performance of the two proposed structures with different output schemes, i.e., MMO, MMMO, and MP, we performed the following diffusion test: the previous defined message M is chosen and a hash value h is generated. Next, a bit in the message is randomly selected and toggled and a new hash value is generated. Then, the number of bits changed B i between the two hash values is calculated. This test is performed at J-time, where J = 512, 1024, and 2048 tests.

The six statistical values concerning this test are calculated as follows:

1. Minimum number of bits changed: B min = min({B i } i=1,...,J ) bits 2. Maximum number of bits changed:

B max = max({B i } i=1,...,J ) bits 3. Mean number of bits changed: B = 1 J J i=1 B i bits 4. Mean changed probability (mean of HD i (%)):

P = ( B 256 ) × 100 % 5. Standard variance of the changed bit number: ∆B = 1 J-1 J i=1 (B i -B) 2 6. Standard variance of the changed probability: ∆P = 1 J-1 J i=1 ( B i 256 -P ) 2 × 100 %
The obtained statistical results of diffusion presented in Table 16 with 2048 tests demonstrates that the diffusion effect is close to the expected one. Indeed, irrespective of the used structure and the output schemes, both B and P are very close to the ideal values (128 bits and 50%, respectively), while ∆B and ∆P are very low, which indicates that the diffusion is extremely stable. These results, presented in Table 17, are also confirmed through the tests with J = 512 and 1024, for Structures 1 and 2 with MP output scheme.

In addition, we draw the histogram B i (Fig. 17) of Structure 1 with MP output scheme to show that the values of B i are centered on the ideal value 128 bits. Similar results are obtained for the other proposed hash functions as well.

Cryptanalysis

The attackers make use of some general attack methods that are available to them, which can be applied to any Unkeyed or Keyed hash functions (Fig. 15). These attacks depend only on the hash value length u for the unkeyed hash function and on the hash value length u and the secret key length |K| for the keyed hash function. If the cryptanalyst can find a method to retrieve K, the system is entirely compromised (during the key life time) [START_REF] Lucks | Design principles for iterated hash functions[END_REF][START_REF] Mironov | Hash functions: Theory, attacks, and applications[END_REF].

Brute force attacks

A brute-force attack on a keyed hash function is more difficult than a brute-force attack on an unkeyed hash function. There are two possible types of attacks, which are as follows:

1. Attacks on the hash value h, namely Preimage attack, second preimage attack, and collision resistance attack. 2. Attack on the secret key K, namely Exhaustive key search attack. For the first type of attacks, for a given secret key K, the fastest way to compute a first or second preimages and collision resistance is through a brute force attack that consists of randomly selecting values of M and try each value until a collision occurs. For exhaustive key search attack, the attacker requires known {message, hash} pairs. Preimage and second preimage attacks [START_REF] Aoki | Preimage attacks on one-block md4, 63-step md5 and more[END_REF]: In a preimage attack, given only the hash value h, the attacker tries to find the original message M in a way such that H(M) = h without attempting to recover the secret key K. For example, in an authentication security service, a website stores {username, H (password)} in its database instead of {username, password}. When a user tries to access the website in question, the website verifies the authenticity of the user by comparing H (input) with the stored hash H (password) (Fig. 18). Now, suppose this database is compromised and an attacker succeeds in accessing a given hash value, then he can try to generate the corresponding message using a preimage attack. In a second preimage attack, the adversary has more information. Specifically, he knows the hash value h for a given message M and he tries to find another message M that produces the same hash value h. For example, in digital signature scheme for data integrity security service, the attacker has access to both document M and its hash h and tries to find a new document M , such that H(M ) = h, so that he can send the signed new document M as the original signed document M (Fig. 19). For the first and second preimage attacks, the adversary would have to try, on average, 2 u-1 values of M to find one that generates the given hash value h. Our proposed structures produce hash values of length 256 bits, so that the minimum amount of work required by an attacker to violate the preimage or second preimage Collision resistance attack (Birthday attack ) [START_REF] Flajolet | Birthday paradox, coupon collectors, caching algorithms and self-organizing search[END_REF]: In the collision resistance attack, the attacker tries to find two messages (M, M ) that collide with the same hash value h. The minimum amount of work required by an attacker to violate the collision resistance property is approximately 2 u/2 operations. This required effort is proven by a mathematical result referred to as the birthday paradox, which is detailed in the example below.

Let us take the situation whether any two students in a class have the same birthday. Suppose that the class has 23 students. If a teacher specifies a day (say August 11), then the probability that at least one student has the same birthday as any other student is (1 -(365×364×...×343) 365 (23) ) = 50.73%. Birthday attack is widely exploited for finding any two messages M and M , such that H(M) = H(M ), then the couple (M, M ) is named a collision. If the length of h is u and hash values are random with a uniform distribution, an adversary can expect to find a collision (M, M ) with a 50% probability within √ 2 u = 2 u/2 attempts. Yuval [START_REF]How to swindle rabin[END_REF] proposed the following strategy in DS application (Fig. 19) to exploit the birthday paradox in a collision resistant attack without attempting to recover the secret key K :

1. The sender is prepared to sign a legitimate message M by appending the appropriate ciphered u-bit hash code using its private key. 2. The attacker generates 2 u/2 minor variations δM of the message M , where all of them essentially convey the same meaning along with storing these messages and their hash values in a table. 3. The attacker tries to find a fraudulent message M that has the same sender's signature which was generated using the second preimage attack. 4. The attacker generates 2 u/2 minor variations δM of M , where all of them essentially convey the same meaning. For each δM , the attacker computes H(δM ), checks for matches with any of the H(δM ) values, and continues until a match is found, H(δM ) = H(δM ). 5. Then, the attacker gives the valid fraudulent message δM to the sender for signature and this signature can then be attached to the fraudulent message for transmission to the intended receiver. Thus, the attacker is assured of success even though the encryption key is not known.

Another practical example is when the attacker finds a collision between a valid Microsoft Windows security patch and a malware. Then, the attacker sends his malware to sign it, in any certificate company, and ship it to Microsoft Windows users around the world. Later, when a user tries to download the new patch, his computer gets infected. Also, for collision resistance attack, the length of hash value h determines the security and the proposed hash functions are secure against these kinds of attacks because an attacker needs, on average, 2 128-1 tries.

Exhaustive key search attack [START_REF] Preneel | Analysis and design of cryptographic hash functions[END_REF][START_REF] Bakhtiari | Cryptographic hash functions: A survey[END_REF]: In keyed CNN hash functions, if the attacker has access to a pair (message, digest), then normally the key can be found by exhaustive searching and, on average, the attacker needs 2 |K|-1 tries, where |K| is the length of the secret key K. Thus, the level of effort for brute force attack on keyed hash functions can be expressed as min(2 |K| , 2 u ). As |K| = 160 bits, consequently, the proposed hash functions are immune against these kinds of attacks.

Cryptanalytical attacks

Cryptanalytic attacks seek to exploit some properties of the keyed hash function to perform some attacks other than brute force attacks. An ideal keyed hash function should require a cryptanalytic effort greater than or equal to the brute force effort. Far less research has been conducted on developing such attacks. A useful survey of some methods for specific keyed hash functions is developed in [START_REF] Preneel | On the security of two mac algorithms[END_REF]. In the following paragraphs, we apply the main cryptanalytic attacks of the literature on the proposed hash functions, which are listed below: The attacker can perform the following steps. Suppose Alice sends (message M, hash value h) as a pair to Bob. Let us assume that the attacker has access to the message and its hash, then, he can easily calculate, from this pair, a new hash value h , which is as follows:

1. Pad the message M with an arbitrary extended message EM with a length equal or multiple of a size block. 2. Set the digest h as the secret key.

Calculate the new hash value h corresponding to (M ||EM ). This means that

h is used as the key for the added block(s) of (M ||EM ). 4. Substitute (M, h) pair by (M ||EM, h ) and send it to Bob as a valid signature (Fig. 20).

In our proposed hash functions, the secret key K is not pre-pended to the message M but used as an input for the Chaotic System to produce the necessary supplies to CNN. Then, such an attack can not be conducted.

Meet-in-the-middle preimage attack (MITM ) [START_REF] Wei | Improved meet-in-themiddle cryptanalysis of ktantan (poster)[END_REF][START_REF] Aoki | Meet-in-the-middle preimage attacks against reduced sha-0 and sha-1[END_REF]: The meet-in-the-middle preimage attack is a generic cryptanalytic approach that is originally applied to the cryptographic systems based on block ciphers (Chosen plain-text attack). In 2008, Aoki and Sasaki [START_REF] Aoki | Meet-in-the-middle preimage attacks against reduced sha-0 and sha-1[END_REF] noticed that the MITM attack could be applied to hash functions, to find preimage, second preimage, or collision for intermediate hash chaining values instead of the hash value h. This attack has successfully broken several designs: the MD hash family includes MD5 [START_REF] Sasaki | Finding preimages in full md5 faster than exhaustive search[END_REF], round-reduced SHA-0, and SHA-1 [START_REF] Aoki | Meet-in-the-middle preimage attacks against reduced sha-0 and sha-1[END_REF], round-reduced SHA-2 [START_REF] Aoki | Preimages for step-reduced sha-2[END_REF], some Davies-Meyer hash constructions, e.g., Tiger [START_REF] Guo | Advanced meet-in-the-middle preimage attacks: first results on full tiger, and improved results on md4 and sha-2[END_REF], reduced HAS-160 [START_REF] Hong | Improved preimage attack for 68-step has-160[END_REF] and HAVAL [START_REF] Sasaki | Preimage attacks on 3, 4, and 5-pass haval[END_REF]. The steps of MITM attack, illustrated in Fig. 21 for a given secret key K, can be explained as follows: Use the hash function H to calculate the hash value h of a message M that is divided into q fixed-size blocks. 2. Split the chain hash function in two parts, where the first part includes q-2 blocks and the second part includes the last two blocks q-1 and q. 3. Choose a message Q of length q-2 in the form {Q 1 , Q 2 , ..., Q q-2 }. 4. Compute the hash value KQ q-2 of the chosen message using H. 5. Generate 2 u/2 random blocks B X . For each generated block B X i (instead of M q-1 ), start computing (from the splitting point) to generate the chaining hash value: KQ q-1,i = C(B X i , KQ q-2 ), i = 1, 2, ..., 2 u/2 , which forms a list L B X containing all the computed chaining values (KQ q-1,i ) X , i = 1, 2, ..., 2 u/2 at the matching point. 6. Generate 2 u/4 random blocks B Y . For each generated block B Y j , j = 1, ..., 2 u/4

(instead of M q ), start calculating KQ q,k (k = 1, 2, ..., 2 u/4 ) with KQ q,k = C(B Y j , KQ q-1,k ) (k = 1, 2, ..., 2 u/4 ). Then form a list L B Y j,k containing the chaining values of (KQ q-1,j,k ) Y (k = 1, 2, ..., 2 u/4 ). Then, L B Y is compared to L B X to find a collision at the matching point. 7. If a collision is found, then form the message {Q 1 , Q 2 , ..., Q q-2 , B X i , B Y j } that gives the desired hash value h and, therefore, use it to produce the same digital signature. Otherwise, repeat the above six steps with a different chosen message {Q 1 , Q 2 , ..., Q q-2 }.

The probability that one element

{KQ q-1,j,k } Y from L B Y matches one element {KQ q-1,k } X from L B X is equal to 1 2 u/2 . Otherwise, the probability is (1-1 2 u/2
). For all the elements of L B Y , the probability that none of them are equal to an element of B X , is (1

-1 2 u/2 ) 2 u/2
. Given that, (1 -x) ≤ e -x , the previous expression can be approximated by: (e -1/2 u 2 ) 2 u/2 = e -1 . Then, the probability that one intermediate matching value occurs is: As our hash functions are preimage resistant, the effort to succeed the meet-inthe-middle attack with probability 0.632 is 2 u/2 .

P = 1 -e -1 = 0.632 (26)
Joux attack [START_REF] Joux | Multicollisions in iterated hash functions. application to cascaded constructions[END_REF]: A collision attack takes time of order 2 u/2 (sec. 4.3.1). A multicollision attack means that a set of messages that all have the same hash value h. In 2004, Joux showed that searching multi-collisions is not so hard when it comes to finding ordinary collision. Indeed, he demonstrated that finding 2 t collisions cost only about t times a single collision attack, t × 2 u/2 instead of 2 u(2 t -1)/2 t evaluations [START_REF] Lucks | Design principles for iterated hash functions[END_REF]. To illustrate this relation, let we show how 4 collisions (t = 2) can be obtained with only two calls of a collision finding machine. This collision finding machine uses birthday attack algorithm. For a given secret key K, a first call to the collision finding machine generates two different blocks M 1 and M 1 that yield a collision: KM 1 = C(M 1 , K) = C(M 1 , K). Then, a second call to the same collision finding machine locates two other blocks M 2 and M 2 such that C(M 2 , KM 1 ) = C(M 2 , KM 2 ). When putting these two steps together, we obtain the following 4 collisions:

C(M 2 , C(M 1 , K)) = C(M 2 , C(M 1 , K)) = C(M 2 , C(M 1 , K)) = C(M 2 , C(M 1 , K)).
Joux claimed that this basic idea can be extended to much larger collisions by using more calls to the collision finding machine. More precisely, using t calls, we can build 2 t -collision for a given hash function H. All of the 2 t hashing processes go through KM 1 , KM 2 , ..., KM t . A schematic representation of these 2 t blocks together with their common intermediate hash values is drawn in Fig. 22. Furthermore, Joux observed that, for two independent hash functions H and G and a given message M with H(M) = h and G(M) = g, the concatenation of the two obtained hash values (h||g) is not more secure against collision attacks, preimage resistance attack, and second preimage attack than any of the two hash functions taken separately. Long message second preimage and Herding attacks The Long message second preimage attack [START_REF] Kelsey | Second preimages on n-bit hash functions for much less than 2 n work[END_REF] and the Herding attack [START_REF] Kelsey | Herding hash functions and the nostradamus attack[END_REF] are closely related to the Joux attack. For the first kind of attack, the attacker can find a second preimage for a message M of 2 b blocks with b × 2 u/2+1 + 2 u-b+1 effort. For the second attack, the needed work by the attacker to find 2 t collisions is 2 u-t-1 +2 u/2+t/2+2 +t×2 u/2+1 .

Speed analysis

We evaluated the computing performance of the two proposed hash functions with their output schemes for different message lengths. For this purpose, we calculated the average hashing time HT (micro second), the average hashing throughput HTH (MBytes/second) and the needed number of cycles to hash one Byte NCpB (cycles/Byte).

HT H (M Bytes/s) = M essage size(M Bytes) Average hashing time(s)

N CpB (cycles/Byte) = CP U speed(Hz) HT H(Byte/s)

We used a computer with a 2.6 GHZ Intel core i5-4300M CPU with 4 GB of RAM running Ubuntu Linux 14.04.1 (32-bit). In Tables 18,19, and 20, the average HT, the average HTH, and the average NCpB for the two structures with their output schemes are presented. It was observed that, irrespective of the output schemes, the computing performance of Structure 2 is approximately twice better than the computing performance of Structure 1, even for r = 24 rounds. To focus more on these results, the HTH for the two structures with their output schemes 23 were drawn. The variation of computing performance according to the size of the message is due to the transition phase of both chaotic system and chaotic activation function We compared the performance of the proposed hash functions with some hash functions of literature in terms of statistical analysis and NCpB. Table 21 presents the comparison with chaos-based hash function in terms of collision resistance for MP output scheme with 2048 tests. As we can see, except Li et al. [START_REF] Li | Parallel hash function construction based on chaotic maps with changeable parameters[END_REF] our obtained results are more close to the expected values. Table 22, additionally, presents the comparison of statistical results of diffusion. We observed that the obtained results for all cited references are closed to the expected values. It should be noted that besides the two references [START_REF] Jiteurtragool | A topologically simple keyed hash function based on circular chaotic sinusoidal map network[END_REF][START_REF] Chenaghlu | A novel keyed parallel hashing scheme based on a new chaotic system[END_REF], all the other references in Tables 21 and22 present structures that work with hash value h = 128 bits. For comparison purposes, we took the 128 LSB hash values. The speed performance, in terms of the number of cycles to hash one Byte (NCpB ), of the proposed keyed chaos-based hash functions is compared to that of some chaos-based hash functions of literature and with the main standards of the unkeyed and keyed hash functions, which are presented in Tables 25 and26, respectively. We observed that the NCpB of the Structure 2 is approximately twice as fast as the best NCpB obtained by [START_REF] Teh | Parallel chaotic hash function based on the shuffle-exchange network[END_REF], but it is a little bit slower than the SHA-2's NCpB and approximately four times slower than the main keyed hash functions.

Conclusion

We realized and analyzed the security and computation performance of the two keyed chaotic neural network hash functions, based on Merkle-Dåmgard construction with three output schemes MMO, MMMO, and MP. The obtained results quantified the robustness of the proposed hash functions for using them in data integrity, message authentication, and digital signature applications. The very good performance is due to the strong one-way property of the combined chaotic system

Fig. 3 :Fig. 4 :Fig. 5 :

 345 Fig. 3: Classification of cryptographic hash functions

Fig. 6 :

 6 Fig. 6: The padding of input message in the proposed hash functions

  case a : if L = 6066 bits : v = 2048 -mod[(6066 + 64), 2048] = 14 bits. case b : if L = 6144 bits : v = 2048 -mod[(6144 + 64), 2048] = 1984 bits. case c : if L = 6086 bits : v = 2048 -mod[(6086 + 64), 2048] = 2042 bits.

Fig. 7 :

 7 Fig. 7: The proposed Merkle-Dåmgard compression functions based on CNN with output schemes

Fig. 8 :

 8 Fig. 8: The structure of the Chaotic System

Fig. 9 :

 9 Fig. 9: The structure of the i eme block in the proposed keyed hash function based on two-layer CNN with MP output scheme

Fig. 10 :

 10 Fig. 10: A detailed structure of the i eme block in the proposed keyed hash function based on two-layer CNN with MP output scheme

Fig. 12 : 3 . 4

 1234 Fig. 12: The proposed keyed hash function based on two-layer CNN with MP output scheme

  |W I| = 64 samples, |BI| = 8 samples, |QI| = 16 samples, and |W O| = 8 samples, each of 32 bits length. The outputs C k (k = 0, ..., 7) of the chaotic activation function given by equation 11 are weighted by W O k,k (k = 0, ..., 7) to form the inputs of the NL layer. The outputs H k (k = 0, ..., 7) are given by equation 17.

Fig. 13 :

 13 Fig. 13: Non-linear functions

Fig. 14 :Fig. 15 :

 1415 Fig. 14: The proposed keyed hash function based on one-layer NL CNN with MP output scheme

Condition 1 :Fig. 16 :

 116 Fig. 16: Distribution of hash value for Structure 1 with MP output scheme

Condition 2 :

 2 We change the initial condition KSs(0) in the secret key. Condition 3 : We change the parameter Ks in the secret key. Condition 4 : We change the initial condition KSs(-1) in the secret key. Condition 5 : We change the control parameter Q1 in the secret key.

Fig. 17 :

 17 Fig. 17: Histogram of B i

Fig. 18 :Fig. 19 :

 1819 Fig. 18: General scheme of hash authentication

Fig. 20 :

 20 Fig. 20: Hash length extension attack

Fig. 21 :

 21 Fig. 21: Meet-in-the-middle preimage attack

Fig. 22 :

 22 Fig. 22: Joux attack

  of a neuron. Indeed, the cost of the transition phase is approximately equal 2× tr ×4 = 240 Bytes for Structure 1 (tr = 30) and 160 Bytes for Structure 2 (tr = 20) in our implementation. 4.5 Performance comparison with other Chaos-based hash functions of literature and standards hash functions

Fig. 23 :

 23 Fig. 23: Comparison of HTH for Structure 1 and Structure 2 -r = 24 rounds with MMO, MMMO, and MP output schemes

Preimage resistance Second Preimage resistance Collision resistance

	Message M Message M	Message ? Message ?	Message ? Message ?	Message Message ? ?
		H	H	H
	Hash value h		Hash value h
	Hash functions security goal	MAC	Digital Signature
	Integrity	Yes	Yes
	Authentication	Yes	Yes
	Non-repudiation	No	Yes
	Kind of keys	Symmetric keys	Asymmetric keys

Fig. 2: Security properties of hash functions

Table 1 :

 1

Two primary types of keyed hash functions

2.2 Structures of hash functions

Table 2 :

 2 Number of hits ω according to the number of rounds r of Structure 2 for 2048 tests of tests J. These results are in sync with the theoretical values of W J (ω) calculated from equation 21 and are represented in Table

Table 3 :

 3 To verify this property, we perform the following test: for a given message M, With the Number of hits ω regarding the proposed structures with the three output schemes for 2048 tests

		Output schemes	Number of hits ω
			0	1	2	3
	Structure 1	MMO	1833 200 15 0
		MMMO	1799 237 12 0
		MP	1803 232 13 0
	Structure 2	MMO	1825 207 15 1
	r = 8	MMMO	1800 237 10 1
		MP	1817 215 16 0
	Structure 2	MMO	1817 225	6	0
	r = 24	MMMO	1810 230	7	1
		MP	1815 226	7	0
		Number of tests	Number of hits ω
			0	1	2	3
	Structure 1	512	444	64	4	0
		1024	905	111	8	0
		2048	1803 232 13 0
	Structure 2	512	446	62	4	0
	r = 8	1024	899	117	8	0
		2048	1817 215 16 0
	Structure 2	512	452	58	2	0
	r = 24	1024	905	116	3	0
		2048	1815 226	7	0

Table 4 :

 4 Number of hits ω of the proposed structures with MP output scheme for J = 512, 1024, and 2048 tests

					ω
			0	1	2	3	32
	J	512	451.72	56.68	3.44	0.13 4.42 × 10 -75
		1024	903.45	113.37	6.89	0.27 8.84 × 10 -75
		2048 1806.91 226.74 13.78 0.54 1.76 × 10 -74

Table 5 :

 5 Theoretical values of the number of hits ω according to the number of tests J

		Output schemes	Mean	Mean/character Minimum Maximum
	Structure 1	MMO	2721.43	85.04	1736	3723
		MMMO	2764.05	86.37	1829	3757
		MP	2633.17	82.28	1471	3779
	Structure 2	MMO	2616.94	81.77	1559	3574
	r= 8	MMMO	2854.76	89.21	1845	4195
		MP	2861.93	89.43	1707	3951
	Structure 2	MMO	2746.07	85.81	1696	3807
	r= 24	MMMO	2856.03	89.25	1545	3981
		MP	2615.44	81.73	1540	3671

Table 6 :

 6 Mean, Mean/character, Minimum, and Maximum of the absolute difference d for the proposed structures with the three output schemes and J = 2048 tests

		Number of tests	Mean	Mean/character Minimum Maximum
	Structure 1	512	2637.00	82.40	1471	3779
		1024	2637.99	82.43	1471	3779
		2048	2633.17	82.28	1471	3779
	Structure 2	512	2872.23	89.75	1828	3872
	r= 8	1024	2868.04	89.62	1707	3951
		2048	2861.93	89.43	1707	3951
	Structure 2	512	2603.32	81.35	1764	3671
	r= 24	1024	2620.85	81.90	1626	3671
		2048	2615.44	81.73	1540	3671

Table 7 :

 7 Mean, Mean/character, Minimum, and Maximum of the absolute difference d for the proposed structures with MP output scheme and J = 512, 1024, and 2048 tests wide application of Internet and computer technique, information security becomes more and more important. As we know, hash function is one of the cores of cryptography and plays an important role in information security. Hash function takes a message as input and produces an output referred to as a hash value. A hash value serves as a compact representative image (sometimes called digital fingerprint) of input string

Table 8 :

 8 Sensitivity of hash value to the message for the proposed structures with MMO output scheme

		Message variants	Hexadecimal hash values	Bi	HDi%
	Structure 1	1	719adf0e0cdf5b149edc54efdbc09bb6df5a0ce3d3ac9bccc39ac5a64ea65531	-	-
		2	a9472c054759a85c0c172e27bc1b957f09488c40329424c48aac1d1141dd8297	132	51.56
		3	1bee2969559824929f8d53fda2c541288a4a04491a0a11670b3b907fa0d5dd91	119	46.48
		4	27c29f1e040d922b31559e0e3f4e36edc9bdad55cf058d7f0eaa7a9f9eda6d98	124	48.43
		5	65489772dff489621f3188237c1ff84c8bf686d7a4f5c6ff1e114b740c72c922	133	51.95
		6	64755b1267f7243f2dbf243d698db2dd40ff63df7375f645886d064b2d05fdb2	135	52.73
		Average	-	128.6	50.23
	Structure 2	1	a594a994aa162adca654e889dea0e6344190aa02328302465570df8f0084f5e6	-	-
	r = 8	2	9d698ca7855b104a526a075a36cbf158da31c872257db0d8d589502f60a8115f	135	52.73
		3	fe77f2939687110cc6f383ed0ac2990e89b513ed1425c2a2ded04ce8ab26331e	129	50.39
		4	d906ae7eaf90974ce664e8adb535e71b798873bfdc77827e3715715bb6b5cbb5	113	44.14
		5	f1ea83b16b7fecd5d523573d35f52a424e35a8dc38af6e013f9d2020f0825c35	136	53.12
		6	29e7a1e00480ff09b86d357982d28ab641758c071cee1a2095452cb583740194	121	47.26
		Average	-	126.8	49.53
	Structure 2	1	6abbd825d6b17184a5fc558670f9f78d91b3812c899c8a062ef855507b4a81e5	-	-
	r = 24	2	c7c8654da6fd4fb838f8f9bea4baa223b8298a1c1e0cda2181a23e612cbb8446	122	47.65
		3	0fe4ee2f96a9092f539a4fd229466b381a794db148da178e635022d9a690eabf	130	50.78
		4	9b01f686addb2e2f6dbd7046b985b4ae1b5b39a7da3aec544ecb6c8efd310a00	128	50.00
		5	9901ff0d69138df2f70a5930ede63447875c859830bc87e4164a83b083a6a193	131	51.17
		6	c5035924044140a2009837907fba710d05efbcbe12ff9c1d14d9090961bd054e	113	44.14
		Average	-	124.8	48.75

Table 10 :

 10 Sensitivity of hash value to the message for the proposed structures with MP output scheme

		Output scheme	B i	HD i %
	Structure 1	MMO	126.2	49.29
		MMMO	128.6	50.23
		MP	135.40	52.89
	Structure 2	MMO	131.4	51.32
	r = 8	MMMO	126.8	49.53
		MP	135.2	52.81
	Structure 2	MMO	129.6	50.62
	r = 24	MMMO	124.8	48.75
		MP	123.8	48.35

Table 11 :

 11 A comparison of average B i and HD i (%) for message sensitivity

		Message variants	Hexadecimal hash values	Bi	HDi%
	Structure 1	1	bedf7967520105d114e2cdf3399f52394a53e276bb104307345bacf93e317ef6	-	-
		2	60f63ae88faea074964bc5e71022d77003f61ed4dddd8b027c7826e8f31725ff	116	45.31
		3	3e7a24001b11a0a5376d55d073e5910e1bb3b98e4736793ca8bcdf4b5da27b41	127	49.60
		4	fd8fe49f2c5013871f1e291d6c74ceefeb9c4eead9a236d6b923bb04da3c7f4b	135	52.73
		5	054c289004f47fde2fd041e5e830cd4a74d9b586ba2b79835fb5ee13c7289717	139	54.29
		Average	-	129.25	50.48
	Structure 2	1	1d6238873699dd1c252e02c88e1d2a380d9b5ea8e6c09c788fa4d3955b959975	-	-
	r = 8	2	aab2bfb971b64b4349a5045d277421df6ee299dc209b0bf0ce9bfccff8bbbe8b	138	53.90
		3	c5667f505bcb289ec52be2fce9a168b72ad0de3fae396b7654f34cf419309b0f	123	48.04
		4	54b21e25c1ee818897c54e84eca15d2ddbd7b505ef81ba2c099a5c852db33b51	121	47.26
		5	f6e6702867e3c3ee86a4d86a6153b1266f58847a704665417fbc66fc39d8179f	132	51.56
		Average	-	128.5	50.19
	Structure 2	1	af5e7ca7c83a72c77f0e9b7d47df11b0f66cadc862d6f522d592dc5ad9bae938	-	-
	r = 24	2	f922e9e31c36e932ffb098930fa2726b29a1ce91c5c62b1f16981609b9b2453b	125	48.82
		3	3566ab26fff9c3a232368b624267c3397ab1099ba744ff5f6ec97a7cbc483fa5	126	49.21
		4	3b6a773dfe06e246ab3f53c3c9a0af08123346bb8a0e58a17caf6046992e08a7	130	50.78
		5	40ed183aa3cfb41d9d6f7e304d9ab05a0007044b0db84f039f4315c046051641	146	57.03
		Average	-	131.75	51.46

Table 12 :

 12 Sensitivity of hash value to the secret key for the proposed structures with MMO output scheme

Table 13 :

 13 Sensitivity of hash value to the secret key for the proposed structures with MMMO output scheme

		Message variants	Hexadecimal hash values	Bi	HDi%
	Structure 1	1	a005e50f9673ecee6e80c07c550e53f8a950cb4a91176a2a340b5822ec2f28c4	-	-
		2	27de6d91694c777474b94f2a4ec3ed8c5b5b0da8c38fed5b4c75e2e2bf97972f	143	55.85
		3	3fa8a997b46131a1429d0006b6c03f181898632313a64f3da8143d1cadd66925	122	47.65
		4	f670f60cfc1daecb0c81988735b736c8c18851cebe5b94a6f1234f49bd4d5209	117	45.70
		5	7c68bc63287bfe02badbceb99cdde6a0ef5e9e7429d1dc3d2a9bf90b34a6402c	123	48.04
		Average	-	126.25	49.31
	Structure 2	1	31882869cce69d7734f0078d29f297841b99d3f9786a1cf522688de9561826ee	-	-
	r = 8	2	0b840b10ffda4c9feb4dabf4ab2f642ffe55f730386b8d295534368af526fa33	136	53.12
		3	2f65ed46a3cb9b0ebb1cf7cd52558de58e2ebc7474b01f169a6b30067e20e5a5	134	52.34
		4	cf524afe65de3a8123e43e61540a28180f0be21669a3ca4b4d62fdca34f538b5	139	54.29
		5	27d7a12c3a95c9f52148b43d60c7dbd3acd0b774c885d712bf2bb7673b77443e	131	51.17
		Average	-	135	52.73
	Structure 2	1	a86e4c2ff1450a08a173b2d9ef27d941fcb9a06f76ad1e70108192ce3cd02a16	-	-
	r = 24	2	37235dea611e13421ca8545078d0ec3a88654cfbc4e24bd64dd110ce2ed4ea3e	121	47.26
		3	7f60df23e3570ba37890a0b199e891835757fabc67b96e2cbbd02d0f64629cb7	120	46.87
		4	d3bd1e2064cecd5851624b61019a097a00eca137bd1cff0d50b1af161185581e	127	49.60
		5	149bb7e22e3a018254a5cfb711e192471971857c96663e6ec189762548f09ca3	139	54.29
		Average	-	126.75	49.51

Table 14 :

 14 Sensitivity of hash value to the secret key for the proposed structures with MP output scheme

		Output scheme	B i	HD i %
	Structure 1	MMO	129.25	50.48
		MMMO	120.50	47.07
		MP	126.25	49.31
	Structure 2	MMO	128.5	50.19
	r = 8	MMMO	128.5	50.19
		MP	135	52.73
	Structure 2	MMO	131.75	51.46
	r = 24	MMMO	134.25	52.44
		MP	126.75	49.51

Table 15 :

 15

A comparison of average B i and HD i (%) for key sensitivity

Table 16 :

 16 Diffusion statistical-results for the two proposed structures

			Number of tests
			512	1024	2048
	Structure 1	B min	100	100	100
		Bmax	149	152	154
		B	128.11 128.22 127.95
		P	50.04	50.08	49.98
		∆B	8.11	8.17	8.03
		∆P	3.16	3.19	3.13
	Structure 2	B min	104	104	103
	r = 8	Bmax	150	151	157
		B	127.98 127.88 127.97
		P	49.99	49.95	49.99
		∆B	7.92	7.98	8.01
		∆P	3.09	3.12	3.13
	Structure 2	B min	100	100	100
	r = 24	Bmax	153	153	157
		B	127.85 127.96 127.88
		P	49.95	49.98	49.95
		∆B	8.22	8.10	7.94
		∆P	3.21	3.16	3.10

Table 17 :

 17 Diffusion statistical-results for the two proposed structures with MP output scheme

  In cryptography and computer security, a length extension attack is a type of attack where an attacker can use H(M ) and the length of M to calculate H(M ||EM ) for an attacker-controlled extended message EM . The following attack is applied on M erkle -Dåmgard structure that is transformed on keyed hash functions by adding the secret key K in the beginning of the message M (MAC ). This attack allows the inclusion of extra message (EM ) into a signed message, but needs to know the length of secret key K. Algorithms like MD5, SHA-1, and SHA-2 that are based on the M erkle -Dåmgard construction are vulnerable to these kinds of attacks. However, HMAC is not vulnerable to the length extension attacks[START_REF]Stop using unsafe keyed hashes, use hmac -rdist[END_REF].

	1. Length extension attack (Padding attack )
	2. Meet-in-the-middle preimage attack
	3. Joux attack (Multi-collision attack )
	4. Long message second preimage attack
	5. Herding attack
	Length extension attack [76,77]:

Table 18 :

 18 Hashing time, hashing throughput, and the number of cycles per Byte for Structures 1 and 2 with MMO output scheme and 2048 random tests

	Message	Structure 1		Structure 2 -r = 8	Structure 2 -r = 24
	length	HT	HTH	NCpB	HT	HTH	NCpB	HT	HTH	NCpB
	513	8.60	57.37	43.70	4.47	112.02	22.71	6.73	73.21	34.20
	1024	15.24	64.98	38.75	8.18	124.18	20.79	8.02	124.17	20.30
	2048	27.02	72.66	34.33	13.82	143.44	17.56	15.11	132.90	19.20
	4096	51.13	76.50	32.46	25.73	153.06	16.34	26.99	146.33	17.13
	10 4	122.15	78.18	31.76	60.16	159.42	15.64	62.30	153.79	16.20
	10 5	1211.30	79.14	31.49	590.16	162.70	15.34	626.89	154.21	16.29
	10 6	11972.02	79.73	31.12	5910.81 162.14	15.36	6185.43 155.61	16.08
	Message	Structure 1		Structure 2 -r = 8	Structure 2 -r = 24
	length	HT	HTH	NCpB	HT	HTH	NCpB	HT	HTH	NCpB
	513	8.53	57.72	43.34	5.16	99.80	26.21	6.89	71.12	35.02
	1024	15.11	65.65	38.42	7.78	127.88	19.77	8.03	124.46	20.40
	2048	27.21	72.30	34.56	13.47	145.78	17.11	14.32	137.94	18.19
	4096	51.71	75.81	32.83	25.40	154.57	16.13	26.67	147.56	16.93
	10 4	122.50	78.05	31.85	59.71	160.27	15.52	63.25	152.32	16.44
	10 5	1216.68	78.70	31.63	603.15	159.79	15.68	632.82	153.17	16.45
	10 6	11935.23	79.97	31.03	6015.73 160.38	15.64	6272.66 153.96	16.30

Table 19 :

 19 Hashing time, hashing throughput, and the number of cycles per Byte for Structures 1 and 2 with MMMO output scheme and 2048 random tests

	Message	Structure 1		Structure 2 -r = 8	Structure 2 -r = 24
	length	HT	HTH	NCpB	HT	HTH	NCpB	HT	HTH	NCpB
	513	8.67	57.19	44.04	4.45	111.99	22.61	6.76	73.19	34.36
	1024	14.77	66.84	37.55	7.72	128.94	19.62	7.94	124.42	20.19
	2048	27.05	72.73	34.35	13.81	143.17	17.55	16.03	127.37	20.36
	4096	51.52	76.12	32.71	27.42	145.93	17.41	28.16	141.84	17.88
	10 4	122.12	78.32	31.75	59.73	160.25	15.53	63.87	151.23	16.60
	10 5	1232.16	78.32	32.03	585.29	163.83	15.21	631.08	153.34	16.40
	10 6	11866.13	80.42	30.85	5864.95 163.29	15.24	6250.05 154.55	16.25

Table 20 :

 20 Hashing time, hashing throughput, and the number of cycles per Byte for Structures 1 and 2 with MP output scheme and 2048 random tests

Table 24 :

 24 Comparison of the statistical results of diffusion for the two proposed structures with MP output scheme and SHA2-256

	Hash		Structure 1		Structure 2 -r = 8	Structure 2 -r = 24	Wang [10]	Akhavan [17] Teh [35]
	function MMO	MMMO	MP	MMO	MMMO	MP	MMO	MMMO	MP
	NCpB	31.12	31.03	30.85	15.36	15.64	15.24	16.08	16.30	16.25	122.4	105.5	28.45

Table 25 :

 25 Comparison of NCpB of the proposed structures with three output schemes with some chaos-based hash functions

	Hash function		Structure 1		Structure 2 -r = 8	Structure 2 -r = 24	SHA2-256
		MMO	MMMO	MP	MMO	MMMO	MP	MMO	MMMO	MP
	NCpB	31.12	31.03	30.85	15.36	15.64	15.24	16.08	16.30	16.25	11.87
	Hash function VMAC HMAC GCM CMAC DMAC	CBC-MAC BLAKE 2
	NCpB	0.42	14.42	0.42	4.41	4.40	2.88	2.58

Table 26 :

 26 Comparison of NCpB of the proposed hash functions with the unkeyed and keyed standards