Keywords:

Symmetric Cryptanalysis Beyond Primitives use today: block ciphers (such as AES [AES]), stream ciphers (such as Salsa20 [Ber08]), hash functions (such as the SHA standards [SHA1; SHA2; SHA3]), and cryptographic permutations (such as ).

. Similarly, the sponge construction and its variants turn a cryptographic permutation into a hash function, a stream cipher, or an authenticated encryption. Hash functions are typically considered a primitive, but they are actually built using a mode of operation (often Merkle-Damgård or HAIFA) from a smaller primitive: a compression function.

In the last years, an important trend is the design of lightweight primitives, for use in embedded devices with very limited power (medical implants, contactless smart cards, sensor nodes, ...), where standard cryptography is too expensive. In particular, the US National Institute of Standards and Technology (NIST) has recently organized a competition to select new standards in this field. 1 Some industry applications use proprietary (non-public) algorithms, in particular for lightweight use cases where standard algorithms do not fit. In most cases, these algorithms turn out to be weak and can be broken in practice, such as CSS [Ste99] (used for the DRM system of DVDs), PC1 (used for the DRM system of Amazon ebooks) [BLR13], Keeloq [IKD+08; EKM+08] (used in car keys from multiple manufacturers), DST 40 [WMA+19] (also used in car keys) or MiFare [GKM+08] (used in transport card such as the Oyster card in London).

Asymmetric cryptography. On the other hand asymmetric cryptography, or public-key cryptography uses different keys to encrypt a message and to decrypt it. Therefore, the encryption key does not have to be kept secret, and can be widely distributed. This solves the problem of key distribution, which is a big drawback of symmetric cryptography.

The most widely used constructions today are based on hard problems from number theory: the Diffie-Hellman key exchange [DH76] relies on the hardness of computing discrete logarithms, while the RSA signature and encryption scheme [RSA78] relies on the hardness of factoring.

 or latticebased cryptosystems [Ajt96; Reg05]. The NIST has recently organized a standardization process for this type of post-quantum algorithms. 2 Hybrid systems. Many security systems rely on public-key cryptography for key establishment, but only secret-key cryptography can offer sufficient performance to process bulk messages. Therefore, in practice, we use hybrid schemes that combine public-key cryptography and symmetric cryptography.

Symmetric Cryptanalysis Beyond Primitives

Table 1.1: Symmetric cryptography usage on the web, according to different sources. Telemetry data [Moz23] is from Firefox Nightly; it represents the percentage of actual connections using each cipher. Internet scan data [Cen23] is from Censys [DAM+15]; it represents the percentage of public internet services that would use each cipher. The discrepancy in Chacha-Poly usage is due to different client-side preferences. Source Telemetry [Moz23] Internet scan [Cen23] per connection per service (host, port) Encryption AES-GCM 98.7% 61.8% Chacha-Poly 0.6% 32.9% AES-CBC 0.7% 5.2% 3DES-CBC 0.0001% 0.1% MAC HMAC-SHA256 76.7% 67.9% HMAC-SHA384 22

First, I must specially thank Anne, María and Jean-Pierre who pushed me to finally write down this manuscript and defend this habilitation. Without their regular nagging, I wouldn't be writing this acknowledgment and you wouldn't be reading it.

I would like to thank all my coauthors, without whom I wouldn't have obtained all the results presented in this thesis. In particular, I would like to thank the PhD students that I have had the pleasure to supervise: Sébastien, Ferdinand, Clara and Augustin. Working with them has been motivating and encouraging.

I am grateful to Pierre-Alain who took me in as a PhD student, and to Alex and François-Xavier who hosted me as a postdoc, for giving me the taste of research in cryptography, a challenging and fun research topic. Since 2013, I have had the pleasure of working with the Secret team at INRIA, which become known as Cosmiq in 2020. I would like to thank all past and present members of the team for welcoming me in the group, for the great interactions we've had, and for the wonderful working environment. The team owes a lot to Anne, who lead the group when it was known as Secret, and to Jean-Pierre as the current leader, but also to all the researchers, post-docs, PhD students and visitors (I will not attempt to list them because I would certainly forget someone). I particularly enjoy the discussions at the coffee break, the daily crosswords and regular occasions to share a drink together. In recent years, the atmosphere at INRIA has become less welcoming to research than it used to be, but the Cosmiq team is still a great place to work, thanks to its members.

Research is a collaborative endeavor, and I'm glad we have a great community in symmetric cryptography, so that it's always fun to meet coauthors and colleagues at conferences, or to spend some time visiting their labs. Within France, we also have regular collaboration with several groups through collaborative projects (in particular the groups in Versailles, Rennes, and Nancy), and this often led to fruitful collaborations; more generally, the C2 community is full of amazing researchers.

Finally, I would like to warmly thank Bart, Henri and Tetsu for their work reviewing my manuscript, and all the members of the jury who make me the honor of being here today: Anne, Antoine, Bart, Gregor, Henri, Karthik, Orr, Tetsu, and Vincent.

I study the construction and analysis of symmetric cryptography algorithms. Symmetric primitives are mostly standardized through open international competitions, where their security is assessed by public cryptanalysis. I have contributed to several competitions (SHA-3, CAESAR, NIST Lightweight) by designing new primitives, and analyzing the other candidates. I have also applied cryptanalysis techniques beyond primitives, to analyze the security of modes of operations, and to extend cryptanalysis results to practical settings.

I briefly mention my main results below.

Design of primitives.

I have contributed to the design of several primitives; most of them have been submitted to standardization processes:

• SIMD, a hash function submitted to the SHA-3 competition [LBF08];

• SPRING, a PRF based on a lattice construction [BBL+15];

• SCREAM an authenticated encryption algorithm based on LS-designs submitted to the CAESAR competition [GLS+14];

• Spook an authenticated encryption algorithm based on LS-designs submitted to the NIST lightweight standardization [BBB+20];

• Saturnin [CDL+20] an authenticated encryption algorithm with post-quantum security submitted to the NIST lightweight standardization [BBB+20]; we later proposed a dedicated mode of operation, with post-quantum security: QCB [BBC+21].

I have also proposed constructions for components of symmetric primitives (used in some of the primitives above):

• the LS-design methodology for block ciphers [GLS+15];

• constructions for lightweight 8-bit S-Boxes based on 4-bit S-Boxes [CDL16];

• constructions of lightweight MDS matrices [DL18].

Cryptanalysis of primitives. I have obtained important cryptanalysis results on primitives, either in the context of standardization processes, or by evaluating the security of widely used primitives. Some of my main results are:

• the first preimage attack against the full MD4 [Leu08a];

• tools for the analysis of ARX primitives [Leu12; Leu13];

• a differential-linear attack against Chaskey [Leu16b]; the attack breaks 7 rounds and has motivated the authors to increase the number of rounds from 8 to 12;

• an analysis of differential and linear cryptanalysis in the quantum setting [KLL+16b];

• a chosen-prefix collision attack against the full SHA-1 [LP19; LP20];

• a new representation of the AES key-schedule [LP21] (Eurocrypt 2021 best paper award);

x Symmetric Cryptanalysis Beyond Primitives

• attacks against the full permutation Gimli [FLN+20; FLN+21] (Asiacrypt 2020 best paper award);

• attacks against Simon and Simeck [LPS21];

• an analysis of GEA, the encryption algorithm used in GPRS showing an intentional weakness in GEA-1 [BDL+21];

• improvement of boomerang attacks against AES-based primitives [BL23];

• algebraic attacks against arithmetization-oriented primitives [BCD+20; BBL+22;LMP+23]; in particular we solved several challenges from the Ethereum Foundation. 1

Generic attacks. I also use cryptanalysis techniques more originally, in order to devise generic attacks against modes of operations or ideal constructions. Some of the results obtained are quite surprising:

• generic attacks against hash-based MACs [LPW13; DL14; DL16]; surprisingly, we obtain a key-recovery attack when the hash function uses an internal checksum, showing that the checksum makes the hash function weaker;

• a preimage attack against the sum of two hash functions, showing that the sum is often weaker than the initial functions [LW15];

• generic attack against several MACs with security beyond the birthday bound [LNS18]; this contributed to closing the gap between proofs and attacks, and we have also invalidated a previous proof;

• a generic attack against the CTR mode, showing plaintext recovery with complexity 2 n/2 [LS18];

• forgery attacks with polynomial complexity against MACs in the quantum setting [KLL+16a;BLN+21]; this shows that quantum computing has a strong impact on symmetric cryptography, in addition to asymmetric cryptography.

Practical impact of cryptanalysis. Finally, I'm also interested in the practical security impact of cryptanalysis, and I've demonstrated several attacks against concrete protocols, using weaknesses of cryptographic algorithms. In particular, I am proud that several of my works have contributed to the deprecation of obsolete standards:

• a password-recovery attack against APOP using MD5 collisions [Leu07] (CVE-2007-1558);

• a demonstration of the well-known collision attack with complexity 2 n/2 , showing that it is actually practical against block ciphers with 64-bit blocks, such as 3DES (Sweet32, CVE-2016-2183, CVE-2016-6329);

• the first chosen-prefix collision for SHA-1, using it for impersonation attack against the PGP web-of-trust [LP20] (Shambles, CVE-2019-14855);

• transcript-collision attacks against internet protocols TLS, SSH, and IPsec using chosen-prefix collisions for MD5 and SHA-1 [BL16b] (SLOTH, CVE-2015-7575 -NDSS 2016 distinguished paper award).

Focus of this thesis. In this thesis, I will explain cryptanalysis techniques that don't target directly primitives; instead I will focus on application to modes of operations and ideal constructions, and on leveraging weaknesses of primitives to break concrete protocols.

Introduction

Cryptography enables secure communication in the presence of an adversary, with tools to guarantee the confidentiality and authenticity of messages, and to authenticate users. It is a vital part of the today's digital world, where we exchange private information over the internet, we buy goods and services on the web, industrial control systems are networked, banks settle financial transactions online, and state agencies communicate remotely. Indeed, we have strong evidence that adversaries are trying to intercept communications and to penetrate computer systems, from cybercriminals to state agencies performing massive surveillance and to private companies collecting personal data for targeted advertising. Cryptographic schemes are designed with a bottom-up approach, starting from primitives that operate on small messages and achieve a well-defined security notion (such as being hard to invert). Then, primitives are used inside a mode of operation (or mode) and a protocol to deal with session establishment and arbitrary messages.

In order to allow security evaluation of the schemes, the algorithms must be published, and their security must rely on a small piece of information that is different for each user, and kept secret: the key. These principles have been established as early as 1883 by Auguste Kerckhoffs: " 1. Le système doit être matériellement, sinon mathématiquement, indéchiffrable; 2. Il faut qu'il n'exige pas le secret, et qu'il puisse sans inconvénient tomber entre les mains de l'ennemi;

Symmetric and asymmetric cryptography

The most natural cryptographic construction use the same key to encrypt a message and to decrypt it; it has been used since antiquity to protect military communications. Today, we denote the corresponding field as symmetric cryptography or secret-key cryptography.

Symmetric cryptography. Symmetric primitives are mostly dedicated designs that try to mix the key and the message in a complex way following the notions of confusion and diffusion formalized by Shannon in 1949 [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. We have four main types of primitives in

Evaluating cryptographic schemes

Since the seminal work of Goldwasser and Micali [START_REF] Goldwasser | Probabilistic Encryption[END_REF], provable security has become the accepted practice in cryptography. Proposals for new schemes and protocols are expected to come with a security reduction, showing that the system is secure under a reasonable security assumption, or security model, for the underlying primitive(s).

A security proof starts by defining a security notion, and bounds the probability (or advantage) of an adversary to break that security notion, depending on the resources she can use, and the security of the primitive. Provable security focuses on asymptotic security: a mode is secure if the bound decreases exponentially with n.

Concrete security. In order to better understand the security of cryptographic schemes, the "concrete security" [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF] approach writes explicit bounds on the security depending on the parameters of the system. This allows to select appropriate parameters. For instance, the security proofs of several CBC-MAC variants [BKR94; PR00] can be written as:

Adv PRF CBC-MAC-E ≤ Adv PRP E + σ 2 2 n ,
where E is an n-bit block cipher, and σ the amount of data authenticated. This means that CBC-MAC is a secure family of pseudo-random functions (PRF) as long as σ ≪ 2 n/2 , and the block cipher is a secure pseudo-random permutation family (PRP).

In practice, the bounds of many modes of operation include a term in the order of σ 2 /2 n , where σ is the total length of the queries made by the adversary. This means that the mode is only secure when σ ≪ 2 n/2 , which is called birthday-bound security.

Cryptanalysis. Cryptanalysis is another way to evaluate the security of cryptographic schemes, using a whole range of algorithmic knowledge to search for efficient attacks. There are classical techniques that apply to large classes of schemes (such as differential [START_REF] Biham | Differential Cryptanalysis of DES-like Cryptosystems[END_REF] and linear [START_REF] Matsui | Linear Cryptanalysis Method for DES Cipher[END_REF] cryptanalysis), but cryptanalysis is still a difficult task because these techniques must be tailored to each scheme, and new techniques must often be devised.

Cryptanalysis is a crucial part of cryptographic research because we cannot prove unconditionally that a cipher is secure. In particular, we cannot prove the security of cryptographic primitives, because we cannot reduce their security to the security of a lower-level components. Therefore, a large, public cryptanalysis effort is of utmost importance. If such an effort unveils weaknesses in a cryptographic construction, it will be deprecated, hopefully before the weaknesses lead to practical breaks. Conversely, a continued cryptanalysis effort lasting over several years without finding security weaknesses is a good way to build trust in the security of a construction. For instance the AES standard is a widely available and well trusted block cipher, because numerous experts have tried to break it in the last 25 years.

Cryptography usage in practice

Cryptography is now used routinely in our daily lives. Most of the devices with wireless communication use some kind of encryption, because radio transmissions are easy to intercept: Wi-Fi uses WEP (based on RC4) or WPA (based on AES), cell phone communications are encrypted with Kasumi, SNOW 3G, AES, or ZUC, Bluetooth uses E0, cordless phones use the DECT Standard Cipher, etc. Cryptography is also widely used to authenticate legitimate users of a system: credit cards use public-key cryptography to prove to a reader that they are genuine; wireless keys fobs or cards are used to open cars, to access public transports, or to enter buildings; and passports contain an RFID chip to authenticate them. One of the most successful deployments of cryptography in practice is the SSL/TLS protocol, with more than 80% of pages loaded on the web now encrypted with TLS. 3 It is also a good example to understand what a real-world attacker can do.

The Transport Layer Security protocol (TLS). TLS is a transport protocol that can be used to encapsulate various internet protocols. It is widely used today on the internet, with most HTTP and IMAP connection secured by TLS (HTTP over TLS is denoted as HTTPS). TLS derives from SSL, originally designed by Netscape, with SSL 2.0 released in 1995 and SSL 3.0 in 1996. Development of the protocol was then taken over by the IETF, and later versions are denoted as TLS, with four version up to date: TLS 1.0 in 1999, TLS 1.1 in 2006, TLS 1.2 in 2008, and TLS 1.3 in 2018.

TLS is a hybrid protocol, using public-key cryptography for key establishment, and symmetric cryptography to encrypt and authenticate the actual data with the session key. When a client connects to a server, they start a handshake phase, where public-key cryptography is used to authenticate the server and to establish the session key, and parameters of the connection are negotiated (in particular the choice of ciphers to use). Figure 1.1 shows a typical example of TLS handshake and data transmission.

When used properly, TLS guarantees the identity of the server (and optionally the identity of the client), and protects the data from interception and modification.

The man-in-the-browser setting. When TLS is used to secure web connections, an attacker can use the man-in-the-browser setting to mount powerful attacks in practice (Figure 1.2). This setting was first considered in the BEAST attack [START_REF] Duong | Here come the ⊕ ninjas[END_REF], and assumes that:

1. The attacker has access to the network and can read and modify network packets. This is easy to realize when the victim is connected to an open Wi-Fi network, as used in many public spaces.

2. The victim is logged-in to a valuable website (such as a webmail, or an online bank).

Since HTTP is a stateless protocol, the victim's browser uses an authentication token (usually a secret cookie) to identify queries to the website, and every HTTP query includes this token in a header. 3. The victim visits an attacker-controlled website. In practice, the attacker can use phishing, or modify a web page on the fly if the victim visits a non-encrypted website.

When those conditions are met, the attacker can use the malicious website to send arbitrary JavaScript code to the victim. This code will be executed by the victim's browser, and can make arbitrary queries to the target website (see Figure 1.3 for a concrete example). Since HTTP is stateless, every query includes the authentication token. The attacker cannot read the plaintext messages with the token or receive the answers from the target website, but she can ask for the encryption of chosen messages that include the token, and capture the corresponding ciphertexts on the network. This is a powerful attack scenario, showing that chosen-plaintext attacks are actually practical.

The attacker will try to exploit weaknesses of TLS to recover the authentication token. If she succeeds, she can use the token to authenticate as the victim on the target website, and extract all the information she wants.

The chosen-prefix secret-suffix model. In order to make attacks easier to explain, Hoang et al. have proposed a simple model to capture the type of attacks possible in the man-inthe-browser setting [START_REF] Hoang | Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance[END_REF]. The attacker must recover a secret value S, given access to an oracle that computes the encryption of M ∥ S for a chosen prefix M :

O : M → E(M ∥ S).
This is an important model because it corresponds to practical adversaries in the man-in-the-browser setting, even though chosen-plaintext attacks can seem artificial. It is also sufficiently generic to capture most attacks in practice. In particular, the attacker can vary the length of the prefix, and move the secret suffix across block boundaries. Some proofs are flawed: several high-profile modes of operations have been broken, even though they had been proven secure, such as EAX' [START_REF] Minematsu | Attacks and Security Proofs of EAX-Prime[END_REF], or OCB2 [START_REF] Inoue | Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality[END_REF]. Indeed, security proofs are very technical; it is easy to make a mistake, and hard to verify the correctness of a proof. Some proofs are not tight: when there is a gap between the proof and the best attack, more analysis is needed. For instance, CENC [START_REF] Iwata | New Blockcipher Modes of Operation with Beyond the Birthday Bound Security[END_REF] and SUM-ECBC [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF] were initially proven secure up to 2 2n/3 queries, but no attack faster than 2 n was known; after further analysis, it turned out that the security of CENC is essentially 2 n [IMV16], while the security of SUM-ECBC is about 2 3n/4 [LNS18; KLL20].

The security depends on the model used: security proofs make assumption about the power of the adversary (such as knowing or choosing the plaintext), and this has a large impact on the achieved security. For instance encryption without authentication is secure against passive adversaries, but insecure against active adversaries. More recently, cryptography have been studied in a quantum setting, and many standardized MACs proven secure in the classical setting were shown insecure [KLL+16a].

Modes with similar proofs can have different security: even if the proof is tight, the security degradation outside the domain of the proof can range from low-impact distinguishers to devastating key-recovery. For instance, PMAC is secure up to 2 n/2 queries [START_REF] Rogaway | Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC[END_REF], and there is a matching forgery attack [START_REF] Lee | Forgery and Key Recovery Attacks on PMAC and Mitchell's TMAC Variant[END_REF]. However, small variations of PMAC become susceptible to a key-recovery attack with 2 n/2 queries, even though the security proof is the same [FLS15].

Understanding attacks helps us design better modes: Understanding generic attacks also helps to design more secure modes. For instance, the generic attack by Preneel and van Oorschot [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] against iterated MACs explains the constructions used for MACs with security beyond the birthday bound: RMAC [START_REF] Jaulmes | On the Security of Randomized CBC-MAC Beyond the Birthday Paradox Limit: A New Construction[END_REF] and the Wegman-Carter MAC [START_REF] Wegman | New Hash Functions and Their Use in Authentication and Set Equality[END_REF] are randomized, while SUM-ECBC [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF] and PMAC+ [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF] use a 2n-bit internal state.

Real-world usage sometimes violates the assumptions of the proofs: SHA-1 has been broken decades ago, but it has stayed in use for a long time in protocols whose proofs assumed collision-resistance, because deprecation takes time, and attacks against primitives do not directly translate to attacks on real-world protocols (even when they invalidate the proofs). Block ciphers with 64-bit blocks (such as 3DES) have also been used with an amount of data that violates the assumptions of the proofs [BL16a].

Real-world impact of cryptanalysis

Weak cryptography can be used long after weaknesses have been found by the academic community. Unfortunately, public demonstrations of high-profile attacks seem to be the only way to convince the industry to move away from widely used standards with known weaknesses, as expressed by AlFardan and Paterson:

" Our long-term aim is to ensure that weak encryption options are eliminated from TLS, to the eventual benefit of all users of TLS. Experience shows that the only way to make this happen is to make the attacks as powerful as possible and build proof-of-concept implementations of them. Source: [START_REF] Holz | The SSL landscape: a thorough analysis of the x. 509 PKI using active and passive measurements[END_REF] (2009-2011), https://www.ssllabs.com/ssl-pulse/ (after 2012).

For instance, den Boer and Bosselaers found weaknesses in MD5 as early as 1993, with a collision attack on the compression function [dB94]. Even after the full collision attack of Wang et al. in 2004 [WY05], many users argued that collisions only had a limited impact on applications. Indeed, the attacker must choose both messages to exploit a collision, and she has little control over the values of the actual colliding messages, where the differences are inserted. In particular, MD5 continued to be used to sign website certificates, as seen in Figure 1.4. It took a public demonstration of the creation of a rogue certificate in 2009 to eliminate MD5 from certificate authorities [START_REF] Stevens | Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate[END_REF]. The same story happened with SHA-1: a collision attack has been known since 2005 [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF], but due to its high computational complexity, it was only implemented in practice in 2017, using a large GPU cluster [START_REF] Stevens | The First Collision for Full SHA-1[END_REF]. SHA-1 has been widely used until 2015, and there was still non-negligible usage of SHA-1 in 2020 (outside web certificates), when we demonstrated a practical impersonation attack against the PGP/GnuPG Web-of-Trust using weaknesses of SHA-1.

As another example, several attacks against TLS have been announced in the last years, and forced the deployment of countermeasures, even though the underlying weaknesses were known for a long time. The BEAST attack [START_REF] Duong | Here come the ⊕ ninjas[END_REF] is due to the use of predictable IVs, which was known to be an issue since at least 1995. 4 The CRIME attack [START_REF] Rizzo | The CRIME attack[END_REF] uses compression, which was seen as a problem in 2002 [START_REF] Kelsey | Compression and Information Leakage of Plaintext[END_REF]. The Lucky Thirteen [START_REF] Alfardan | Lucky Thirteen: Breaking the TLS and DTLS Record Protocols[END_REF] and POODLE [START_REF] Möller | This POODLE Bites: Exploiting The SSL 3.0 Fallback[END_REF] attacks use a padding oracle, as defined by Vaudenay [START_REF] Vaudenay | Security Flaws Induced by CBC Padding -Applications to SSL, IPSEC, WTLS[END_REF]. In 2013 and 2015, new attacks against RC4 use in TLS [ABP+13; GPv15; VP15] used biases in the keystream that have been known since 2000 [START_REF] Fluhrer | Statistical Analysis of the Alleged RC4 Keystream Generator[END_REF][START_REF] Mantin | A Practical Attack on Broadcast RC4[END_REF]. Many of these attacks are based on the man-in-the-browser attacker model.

Algorithm negotiation and downgrade attacks.

Another issue in practice is the possibility of downgrade attacks when a client and a server negotiate the protocol to use and its parameters (in particular algorithms and key sizes). Algorithm negotiation is designed so that the client and server agree on the best algorithm that they both support. However, in some cases an attacker can force them to use the worst algorithm that they support. TLS supports a huge range of ciphersuites, including modern authenticated encryption algorithms such as AES-GCM, and obsolete algorithms like DES and RC4, but the obsolete algorithms are often enabled to support legacy clients. This has been exploited in many different attacks over the years, leading deprecation of older standards and ciphers one by one. The SSLStrip [START_REF] Marlinspike | More tricks for defeating SSL in practice[END_REF] removes redirections from HTTP to HTTPS, so that the client keeps using unsecured HTTP even if the server wants to use HTTPS. The POODLE [START_REF] Möller | This POODLE Bites: Exploiting The SSL 3.0 Fallback[END_REF] attacks exploits insecure version fallback from TLS to SSL 3.0. The FREAK [START_REF] Beurdouche | A Messy State of the Union: Taming the Composite State Machines of TLS[END_REF] and Logjam [START_REF] Adrian | Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice[END_REF] attacks exploit export-grade ciphers that are weak on purpose, but that many clients and servers still supported. Downgrade attacks are also a concern in telephony network, where phones will switch to the insecure GSM network if more secure networks (3G, 4G, 5G) are jammed.

In particular, some attacks exploiting weaknesses of cryptographic algorithms are possible as long as the algorithms are supported by implementations, even if they are not used in normal conditions.

In recent years, there has been significant improvements, with TLS 1.3 disabling many legacy algorithms (in particular MD5 and SHA-1), and including a robust downgradedetection mechanism [START_REF] Bhargavan | Downgrade Resilience in Key-Exchange Protocols[END_REF]. Web browsers are also disabling TLS 1.0 and TLS 1.1, which don't offer modern authenticated encryption algorithms and depend on SHA-1.

Prelude: the birthday bound

The security of the vast majority of cryptosystems is affected by the presence of collisions. This is a well-known issue for hash functions: due to the birthday paradox we expect to find collisions in an n-bit hash function with roughly 2 n/2 queries. Intuitively, with 2 n/2 queries, there are about 2 n-1 pairs of queries, and each pair is a collision with probability 2 -n if it behaves randomly. The pairs are not independent, but assuming independence gives a simple explanation that is quite close to the truth.

More formally, we consider t independent random variables in {0, 1} n . The probability that they are all distinct is

Pr[no collision] = 1 × 2 n -1 2 n × 2 n -2 2 n × 2 n -3 2 n × . . . = t-1 i=0 1 - i 2 n ≈ exp -t 2 2 n+1
10 Symmetric Cryptanalysis Beyond Primitives A variant with two sets of random variables is also useful for cryptographic applications. Given two random subsets S, T ⊂ {0, 1} n , they have a non-empty intersection with high probability as soon as |S| • |T | ⪆ 2 n . We note that the theoretical analysis assumes independent random variables. In practice, we often apply it to cryptographic functions that are not actually random, but deviation from the random behavior would typically be a sign of a deeper weakness in the cryptosystem. Moreover, experiments can validate this heuristic analysis.

Finding collisions efficiently

The birthday paradox shows that collisions exist after roughly 2 n/2 evaluations of a random function h. This defines the security level of an ideal hash function in the informationtheoretic model, where we only count oracle calls, and we don't consider the additional computations required to locate the collision.

In practice, we find collisions efficiently by building a list of 2 n/2 inputs and outputs of the hash function, and sorting it according to the hash output. Then we locate the collisions by traversing the list. This requires O(n × 2 n/2 ) operations and O(n) memory. There are more advanced techniques with almost the same time complexity using very little memory. The rho method (ρ) by Pollard [START_REF] Pollard | A Monte Carlo method for factorization[END_REF] considers iterates of the function h: x i = h(x i-1 ). After some iterations, the values enter a cycle, and the cycle entry is a collision. Using Floyd's tortoise and hare algorithm, the cycle entry is detected with constant memory: a collision is found with O(2 n/2 ) operations and O(1) memory.

The variant of van Oorschot and Wiener [vW99] has essentially the same complexity, but uses distinguished point to allow efficient parallelization. Moreover, it generalizes well to the search for multiple collisions: finding m collisions requires a memory O(m) and time O(2 n/2 × √ m). The time complexity matches the information-theoretic lower bound up to a constant factor. When looking for a collision between two sets S and T , we sort both of them and traverse them simultaneously to locate collisions. If the sets correspond to the evaluations of two functions h and g (i.e. S = {h(x) : x}, T = {g(y) : y}), we can use the memory-less algorithms by defining a helper function

ϕ(x) = h(x) if x is odd g(x) if x is even
With constant probability, a collision in ϕ is a collision between h and g. For further details about algorithmic aspects of collision finding, we refer to the work of Joux [START_REF] Joux | Algorithmic Cryptanalysis[END_REF].

Birthday-bound security

Birthday attacks are very common across symmetric cryptography; they affect hash functions, MACs, block cipher modes of operation, and even stream ciphers [START_REF] Golic | Cryptanalysis of Alleged A5 Stream Cipher[END_REF]. In most cases, there is a matching proof and the security of the construction is well understood. However, it is important to study the security loss around the birthday bound to better understand the modes, and to select adequate parameters for real-world use.

In particular, the security of a block cipher is often reduced to the key size κ: the best attack should be the exhaustive search of the key, with complexity 2 κ . However, birthday attacks on modes of operation show that the security is threatened when 2 n/2 blocks of data are processed. Therefore, the block size n is also an important security parameter.

Surprisingly, this aspect of block cipher security is often overlooked, and block ciphers with small block size are commonly used (n = 128 is the typical case, but n = 64 is sometimes used for legacy or lightweight systems). This contrasts with the case of hash functions or stream cipher, where birthday attacks apply directly to the primitives and constructions with a state size n smaller than 160 have been deprecated.

Security beyond the birthday bound

In order to make block ciphers with a small block size more usable in practice, new modes of operation have been designed to stay secure after more than 2 n/2 blocks of data. This requires very careful design, and advanced proof techniques to demonstrate security. Some of these modes are secure up 2 2n/3 , 2 3n/4 or even 2 n blocks of data. For encryption, an important example is CENC [START_REF] Iwata | New Blockcipher Modes of Operation with Beyond the Birthday Bound Security[END_REF] a modification of the counter mode secure up to roughly 2 n blocks of data [START_REF] Iwata | CENC is Optimally Secure[END_REF]. For authentication, several MACs have been proposed with security beyond the birthday bound, such as SUM-ECBC [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF] and PMAC+ [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF]. Alternatively, several recent constructions use a tweakable block-cipher as the underlying primitive rather than a block cipher. This enables higher security without increasing the internal state size.

Outline

In this thesis, I present several results obtained by applying cryptanalysis techniques beyond primitives, to reveal properties of modes and protocols that are not captured by security proofs. Most of the results rely on finding collision between carefully crafted sets or functions, showing the importance of the birthday paradox across many aspects of symmetric cryptography.

In particular, I present many surprising or unexpected results:

• The sum of two hash functions (h 1 (m) ⊕ h 2 (m)) is often weaker than the initial functions (Chapter 2);

• SHA-1 signatures can be abused in practice (Chapter 3);

• Secure channel protocols (TLS, SSH, IPsec) are broken by chosen-prefix collisions on the underlying hash function;

• The use of an internal checksum in a hash function (as in the GOST standards) makes it weaker when used in HMAC (Chapter 4);

• Block ciphers with a 64-bit block size (3DES, Blowfish) can be abused, leading to practical plaintext recovery (Chapter 5);

• The CTR mode leaks information about the plaintext after roughly 2 n/2 blocks, just like the CBC mode (Chapter 5);

• Cryptanalysis techniques based on collisions can be used against several MACs with security beyond the birthday bound (Chapter 6);

• Widely used MAC constructions are broken in the quantum setting, even though quantum computers were believed to affect mainly public key cryptography (Chapter 7).

Generic Attacks Against Hash

Functions and Hash Combiners

This chapter begins with a review of the state of the art, and includes new results based on articles [LW15] and [START_REF] Bao | Generic Attacks on Hash Combiners[END_REF], found in Appendix A and B.

Cryptographic hash functions are crucial components in many information security systems, used for various purposes such as building digital signature schemes, message authentication codes, commitments schemes, or password hashing functions. A hash function H : {0, 1} * → {0, 1} n takes an arbitrary length input and produces an n-bit output or digest. Hash functions are used in many settings with various security requirements; the general expectation is that a hash function should behave like a random function from {0, 1} * to {0, 1} n . More concretely, the main security notions expected from a hash function are:

Collision resistance. It should be hard to find two messages M ̸ = M ′ with H(M ) =

H(M ′ ).

Second-preimage resistance. Given a challenge message C, it should be hard to find

M ̸ = C with H(M ) = H(C).
Preimage resistance. Given a target hash value H, it should be hard to find M with

H(M ) = H.
Since generic collision attacks have complexity 2 n/2 , and generic preimage (and secondpreimage) attacks have complexity 2 n , a secure hash function should have the same level of resistance.

Iterated hash functions

In practice, hash function are built by iterating a compression function with fixed-length inputs. In this chapter, we focus on narrow-pipe designs, i.e. we assume that the internal state size is the same as the output size n. The message M is first split into blocks m 0 , . . . , m L-1 ; for simplicity, we assume that the message length is a multiple of the block size, and we ignore the padding. The hash function iterates a series of compression Chapter 2. Generic Attacks Against Hash Functions and Hash Combiners 13 functions h (i) over an internal state x, with the initial value denoted as IV. Finally, the hash value is computed with a finalization function g (see Figure 2.1):

h (0) n m 0 x 0 h (1) n m 1 x 1 h (2) n m 2 x 2 x 3 H(M )
x 0 = IV x i+1 = h (i) (x i , m i ) H(M ) = g(x L , |M |)
The finalization function g takes the message length as a parameter; this is denoted as MD strengthening. For simplicity, we sometimes write h instead of h (i) , and g(x) with the length being implicit. This generic description includes two widely-used constructions as special case:

The Merkle-Damgård construction [Mer90; Dam90] uses the same compression function h for all steps (∀i, h (i) = h), as well as for the finalization (g = h). It used by standards SHA-1 [START_REF]Secure Hash Standard[END_REF] and SHA-2 [START_REF]Secure Hash Standard[END_REF].

The HAIFA construction [START_REF] Biham | A Framework for Iterative Hash Functions -HAIFA[END_REF] is a strengthened variant of the Merkle-Damgård construction where each compression function takes the block index as a parameter, and the finalization function takes a special parameter to make it different from the compression function. This avoids "cut-and-paste" attacks that move blocks of message around. This mode was used by several candidates in the SHA-3 competition, such as BLAKE [START_REF] Aumasson | SHA-3 proposal BLAKE[END_REF] and Skein [START_REF] Ferguson | The Skein Hash Function Family[END_REF].

We use the notation h * to denote the iterated compression function (without the finalization function): h * (m 0 ∥ m 1 ∥ m 2 ) = h 2 (h 1 (h 0 (IV, m 0 ), m 1 ), m 2 ). For simplicity, we also abuse this notation with an extra input argument corresponding to the initial state:

h * (x, m 0 ∥ m 1 ∥ m 2 ) = h(h(h(x, m 0 ), m 1 ), m 2 )

(with the block index implicit).

There has been a lot of work on generic attacks on iterated hash functions, in particular after the seminal multicollision attack of Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF]. There are many security notions that fall between collision-resistance and preimage-resistance, and we need cryptanalysis to understand their security. In many cases, we find attacks with complexity close to the birthday bound, but some attacks are quite involved.

Generic attacks on hash functions

The Merkle-Damgård construction was proposed because it preserves collision resistance: any collision in the iterated hash function implies a collision in the compression function. In particular, if the compression function is collision-resistant (in the sense that no collision is known, and it is infeasible to find one explicitly), then the iterated hash function is collision-resistant. Generically, finding a collision in the compression function requires 2 n/2 operations (due to the birthday paradox).

The Merkle-Damgård construction also preserves preimage resistance: a preimage in the iterated hash function implies a preimage of the finalization function. Generically, finding a preimage of the finalization function requires 2 n computations.

More generally, the Merkle-Damgård construction and its variants have been proven indifferentiable up to the birthday bound [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF]. This means that the hash function behaves like a random oracle, assuming that the compression function is ideal.

However, several generic attacks have been proposed, showing that an attacker can break some security notions if she can perform more than 2 n/2 operations. These attacks are based on special structures of messages, build from well-crafted collisions.

Collision extension

An important property of iterated hash function is that collisions in the internal state can be extended. Indeed, let us consider two messages M, M ′ of the same length. If h * (M ) = h * (M ′ ) then for any suffix S we have h * (M ∥ S) = h * (M ′ ∥ S) (this implies

H(M ∥ S) = H(M ′ ∥ S)). IV x 1 h h m ′ 0 /m 0 x 2 h h m ′ 1 /m 1 x 3 h h m ′ 2 /m 2 x 4 h h m ′ 3 /m 3 x * h h m ′ 4 /m 4 H g Figure 2.
2: Joux's multicollision.

In particular, this distinguishes a narrow-pipe hash function from an ideal hash function using O(2 n/2 ) operations (finding many related collisions is hard for an ideal hash function).

Multicollisions and attack against concatenation [Jou04]

Multicollision. A multicollision is a large set of messages M such that all messages have the same digest. In 2004, Joux introduced a simple technique to build a multicollision efficiently for narrow-pipe hash functions, as shown in Figure 2.2:

1. Starting from the IV, find a collision m 0 , m ′ 0 :

x 1 = h(IV, m 0 ) = h(IV, m ′ 0 )
2. Starting from x 1 = h * (m 0 ), find a collision m 1 , m ′ 1 :

x 2 = h(x 1 , m 1 ) = h(x 1 , m ′ 1 )
3. Starting from x 2 = h * (m 0 ∥ m 1 ), find a collision m 2 , m ′ 2 :

x 3 = h(x 2 , m 2 ) = h(x 2 , m ′ 2 )
4. . . . Since the internal states collide at every step, each collision is independent of the choice of the previous messages. After t iterations, we obtain a set of 2 t messages with the same digest:

[m 0 ∥ m 1 ∥ m 2 ∥ . . .], [m ′ 0 ∥ m 1 ∥ m 2 ∥ . . .], [m 0 ∥ m ′ 1 ∥ m 2 ∥ . . .], [m ′ 0 ∥ m ′ 1 ∥ m 2 ∥ . . .], [m 0 ∥ m 1 ∥ m ′ 2 ∥ . . .],
etc. Each step requires roughly 2 n/2 work to find a collision, so that a multicollision of size 2 t is built with complexity t • 2 n/2 in a narrow-pipe function. However, it would require roughly 2 n•(2 t -1)/2 t operations for an ideal n-bit hash function (almost 2 n for moderately large values of t).

Breaking the concatenation of two hash functions. Joux used multicollisions to break the concatenation of two hash functions: x → H 1 (x) ∥ H 2 (x), with H 1 and H 2 two narrowpipe hash functions, each with a state size of n bits. Surprisingly, the concatenation offers the same security as a single hash function, even though it has a larger internal state and a larger output size.

In order to find a collision, the attacker first builds a multicollision M of size 2 n/2 for H 1 . Then she evaluates H 2 over all messages in the multicollision, in order to find two messages (M, M ′ ) ∈ M with H 2 (M ) = H 2 (M ′ ). This produces a collision for the concatenation with complexity Õ(2 n/2 ) because all messages in M have the same hash under H 1 .

In order to find a preimage of a target value H 1 ∥ H 2 , the attacker first builds a multicollision M of size 2 n for H 1 with final state x * . Then she tries random blocks r until she finds one such that g 1 (h 1 (x * , r)) = H 1 (therefore, ∀M ∈ M, H 1 (M ∥ r) = H 1 ). Finally, she iterates over all messages M ∈ M, until H 2 (M ∥ r) = H 2 . This produces a preimage for the concatenation with complexity Õ(2 n ).

Expandable messages and second-preimage attack with a long challenge [KS05]

Expandable message. An expandable message is a large set of messages M of different lengths, such that all messages have the same digest. It is obtained with the same process as a multicollision, using messages pairs (m, m ′ ) of different lengths at each step (see Figure 2.3). Second-preimage attack. The Merkle-Damgård construction resists preimage attacks, but Kelsey and Schneier have proposed a second-preimage attack with complexity 2 t +2 n-t , assuming that we are given a challenge message C of length 2 t (Figure 2.4).

The attacker first evaluates the hash function over the challenge message C, and stores all 2 t internal states x i encountered during the computation of H(C), so that connecting to a random x i only requires 2 n-t random trials due to the birthday paradox. In order to deal with the MD strengthening, the attacker builds an expandable message M covering lengths up to 2 t , with final state x * . Then she tries random blocks r until h(x * , r) = x i * ∈ {x i }. We denote the final part of the challenge starting from x i * as C * . Finally, the attacker selects the message m of length i * -1 in the expandable message, and builds the second preimage as m ∥ r ∥ C * . We have h * (m ∥ r) = x i * , therefore h * (m ∥ r ∥ C * ) = h * (C); moreover the new message has the same length as the challenge, so that the finalization function is the same, and H(m ∥ r ∥ C * ) = H(C).

The attack is not applicable to constructions with different compression functions h (i) at each step. Actually, this was one of the motivations to introduce the HAIFA framework.

Diamond structures and herding attack [KK06]

Diamond structure. Given a set of internal states x i , the diamond structure of Kelsey and Kohno is a set of messages S i such that all internal states reach a common value x * : ∀i, h * (x i , S i ) = x * .

Kelsey and Kohno use an iterative procedure to reduce the size of the set {x i }. Starting from 2 t internal states, they evaluate the compression function with 2 n/2-t/2 random message blocks from each state. Each state is part of a collision with high probability: there are 2 n/2-t/2 successors of a given state, and 2 n/2+t/2 successors of the other states. They select a set of collisions without overlapping states, in order to obtain a new set of internal states for the next block with (essentially) half the size of the initial set. After O(t) iterations, a single final state is reached, so that building the full structure requires Õ(2 (n+t)/2 ) operations. The structure has the shape of a binary tree (as shown by Figure 2.5), and the message S i corresponding to an input state x i is obtained by following the path from a leaf to the root.

Herding attack. Kelsey and Kohno use this structure to attack commitment schemes: an attacker can publish the hash value g(x * ) (after the finalization function), and later build a message with this hash value using the diamond structure. This attack seems almost Symmetric Cryptanalysis Beyond Primitives x *

x (0) h x (1) h h

x (2) h

x (3) h h h

x (4) h

x (5) h h

x (6) h x (7) as hard as finding preimages, but it is in fact significantly easier for narrow-pipe hash functions. They describe two different scenarios:

• If the attacker has a small set of 2 t predefined messages M i , she builds a diamond structure starting from the states obtained after processing the messages (x i = h * (M i )) with complexity 2 (n+t)/2 . She publishes the common hash value g(x * ), and she knows the messages S i such that H(M i ∥ S i ) = g(x * ) for each i.

• If the attacker wants to herd any possible message to a fixed hash value, she builds a diamond structure from a set of 2 n/3 arbitrary internal states, with complexity 2 2n/3 . After publishing the common hash value g(x * ), she can generate a message S such that H(C ∥ S) = g(x * ) for any challenge C with complexity 2 2n/3 . She just has to evaluate h * (C ∥ r) for 2 2n/3 choices of r, until reaching one of the states x i in the diamond structure. Then she recovers the message S i from the diamond structure to build the full message S = r ∥ S i with H(C ∥ S) = H(C ∥ r ∥ S i ) = g(x * ).

Combiners

In order to build systems that are more resilient, a natural idea is to combine several cryptographic primitives, so that a weakness in one primitive does not break the whole system. In particular, this has been used in TLS version 1.0 and 1.1, with the XOR of two MAC algorithms (HMAC-MD5 and HMAC-SHA-1); the designers explain [RFC2246]: "In order to make the PRF as secure as possible, it uses two hash algorithms in a way which should guarantee its security if either algorithm remains secure." There are two classical combiners for hash function: the concatenation combiner H 1 (M ) ∥ H 2 (M ) and the XOR combiner H 1 (M ) ⊕ H 2 (M ) (Table 2.1). The concatenation combiner has the advantage of being robust: as long as one of the function is collisionresistant, the concatenation is collision-resistant. However, we have seen that it does not increase the security, because of the multicollision attack of Joux.

The security of the XOR combiner is not as well understood. Hoch and Shamir [START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF] proved that it is indifferentiable from a random oracle up to the birthday bound when the compression functions are modelled as random oracles (or even as weak random oracles). In particular, this implies security at least 2 n/2 for collisions and preimages. For collision resistance, the bound is tight, since it is matched with the generic birthday attack bound. However, the security against preimage attacks is an open problem: there is a trivial attack with complexity 2 n , but this leaves a gap between the best attack and the known security proof.

Our results. In the following we describe new attacks against the XOR combiner, when using two narrow-pipe hash functions with state size n bits. We first describe a new

The interchange structure

We now consider two narrow-pipe hash functions H 1 and H 2 with compression functions respectively h (i) 1 and h (i) 2 , and finalization functions g 1 and g 2 . The interchange structure is a new structure to control simultaneously the behavior of two independent hash computations which share the same input message. An interchange structure is a set of messages M and two sets of internal states, A for H 1 and B for H 2 , such that: for any value A from A and any value B from B, we can derive a message M A,B from M such that h * 1 (M A,B ) = A and h * 2 (M A,B ) = B. Therefore, we can select states from A and B independently using this structure.

The main idea is to consider several chains of internal states reached by processing a common message M from different starting points (note that the message M is not fixed in advance, but will be determined when building the structure). More precisely, the message M is denoted as the primary message, and divided in several chunks: M = M 0 ∥M 1 ∥. . . (as discussed later, a chunk will consist of several message blocks). We denote chains of internal states for H 1 as a j , and the individual states of the chain as a i j , with h * 1 (a i j , M i ) = a i+1 j . Similarly, we denote chains for H 2 as b k , with h * 2 (b i k , M i ) = b i+1 k . When considering both hash functions, message block M i leads from the pair of states (a i j , b i k ) to (a i+1 j , b i+1 k ), which is denoted:

(a i j , b i k ) Mi ⇝ (a i+1 j , b i+1 k ).

Switch structure.

First we build special structures called switches in order to jump between chains in a controlled way. A switch allows jumping from a specific pair of chains (a j0 , b k0 ) to a different pair of chains (a j0 , b k1 ) using a secondary message chunk M ′ i , in addition to the Symmetric Cryptanalysis Beyond Primitives normal transitions using chunk M i of the primary message M :

(a i j , b i k ) Mi ⇝ (a i+1 j , b i+1 k ) :
normal transition for each chain (∀j∀k)

(a i j0 , b i k0 ) Mi ′
⇝ (a i+1 j0 , b i+1 k1 ) : jump from chains (a j0 , b k0 ) to (a j0 , b k1 )

The main message chunk M i and the secondary message chunk M ′ i are determined when building the switch, with the following constraints:

h * 1 (a i j0 , M i ) = h * 1 (a i j0 , M i ′ ) h * 2 (b i k1 , M i ) = h * 2 (b i k0 , M i ′ )
We start with a multicollision of size 2 n/2 satisfying the first equality, and select two messages (M i , M ′ i ) satisfying the second equality. The chains are defined by following the main message:

a i+1 j = h * 1 (a i j , M i ) b i+1 k = h * 2 (b i k , M i )
This defines a switch structure with complexity Õ(2 n/2 ). A simple example is depicted in Figure 2.6. We note that the secondary message chunk M ′ i should only be used when the state is (a i j0 , b i k0 ).

Interchange structure.

By combining several switches, we build an interchange structure with starting points IV 1 and IV 2 and ending points {A j } and {B k } (0 ≤ j, k < 2 t ), so that we can select a message ending in any state (A j , B k ). Figure 2.7 shows one possible way to build such a structure, and Figure 2.8 shows how to select a given message in the structure. The chains a j , j ̸ = 0 and b k , k ̸ = 0 are initialized arbitrarily, and the message chunks are determined when building the switches. An interchange structure with 2 t chains for each function requires about 2 2t switches. Since we can build a switch for a cost of Õ(2 n/2 ), the total structure is built with Õ(2 2t+n/2 ) operations.

Preimage attack against the XOR combiner

Finally, we use an interchange structure with ending points {A j } and {B k }, (0 ≤ j, k < 2 t ) to build a preimage attack as follows. Let H denote the target value. We select a random message block r, and we compute two lists by evaluating the compression functions after the interchange structure: {A ′ j = g 1 (h 1 (A j , r))} and {B ′ k = H ⊕ g 2 (h 2 (B k , r))}. We expect a match between the lists with probability 2 2t-n . After about 2 n-2t random choices of r, we get a match (j * , k * ): g 1 (h 1 (A j * , r)) = H ⊕ g 2 (h 2 (B k * , r)). Therefore, we construct a preimage of H by concatenating the message leading to (A j * , B k * ) in the interchange structure, and the block r. We obtain

H 1 (M A j * ,B k * ∥ r) ⊕ H 2 (M A j * ,B k * ∥ r) = g 1 (h 1 (A j * , r)) ⊕ g 2 (h 2 (B k * , r)) = H
Complexity analysis. Building the interchange structures requires Õ(2 2t+n/2 ) evaluations of the compression function, while the preimage search requires about 2 n-t evaluations. The optimal complexity is reached when both steps take the same time, i.e. t = n/6. This gives a complexity of Õ(2 5n/6 ).

IV 1 IV 2 H 1 H 2 B A B A B A B A M M ′ M M M M M M M M ′ M M M M M

Preimage attack using cycles in the functional graph

We now assume that the hash functions H 1 and H 2 use the Merkle-Damgård construction, so that the compression function is the same at every step. This gives more freedom to the attacker, and more advanced techniques have been proposed to find preimages of the XOR combiner with a smaller complexity. In the section, we present an alternative description of the multi-cycle idea introduced in [START_REF] Bao | Functional Graph Revisited: Updates on (Second) Preimage Attacks on Hash Combiners[END_REF], to obtain a simplified attack with complexity Õ(2 3n/4 ).

This attack uses long messages that repeat a fixed message block β (for instance, β = 0). When evaluating h * on such a message, we iterate a fixed function x → h(x, β). Assuming that this function behaves as a random function, we expect to reach a cycle after roughly 2 n/2 iterations, and the cycle has length roughly 2 n/2 . More precisely, there are several components in the functional graph with cycles of different lengths; the main component has expected size 0.76 × 2 n with a cycle of expected size π/8 × 2 n/2 [START_REF] Flajolet | Random Mapping Statistics[END_REF].

We iterate the function h 1 (•, β) starting from IV 1 , until we reach a cycle; we denote the cyclic points as {A j } and its length as ℓ 1 . Similarly, we obtain a cycle {B k } of length ℓ 2 for the function h 2 (•, β) starting from IV 2 . We assume that ℓ 1 and ℓ 2 are relatively prime 1 with ℓ 1 < ℓ 2 , and of the order of 2 n/2 .

This simple structure provides an alternative way to control independently the behavior of H 1 and H 2 , by varying the length of a message M = β λ . Indeed, with λ > µ, with µ = Θ(2 n/2 ) the distance to reach both cycles, the final state is of form (A j , B k ); moreover, with a suitable choice of the indices of A j and B k we have:

h * 1 (β λ ) = A λ mod ℓ1 h * 2 (β λ ) = B λ mod ℓ2
Therefore, we obtain a message reaching a specific state (A j * , B k * ) by solving a set of modular equations: λ ≡ j * mod ℓ 1 , λ ≡ k * mod ℓ 2 . Using the Chinese remainder theorem, we deduce a length λ ≥ µ such that h * 1 (β λ ) = A j * and h * 2 (β λ ) = B k * . For a random (j * , k * ), the length λ is uniformly distributed between µ and µ + ℓ 1 ℓ 2 .

The full attack requires an expandable message to deal with the MD strengthening. It produces a message of length 2 3n/4 with the following steps, as shown in Figure 2.9:

1. Build an expandable message M, with maximum length 2 3n/4 , with final states s 1 , s 2 .

2. Find the cycle {A j } of h 1 (•, β) and the cycle {B k } of h 2 (•, β), starting from s 1 and s 2 .

3. For a random block r, match {g 1 (h 1 (A j , r))} and {g 2 (h 2 (B k , r)) ⊕ H}.

If there is a match (j * , k * ), find the length λ such that h * 1 (s 1 , β λ ) = A j * and h * 2 (s 2 , β λ ) = B k * using the Chinese remainder theorem. If λ < 2 3n/4 , select the message m of length 2 3n/4λ -1 in the expandable message. The preimage is M = m ∥ β λ ∥ r.

Otherwise, repeat Step 3.

Complexity analysis.

Step 1 has complexity O(2 3n/4 ) and step 2 has complexity O(2 n/2 ).

Each iteration of Step 3 (for each try of r) has complexity O(2 n/2 ). On average there is a single match (j * , k * ), and the probability that λ < 2 3n/4 is 2 -n/4 . Therefore, we expect 2 n/4 iterations, with a total complexity 2 3n/4 .

IV 1 IV 2 s 1 s 2 H 1 H 2 {A j } {B k }

Improved preimage attack using cycles in the functional graph

Finally, we present the best known attack, with complexity 2 3n/5 . This unpublished attack is an improved variant of the attack given in [START_REF] Bao | Generic Attacks on Hash Combiners[END_REF], using the short cycle idea from [START_REF] Gilbert | Generic Attack on Duplex-Based AEAD Modes Using Random Function Statistics[END_REF]; it is a joined work with Xavier Bonnetain, Rachel Heim Boissier and André Schrottenloher. The first improvement is to consider several connections from the IV to the cycle. In the final step, each target (A j , B k ) can now be reached in many different ways, and this improves the probability that one of the corresponding messages β λ is short. In order to build the connections efficiently, we precompute 2 3n/5 points in the functional graph, together with their distance to a fixed cyclic point. Therefore, starting from a random point, we only need 2 2n/5 iteration to reach a precomputed point, and to deduce the connection to the cycle. Moreover, we use an interchange structure to provide independent choices of the connections in H 1 and H 2 .

The second improvement is to select a value β such that the cycles in the main component of h 1 (•, β) and h 2 (•, β) are shorter than average, with ℓ 1 , ℓ 2 ⪅ 2 9n/20 . This requires on average 2 n/10 random choices of β, and each trial requires 2 n/2 evaluations of the compression function in order to identify the main cycle. Thanks to the shorter cycles, the length λ computed from the Chinese remainder theorem will be at most ℓ 1 ℓ 2 ≈ 2 9n/ 10 .

The attack produces a message of length 2 3n/5 with the following steps (see Figure 2.10):

1. Build an expandable message M, with maximum length 2 3n/5 , with final state s 1 , s 2 .

2. Build an interchange structure I with 2 n/20 endpoints {x u } and {y v }, starting from (s 1 , s 2 ).

3. Find β such that ℓ 1 , ℓ 2 ⪅ 2 9n/20 . Denote the cycle of h 1 (•, β) as {A j } and the cycle of h 2 (•, β) as {B k }.

4. Precompute a set of 2 3n/5 points in the main component of h 1 (•, β) and h 2 (•, β), with known distances to the main tree root.

5. Choose 2 3n/20 random blocks ρ w ; for all interchange endpoints x u and y v compute the distance from h 1 (x u , ρ w ) and h 2 (y v , ρ w ) to the respective cycle.

6. For a random block r, match {g 1 (h 1 (A j , r))} and {g 2 (h 2 (B k , r)) ⊕ H}.

If there is a match (j * , k * ), then for each x u , y v , ρ w , find the length λ such that h * 1 (x u , ρ w ∥ β λ ) = A j * and h * 2 (y v , ρ w ∥ β λ ) = B k * using the Chinese remainder theorem. If λ < 2 3n/5 , select the message µ such that h * 1 (s 1 , µ) = x u , h * 2 (s 2 , µ) = y v in the interchange structure and the message m of length 2 3n/5 -λ-2-|µ| in the expandable message. The preimage is M = m ∥ µ ∥ ρ w ∥ β λ ∥ r.

Otherwise, repeat Step 6.

Complexity analysis.

Step 1 has complexity O(2 3n/5 ); step 2 has complexity Õ(2 n/2 + 2 2×n/20 ) = Õ(2 3n/5 ); step 3 has complexity Õ(2 3n/5 ); step 4 has complexity O(2 3n/5 ).

Step 5 has complexity O(2 3n/20 × 2 n/20 × 2 2n/5 ) = O(2 3n/5 ) using the points precomputed at step 4. Since we use the main component of h 1 (•, β) and h 2 (•, β), each point h 1 (x u , ρ w ) or h 2 (y v , ρ w ) has a constant probability to reach the cycle.

Each iteration of Step 6 (for each try of r) has complexity ℓ 2 = O(2 9n/20 ). There is a match (j * , k * ) with probability O(2 2×9n/20-n ) = O(2 -n/10 ). In this case we obtain 2 n/20 × 2 n/20 × 2 3n/20 = 2 n/4 candidates λ; each one is smaller than 2 3n/5 with probability Ω(2 3n/5 /2 2×9n/20 ) = Ω(2 -3n/10 ); in total, we obtain one λ < 2 3n/5 with probability 2 n/4 × 2 -3n/10 = 2 -n/20 . Therefore, we expect O(2 3n/20 ) iterations of Step 6, with a total complexity O(2 3n/20 × 2 9n/20 ) = O(2 3n/5 ).

Conclusion

The interchange structure is a novel construction that gave the first generic attack against the XOR combiner. This result is rather surprising: the sum of two ideal narrow-pipe hash functions only has about 5n/6 bits of security against preimage attacks. In particular, the sum is weaker than the initial functions. More advanced attacks reduce this complexity in the case of Merkle-Damgård hash functions: the best known attack has complexity 2 3n/5 . Since many practical hash functions are narrow-pipe (e.g. SHA-1, SHA-2, Whirlpool, Using an identical-prefix collision attack, it is hard to generate a collision with different meaningful identities. However, it is possible to generate a collision with two different keys for the same identity. The attacker starts the collision attack after processing id, and hides the colliding messages M, M ′ inside the cryptographic keys (Figure 3.1). This was demonstrated on X.509 certificated signed with MD5 [START_REF] Lenstra | On the Possibility of Constructing Meaningful Hash Collisions for Public Keys[END_REF]. The attacker generates RSA moduli with known factorization by choosing only the low-order bits.

IV P M M ′ S id k
A chosen-prefix collision gives more freedom to the attacker. She can use two different identities id, id ′ as prefixes, and compute a collision (Figure 3.2). If id is her identity, and id ′ the identity of a victim, this results in an impersonation attack, because she obtains a valid certificate under the name of id ′ . This was demonstrated on X.509 certificates signed with MD5 [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF], and a more advanced variant of this attack resulted in a rogue certificate authority [START_REF] Stevens | Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate[END_REF].

Our results. In this chapter we present new chosen-prefix collision attacks, and new applications of CP collisions. In particular, we have computed the first SHA-1 CP collision. The main goal of those results is to demonstrate that weaknesses of MD5 and SHA-1 are not just theoretical issues: they can be exploited to mount practical attacks against real-world systems.

We assume that the hash function considered is an n-bit narrow pipe primitive, based on a Merkle-Damgård-like operating mode. In addition, we assume that the compression function is built upon a block cipher in Davies-Meyer mode: h(x, m) = E m (x) + x, with + a group operation (MD5 and SHA-1 use modular addition).

From collisions to chosen-prefix collisions

The most widely used hash functions since the 1990's are based on similar design principles, and are collectively called the MD-SHA family:

MD4 [Riv91], MD5 [RFC1321],
SHA-1 [START_REF]Secure Hash Standard[END_REF], SHA-2 [START_REF]Secure Hash Standard[END_REF] (SHA-2 is a family of functions including SHA-224, SHA-256, SHA-384 and SHA-512). There is a large body of previous work on cryptanalysis of the MD-SHA family. In particular, the early members of the family have been broken in practice, with actual collisions given for MD4 [Dob96; WLF+05], MD5 [WY05], and SHA-1 [WYY05; SBK+17] (Table 3.1). On the other hand, SHA-2 is still considered secure. SHA-3 does not follow these design principles and is also considered secure.

Cryptanalysis of the MD-SHA family

Collision attacks against MD-SHA hash functions are based on differential cryptanalysis, where an attacker manages to somewhat control the output of the compression function. Several important ideas were used to turn differential cryptanalysis into an effective tool against hash functions:

Local collisions [START_REF] Dobbertin | RIPEMD with Two-Round Compress Function is Not Collision-Free[END_REF]. An important trick to build high probability differential trails is to construct local collisions: small message differences whose influence is immediately corrected with other message differences inserted in the subsequent steps. In MD4 and MD5, this trick ensures many rounds without any difference in the internal state, so that those rounds don't contribute to the probability.

Linearization [CJ98]. In order to build differential trails with high probability for SHA-1, a linearized version of the step function is used. Thanks to the linearity of the message expansion, a combination of disturbances and corrections gives a series of local collisions. Differential trails with a low-weight output difference δ O can be used to find near-collisions in the compression function (i.e. two outputs that are close to a collision).

Message modification [BC04; WYY05].

In a differential attack against a hash function, the attacker can choose messages that directly satisfy some of the constraints of the path, because there is no secret key. While the conditions in the first steps are easy to satisfy, more advanced techniques have been introduced to extend the usage of these degrees of freedom to later rounds in order to speed-up collision search: neutral bits (firstly introduced for cryptanalysis of SHA-0 [BC04; BCJ+05]), message modifications [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF] and boomerangs/tunnels [Kli06;JP07].

Non-linear trails [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF]. In order to get more flexibility on the differential trails, the first few steps can use non-linearity instead of following the constraints of the linearized step function. This does not affect the complexity of the search for conforming messages (thanks to message modification techniques), but it allows building trails from an arbitrary input difference to a good fixed output difference δ O (or its opposite -δ O ).

Multi-block technique [CJ98; WYY05]. The multi-block technique takes advantage of the Davies-Meyer construction used inside the compression function (h(x, m) =

E m (x) + x). Because of the feed-forward, an attacker can use several differential trails in E, and several near-collisions blocks, to iteratively affect the internal state.

In particular, using non-linearity in the first steps, she can derive two related trails 0

δ M ⇝ δ O and δ O -δ M
⇝ -δ O in E from a single linear trail, by swapping the message pair. When conforming messages are found for each block, this leads to a collision because the internal state differences cancel out (see Figure 3.3).

Birthday phase for chosen-prefix collisions [SLW07; Ste13

]. Differential techniques have also been used for chosen-prefix collision attacks. An attacker can relax the last steps of the differential trail to allow a set D of output differences rather than a single δ O . She can also use several differential trails, and use the union of the corresponding sets. Starting from two different prefixes P, P ′ , the chosen-prefix collision attack has two stages (see Figure 3.4):

• In the birthday stage, the attacker uses a generic collision search with message blocks m 0 , m ′ 0 to reach a difference δ = H(P ′ ∥ m ′ 0 ) -H(P ∥ m 0 ) in D with complexity roughly π • 2 n /|D|.

• In the near-collision stage, she builds a differential trail δ ⇝ -δ using nonlinearity in the first steps, and searches for a conforming message to build the chosen-prefix collision.

Multi-block for chosen-prefix collisions [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF]. If a collection of differential trails affecting separate parts of the internal state is available, chosen-prefix collision attacks can be greatly improved. In particular, if an arbitrary input difference δ R can be decomposed as δ R =δ

(1)

O + δ (2) O + • • • + δ (r)
O , where each δ

(i)
O can be reached as the output of a differential trail, the attacker just has to find near-collision blocks with output differences δ Alternatively, if this only covers a subset of input differences, the multi-block technique is combined with a birthday stage. This approach was notably applied to MD5 [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF].

New techniques for chosen-prefix collisions

The CP collision attack against MD5 [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF] uses dedicated differential paths in order to control separate parts of the internal state difference. This requires dedicated analysis to find suitable trails. In this section we present a more generic way to build CP collision attacks, reusing an existing collision attacks. This is particularly well-suited to SHA-1, given the limited freedom in the construction of differential trails.

The main improvement comes from how we use multiple near-collision blocks. For instance, let us consider a trail allowing a set D of output differences. Using two nearcollision blocks we can start from any difference in the set S := {δ 1 + δ 2 : δ 1 , δ 2 ∈ D}, and cancel it iteratively with a first block following a trail δ 1 + δ 2 ⇝ -δ 1 and a second block following a trail δ 2 ⇝ -δ 2 . The set S grows with the number of blocks: this reduces the cost of the birthday search in exchange for a more expensive near-collision stage.

While there are previous chosen-prefix collision attacks using several near-collision blocks [LPR+07; Pey07; SLW07; SSA+09; MRS15], these attacks use a collection of differential trails to impact different parts of the state (each block uses a different trail). Previous chosen-prefix collision attacks based on a single trail (against SHA-1 [Ste13] and MD5 [SSA+09, Section 6]) used only one near-collision block. On the opposite, our technique can be used with a single differential trail, or a collection of trails without any special property.

Overview of the attack. Our strategy is composed of two phases. After processing the two prefixes, the first phase uses a generic birthday search to reach a chaining value difference in a predefined set S. In the second phase, we use several near-collision blocks to map the chaining variable difference to a collision, using techniques developed for collision attacks.

The second phase is the most challenging. The attacker uses a graph G, where each node represents a chaining variable difference in the set S. A directed edge from node i to node j represents a way for an attacker to reach chaining variable difference j from difference i with a single message block; the details of the differential trail are attached to the edge. A path in the graph from a node δ to the node 0 corresponds to a sequence of output differences that ends up with a collision.

Building the set S and the graph G

We consider that the attacker knows some good core differential trails for the internal block cipher E, that is differential trails that go from early steps to late steps of E. We denote the set of all possible output differences as D (in particular, we have 0 ∈ D, and δ ∈ D ⇐⇒ -δ ∈ D because of symmetries).

We further assume that any input difference for E can be mapped to any of the core differential trails inside the primitive. With functions of the MD-SHA family, this is achieved with the non-linear part of the trail in the first steps of the function.

Simple graph. For simplicity, we fix a maximum number of block t for the near-collision phase. We deduce that the set of differences that can be corrected is

S := {δ 1 + δ 2 + • • • δ t : δ 1 , δ 2 , . . . δ t ∈ D}.
We build the graph G by adding an edge between nodes i and j when ij ∈ D. We obtain a simple attack by taking the shortest paths in this graph, as illustrated by Figure 3.6.

IV H m 1 m 2 ⟨δ M ⟩ ⟨-δ M ⟩ ⟨0⟩ ⟨δ I ⟩ ⟨δ O ⟩ ⟨δ O ⟩ ⟨-δ I ⟩ ⟨-δ O ⟩ ⟨0⟩ ⟨δ O ⟩ ⟨0⟩ N L 1 N L 2 L L
cv S H m 2 ⟨ δ M ⟩ ⟨ δ ⟩ ⟨ δ I ⟩ ⟨ -δ ⟩ ⟨ δ ⟩ ⟨ 0 ⟩ N L 1 L ⟨ δR ⟩ m 1 δ ∈ S
O + δ (2) O + • • • + δ (r)

O

, where each δ

(i)
O can be reached as the output of a differential trail. Clustering. In order to minimize the complexity of the near-collision phase of the attack, we use a clustering technique to exploit multiple paths in the graph (see Figure 3.7). Indeed, the search for near-collision blocks is a random process that generates many message pairs following the trail until some intermediate step, and verifies the final difference. Therefore, the attacker does not have to commit to a fixed output difference. If a single core trail produces several output differences that correspond to useful edges in the graph, the attacker can run the search for near-collision blocks and stop as soon as one of them is obtained.

Concretely, let us assume we have two output differences δ 1 and δ 2 compatible with the same differential trail, that can each be reached with a cost of C block . There are two different ways to erase a difference -δ 1δ 2 in the state:

• a block with difference δ 1 , followed by a block with difference δ 2 ;

• a block with difference δ 2 , followed by a block with difference δ 1 .

If we don't decide in advance the target difference for the first block, the search is expected to reach either δ 1 or δ 2 with a cost of only 0.5 C block , leading to an attack complexity of 1.5 C block rather than 2 C block .

Bi-directional search. Since the CP collision attack is essentially a path search in a graph, we use a bi-directional search to reduce the size of the precomputed graph. More precisely, when we evaluate the cost of a node, instead of just looking it up in the graph, we recompute all edges starting from the current node to see if they reach the graph. Indeed, the complexity of the birthday search is essentially π • 2 n /|S|, therefore we need a large set S, but storing it becomes an issue. This is illustrated by Figure 3.8, where black dots correspond to precomputed nodes stored in the graph, and white dots are only computed during the online phase. We can't compute exactly the size of the implicit graph, but we can evaluate it experimentally.

Implicit edges. We build the graph with a fixed set D of potential output differences with high probability. However, the messages produced by the near-collision block search can reach many other output differences. Some of them can be useful in our attack, even if they have a lower probability: we can use a block as long as the new state difference is closer to a collision. Therefore, during the near-collision phase, we also keep blocks that don't correspond to a difference in D, and look up the new state difference in the graph.

Chosen-prefix collision attack against SHA-1

To apply the method to SHA-1, we reuse as much as possible the details of the collision attack from [START_REF] Stevens | The First Collision for Full SHA-1[END_REF]. In particular, we use the best core trail known for attacks against SHA-1, and we reuse the GPU code from the collision attack [START_REF] Stevens | The First Collision for Full SHA-1[END_REF]. We denote the complexity to find a block conforming to the trail (with an optimal output difference) as C block ; this cost was estimated as C block = 2 64.7 SHA-1 evaluations on a GTX-970 GPU.

Improvements to near-collision block search

As a first contribution, we propose improvements to the collision attack from Eurocrypt 2013 [Ste13] and its GPU implementation from Crypto 2017 [START_REF] Stevens | The First Collision for Full SHA-1[END_REF]. Through better use of degrees of freedom (message modifications and boomerangs) and code improvements, we gained a factor between 8 and 10 (depending on GPU architecture) on the time needed to find a conforming block.

With these improvements, we obtain the cost of a near-collision block as C block = 2 61.2 SHA-1 evaluations on a GTX-970 GPU, and C block = 2 61.6 on a GTX 1060.

Parameters of the attack

Differential trails. As in the previous chosen-prefix collision attack on SHA-1 [Ste13], we consider several variants of the core trail by changing some of the message constraints in the last steps (in particular, we flip the sign of some message bits), and we relax the last steps to reach a larger set of output difference. However, we do this more exhaustively than Stevens: he only describes a set D of size 192 with cost at most 1.15 • C block , but we found a set of size 8768 with cost at most 8 • C block , including 576 values with cost at most 1.15 • C block . In particular, this directly leads to an improvement of the single-block chosen-prefix collision from [Ste13], with complexity roughly π • 2 160 /8768 ≈ 2 74.3 , rather than π • 2 160 /192 ≈ 2 77 .

Building the graph G. We first build a graph with all nodes that are reachable with a path of cost at most 24 C block and up to 10 blocks. This results in a graph with 2 36.2 nodes, which requires 2 TB of storage (storing only the nodes and their cost). Using the bi-directional method above, our simulations show that there are around 2 38 differences δ that can be used in this attack, with at most 11 blocks. Further simulations show that the average cost from a node in the graph to a collision is around 2 C block when using implicit edges.

Running the attack in practice

Running an attack on this scale is a significant challenge. Following previous work [KPS15; SBK+17], we use GPUs for this computation, because they offer a better performance/price ratio.

Overall, for the attack parameters chosen, the birthday part costs about 2 62.05 SHA-1 computations, while the near-collision part is expected to require 1 C block for the last block, and 1 C block in total for all the previous blocks. The total complexity is estimated as equivalent to 2 63.5 SHA-1 evaluations on a GTX 1060 GPU, less than four times higher than the cost of an identical-prefix collision. Since SHA-1 is a 160-bit hash function, the expected security level for (CP) collision attacks is 2 80 . A GPU cluster. When running this computation in 2019, we originally estimated that our attack would cost around US$ 160k by renting GPUs from a cloud provider such as Amazon or Google (using spot or preemptible prices). However, since our computations do not require communication between the GPUs, nor fancy inter-GPU task scheduling, we instead rented cheaper GPUs from providers that use gaming or mining cards in consumer-grade PCs, rather that the datacenter-grade hardware used by big cloud providers. Services like gpuserversrental.com rented GTX 1060 or GTX 1080 GPUs for a price below 5 cents per month per CUDA core; this translates to a total cost around US$ 75k to compute a chosen-prefix collision.

Our cluster was made of 150 machines with 6 GPU each (with a mix of GTX 1060 3G, and GTX 1060 6G), and one master node with two 2 TB hard drives in a RAID configuration. The master node had a Core i7 CPU, but the GPU nodes had low-end Pentium or Celeron CPU with two cores.

Running the attack. The birthday phase is relatively straightforward, using the parallel collision search of van Oorschot and Wiener [vW99].

The near-collision phase is very technical and very complex. Every time a block is found, we have to prepare the search for the next block. This first requires traversing the graph G to find the parameters for the next block, and to generate a new non-linear trail for the early steps. We used tools similar to [START_REF] De Cannière | Finding SHA-1 Characteristics: General Results and Applications[END_REF], which take a lot of parametrization and trial-and-error to have a proper non-linear trail that fits nicely with the core differential path. This was automated to some extent, but still took between a few hours and a few days of manual work to prepare for each block.

After two months of computations, we successfully obtained a CP collision for SHA-1. Our collision uses only 9 near-collision blocks because some implicit edges correspond to shortcuts in the graph.

Impersonation attack against the PGP Web-of-trust

Our demonstration of a chosen-prefix collision targets the PGP/GnuPG Web of Trust. More precisely, our goal is to create two PGP keys with different UserIDs, so that key B is a legitimate key for Bob (to be signed by the Web of Trust), but the signature can be transferred to key A which is a forged key with Alice's ID. This will succeed if the hash values of the identity certificates collide, as in previous attacks against X.509 MD5-based certificates [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF][START_REF] Stevens | Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate[END_REF]. Moreover, due to details of the PGP/GnuPG certificate structure, our attack can reuse a single CP collision to target arbitrary users Alice and Bob: for each victim, the attacker only needs to create a new key embedding the collision, and to collect a SHA-1 signature. This is arguably the first practical attack against a real-world security application using weaknesses of SHA-1.

Exploiting a chosen-prefix collision

We focus on the identity certificates that will be hashed and signed. Following [START_REF] Finney | OpenPGP Message Format[END_REF], the hash computation done during certificate signing includes the public key packet, then a UserID or user attribute packet, and finally a signature metadata packet and a trailer. Our attack uses two public keys of different sizes, so that the remaining fields to be signed are misaligned, and we can hide the UserID of key A in another field of key B. Following RFC 4880, the signature metadata packet is protected by a length value at the beginning and at the end, so that we have to use the same signature metadata packet in key A and key B (we cannot stuff data in the hashed subpacket). Therefore, we can only play with the UserID and/or user attribute packets. Still, a user attribute packet with a JPEG image gives us enough freedom to build colliding certificates, because typical JPEG readers ignore any bytes after the End of Image marker (ff d9). This gives us some freedom to stuff arbitrary data in the certificate.

More precisely, we build keys A and B as follows. Key A contains an 8192-bit RSA public key, and a UserID field corresponding to Alice. On the other hand, key B contains a 6144-bit RSA public key, and a user attribute containing a JPEG image.

Content of identity certificates. Figure 3.9 shows a template of the values included in the identity certificate: those values are hashed when signing a key, and we want the two hashes to collide. In this example, the UserID field of key A contains "Alice <alice@example.com>", and the image in key B is a valid JPEG image that will be padded with junk data after the End of Image marker. The real JPEG file is 181 bytes long 1 (from ff d8 to ff d9), and it is padded with 81 bytes, so that the file included in the key is 262 bytes long (here the padding includes 46 bytes corresponding to the end of the modulus of key A, 5 bytes corresponding to the exponent of key A, and 30 bytes corresponding to Alice's UserID).

After computing the CP collision, we obtain a pair of keys with colliding certificates:

• https://sha-mbles.github.io/alice.asc

• https://sha-mbles.github.io/bob.asc 1 Building a JPEG image smaller than 256 bytes is not easy, but it is possible.

0x0000 99 04 0d 04 ** ** ** ** 01 20 00 ?? ?? ?? ?? ?? 99 03 0d 04 ** ** ** ** 01 18 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0x0040 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

. . . . . . 0x02c0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Collision here! The colors correspond to the packets hashed when computing the signature: first, the public key packet public key packet (with header), then the UserID UserID or user attribute user attribute, and finally the signature packet and trailer signature packet and trailer. Arrows show when a value is chosen in one key and copied to the other. We use the following symbols: 01 Value fixed by the specifications, or chosen in advance (length of fields, UserID, ...) ?? Bytes determined by the chosen-prefix collision algorithm !! Bytes selected after finding the collision, to generate an RSA modulus .. Bytes that are copied from the other certificate ** Time-stamps chosen by the attacker $$ Time-stamp chosen by the signer Underlined values correspond to packet headers (type and length).

Symmetric Cryptanalysis Beyond Primitives

A B m 1 = g x , info A m 2 = g y , info B k = kdf(g xy ) k = kdf(g xy ) sign(sk A , H(m 1 ∥ m 2 )), mac(k, A) sign(sk B , H(m 1 ∥ m 2 )), mac(k, B)

Transcript collision attacks

Many popular cryptographic protocols have been defined using hash functions MD5 and SHA-1, which are vulnerable to collision attacks and chosen-prefix collision attacks. Practitioners commonly believe that collisions only affect non-repudiable signatures (like certificates), but that signatures and MACs used within protocols are safe as long as they include unpredictable contents, such as nonces [START_REF] Hoffman | Use of Hash Algorithms in Internet Key Exchange (IKE) and IPsec[END_REF][START_REF] Hoffman | Attacks on Cryptographic Hashes in Internet Protocols[END_REF]. In these cases, protocol folklore says that a second preimage attack would be required to break these protocols, and such attacks are still considered hard, even for MD5.

Conversely, theoretical cryptographers routinely assume collision-resistance in proofs of security for these protocols. For example, various proofs of TLS [JKS+12; KPW13; GKS13] assume collision-resistance even though the most popular hash functions used in TLS at the time were MD5 and SHA-1. Whom shall we believe? Either it is the case that cryptographic proofs of these protocols are based on too-strong (i.e. false) assumptions that should be weakened, or that practitioners are wrong and collision resistance is required for protocol security.

In this section, we clarify this situation by investigating the use of hash functions in the authenticated key exchanges. We describe a generic class of attacks called transcript collision attacks, demonstrating that, contrary to common belief, collisions can be used to break fundamental security guarantees of these protocols.

Authenticated Key Exchange

Authenticated Key Exchange (AKE) protocols are executed between two parties, usually called client and server or initiator and responder, in order to establish a shared session key that can be used to encrypt subsequent messages. A typical example is the SIGMA' protocol depicted in Figure 3.10. This protocol is a variant of the basic SIGMA (sign-andmac) protocol from [START_REF] Krawczyk | SIGMA: The "SIGn-and-MAc" Approach to Authenticated Diffie-Hellman and Its Use in the IKE Protocols[END_REF] which served as the inspiration for the key exchanges used in many protocols including IKE, OTR, and JFK.

In SIGMA', the initiator A first sends a message m 1 to B, consisting of a Diffie-Hellman public value g x , along with some protocol-specific parameters info A that may include, for example, a nonce, a protocol version, a proposed ciphersuite, etc. B responds with a message m 2 containing its own Diffie-Hellman public value g y and some parameters info B .

A and B have now completed an anonymous Diffie-Hellman exchange and can compute the shared secret g xy and use it to derive the session key. However, before using the session key, they authenticate each other by exchanging digital signatures over the protocol transcript H(m 1 ∥ m 2 ) using their long-term signing keys (sk A , sk B ). (Digital signature algorithms typically hash their arguments before signing them, and we have chosen to make this hashing explicit in our presentation of SIGMA'.) By signing the transcript, A and B verify that they agree upon all the elements of the key exchange, and in particular, that a network attacker has not tampered with the messages. Finally, A and B also prove to each other that they know the session key g xy by exchanging MACs computed with this key over their own identities. Like other AKE protocols, SIGMA' aims to prevent message tampering, peer impersonation, and session key leakage, even if the network and other clients and servers are under the control of the adversary. Formally, authenticating the transcript guarantees matching conversations, that is, that the two parties agree on each other's identity and other important protocol parameters.

A B M m 1 = g x , info A Finds x ′ , y ′ , info ′ A , info ′ B s.t. H(g x ∥ info A ∥ g y ′ ∥ info ′ B ) = H(g x ′ ∥ info ′ A ∥ g y ∥ info B ) m ′ 1 = g x ′ , info ′ A m 2 = g y , info B m ′ 2 = g y ′ , info ′ B H(m 1 ∥ m ′ 2 ) = H(m ′ 1 ∥ m 2 ) sign(sk A , m 1 ∥ m ′ 2 ), mac(g xy ′ , A) sign(sk A , m ′ 1 ∥ m 2 ), mac(g x ′ y , A) sign(sk B , m ′ 1 ∥ m 2 ), mac(g x ′ y , B) sign(sk B , m 1 ∥ m ′ 2 ), mac(g xy ′ , B)

Transcript collision attacks

The alert reader will notice that SIGMA' does not in fact guarantee that A and B agree on the message sequence m 1 ∥ m 2 ; it only guarantees that they agree on the hash of this sequence. What if a network attacker were to tamper with the messages, so that A and B see different message sequences but the hashes of the two sequences is the same? In that case, the protocol will proceed to completion but the integrity and authentication guarantees no longer hold. Figure 3.11 illustrates such an attack in the man-in-the-middle setting. The attacker intercepts messages sent between A and B. She sends her own message m

′ 1 = g x ′ ∥ info ′ A to B and her own response m ′ 2 = g y ′ ∥ info ′ B to A.
Suppose she can choose these messages such that the authenticated transcripts match:

H(m 1 ∥ m ′ 2 ) = H(m ′ 1 ∥ m 2 )
We call this a transcript collision. Now, the attacker can simply forward A's signature over this transcript to B and vice versa. A and B will accept the signatures since the hashed transcripts match and the signing keys are correct. However, the attacker knows the session keys (g x ′ y , g xy ′ ) on both connections (since she knows x ′ , y ′ ). Hence, the attacker has fully hijacked both connections and can now send messages to B pretending to be A and to A pretending to be B. This is an impersonation attack that breaks peer authentication.

If the boundaries between the messages m 1 and m 2 are not clearly demarcated, there are a number of trivial attacks that can ensure that m 1 ∥ m ′ 2 = m ′ 1 ∥ m 2 with no need for hash collisions. In the following examples, we will assume that each message (and each message field) is prefixed with its length.

A generic transcript collision

The main challenge in implementing the attack in Figure 3.11 is that the attacker has to compute the messages m ′ 1 and m ′ 2 after receiving m 1 but before the responder has sent her response m 2 . The feasibility of the attack depends on the contents and formats of these messages.

Suppose the responder B always sends the same message m 2 for every request; that is, she uses the same (static) Diffie-Hellman value g y and same parameters info B . This situation occurs, for example in protocols like QUIC, where the server uses a static configuration. In that case, after receiving m 1 , the attacker can compute a transcript collision by finding

x ′ , y ′ , info ′ A , info ′ B such that H(m 1 ∥ m ′ 2 ) = H(m ′ 1 ∥ m 2 )
. This requires 2 n/2 hash evaluations, because of the birthday paradox.

A chosen-prefix transcript collision

We now consider a more efficient attack that works even when B sends an unpredictable m 2 containing a fresh (ephemeral) Diffie-Hellman value g y and a previously unknown info B . However, we assume that the length of m 2 (ℓ m ) is fixed and known to the attacker. Moreover, suppose that in the second message of SIGMA', info B is allowed to have arbitrary length and arbitrary contents. That is, even if info B has junk data at the end, A will accept the message. Specifically, suppose that info B = len B ∥ data B where data B is opaque data that will be ignored by A. Such "collision-friendly" messages exist in TLS, IKE, and SSH.

Under this condition, the attacker can compute a transcript collision by constructing a chosen-prefix collision (C 1 , C 2 ) of ℓ 1 and ℓ 2 bytes respectively, such that:

H(m 1 ∥ [g y ′ ∥ info ′ B len ′ B ∥ C 1 ∥ -] m ′ 2 ) = H([g x ′ ∥ info ′ A C 2 ] m ′ 1 )
where len ′ B = ℓ 1 + ℓ m . Note that we have left empty space (written -) of size ℓ m bytes that still needs to be filled after C 1 in info ′ B . After receiving m 1 from A and computing C 1 , C 2 , the attacker sends m ′ 1 to B. When B responds with m 2 (of size ℓ m bytes), she stuffs m 2 at the end of info ′ B (in place of -) and sends m ′ 2 to A. Due to the collision extension property, we have:

H(m 1 ∥ [g y ′ ∥ info ′ B len ′ B ∥ C 1 ∥ m 2 ] m ′ 2 ) = H([g x ′ ∥ info ′ A C 2 ] m ′ 1 ∥m 2 )
That is, the attacker has obtained a transcript collision and the impersonation attack succeeds.

Application to TLS, IKE and SSH

The transcript-collision attack exploits hash collisions in combination with flexible protocolspecific message formats. This trick can be applied to several mainstream protocols such as TLS, IKE, and SSH.

In [BL16b] (Appendix E), we demonstrate how a man-in-the-middle attacker can impersonate TLS 1.2 clients, TLS 1.3 servers, and IKEv2 initiators. We also show how a network attacker can downgrade TLS 1.1 and SSH-2 connections to use weak ciphers. We have implemented proofs-of-concept exploit demos for three of these attacks to demonstrate their practicality, and provide attack complexities for the others. We believe that ours are the first hash collision-based attacks on the cryptographic constructions within these protocols. This settles the debate on whether the security of mainstream cryptographic protocols depends on collision resistance. We recommend that weak hash functions like MD5 and SHA-1 should be disabled from Internet protocols.

Conclusion

Chosen-prefix collisions have first been demonstrated on MD5 in 2007 [START_REF] Stevens | Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities[END_REF]. In this chapter we demonstrated them on SHA-1 for the first time. We summarize the complexity of known attacks in Table 3.1. We also provide several new applications of CP collisions, clearly showing that MD5 and SHA-1 signatures can be abused in practice. The transcriptcollision attacks are hard to deploy in the wild because the CP collision must be computed online; on the other hand, the PGP impersonation attack is easy to mount because the CP collision is a precomputation, independent of the target identity.

Responsible disclosure. Our transcript-collision attacks on TLS were responsibly disclosed under the name SLOTH2 in 2015 (CVE-2015-7575) and have resulted in security updates to several TLS libraries. Our chosen-prefix attack on SHA-1 was also responsibly disclosed under the name Shambles3 in 2019 (CVE-2019-14855). In particular, we contacted the authors of GnuPG and OpenSSL.

SHA-1 usage and deprecation

SHA-1 has been known to be broken since 2005 [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF]. NIST has been relatively fast to deprecate SHA-1 usage for signatures:

" Federal agencies should stop using SHA-1 for digital signatures, digital time stamping and other applications that require collision resistance as soon as practical, and must use the SHA-2 family of hash functions for these applications after 2010.

"

-NIST, March 15, 2006 However, SHA-1 was still used in many different contexts when we demonstrated our chosen-prefix collision attack in early 2020, including within signatures. In late 2020, NIST announced than it would retire SHA-1 for all usages in 2030, due in part to our chosen-prefix collision attack.4

X.509 certificates. The CA/Browser Forum decided to sunset SHA-1 in October 2014, and its members were not supposed to issue SHA-1 certificates after 2016. Web browsers have enforced similar rules, and major browsers started to reject SHA-1 certificates in early 2017. Figure 1.4 shows hash function usage in the certificates of top websites: SHA-1 was still used until 2016 and stopped being used in early 2017, around the time the first collision was announced [START_REF] Stevens | The First Collision for Full SHA-1[END_REF].

For non-web clients, SHA-1 certificates have been supported longer in some applications. For instance, OpenSSL has deprecated SHA-1 signatures with version 3.0.0 in September 2021.

PGP / GnuPG. There are currently two supported branches of GnuPG: GnuPGv1 is the "legacy" (or "classic") branch, and GnuPGv2 is the "modern" branch. The first version of GnuPGv2 dates back to 2006, and the "legacy" branch is no longer recommended, but the transition took a long time. In particular, GnuPGv1 was still the default version in Fedora 29 (released in October 2018), and in Ubuntu 16.04 LTS (supported until April 2021).

GnuPG supports many different algorithms, including SHA-1. Moreover, SHA-1 is the default algorithm for identity certification in GnuPGv1. This is why we targeted PGP in our demonstration of chosen-prefix collisions. After we disclosed our results to the GnuPG team, SHA-1 signatures are no longer trusted in the GnuPGv2 branch.

The current draft of the next PGP standard [START_REF] Wouters | Internet-Draft draft-ietf-openpgp-crypto-refresh-12[END_REF] deprecates MD5 and SHA-1, and defines a new signature format adding a salt at the beginning of the hashed data. This prevents attacks were one party generates a collision and asks another party to sign it. TLS handshake. In TLS 1.0 and 1.1, the handshake is hashed with the concatenation of SHA-1 and MD5. Using the multicollision attack from Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF], computing a CP collision for MD5 ∥ SHA-1 is not much harder than for SHA-1. This makes those versions vulnerable to transcript-collision attacks. Figure 1.5 shows TLS usage for top websites: TLS 1.0 and 1.1 are being phased out, but they were still used when we demonstrated our attack. TLS 1.0 and 1.1 have been deprecated in 2021 [START_REF] Moriarty | Deprecating TLS 1.0 and TLS 1.1[END_REF], mostly because of SHA-1 weaknesses.

In TLS 1.2, the hash function used is configurable. In 2015, many servers and client supported MD5, and some used it in normal usage: this was the default configuration of Java clients and servers. MD5 has been disabled in many libraries after disclosing our attack. In late 2019, the vast majority of clients and servers supported SHA-1, and some servers actually preferred to use SHA-1, even when the client offers better algorithms. 5,6 Usage of MD5 and SHA-1 has been deprecated in 2021 [START_REF] Velvindron | Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1[END_REF].

Modern clients (such as web browsers and OpenSSL) have removed support for TLS 1.0 and 1.1, as well as SHA-1 support to sign the handshake. DNSSEC. SHA-1 was still used in DNSSEC, with 18% of the top-level domains using SHA-1 in early 2020. 7 Since DNSSEC signatures include user-supplied content, CP collisions could potentially be used to attack the DNSSEC system.

Generic Attacks Against

Hash-Based MACs

This chapter is based on articles [LPW13] and [DL14;[START_REF] Dinur | Improved Generic Attacks Against Hash-Based MACs and HAIFA[END_REF], found in Appendix F and G.

Message Authentication Codes (MACs) are an important type of symmetric cryptography primitives, used to verify the integrity and authenticity of messages. The sender of a message uses a MAC to compute a tag from the message and a shared secret key. The tag is appended to the message and the receiver can recompute the tag using the key, and reject the message when it does not match the received tag. Common MAC algorithms are built from block ciphers (e.g. CBC-MAC, PMAC), from hash functions (e.g. HMAC, NMAC), or from universal hash functions (e.g. GMAC, Poly1305, UMAC).

Security of MAC algorithms

The main security requirement of a MAC is the resistance to forgery: it should be hard for an adversary to forge a valid tag without knowing the key. We define two variants of forgery attacks, assuming oracle access to the MAC with the secret key: Existential forgery. After querying the oracle to obtain the tags of some chosen messages, the adversary must predict the tag of a message that has not been queried.

Universal forgery.

The adversary is given a challenge message C before interacting with the oracle. She can query any message excepted C, and must predict the tag of C.

It should also be impossible to recover the secret key excepted by exhaustive search. In addition, cryptanalysts have studied state-recovery attacks, where the adversary attempts to recover the internal state of the MAC.

Generic forgery attack against iterative MACs

Preneel and van Oorschot described a generic attack against all deterministic iterated MACs with a state size of n bits [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] based on collisions. After 2 n/2 queries with small messages of the same length, we expect that two messages reach the same internal state.

If the message pair (M, M ′ ) produces an internal collision, then for any suffix S the pair (M ∥ S, M ′ ∥ S) also collides in the tag: MAC(M ∥ S) = MAC(M ′ ∥ S). Therefore, we can create a forgery by asking for MAC(M ∥ S) and using it to predict MAC(M ′ ∥ S). This attack is similar to the collision extension property of hash functions, but the attacker does not have access to the internal state, because a MAC is a keyed function. However, the internal collision can be detected because it implies a collision in the tag. For some MACs there are also false-positive pairs colliding on the tag but not on the internal state, but they are filtered out by testing the forgery attack.

Security loss beyond the birthday bound

Even though all deterministic iterated MACs have essentially the same security bound, the impact of the attacks can be quite different. For instance, the Envelope MAC [START_REF] Tsudik | Message Authentication with One-way Hash Functions[END_REF] and the Sandwich MAC [START_REF] Yasuda | Sandwich" Is Indeed Secure: How to Authenticate a Message with Just One Hashing[END_REF] are two similar MAC constructions based on hash functions with an n-bit internal state:

Envelope k (M ) = H(k ∥ M ∥ k) Sandwich k (M ) = H(pad(k) ∥ pad(M ) ∥ pad(k))
where pad pads its input to an integer number of blocks. Both modes are secure up to the birthday bound, and the generic forgery attack matches the bound. However, there is a more complex key-recovery attack against the envelope MAC with birthday complexity [START_REF] Preneel | On the Security of Two MAC Algorithms[END_REF].

Key-recovery attack against the Envelope MAC. For simplicity, we assume that the hash function uses n-bit message blocks, and that the size of the key is also n bits. The attacker considers n-bit messages (M, M ′ ), with the last bit equal to zero (M [n-1] = M ′ [n-1] = 0). After querying 2 n/2 messages she expects a collision in the internal state:

h * (k ∥ M ) = h * (k ∥ M ′ )
She detects the hash collision as a MAC collision (Envelope k (M ) = Envelope k (M ′ )), and she verifies that it is an internal state collision with a few extra queries.

Next, she queries the MAC of n -

1-bit messages M [0..n -2] and M ′ [0..n -2]. If k[0] = 0,
* (k ∥ M ) = h * (k ∥ M ′ ): k ∥ M [0..n -2] ∥ k[0] = k ∥ M [0..n -2] ∥ 0 = k ∥ M k ∥ M ′ [0..n -2] ∥ k[0] = k ∥ M ′ [0..n -2] ∥ 0 = k ∥ M ′
The collision is preserved by the final block, because its content is the same for both messages (k[1..n -1]).

On the other hand, if k[0] = 1, the tags are different with high probability because we have two different values for the second block (M [0..n -2] ∥ 1 and M ′ [0..n -2] ∥ 1) that are not known to collide. Using this technique, the adversary recovers the key iteratively (bit-by-bit or byte-by-byte), building a special collision corresponding to each successive partial guess. She obtains a key-recovery attack with complexity Õ(2 n/2 ). This attack does not apply to the Sandwich MAC, because the padding after the message prevents mixing message bits and key bits in the same block. This shows that modes with similar security proofs can have different security degradation beyond the birthday bound.

Hash-based MACs

In this chapter we study MAC algorithms based on a hash function such as HMAC [START_REF] Bellare | Keying Hash Functions for Message Authentication[END_REF], one of the most widely used MACs. Using a hash function H, HMAC is defined as

HMAC(k, M ) = H(k ⊕ opad ∥ H(k ⊕ ipad ∥ M )),
with ipad and opad two fixed constants of size one block. More generally, we consider a class of iterative designs based on a family of compression functions h (i) and a finalization function g, following Chapter 2. For simplicity, we assume that the internal state and the tag are both n-bit long. The message M is divided into L blocks x i , and the tag τ is computed as (see Figure 4.1):

h (0) n m 0 x 0 h (1) n m 1 x 1 h (2) n m 2 x 2 x 3 MAC k (M ) n n |M | I k g k
x 0 = I k x i+1 = h (i) (x i , m i ) τ = g k (x L , |M |).
The message processing updates the internal state starting from a key-dependent value I k , and the output is produced with a key-dependent finalization function g k . On the other hand the state update does not depend on the key. Our description covers HMAC [BCK96], Sandwich-MAC [START_REF] Yasuda | Sandwich" Is Indeed Secure: How to Authenticate a Message with Just One Hashing[END_REF] and Envelope-MAC [Tsu92] with common narrow-pipe hash functions. In particular, we consider that the finalization function depends on the message length |M |, because many hash functions use MD strengthening. When the hash function uses the Merkle-Damgård mode, the compression function is the same at every step, and we denote it as h (∀i,

h (i) = h).
We know that iterated hash functions are indifferentiable up to the birthday bound, assuming that the compression function is ideal [START_REF] Coron | Merkle-Damgård Revisited: How to Construct a Hash Function[END_REF]. This also implies that hashbased MACs are secure up to the birthday bound.

Our results.

In the following we study the security of hash-based MACs above the birthday bound. We give generic state-recovery attacks with complexity Õ(2 n/2 ) when the hash function follows the Merkle-Damgård mode (Section 4.3) and Õ(2 4n/5 ) for the more general HAIFA mode (Section 4.4). This contradicts previous beliefs that state-recovery attacks should have complexity 2 n . We also extend these to key-recovery attacks when the hash function uses an internal checksum (Section 4.5).

State-recovery attack using cycles

Our first attack uses long messages repeating a fixed block β (for instance, β = 0). We assume that the hash function uses the Merkle-Damgård construction, so that the compression function h is the same at every step. When evaluating the MAC on such a message, we actually iterate a fixed function ϕ : x → h(x, β); our goal is to exploit properties of the functional graph of ϕ. We travel in the graph by querying the oracle using consecutive β message blocks. However, since the key is unknown, we do not have access to the internal state; we can only detect collisions because they are preserved by the finalization function.

Forgery

We start with a forgery attack based on collisions. This attack exploits the cycle length of the main component of ϕ. Since ϕ is a public function, we identify the main component and its main cycle with O(2 n /2) operations; we denote its length as ℓ.

Assuming that ϕ behaves as a random function, the expected tail length (the distance to the cycle) is √ π2 n-3 and the expected cycle length is also √ π2 n-3 [START_REF] Flajolet | Random Mapping Statistics[END_REF]. Moreover, the main component has expected size 0.76 × 2 n [FS09, §VII.14].

Naive attack. We first assume that no length padding is used in the hash function, so that the finalization function g does not depend on the message length. In this case, it is quite easy to obtain a collision, and therefore a forgery. We consider the following messages

M 1 = β 2 n/2 M 2 = β 2 n/2 +ℓ
With constant probability, the initial value I k is in the main component, and the sequence of 2 n/2 β blocks is sufficiently long to enter the cycle. In this case, the two MAC outputs will collide.

Dealing with MD strengthening. In order to deal with the MD strengthening, we must generate two messages of the same length. We use the following trick: we start from a message M = β 2 n/2 ∥ α ∥ β 2 n/2 with an arbitrary block α ̸ = β. With constant probability, the internal state reaches the main cycle after the first series of β, and again after the second series of β. In this case, we can add ℓ β blocks in the first or the second series to obtain two colliding messages of the same length (see Figure 4.2):

M 1 = β 2 n/2 ∥ α ∥ β 2 n/2 +ℓ M 2 = β 2 n/2 +ℓ ∥ α ∥ β 2 n/2
Complexity analysis. The attack has complexity O(2 n/2 ) and succeeds if

1. I k is in the main component of ϕ;
2. The cycle is reached after less than 2 n/2 blocks β;

3. The state reached after α is also in the main component of ϕ;

4. The cycle is reached after less than 2 n/2 blocks β.

Events 1 and 3 have probability about 0.76, while events 2 and 4 have probability at least 1 /2 given that the expected tail length is shorter than 2 n/2 . Overall the success probability is at least 0.14. The attack can be repeated with a random prefix block if needed.

State recovery

We now extend the forgery attack into a state-recovery attack. We use an additional property of the graph of a random mapping: the graph contains a giant tree of expected size 0.48 × 2 n [FS09, §VII.14]. Therefore, starting from a random node in the graph, there is a constant probability to enter the cycle at one specific node: the root of the giant tree. Since ϕ is a public function, we identify this node offline with complexity O(2 n/2 ). When the forgery attack above succeeds, there is a constant probability that the first cyclic node is exactly the root of the giant tree. Therefore, we obtain a state-recovery attack by searching for the smallest length z such that the cycle is reached after processing β z . If the cycle is reached, we know that the following two messages have a constant probability to have the same MAC:

M 1 = β z ∥ α ∥ β 2 n/2 +ℓ M 2 = β z+ℓ ∥ α ∥ β 2 n/2
In order to avoid false negatives, we repeat queries with several choices of α for each z, to obtain a high-selectivity test. Using a binary search, we need only O(n) queries to find the smallest z reaching the cycle. With constant probability, the state after processing the message β z is the root of the giant tree.

Complexity analysis. The attack has complexity Õ(2 n/2 ) and succeeds with constant probability.

I k ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ M 1 = β 2 n/2 α β 2 n/2 +ℓ I k ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ ϕ M 2 = β 2 n/2 +ℓ α β 2 n/2

State-recovery attack based on chains

We now propose an attack applicable to HAIFA hash functions, i.e. with different compression functions h (i) at each step, but we sometimes omit the step index for simplicity. Again, we use a fixed long message, but since we have different functions we cannot use properties of the functional graph. Instead, we study the entropy loss.

Entropy loss

When we iterate a fixed sequence of random functions, the image space is reduced at each step. More precisely, we have the following lemma:

Lemma 1. Let f 1 , f 2 , .
. . , f 2 s be a sequence of random functions over the set of 2 n elements, with s ≤ n/2 and

g i ≜ f i • . . . • f 2 • f 1 .
Then, the images of two arbitrary inputs to g 2 s collide with probability of about 2 s-n , i.e. Pr x,y [g

2 s (x) = g 2 s (y)] = Θ(2 s-n ).
In order to exploit this property, we fix a message C of length 2 s , and query the oracle with messages of the form r ∥ C. If we denote the function

x → h (i) (x, C[i -1]) as f i (1 ≤ i ≤ 2 s ), the final state after processing r∥C is in the image space of g 2 s ≜ f 2 s •. . .•f 2 •f 1 .
This set has properties similar to the root of the giant tree used in the previous attack: we can sample the set offline, it has reduced entropy, and we can build messages that reach this set online. In order to obtain a state-recovery attack, we need to match the unknown states obtained though online queries with the known states computed offline.

Using collision filters

A collision filter for an offline state x is a pair of blocks b

̸ = b ′ such that h(x, b) = h(x, b ′ ).
Given a message M , we test whether the state obtained after processing M is equal to Alternatively, we can build the filter online, and evaluate it on offline states. An online collision filter for a message M is a pair of blocks b ̸ = b ′ , such that MAC(M ∥b) = MAC(M ∥b ′ ).

I k 1 2 s 2 u [j] C Online structure 2 s 2 t $ C Offline structure

State recovery.

We obtain a first attack using online collision filters:

1. (online) Fix a message C of length 2 s . Query the oracle with 2 u messages M j = [j]∥C. Build a collision filter for each message M j .

2. (offline) Starting from 2 t arbitrary starting points, iterate the compression function with the fixed message C.

(offline) Test each image point x obtained in

Step 2 against each of the messages M j . If a match is found, the state reached after M j is x.

Complexity analysis. In Step 3, we match a set of size 2 u and a set of size 2 t . According to Lemma 1, each pair collides with probability 2 s-n . Therefore, the attack is successful with high probability if t + u ≥ ns.

The optimal trade-off is obtained with u = s and t = n -2s, with the following complexity:

Step 1: 2 s+u+n/2 = 2 n/2+2s Step 2: 2 s+t = 2 n-s Step 3:

2 t+u = 2 n-s
The optimal complexity is O(2 5n/6 ) when s = n/6. More generally, we obtain an attack with complexity O(2 n-s ) when s ≤ n/6.

Using a diamond filter

Building the filters is the bottleneck of the attack. In order to build filters for 2 u messages M j more efficiently, we use the diamond structure of Kelsey and Kohno [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF]. Since the construction of the diamond structure is based on collisions, we can build a diamond for the unknown states corresponding to online queries. This requires Õ(2 (n+u)/2 ) queries, with messages of length O(|M j |).

We obtain messages m j such that all messages M j ∥ m j reach the same state. Then we build a collision filter (b, b ′ ) for the final state of the diamond, and we obtain filters for all messages M j . We test whether the state obtained after processing M j is equal to

x by comparing h * (x, m j ∥ b) and h * (x, m j ∥ b ′ ). Building the filter for 2 u messages has complexity O(|M j | × 2 (n+u)/2 ), and using a single filter has complexity O(u).

State recovery.

We obtain an improved attack using the online diamond filter (Figure 4.3):

1. (online) Fix a message C of length 2 s . Query the oracle with 2 u messages M j = [j]∥C.

Build a diamond filter for all messages M j .

IV k ⊕ ipad h n M 0 x 0 h n M 1 x 1 h n M 2 x 2 σ x 3 x * n |M | h h n g H(k ⊕ ipad ∥ ) • Figure 4
.4: HMAC based on a hash function with a checksum (dashed lines) and a lengthpadding block. We only detail the first hash function call.

2. (offline) Starting from 2 t arbitrary starting points, iterate the compression function with the fixed message C.

(offline) Test each image point x obtained in

Step 2 against each of the messages M j . If a match is found, the state reached after M j is x.

Complexity analysis.

Again, the attack is successful with high probability if t + u ≥ ns.

The optimal trade-off is obtained with u = s and t = n -2s, with the following complexity:

Step 1:

2 s+u/2+n/2 = 2 n/2+3s/2 Step 2: 2 s+t = 2 n-s Step 3: 2 t+u = 2 n-s
The optimal complexity is Õ(2 4n/5 ) when s = n/5. More generally, we obtain an attack with complexity Õ(2 n-s ) when s ≤ n/5.

Key-recovery attack against HMAC-GOST

Finally, we consider HMAC used with a hash function with an internal checksum. The checksum computes the sum (XOR) of all message blocks, and uses this sum as an extra input to the finalization function. This technique is supposed to improve the security of a hash function, assuming that controlling the checksum would be an additional challenge for an adversary. Previous work have shown that the checksum fails to improve the security on many cases [START_REF] Gauravaram | Linear-XOR and Additive Checksums Don't Protect Damgård-Merkle Hashes from Generic Attacks[END_REF], but we obtain a more surprising result: the checksum makes the hash function weaker, enabling key-recovery attack faster than exhaustive search on HMAC.

Notable examples of hash functions with a checksum are the standards from the Russian government: GOST [START_REF] Dolmatov | Hash Function Algorithm[END_REF] and Streebog [START_REF] Dolmatov | Hash Function[END_REF]. Figure 4.4 shows the evaluation of HMAC with a Merkle-Damgård hash function with a checksum.

State recovery.

First, we note that the checksum does not prevent the state-recovery attacks. Concretely, the attack of Section 4.3 is based on detecting collisions between pairs of messages

M 1 = β z ∥ α ∥ β 2 n/2 +ℓ M 2 = β z+ℓ ∥ α ∥ β 2 n/2
Since the messages have the same checksum, a collision in the state will be preserved. We use the state-recovery attack to recover the internal state x * before the checksum is processed.

Key recovery.

In HMAC, k ⊕ ipad is prepended to a message M , and (k ⊕ ipad) ∥ M is hashed by the underlying hash function H. Therefore, the final checksum value is

σ = Sum ⊕ ((k ⊕ ipad) ∥ M ) = k ⊕ ipad ⊕ M i .
We take advantage of the fact that σ contains the key, and can be controlled by changing the message. We inject a known difference in the checksum to perform a kind of related-key attack on the finalization function g, even though we have access to a single HMAC key.

More precisely, we use Joux's multicollision attack [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] to generate a large set of messages with the same value x * before the finalization, but with different values of the checksum. We detect MAC collisions among those messages, and we assume that the collisions happen when processing the checksum. For each such collision, we have

g(x * , k ⊕ ipad ⊕ M i ) = g(x * , k ⊕ ipad ⊕ M ′ i )
, and we compute the input difference ∆M = M i ⊕ M ′ i . Finally, we compute g(x * , m) offline for a large set of random values m, and we collect collisions. Again, we compute the input difference ∆m = m ⊕ m ′ for each collision, and we match ∆m to the previously stored ∆M . When a match is found between the differences we look for the corresponding values and we have k ⊕ ipad ⊕ M i = m (or m ′ ) with high probability. This gives the value of the key k.

Application. We obtain an attack with complexity 2 3n/4 on HMAC-GOST and an attack with complexity 2 4n/5 on HMAC-Streebog. The attack on HMAC-Streebog is less efficient because Streebog uses the HAIFA construction, which makes the key-recovery attack more complex.

Conclusion

In the chapter we have demonstrated state-recovery attacks for hash-based MACs with complexity below 2 n . In particular, our generic attacks are more efficient than dedicated attacks (presented as distinguishing-H attacks) that have been published against hash functions of the MD-SHA family [KBP+06; RR08; WYW+09].

For Merkle-Damgård hash functions we obtain an attack with complexity Õ(2 n/2 ), matching the security proof. For HAIFA hash functions, we obtain an attack with complexity Õ(2 4n/5 ), leaving a gap with the proven security bound.

In the full paper [START_REF] Dinur | Improved Generic Attacks Against Hash-Based MACs and HAIFA[END_REF] (Appendix G), we extend the framework for state-recovery attacks. We observe that our state-recovery attacks are similar to collision-finding algorithms: the attack from Section 4.3 is similar to Pollard's rho algorithm, while the attack from Section 4.4 is similar to the parallel algorithm of van Oorschot and Wiener [vW94]. We point out that Pollard's rho algorithm returns one specific collision with high probability: the root of the giant tree. This property is used in our state-recovery attack. We show that the algorithm of van Oorschot and Wiener also returns collisions from a small set. Based on this observation, we obtain different attacks with various trade-offs between the message length and the complexity of the attacks, as shown in Figure 4.5.

Those techniques have also been used to devise universal forgery attacks, where the attacker is given a long challenge, and must predict the MAC of the challenge after interacting with the oracle [PW14; GPS+14; DL14].

Generic Attacks Against

Encryption Modes

This chapter is based on articles [BL16a] and [LS18], found in Appendix H and I.

Block ciphers (such as DES or the AES) are probably the most widely used cryptographic primitives. Formally, a block cipher is just a keyed family of permutations over n-bit blocks, but when combined with a mode of operation, it can provide confidentiality (e.g. using CBC, or CTR), authenticity (e.g. using CBC-MAC, PMAC, or GMAC), or authenticated encryption (e.g. using GCM, CCM, or OCB). A mode of operation defines how to divide a message into blocks, and how to process the blocks one by one with some chaining rule.

When analyzing the security of block cipher modes of operations, there is frequently a term σ 2 /2 n in the security proof (with σ the total length of the queries made by the adversary, and n the block size), due to the PRF/PRP switching lemma [START_REF] Bellare | The Security of Cipher Block Chaining[END_REF]. Indeed, a block cipher is idealized as a pseudo-random permutation (PRP) family, but proofs often need it to behave as a pseudo-random function (PRF) family. The difference between a PRF and a PRP is that PRFs have collisions, which are detected with probability at most σ 2 /2 n . More generally, most proof techniques fail at the birthday bound; this explains why we use modes with birthday security.

CBC and CTR

Two important examples are the CBC (Cipher-Block Chaining) mode and the CTR (Counter) mode; they are the most widely used modes of operation used for symmetric encryption.

The CBC mode. CBC is one of the oldest encryption modes, standardized in 1980 [START_REF]DES Modes of Operation[END_REF], and still widely used. The message M is divided into blocks m i , 0 ≤ i < L and is encrypted

c -1 = IV m 0 E k c 0 m 1 E k c 1 m 2 E k c 2 m 3 E k c 3 Figure 5.1: CBC mode. 0 E k m 0 c 0 1 E k m 1 c 1 2 E k m 2 c 2 3 E k m 3 c 3
c i = E k (m i ⊕ c i-1 ),
where c -1 is an initialization value usually denoted as IV. For simplicity, we assume that all message sizes are a multiple of the block size.

CBC has been proven secure up to 2 n/2 blocks of messages [BKR94; PR00]. On the other hand there is a simple birthday attack against CBC: after 2 n/2 message blocks encrypted with the same key (in the same message or in different messages), a collision between two ciphertext blocks c i = c j is expected. Since E k is a permutation, a collision in the output means that the inputs are the same (m i ⊕ c i-1 = m j ⊕ c j-1 ), which reveals the XOR of two plaintext blocks:

m i ⊕ m j = c i-1 ⊕ c j-1 .
The CTR mode. The CTR mode was first proposed in 1979 [START_REF] Diffie | Privacy and authentication: An introduction to cryptography[END_REF], but standardized more recently in 2001 [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation[END_REF]. It is now widely used: in particular, it provides the encryption part of authenticated encryption modes CCM and GCM. The counter mode turns a block cipher into a stream cipher: a counter is encrypted to generate a keystream that is xored with the message. More precisely, the message M is divided into blocks m i , 0 ≤ i < L which are encrypted as (see Figure 5.2):

c i = E k (i) ⊕ m i ,
For simplicity we consider a stateful variant of the counter mode with a global counter that is maintained across messages and initialized as 0.

If E k is a pseudo-random function, rather than a pseudo-random permutation, then CTR is secure up to 2 n blocks [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF]. However, in the common case where E k is a permutation, CTR is proven secure only up to 2 n/2 blocks, and there is a matching distinguishing attack with complexity 2 n/2 . If a message where all the plaintext blocks are equal is encrypted, then all the ciphertext blocks will be pairwise different. Indeed, all the E k (i) are unique, because E k is a permutation. More generally, with known plaintext, the adversary can reconstruct the keystream blocks c i ⊕ m i and observe that they are distinct. This distinguishes the counter mode from an ideal encryption scheme, because random data would collide after roughly 2 n/2 blocks.

More interestingly, McGrew proposed a method to eliminate impossible values for the plaintext [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF]. Given two encrypted blocks

c i = E k (i) ⊕ m i and c j = E k (j) ⊕ m j , we have E k (i) ̸ = E k (j), therefore we deduce m i ⊕ m j ̸ = c i ⊕ c j .
Using prior knowledge about the plaintext (such as a dictionary), an attacker can eventually recover the right plaintext.

Security of CTR and CBC.

It is interesting to compare the birthday attacks against CBC and CTR. Both attacks have the same complexity, and show that the proofs are tight. However, they are quite different:

• The CBC attack is based on detecting collisions, and directly leaks information about the plaintext;

• The CTR attack is based on detecting the absence of collisions, and only leaks impossible values of the plaintext.

In general, there is a folklore belief that the leakage of the CTR mode is not as bad as the leakage of the CBC mode. For instance, Ferguson, Schneier and Kohno wrote (in the context of a 128-bit block cipher):

" CTR leaks very little data. [...] It would be reasonable to limit the cipher mode to 2 60 blocks, which allows you to encrypt 2 64 bytes but restricts the leakage to a small fraction of a bit. When using CBC mode you should be a bit more restrictive. [...] We suggest limiting CBC encryption to 2 32 blocks or so.

"

-Cryptography Engineering, [START_REF] Ferguson | Cryptography engineering: design principles and practical applications[END_REF]Section 4.8.2] Our results. In this chapter we study the impact of birthday attacks on CBC and CTR. We show that both modes suffer plaintext-recovery attacks with birthday complexity in realistic settings. Moreover, we demonstrate the CBC attack in practice with ciphers with 64-bit blocks, showing that they do not offer meaningful security.

Birthday-bound security

While block ciphers with n-bit blocks and κ-bit keys are required to resist any attack with up to 2 n data and 2 κ time, most modes of operation are only proven secure up to 2 n/2 blocks of plaintext. Rogaway summarizes the situation as follows:

" In general, unless special efforts are taken, almost any mode of operation based on an n-bit blockcipher will admit attacks that employ σ = 2 n/2 blocks. [...] Do birthday-bound attacks on CBC, CFB, and OFB actually matter? They are of relatively little concern when the blockcipher has a blocksize of n = 128 bits, but the attacks can be a serious concern when employing a blockcipher of n = 64 bits, requiring relatively frequent rekeying to keep σ ≪ 2 32 .

"

-Phillip Rogaway, [START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF]p. 36] The main countermeasure against birthday attacks is to change the key frequently, before reaching the birthday bound under any single key. For instance, if the key is changed after 2 n/2-16 blocks, a collision attack against a given key only succeeds with probability 2 -32 , and an attacker has to collect 2 32 different sessions to mount an attack with high probability.

If implemented properly, this is an effective security measure to strengthen block ciphers with a small block-size. We stress than the key must be changed well before 2 n/2 blocks, despite misleading recommendations in published standards. For instance, ISO used to recommend:

" Generally, for a block cipher with block size of n bits, the maximum amount of plaintext that can be encrypted before rekeying must take place is 2 (n/2) blocks, due to the birthday paradox. As long as the implementation of a specific block cipher do not exceed these limits, using the block cipher will be safe.

"

-ISO/IEC JTC1 SC27, May 2014 [START_REF]On the Assessment of Cryptographic Techniques and Key Lengths[END_REF] NIST had a similar recommendation for 3DES, a legacy standard with a 64-bit block size (denoted as TDEA in NIST documents):

" The security of TDEA is affected by the number of blocks processed with one key bundle.

One key bundle shall not be used to process more than 2 32 64-bit data blocks.

"

-NIST, January 2012 [START_REF] Barker | Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher[END_REF] Those recommendations are inadequate, because collisions occur with high probability (close to 0.39) with only 2 n/2 blocks. Similarly, many internet standards (IPsec, TLS, SSH) do not specify a session limit, and many applications allowed very long sessions with the same key, up to or even above 2 n/2 blocks.

On the practical (in-)security of 64-bit block ciphers

With a modern block cipher with 128-bit blocks such as AES, the birthday bound corresponds to 256 EB (2 68 bytes). While this leaves a safe margin for common uses of cryptography today, the resulting security is still lower than could be expected of 128-bit security and might be an issue in the future. As a point of comparison, the worldwide data storage capacity is estimated to be around More strikingly, the birthday bound corresponds to only 32 GB for a block cipher with 64-bit blocks. There are real-world scenarios in which this amount of data may be encrypted under a block cipher with 64-bit blocks: 3G telephony connections (UMTS) are encrypted with KASUMI using the f8 mode, and Internet protocols like OpenVPN, TLS, SSH, and IPsec use 3DES or Blowfish as legacy ciphers for interoperability. In these scenarios, 32 GB of data can be transferred in less than one hour with a fast connection. In the following, we investigate the practical impact of birthday attacks, with a focus on block ciphers with 64-bit blocks.

Previous work.

McGrew has investigated plaintext-recovery attacks on 64-bit ciphers in CBC, CFB, and CTR modes [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF]. He studied the amount of information leakage by assuming that the attacker can observe all the ciphertext in an encrypted stream, and she has some (incomplete) knowledge of the plaintext. We revisit the results of McGrew by considering a stronger adversary model (with chosen plaintext rather than known plaintext), and more advanced algorithms to solve the underlying problems.

Plaintext-recovery attack against CBC

We consider collision attacks against the CBC mode in the chosen-prefix secret-suffix model [START_REF] Hoang | Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance[END_REF]. The attacker must recover a t-block secret S, given access to an oracle that computes the encryption of M ∥ S for a chosen message M . Using the collision attack above, the attacker queries 2 q arbitrary messages of u block each, corresponding to σ = (t + u) × 2 q blocks of data. She expects on average σ 2 × 2 n-1 collisions among the ciphertext blocks.

Using short messages. When u ≪ t, most collisions reveal the XOR between two blocks from S. The attacker collects these relations until she learns the XOR between all pairs of blocks from S. We model a relation as an edge in a graph whose vertexes are the plaintext blocks; with high probability, the graph will be fully connected when there are more than Θ(t ln(t)) edges. We deduce the following complexity (up to constant factors):

σ 2 × 2 n-1 ≈ t ln(t) σ ≈ t ln(t) × 2 n/2
At this point, there are σ = t ln(t) × 2 n/2 ciphertext blocks from S, and u/t × σ = u × ln(t)/t × 2 n/2 from M . We expect u ln(t) > 1 collisions across the two sets; this reveals at least one block of secret, and the others are deduced using the relations between the blocks from S.

Using longer messages. When u ≳ t, most collisions are between two blocks from M , and the attacker doesn't learn anything from such collisions. But some collisions reveal the XOR between a block from S and a block from M ; we expect u2 q × t2 q × 2 -n = tu × 2 2q-n collisions of this type. In order to recover the full secret, the attacker needs on average t × H t such collisions, following the analysis of the coupon collector's problem (with H t the harmonic numbers H t = t i=1 1 /i). We deduce the complexity of the attack:

t × H t ≈ t ln(t) = tu × 2 2q-n σ = u2 q = u ln(t) × 2 n/2
Using longer queries increases the data complexity of the attack, but it reduces the total number of queries from O( ln(t)/t × 2 n/2 ) to O( ln(t)/u × 2 n/2 ). In practice, this results in a faster attack overall when there is a minimal delay for each query.

With rekeying. If the lifetime of a key is limited to 2 r ≲ 2 n/2 blocks of data, this increases the complexity of the attack, but does not prevent it. Using the short message attack, we can make 2 r /t queries per key, so that we make 2 q queries spread over t × 2 q-r different keys. Collision between ciphertext blocks encrypted with different keys are useless, but we still expect on average 2 2r-n-1 collisions per key, i.e. t × 2 q+r-n-1 useful collisions in total. We obtain the following complexity (up to constant factors):

t × 2 q+r-n-1 ≈ t ln(t) σ = t × 2 q ≈ t ln(t) × 2 n-r
If r is slightly below n/2 the attack still has complexity close to 2 n/2 , because for each key there is a non-negligible probability that a collision occurs.

Usage of 64-bit block ciphers

When we performed this analysis in 2016, there was a non-negligible usage of block ciphers with 64-bit blocks, mostly 3DES and Blowfish. In most cases, there was no limit to session length, or a limit close to 2 32 blocks (insufficient to prevent the attack).

Usage in TLS.

In TLS 1.0 and 1.1, 3DES is the mandatory encryption algorithm, so all TLS libraries implemented it and a vast majority of web servers supported it. Before we disclosed our results, mainstream TLS libraries still treated 3DES to be at the same security level as AES. For example, OpenSSL included 3DES ciphersuites in its HIGH-security list. Until 2014, OpenSSL even considered 3DES as more secure than AES-128 because of its larger key.

In 2016, telemetry results showed around 1% usage of 3DES in web browsers for HTTPS traffic. Actually, 3DES usage increased in 2015, after RC4 was deprecated due to practical attacks [START_REF] Alfardan | On the Security of RC4 in TLS[END_REF]. 3DES was recommended as the backup cipher in place of RC4, for legacy server or clients without AES support. Surprisingly, scan results showed that many servers that would use 3DES actually supported AES, but preferred to use 3DES.

TLS does not explicitly limit the amount of data encrypted with the same key. When using HTTPS, HTTP/1.1 supports sending multiple messages in the same TLS session. In practice, web browsers did not force any rekeying, and we found many web servers that supported long-lived connections with a large amount of data without rekeying. We measured that 0.6% of the top 100k websites would both use 3DES with an up-to-date browser, and supported long sessions. This included high-profile websites such as ebay.com.

Usage in OpenVPN.

OpenVPN is a popular open-source VPN solution. Before version 2.4 (released in December 2016), the default encryption for the transport protocol of OpenVPN was Blowfish, a block cipher with 64-bit blocks, in CBC mode. OpenVPN supports two different ways of generating session keys to encrypt the messages. In pre-shared-key mode, static keys are used for all the traffic. In particular, there is no limit to the lifetime of those keys. In TLS mode, session keys are generated with a TLS handshake, using certificates to authenticate the peers. The session keys are updated periodically, with limits on the number of packets, the number of bytes, or a session time. The default configuration rekeys the tunnel every hour. In addition, the tunnel is rekeyed shortly before 2 32 packets in TLS mode, because the packet counter is a 32-bit integer. In pre-shared-key mode, the packet counter is a 64-bit integer.

Usage in SSH.

In SSH version 1, the strongest available ciphers are all block ciphers with 64-bit blocks: 3DES, Blowfish, and IDEA, and although SSH 2 introduced AES, it still labeled 3DES as the mandatory cipher. Consequently, popular implementations such as OpenSSH still used 3DES as the default cipher for SSH-1 connections. SSH standards recommend that implementations rekey after every 1 GB of data (or after every 2 n/4 blocks when n ≥ 128 [START_REF] Namprempre | The Secure Shell (SSH) Transport Layer Encryption Modes[END_REF]), but many popular SSH clients do not implement this feature.

Practical attacks against CBC with 64-bit block ciphers

As explained in Section 1.3, the man-in-the-browser setting is a practical model for attacks against websites, where the attacker targets an authentication token that is included in every query. Therefore, she can directly apply the chosen-prefix secret-suffix attack given above. We observe that most of the traffic generated is known or predictable. The requested URL is chosen by the attacker, and all the headers excepted the authentication token are predictable and can be observed in any plaintext HTTP traffic.

We have demonstrated two versions of the attack, against OpenVPN tunneling and against TLS encryption. We assume that the token takes two blocks, and that the attacker has aligned it to a block boundary using other headers.

Proof-of-concept attack against OpenVPN.

To demonstrate the attack against Open-VPN, we used a pre-shared-key tunnel between two physical machines running Linux, with Firefox Developer Edition 47.0a2 on one side, and an nginx server on the other side. Access to the server was protected by BasicAuth (in plaintext inside the tunnel). Using the default OpenVPN settings, the tunnel was encrypted with Blowfish in CBC mode.

We used JavaScript code to send a large number of requests to the server though the tunnel. We found that increasing the size of the request to 4 kB did not significantly reduce the query rate, but reduced the number of queries required for the attack. In our setting, the browser generated about 2900 requests per second, using several web Workers running in parallel. The full attack is expected to use about 2 36.6 blocks (780 GB) to recover a two-block secret out of 4 kB messages, corresponding to about 19 hours in this setting. In our demo, it took 18.6 hours and 705 GB, and we successfully recovered the 16-byte authentication token.

Proof-of-concept attack against TLS.

In our setup we used Firefox Developer Edition 47.0a2 running on Linux and an IIS 6.0 server in a Windows Server 2003 R2 SP2 Virtual machine. The default configuration of IIS 6.0 with all recommended updates offered only RC4 and 3DES ciphers, and 3DES was used with Firefox and other browsers where RC4 is disabled. Moreover, IIS 6.0 supports HTTP/1.1 and keeps an active connection open for an arbitrary long time.

We used JavaScript to generate queries but we note that with several Workers running in parallel, Firefox opened a few parallel connections to the server (typically, 6) and split the requests over these connections. For our attack, we need to maximize the throughput over a single connection. This can be achieved by disturbing some of the connections so that most of the requests are sent in a single connection. In our setup, we used iptables rules to limit the rate of all connections except one.

On Firefox Developer Edition 47.0a2, with a few dozen Workers running in parallel, we could send up to 2000 requests per second in a single TLS connection. To further reduce the time needed for the attack, we injected a padding cookie to expand the requests to 4 KB (512 blocks). In our setting this reduced the rate to 1500 requests per second, but still lead to a faster attack. Again, the full attack should require 2 36.6 blocks (780 GB) to recover a two-block token, which should take 38 hours in our setting. Experimentally, we recovered the token (a two-block cookie) after only 30.5 hours and 610 GB.

Responsible disclosure.

Our attack was responsibly disclosed in 2016 under the name Sweet32, using the website sweet32.info. We have contacted the OpenVPN team, as well as various website owners, browser vendors, and TLS libraries. The TLS vulnerability received CVE number CVE-2016-2183, and the OpenVPN vulnerability is tracked as CVE-2016-6329.

Several standards have been updated to deprecate 64-bit block ciphers or impose data limits:

• NIST has reduced the maximum amount of plaintext allowed to be encrypted under a single 3DES key from 2 32 blocks to 2 20 [START_REF] Barker | Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher[END_REF]. They later announced that 3DES usage for encryption would be deprecated in 2023, and disallowed after 2023 [START_REF] Barker | Transitioning the Use of Cryptographic Algorithms and Key Lengths[END_REF].

• ISO has updated its recommendations on block size [START_REF]On the Assessment of Cryptographic Techniques and Key Lengths[END_REF];

Software vendors have also deprecated 3DES:

• Mozilla has implemented data limits (at most 2

The missing difference problem

We now consider the security of the CTR mode against birthday attacks. There is a well-known distinguisher based on the absence of collision in the keystream, and McGrew has formulated a plaintext-recovery attack as a simple algorithmic problem [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF]. In the chosen-prefix secret-suffix model (with a single block secret S), an attacker collects two types of ciphertexts blocks

c i = E k (i) ⊕ m i :
• encrypted blocks corresponding to a known plaintext block m i ; we denote the corresponding keystream as

a i = m i ⊕ c i = E k (i);
• encrypted blocks corresponding to the fixed secret S; we denote the corresponding ciphertext as b j = S ⊕ E k (j).

Algorithm 1 Known-prefix sieving.

Input: n, z < n, A, B, S ⊆ {0} z × {0, 1} n-z h ← Empty hash table. for b in B do h[b [0...(z-1)] ] ∪ ← {b [z...(n-1)] } end for for a in A do v a ← a [z...(n-1)] for v b in h[a [0...(z-1)] ] do Remove 0 ∥ (v a ⊕ v b ) from S; end for end for return S McGrew observes that all values a i ⊕ b j are different from S: i ̸ = j ⇒ E k (i) ̸ = E k (j) ⇒ a i ̸ = b j ⊕ S ⇒ S ̸ = a i ⊕ b j .
Therefore, we consider an attacker that collects a set of keystream blocks A = {a i } ⊆ {0, 1} n and a set of encryption of the secret B = {b j } ⊆ {0, 1} n . We further assume some prior knowledge about the secret: S ∈ S ⊆ {0, 1} n . In order to recover the secret S, the attacker has to solve the following algorithmic problem: Definition 1 (Missing Difference Problem). Given two sets A and B, and a hint S, find the value S ∈ S such that:

∀(a, b) ∈ A × B, S ̸ = a ⊕ b .
In the information theoretic setting, this problem can be solved with |A| = |B| = Õ(2 n/2 ) for any set S, and requires at least |A|×|B| = Ω(2 n ) when |S| ≥ 2. However, the analysis is more complex when taking into account the cost of the computations required to recover S.

McGrew introduces two algorithms for this problem:

• A sieving algorithm that iterates over A × B and discards values from S until there is only one value left. This requires |A| = |B| = Õ(2 n/2 ) and time Õ(2 n ).

• A searching algorithm that iterates first over s ∈ S, then over a ∈ A and checks whether s ⊕ a ∈ B to discard s. With an optimal parameter choice, this requires

|A| = Õ(2 n/2 / |S|), |B| = Õ(2 n/2 |S|) and time Õ(2 n/2 |S|).
In the following we describe more efficient algorithms for this problem. We consider that A and B correspond to oracle queries, so that we want to minimize |A| and |B| as well as the time complexity.

Known-prefix sieving

In many concrete attack scenarios, an attacker knows some bits of the secret message in advance. We model this by assuming that the secret is known to start with z zero bits. 1We propose an algorithm to solve the missing difference problem efficiently in this context (Algorithm 1).

Since S is known to start with z zeroes, we look for z-bit collisions between A and B.

With |A| = |B| = √ n -z × 2 n/2 we expect (n -z) × 2 n-z collisions.
C A⊕B ← FastConvolution(C A , C B ) u ← argmin i C A⊕B [i]
Run known prefix sieving (Algorithm 1), knowing that T (S) = u we discard the corresponding value from S. Following the analysis of the coupon collector, we expect to discard all wrong values. Therefore, we recover S with Õ(2 n/2 ) queries and memory, and Õ(2 n-z + 2 n/2 ) operations.

With z = 0, the algorithm is the same as McGrew's sieving algorithm, but with z ≥ n/2 we have an algorithm with optimal complexity Õ(2 n/2 ), more efficient than McGrew's searching algorithm.

Fast-convolution sieving

When we have no prior information on the secret (S = {0, 1} n ), we can reduce the complexity of the sieving algorithm by using sets A and B of size 2 m ≫ 2 n/2 , rather than Õ(2 n/2 ) as required to uniquely identify S. If we consider all the values a ⊕ b for (a, b) in A × B, we expect that they are close to uniformly distributed over {0, 1} n \ S, so that every value except S is reached about 2 2m-n times, while S is never hit. Increasing m makes the gap more visible than with sets of size only Õ(2 n/2 ). Therefore, we consider buckets of several candidates s, and accumulate the number of a ⊕ b in each bucket. With buckets of 2 t values, each bucket receives 2 t × 2 2m-n values on average, but the bucket containing S receives only (2 t -1) × 2 2m-n values. If we model the counters as random variables following a binomial distribution, the variance σ 2 is about 2 m+t/2-n/2 . Therefore, the bias will be detectable when σ ≪ 2 2m-n , i.e. when t < 2mn.

Concretely, we use a truncation function T that keeps only nt bits of an n-bit word. We consider the values T (a ⊕ b) for all (a, b) ∈ A × B, and count how many times each value is reached. If m is large enough, the lowest counter corresponds to T (S).

For a given multi-set X , we consider an array of 2 n-t counters C X , to represent how many times each value T (x) is reached:

C X [i] = x ∈ X : T (x) = i , i ∈ {0, . . . , 2 n-t -1}.
Our goal is to compute C A⊕B efficiently from A and B, where A ⊕ B is the multi-set {a ⊕ b : (a, b) ∈ A × B}. We observe that:

C A⊕B [i] = |{(a, b) ∈ A × B : T (a ⊕ b) = i}| = j∈{0,1} n-t |{a ∈ A : T (a) = j}| × |{b ∈ B : T (b) = i ⊕ j}| = j∈{0,1} n-t C A [j]C B [i ⊕ j]
This is a form of convolution that can be computed efficiently using the Fast Walsh-Hadamard Transform, in the same way we use the Fast Fourier Transform to compute circular convolutions. We obtain all the values C A⊕B [i] simultaneously with complexity Õ(2 n-t ). This results in an algorithm with complexity Õ(2 m + 2 n-t ) (Algorithm 2), with m > (n + t)/2. We optimize the complexity by choosing t = n/3 and m = 2n/3 + ln(n)/2 such that the time complexity, data complexity, and memory usage are all in Õ(2 2n/3 ).

Plaintext-recovery attack against CTR

The missing difference algorithms give new attacks against the CTR mode and other related constructions, such as Wegman-Carter-Shoup MACs.

Attacking CTR in the chosen-prefix secret-suffix model

We consider collision attacks against the CTR mode in the chosen-prefix secret-suffix model [START_REF] Hoang | Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance[END_REF], given an oracle O : M → E(M ∥ S).

Instead of having the chosen message M and the secret S encrypted in separate blocks, the attacker can use a message M of length n/2, so that the first block of plaintext contains n/2 known bytes and n/2 secret bytes. By making a large number of queries with the same message M , she applies the known prefix sieving algorithm to this block and recovers the first n/2 secret bytes with complexity Õ(2 n/2 ).

Then she makes a set of queries with an empty message M , so that the first block of plaintext contains n bytes of S. Since the first n/2 bytes have been recovered already, she applies the known-prefix sieving again with complexity Õ(2 n/2) . Eventually, the full secret is recovered iteratively with complexity Õ(|S| × 2 n/2 ).

In practice, the man-in-the-browser setting gives enough freedom to the attacker to do this block splitting by varying the length of some headers.

Attacking Wegman-Carter-Shoup MACs

Because the fast convolution algorithm requires few assumptions, it is applicable to other modes of operation based on CTR. We consider the Wegman-Carter-Shoup MAC construction [START_REF] Shoup | On Fast and Provably Secure Message Authentication Based on Universal Hashing[END_REF]; it uses a block cipher E and a keyed universal hash function h, with keys k 1 and k 2 . Given a message M and a nonce N , the MAC is defined as:

MAC(N, M ) = h k1 (M ) ⊕ E k2 (N )
To apply our attack, we use two fixed messages M and M ′ , and we capture many values MAC(N, M ) in a list A and values MAC(N ′ , M ′ ) in a list B, all using unique nonces. We remark that ∀N ̸ = N ′ : E k2 (N ) ⊕ E k2 (N ′ ) ̸ = 0, therefore we recover h k1 (M ) ⊕ h k1 (M ′ ) by solving the missing difference problem with A and B.

In practical constructions such as GMAC [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF] and Poly1305 [START_REF] Bernstein | The Poly1305-AES Message-Authentication Code[END_REF], h is a polynomial evaluation and recovering h k1 (M ) ⊕ h k1 (M ′ ) is sufficient to recover the hash key k 1 , leading to universal forgeries.

Comparison with previous attacks against GMAC.

There are several known attacks against GCM and GMAC, but none of them seems to allow universal forgery with just 2 2n/3 blocks of data and 2 2n/3 computations. In particular, Handschuh and Preneel [START_REF] Handschuh | Key-Recovery Attacks on Universal Hash Function Based MAC Algorithms[END_REF] gave a weak-key attack that can also be used to recover the hash key without weak key assumptions, using roughly 2 n/2 messages of 2 n/2 blocks. Later work extended these weak key properties [Saa12; PC15] but an attack still requires about 2 n blocks in total when no assumptions are made about the key.

A work done in parallel with ours recovers the hash key using O(2 n/2 ) short queries, and O(2 n ) computation [START_REF] Luykx | Optimal Forgeries Against Polynomial-Based MACs and GCM[END_REF]. Actually, their attack is essentially equivalent to the missing difference attack, using the basic sieving algorithm instead of the fast-convolution sieving.

Conclusion

The missing difference attacks against CTR of Section 5.5 and the collision attacks against CBC of Section 5.3 are two different ways block cipher modes can fail beyond the birthday bound. They exploit different properties of the modes, but result in similar attacks in terms of concrete requirements. This contradicts previous beliefs that CTR is less sensitive to birthday attacks than CBC. These techniques can be used against many other modes of operations (OFB, CFB, . . . ); most of them will be vulnerable to at least one the attacks, unless they have been carefully designed to provide security beyond the birthday bound.

Plaintext recovery for OFB. It is interesting to consider the security of OFB in light of the previous results. OFB turns a block cipher into stream cipher by iteratively encrypting an IV:

z -1 = IV z i = E k (z i-1 ) c i = z i ⊕ m i
If OFB is used with many short messages with different IVs, then collisions in the sequence z i are expected. A collision can be detected with partial knowledge of the plaintext; it implies that the next z i also collide and this leaks plaintext information.

On the other hand, if OFB is used with a single long message (or in a stateful variant without IV), then the z i sequence follows a cycle of E k . With high probability, the cycle has length close to 2 n , and no collision is expected around the birthday bound. In this case, the missing difference attack recovers plaintext data.

Plaintext recovery for f8. The f8 mode used in UMTS telephony is a variant of the OFB and CTR modes, that was apparently designed to avoid the collision attack against OFB:

A = E k ′ (IV) z -1 = 0 z i = E k (A ⊕ i ⊕ z i-1 ) c i = z i ⊕ m i
Our attack can be applied to the first block of ciphertext. Indeed, the first block of message

i is encrypted as c 0 = m 0 ⊕ E k (E k ′ (IV)), where the value E k (E k ′ (IV)
) is unique for all the messages encrypted with a given key.

Practical demonstration.

When the block-size n is equal to 64 bits (or smaller), a plaintext-recovery attack can be carried out in practice in a realistic setting, with a manin-the-browser recovering an authentication token. This should not come as a surprise to cryptographers, but practitioners tended to downplay the impact of these attacks, and ciphers with 64-bit block sizes were still in use in many protocols when we disclosed our results. By implementing an attack against a popular protocol under real-world conditions, we managed to convince them to deprecate those ciphers. Since legacy block ciphers are often used with CBC but very rarely with CTR, we only demonstrated the CTR attack in practice.

Generic Attacks Against

Beyond-Birthday-Bound MACs

This chapter is based on article [LNS18], found in Appendix J.

In order to avoid birthday attacks, several block-cipher based MACs have been proposed with an internal state larger than the primitive size. In particular, several constructions use a 2n-bit internal state so that collisions in the state are only expected after 2 n queries. Interestingly, all the above designs share a common structure: the 2n-bit internal state is divided in two n-bit parts, that we denote Σ and Θ, and the final MAC is computed as:

Double-block hash-then-sum MACs

MAC(M ) = E Σ(M ) ⊕ E ′ Θ(M ) ,
where E and E ′ denote the block cipher with potentially different keys. The functions Σ and Θ can be seen as two n-bit universal hash functions computed on the message. This structure has been called double-block hash-then-sum, and it will be the focus of this chapter. All these MACs have a security proof up to 2 2n/3 queries [DDN+18], but there are no known attacks with less than 2 n queries.

Our results. We describe a new cryptanalysis technique for double-block hash-then-sum MACs, that generalizes the collision attack of Preneel and van Oorschot. Instead of looking for a pair of messages so that the full state collides, we look for a quadruple of messages, which can be seen either as two pairs colliding on the first half of the state, or two pairs colliding on the second half. Since the finalization function combines the halves with a sum, we can detect such a quadruple because the corresponding MACs sum to zero, and can usually amplify this filtering. Moreover, when the messages are well constructed, the relations defining the four collisions create a linear system of rank only three, so that we expect one good quadruple out of 2 3n . Therefore, we only need four lists of 2 3n/4 queries, and we expect one good quadruple out of the 2 3n choices in the four lists.

The attacks have a complexity of 2 3n/4 in the information theoretic model (the model used for most MAC security proofs), but we note that an attacker needs more than 2 n operations to create a forgery. However, we have found a variant of our attack against SUM-ECBC and GCM-SIV2 with total complexity below 2 n , using O(2 6n/7 ) queries and 0

m 0 E 1 m 1 E 1 m 2 E 1 E 2 Σ 0 m 0 E 3 m 1 E 3 m 2 E 3 E 4 Θ τ Figure 6.1: SUM-ECBC.
Õ(2 6n/7 ) operations. As far as we know, this is the first attack with complexity below 2 n against a deterministic beyond-birthday-bound-secure MAC.

After the publication of our results, a more advanced security proof by Kim, Lee, and Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hashthen-Sum MACs[END_REF], proved security up to 2 3n/4 queries, achieving tight security.

Attacking SUM-ECBC

We focus on SUM-ECBC [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF], one the simplest double-block hash-then-sum constructions. We describe a universal forgery attack with O(2 3n/4 ) queries and Õ(2 3n/2 ) operations, and a variant with total complexity below 2 n , with O(2 6n/7 ) queries and Õ(2 6n/7 ) operations.

SUM-ECBC was designed by Yasuda in 2010 [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF], inspired by MAC constructions summing two CBC-MACs in the ISO 9797-1 standard. The scheme uses a block cipher keyed with four independent keys, denoted as

E 1 , E 2 , E 3 , E 4 . The message M is first divided into n-bit blocks M = m 0 ∥ m 1 ∥ m L-1
, and the construction is defined as follows (see Figure 6.1):

Σ(M ) = σ L σ 0 = 0 σ i+1 = E 1 (σ i ⊕ m i ) Θ(M ) = θ L θ 0 = 0 θ i+1 = E 3 (θ i ⊕ m i ) MAC(M ) = E 2 (Σ(M )) ⊕ E 4 (Θ(M ))

Using Quadruples

Our strategy consists in looking for a quadruple of messages (X, Y, Z, T ) such that pairs of values collide for one half of the state. More precisely, we look for quadruples satisfying a relation R(X, Y, Z, T ) defined as:

R(X, Y, Z, T ) :=          Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T ) Θ(T ) = Θ(X)
In particular, since the MAC is computed as

MAC(M ) = E Σ(M ) ⊕ E ′ Θ(M ) , it follows that: R(X, Y, Z, T ) =⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0. (6.1)
We build the quadruples with two message injection functions:

ϕ(i) = 0 ∥ i ψ(i) = 1 ∥ i X = ϕ(x) = 0 ∥ x Y = ψ(y) = 1 ∥ y Z = ϕ(z) = 0 ∥ z T = ψ(t) = 1 ∥ t,
Chapter 6. Generic Attacks Against Beyond-Birthday-Bound MACs

59

With this construction, the pairs (X, Y ), (Y, Z), (Z, T ) and (T, X) that we consider always contain a message built with ϕ and message built with ψ. Therefore, we will have the required collisions in Σ or Θ if the difference introduced in the half-state by the second block cancels the difference found after processing the first block.

More precisely, we have

MAC(ϕ(i)) = E 2 E 1 i ⊕ E 1 (0) Σ0(i) ⊕ E 4 E 3 i ⊕ E 3 (0) Θ0(i) MAC(ψ(i)) = E 2 E 1 i ⊕ E 1 (1)
Σ1(i) ⊕ E 4 E 3 i ⊕ E 3 (1)
Θ1(i)
and the relation R becomes:

R(x, y, z, t) ⇔          x ⊕ E 1 (0) = y ⊕ E 1 (1) z ⊕ E 3 (0) = y ⊕ E 3 (1) z ⊕ E 1 (0) = t ⊕ E 1 (1) x ⊕ E 3 (0) = t ⊕ E 3 (1) ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = E 1 (0) ⊕ E 1 (1) x ⊕ t = E 3 (0) ⊕ E 3 (1)
Because of the choice of the injection functions, R reduces to a linear system of rank only three. Therefore, we expect to find one quadruple satisfying the relation out of 2 3n , and we can construct 2 3n quadruples with just 4 × 2 3n/4 queries. This gives an attack with data complexity O(2 3n/4 ).

Detecting Quadruples

To complete the attack we need to identify a quadruple satisfying R. We directly observe when x ⊕ y ⊕ z ⊕ t = 0, and we also detect the relation on the sum of the MACs following Equation (6.1):

R(x, y, z, t) ⇒ MAC(ϕ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(ϕ(z)) ⊕ MAC(ψ(t)) = 0
However, we need a 3n-bit condition to identify a good quadruple with high probability. We use related quadruples that satisfy R simultaneously to amplify the filtering. We observe that R(x, y, z, t) is satisfied if and only

if R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) is satisfied for any constant c. R(x, y, z, t) ⇐⇒ ∀c, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) (6.2)
This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 2 3n/4 values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T with:

     x ⊕ y ⊕ z ⊕ t = 0 MAC(ϕ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(ϕ(z)) ⊕ MAC(ψ(t)) = 0 MAC(ϕ(x ⊕ 1)) ⊕ MAC(ψ(y ⊕ 1)) ⊕ MAC(ϕ(z ⊕ 1)) ⊕ MAC(ψ(t ⊕ 1)) = 0. (6.3)
In practice, we build consider four lists of size 2 3n/4 to express the search for a quadruple as an instance of the 4-sum problem:

L 1 = {x ∥ MAC(ϕ(x)) ∥ MAC(ϕ(x ⊕ 1)) : x ∈ X } L 2 = {y ∥ MAC(ψ(y)) ∥ MAC(ψ(y ⊕ 1)) : y ∈ Y} L 3 = {z ∥ MAC(ϕ(z)) ∥ MAC(ϕ(z ⊕ 1)) : z ∈ Z} L 4 = {t ∥ MAC(ψ(t)) ∥ MAC(ψ(t ⊕ 1)) : t ∈ T } A 4-sum algorithm returns (x, y, z, t) ∈ X ×Y×Z×T such that L 1 [x]⊕L 2 [y]⊕L 3 [z]⊕L 4 [t] = 0.
A naive algorithm would take time 2 3n to examine all quadruples, but there is a simple improvement with time Õ(2 3n/2 ): the attacker first builds L 1 × L 2 and L 3 × L 4 , then she looks for a collision between the two lists. After finding a collision, we verify that it is not a false positive by testing the relation for another value c.

Universal Forgeries. This attack can be extended to a universal forgery. Indeed, the fixed prefix 0 and 1 can be replaced by v and v ⊕ 1 for any block v, and when we identify a right quadruple (x, y, z, t) we deduce the value ∆

1 = E 1 (v) ⊕ E 1 (v ⊕ 1) and ∆ 3 = E 3 (v) ⊕ E 3 (v ⊕ 1). There is also a length extension property: if (x, y, z, t) is a right quadruple, then MAC(v ∥ x ∥ s) ⊕ MAC(v ⊕ 1 ∥ y ∥ s) ⊕ MAC(v ∥ z ∥ s) ⊕ MAC(v ⊕ 1 ∥ t ∥ s) = 0 for any suffix s.
Therefore, if we want to forge a MAC for any message m of size L ≥ 2 blocks we parse it as m = v ∥ w ∥ s (where s has zero, one, or several blocks) and perform the attack to recover ∆ 1 and ∆ 3 . Then we can forge using the previous relation, and Equation (6.2):

MAC(v ∥ w ∥ s) = MAC(v ⊕ 1 ∥ w ⊕ ∆ 1 ∥ s) ⊕ MAC(v ∥ w ⊕ ∆ 3 ∥ s) ⊕ MAC(v ⊕ 1 ∥ w ⊕ ∆ 1 ⊕ ∆ 3 ∥ s)

Optimizing the time complexity.

Equation (6.2) can also be used to reduce the time complexity below 2 n , at the cost of more oracle queries. Indeed, if we consider a subset C of {0, 1} n , we have:

R(x, y, z, t) ⇔ ∀c ∈ C, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) ⇒ ∀c ∈ C, MAC(ϕ(x ⊕ c)) ⊕ MAC(ψ(y ⊕ c)) ⊕ MAC(ϕ(z ⊕ c)) ⊕ MAC(ψ(t ⊕ c)) = 0 ⇒ c∈C MAC(ϕ(x ⊕ c)) ⊕ c∈C MAC(ψ(y ⊕ c)) ⊕ c∈C MAC(ϕ(z ⊕ c)) ⊕ c∈C MAC(ψ(t ⊕ c)) = 0 (6.4)
If we select C as a linear subspace, then the last expression does not depend on the full (x, y, z, t), but only on their projection on the orthogonal complement of C. Concretely, we use C = x : x [3n/7:n] = 0 = x : x < 2 3n/7 , so that the value c∈C MAC(ϕ(x ⊕ c)) depends on only 4n/7 bits of x.

Therefore, we consider the rewritten MAC function

MAC ′ (v ∥ w) = c∈C MAC(v ∥ w ⊕ c),
the following message injections, with a 4n/7-bit input

ϕ ′ (i) = 0 ∥ i|0 ψ ′ (i) = 1 ∥ i|0
, and a reduced relation over 4n/7-bit values:

R ′ (x, y, z, t) :=          x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] y ⊕ z = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] z ⊕ t = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] t ⊕ x = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] x ⊕ t = (E 3 (0) ⊕ E 3 (1)) [3n/7:n]
Thanks to Equation 6.4, we still have:

R ′ (x, y, z, t) ⇒ MAC ′ (ϕ ′ (x)) ⊕ MAC ′ (ψ ′ (y)) ⊕ MAC ′ (ϕ ′ (z)) ⊕ MAC ′ (ψ ′ (t)) = 0
Since the relation R ′ is now only a 12n/7-bit condition, we use shorter lists, with just 2 3n/7 elements. We also increase the filtering using the same trick as previously. Using the 4-sum algorithm, we locate a right quadruple using Õ(2 6n/7 ) operations. The attack uses O(2 6n/7 ) queries to generate the lists, because each element is the sum of 2 3n/7 queries. Table 6.1: Summary of the security for studied modes and our main results. q is the number of queries, ℓ is maximum size of a query, σ is the total number of processed blocks. The expected lower bound and attack complexity is in number of constant length queries (ℓ = O(1)). We use "U" for universal forgeries, and "E" for existential forgeries. Proofs marked with * are invalidated by our results.

Mode

Provable security bounds Our attacks

Advantage

Queries Queries Time Type

SUM-ECBC [Yas10] O( q 3 ℓ 3 2 2n ) with ℓ ≤ 2 2n/5 Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) U O(2 6n/7 ) Õ(2 6n/7 ) U [KLL20] O( q 4/3 ℓ o(1)
2 n

+ q 4/3 ℓ 4 2 2n ) Ω(2 3n/4 ) GCM-SIV2 [IM16] O( qℓ 2 n + q 3 ℓ 2 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) U O(2 6n/7 ) Õ(2 6n/7 ) U PMAC+ [Yas11] O( q 3 ℓ 3 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E [KLL20] O( ℓ 2 n/2 + q 4/3 ℓ 2/3 +qℓ 2 2 n
) Ω(2 3n/4 )

LightMAC+ [Nai17] O( q 3 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E [Nai18] O(q 2 t q v /2 2n ) * [KLL20] O( q 4/3 2 n ) Ω(2 3n/4 ) 1kPMAC+ [DDN+17] O( σ 2 n + qσ 2 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E 3kf9 [ZWS+12] O( q 3 ℓ 3 2 2n + qℓ 2 n ) Ω(2 2n/3 ) O( 4 √ n • 2 3n/4 ) Õ(2 5n/4 ) U [KLL20] O( q 4/3 ℓ 4/3 2 n + q 2 ℓ 2 2 2n + q 4 ℓ 6 2 3n ) Ω(2 3n/4 ) 1kf9 [DDN+15] O( qℓ 2 2 n + q 3 ℓ 4 2 2n + q 4 ℓ 4 2 3n + q 4 ℓ 6 2 4n ) * Ω(2 2n/3 ) * O(2 n/2 ) Õ(2 n/2 ) U

Generalization to double-block hash-then-sum MACs

In the full paper [LNS18] (Appendix J), we generalize this attack to a framework for attacks against double-block hash-then-sum MACs. Table 6.1 shows a summary of our results and how they compare with their respective provable security claims. In particular, we have forgeries attacks with O(2 3n/4 ) short MAC queries against SUM-ECBC, GCM-SIV2, PMAC+, LightMAC+, 1kPMAC+, and 3kf9. As far as we know, these are the first attacks with less than 2 n blocks of data against these constructions. These results were an important step towards understanding the actual security of these modes, by providing a security upper bound of 2 3n/4 short queries when the lower bound from the proof was 2 2n/3 queries. Later work has given security proof with the same bound 2 3n/4 [KLL20] for most of these constructions, which closes the gap between proofs and attacks.

Our attacks exploit the fact that the two halves are combined with a sum, where one side depends only on Σ, and the other side depends only on Θ. They do not seem applicable to constructions with more intricate finalization functions, such as LightMAC+2 [START_REF] Naito | Blockcipher-Based MACs: Beyond the Birthday Bound Without Message Length[END_REF], or the tweakable block-cipher based constructions PMAC_TBC [START_REF] Naito | Full PRF-Secure Message Authentication Code Based on Tweakable Block Cipher[END_REF], PMACx [START_REF] List | Revisiting Full-PRF-Secure PMAC and Using It for Beyond-Birthday Authenticated Encryption[END_REF], ZMAC [START_REF] Iwata | ZMAC: A Fast Tweakable Block Cipher Mode for Highly Secure Message Authentication[END_REF], or ZMAC+ [START_REF] List | ZMAC + -An Efficient Variable-output-length Variant of ZMAC[END_REF].

Mistakes in proofs.

Our attack against LighMAC+ contradicts a security bound for LighMAC+ by Naito [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF], because we have an attack with O(2 3n/4 ) MAC queries, and a single verification query. We have also found an attack with only O(2 n/2 ) queries and Õ(2 n/2 ) operations against 1kf9 [DDN+15], a single key variant of 3kf9 with claimed security up to 2 2n/3 queries. 1kf9 had been withdrawn due to issues with its security proof before our result, but no attack was known previously.

Generic Attacks Against MACs in the Quantum Setting

This chapter is based on articles [KLL+16a] and [BLN+21], found in Appendix K and L.

Cryptography would be particularly affected by the development of large-scale quantum computers. In particular, currently used asymmetric cryptographic primitives based on number theory (RSA [START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF], Diffie-Hellman key exchange [START_REF] Diffie | New Directions in Cryptography[END_REF], elliptic-curve cryptography [Mil86; Kob87], ...) would be broken in polynomial time due to Shor's algorithm [START_REF] Shor | Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer[END_REF]. This has motivated the cryptographic community to search for quantumsafe solutions: the goal of post-quantum cryptography is to prepare cryptographic primitives to resist quantum adversaries, i.e. adversaries with access to a quantum computer. Symmetric cryptography is much less impacted by quantum algorithms. The main result is a quadratic speed-up of exhaustive search using Grover's algorithm [START_REF] Grover | A Fast Quantum Mechanical Algorithm for Database Search[END_REF]. Since the attack is still exponential, it can be countered by just properly dimensioning the primitive.

In this chapter we analyze the security of MAC algorithms in a quantum setting. We consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in this model.

We show that several classical attacks based on finding collisions can be dramatically sped up using a quantum procedure called Simon's algorithm: finding a collision requires Ω(2 n/2 ) queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only O(n) queries in the quantum model. We obtain a series of attacks against many standardized MACs: CBC-MAC, PMAC, GMAC, LightMAC, ... This is quite surprising compared to the situation with encryption modes: standard modes (CBC, CTR, OFB, CFB) are secure with a quantum-secure block ciphers [START_REF] Anand | Post-Quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation[END_REF].

Quantum security models

We present our attacks using quantum algorithms as black boxes, so that our results can be understood without specific knowledge of quantum computing. Nonetheless, we give a basic description of the quantum circuit model in order to define quantum security notions.

The basic computation units are qubits, two-level quantum systems whose state is represented by a superposition α |0⟩ + β |1⟩, with amplitudes α and β, which is a normalized vector in C 2 (of norm |α 2 | + |β 2 | = 1). The state of an n-qubit system belongs to C 2 n , its 2 n basis vectors (in the computational basis) are the 2 n n-bit strings. A quantum algorithm is a sequence of unitary operators of C 2 n , partial measurements, and oracle calls. We say that a function f is queried in superposition if the following unitary operator O f is made available: |x⟩ |y⟩ → |x⟩ |y ⊕ f (x)⟩. Indeed, this operator allows querying f on any quantum state, thus on any superposition of inputs x.

Q1 and Q2 setting. To define quantum security notion, we consider the adversary as a quantum algorithm. Following [KLL+16b], we adopt the Q1 / Q2 terminology to classify quantum attacks on symmetric schemes. In the Q1 setting, the adversary is given only classical encryption or decryption query access to black-boxes. In the Q2 setting, the adversary is given quantum or superposition access, in the sense that a black-box E k becomes a quantum oracle O E k . Note that these models have alternative names, for example Q2 security has been called "quantum chosen-plaintext attack" (qCPA) or "quantum security" in previous works.

The Q1 setting is more realistic: the adversary receives classical data, and only uses local quantum computation. This is the setting used by attacks against asymmetric schemes based on Shor's algorithm: the adversary receives the (classical) public key, and uses a quantum computer to recover the private key. Key-recovery attacks using Grover's algorithm are also in the Q1 setting: the adversary receives a pair of known plaintext and ciphertext, and uses quantum computation locally to recover the corresponding key.

The Q2 setting is a simple and natural extension of the Q1 setting, giving more power to the adversary. It encompasses any reasonable model of quantum attacks, so that a security proof in this model gives a high level of assurance. Previous work has shown that it is possible to build secure cryptosystems in this model [START_REF] Boneh | Quantum-Secure Message Authentication Codes[END_REF]. Concretely, it assumes that the legitimate user implements the algorithm on a quantum computer, and that the adversary obtains oracle access.

The study of quantum attacks on symmetric schemes in the Q2 setting was sparkled by the seminal work of Kuwakado and Morii [KM10; KM12], who showed that the 3round Feistel construction and the Even-Mansour cipher became insecure if exposed to superposition queries. More precisely, they use Simon's algorithm to respectively distinguish the construction and recover the key of the cipher in polynomial time, while classical proofs of security exist.

Unforgeability.

In this chapter, we consider forgery attacks: the goal of the attacker is to forge a tag for some arbitrary message, without the knowledge of the secret key. In a classical setting, we assume that the adversary has access to a MAC oracle, and she must predict the MAC of a message that she has not queried. In the quantum setting, we must modify this definition because a superposition query can include all messages simultaneously.

We follow the EUF-qCMA security definition of Boneh and Zhandry [START_REF] Boneh | Quantum-Secure Message Authentication Codes[END_REF]. A message authentication code is broken by a quantum existential forgery attack if after q queries to the cryptographic oracle, the adversary can generate at least q + 1 valid messages with corresponding tags.

For nonce-based MACs, we assume that the nonce is classical, and chosen randomly by the adversary (as in the IND-qCPA notion [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]). This sidesteps the issue of defining the uniqueness of a nonce in quantum superposition.

Simon's algorithm

Simon's algorithm [START_REF] Simon | On the Power of Quantum Computation[END_REF] was one of the first algorithms to show an exponential speedup in the quantum setting, and inspired Shor's algorithm. It solves the following problem:

Simon's problem: Given a Boolean function f : {0, 1} n → {0, 1} n and the promise that there exists s ∈ {0, 1} n such that for any (x, y) ∈ {0,

1} n , [f (x) = f (y)] ⇔ [x ⊕ y ∈ {0 n ,
s}], the goal is to find s. This problem can be solved classically by searching for collisions. The optimal time to solve it is therefore Θ(2 n/2 ). On the other hand, Simon's algorithm solves this problem 64 Symmetric Cryptanalysis Beyond Primitives 0

m 0 E k m 1 E k m 2 E k E k ′ τ Figure 7.1: Encrypt-last-block CBC-MAC.
with quantum complexity O(n) using superposition queries to f . The algorithm uses a quantum subroutine that makes a single superposition query to f , and returns a random vector y such that y • s = 0. By repeating this subroutine O(n) times, one obtains n -1 independent vectors orthogonal to s with high probability, and s can be recovered using basic linear algebra.

Attack strategy

The general strategy behind our attacks follows the approach used by Kuwakado and Morii. We start with the MAC oracle F k : {0, 1} n → {0, 1} n and exhibit a new function f that satisfies Simon's promise with two additional properties: the adversary should be able to query f in superposition if she has quantum oracle access to F k , and the knowledge of the string s should be sufficient to break the cryptographic scheme. In most cases, the construction of f corresponds to a classical collision attack.

Dealing with unwanted collisions

In our cryptanalysis scenario, it is not always the case that the promise of Simon's problem is perfectly satisfied. More precisely, by construction, there will always exist an s such that f (x) = f (x ⊕ s) for any input x, but there might be additional collisions. If the number of such unwanted collisions is too large, one might not be able to obtain a full rank linear system of equations from Simon's subroutine after O(n) queries.

In [KLL+16a] (Appendix K), we show that Simon's algorithm runs in time O(n) under a weaker assumption:

max t / ∈{0,s} Pr x [f (x ⊕ t) = f (x)] ≤ 1 2 . ( 7.1)
In practice, we cannot prove this bound, but if it does not hold, then some of the primitives used in the construction are far from ideal. We can show that this happens with low probability, and would imply a classical attack against the system.

Breaking CBC-MAC

CBC-MAC is one of the earliest MAC constructions, inspired by the CBC encryption mode [START_REF]Computer Data Authentication[END_REF]. Since the basic CBC-MAC is only secure when the queries are prefixfree, there are many variants of CBC-MAC to provide security for arbitrary messages. In the following we describe the Encrypt-last-block CBC-MAC variant [BKR94], using two keys k and k ′ , but the attack can be easily adapted to other variants. On a message

M = m 0 ∥ . . . ∥ m L-1
, CBC-MAC is defined as (see Figure 7.1):

x 0 = 0 x i+1 = E k (x i ⊕ m i ) CBC-MAC(M ) = E k ′ (x L )
CBC-MAC is standardized and widely used. It has been proven secure up to the birthday bound [START_REF] Bellare | The Security of Cipher Block Chaining[END_REF], assuming that the block cipher is indistinguishable from a random permutation.

Quantum attack. We present a powerful forgery attack on CBC-MAC with very low complexity using superposition queries. We fix two arbitrary message blocks α 0 , α 1 , with α 0 ̸ = α 1 , and we define the following function:

f : {0, 1} × {0, 1} n → {0, 1} n b, x → CBC-MAC(α b ∥ x) = E k ′ E k x ⊕ E k (α b ) .
The function f can be computed with a single call to the cryptographic oracle, and we can build a quantum circuit for f given a black box quantum circuit for CBC-MAC k . Moreover,

f satisfies the promise of Simon's problem with s = 1 ∥ E k (α 0 ) ⊕ E k (α 1 ): f (0, x) = E k ′ (E k (x ⊕ E k (α 1 ))), f (1, x) = E k ′ (E k (x ⊕ E k (α 0 ))), f (b, x) = f (b ⊕ 1, x ⊕ E k (α 0 ) ⊕ E k (α 1 )
). More precisely:

f (b ′ , x ′ ) = f (b, x) ⇔ x ⊕ E k (α b ) = x ′ ⊕ E k (α b ′ ) ⇔ x ′ ⊕ x = 0 if b ′ = b x ′ ⊕ x = E k (α 0 ) ⊕ E k (α 1 ) if b ′ ̸ = b
Therefore, an application of Simon's algorithm returns E k (α 0 ) ⊕ E k (α 1 ). This allows to forge messages easily:

1. Query the tag of α 0 ∥ m 1 for an arbitrary block m 1 ;

2. The same tag is valid for

α 1 ∥ m 1 ⊕ E k (α 0 ) ⊕ E k (α 1 ).
In order to break the formal notion of EUF-qCMA security, we must produce q + 1 valid tags with only q queries to the oracle. Let q ′ = O(n) denote the number of quantum queries made to learn E k (α 0 ) ⊕ E k (α 1 ). The attacker just repeats the forgery step q ′ + 1 times, in order to produce 2(q ′ + 1) messages with valid tags, after a total of 2q ′ + 1 classical and quantum queries to the cryptographic oracle. Therefore, CBC-MAC is broken by a quantum existential forgery attack.

Breaking PMAC

PMAC is a parallelizable block-cipher based MAC designed by Rogaway [START_REF] Rogaway | Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC[END_REF]. PMAC is based on the XE construction: the construction uses secret offsets ∆ i and ∆ * derived from the secret key to turn the block cipher into a tweakable block cipher. More precisely, the PMAC algorithm is defined on a message M = m 0 ∥ . . . ∥ m L-1 as (see Figure 7.2):

c i = E k (m i ⊕ ∆ i ) PMAC(M ) = E k ∆ * ⊕ m L-1 ⊕ L-2 i=0 c i
Some authenticated encryption schemes use variants of PMAC; we denote as PMAC' the variant used in [START_REF] Hoang | AEZ v5: Authenticated Encryption by Enciphering[END_REF] (see Figure 7.3):

c i = E k (m i ⊕ ∆ i ) PMAC'(M ) = E k ∆ * ⊕ L-1 i=0 c i
We omit the generation of the secret offsets because it is irrelevant to our attacks.

Symmetric Cryptanalysis Beyond Primitives

E k E k E k ∆ 0 ∆ 1 ∆ ⋆ m 0 m 1 m 2 τ Figure 7.2: PMAC. E k E k E k E k ∆ 0 ∆ 1 ∆ 2 ∆ * m 0 m 1 m 2 τ Figure 7.3: PMAC' variant.
Using the CBC-MAC attack. When PMAC is used with two-block messages, it has the same structure as CBC-MAC:

PMAC(m 0 ∥ m 1 ) = E * k (m 1 ⊕ E 0 k (m 0 )), with E 0 k (x) = E k (x ⊕ ∆ 0 ) and E * k (x) = E k (x ⊕ ∆ * )
. Therefore, we can use the attack of the previous section to recover

E 0 k (α 0 ) ⊕ E 0 k (α 1 )
for arbitrary values of α 0 and α 1 .

Quantum attack targeting offsets. The CBC-MAC attack is not applicable to the PMAC' variant. We propose an alternative attack to recover the difference between two offsets ∆ i . We use the following function:

f : {0, 1} n → {0, 1} n x → PMAC'(x ∥ x) = E * k (E k (x ⊕ ∆ 0 ) ⊕ E k (x ⊕ ∆ 1 )) . In particular, it satisfies f (x ⊕ s) = f (x) with s = ∆ 0 ⊕ ∆ 1 .
This function does not satisfy the strict promise of Simon's algorithm because it has additional collisions, but we can show that the condition (7.1) is satisfied if E is a good block cipher. Therefore, we apply Simon's algorithm to recover ∆ 0 ⊕ ∆ 1 . We obtain forgeries as follows:

1. Query the tag of m ∥ m for an arbitrary block m;

The same tag is valid for

m ⊕ ∆ 0 ⊕ ∆ 1 ∥ m ⊕ ∆ 0 ⊕ ∆ 1 .

Breaking GMAC

GMAC is the underlying MAC of the widely used GCM standard, designed by McGrew and Viega [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF], and standardized by NIST. GMAC follows the Wegman-Carter construction [START_REF] Carter | Universal Classes of Hash Functions (Extended Abstract)[END_REF]: it is built from a universal hash function, using polynomial evaluation in a Galois field. As opposed to the constructions of the previous sections, GMAC is a randomized MAC; it requires a second input N , which must be non-repeating (a nonce). GMAC is essentially defined as:

GMAC(N, M ) = GHASH(M ∥ len(M )) ⊕ E k (N ||1) GHASH(M ) = len(M )-1 i=0 m i ⊙ H len(M )-i with H = E k (0),
where len(M ) is the length of M , and ⊙ is the finite-field multiplication.

Quantum attack. When the polynomial is evaluated with Horner's rule, the structure of GMAC is similar to that of CBC-MAC (see Figure 7.4). For a two-block message, we have

GMAC(m 0 ∥ m 1 ) = (m 0 ⊙ H) ⊕ m 1 ⊙ H ⊕ E k (N ∥ 1)
. Therefore, we use the same function as in the CBC-MAC attack, with fixed blocks α 0 and α 1 : In particular, we have:

f N : {0, 1} × {0, 1} n → {0, 1} n b, x → GMAC(N, α b ∥ x) = α b ⊙ H 2 ⊕ x ⊙ H ⊕ E k (N ||1).
f N (b ′ , x ′ ) = f (b, x) ⇔ α b ⊙ H 2 ⊕ x ⊙ H = α b ′ ⊙ H 2 ⊕ x ′ ⊙ H ⇔ x ′ ⊕ x = 0 if b ′ = b x ′ ⊕ x = (α 0 ⊕ α 1 ) ⊙ H if b ′ ̸ = b
Therefore f N satisfies the promise of Simon's algorithm with s = 1 ∥ (α 0 ⊕ α 1 ) ⊙ H.

Dealing with the nonce. Since N is a nonce we can only query f N once. 1 Therefore, we cannot apply Simon's algorithm as is, because this requires O(n) queries to the same function. However, a single step of Simon's algorithm requires a single query to the f N function, and returns a vector orthogonal to s, for any random choice of N (the secret period s is independent of N ). Therefore, we recover (α 0 ⊕ α 1 ) ⊙ H after O(n) steps, even if each step uses a different value of N . Then, we deduce H easily, and generate forgeries using H:

1. Query the tag of N, m 0 ∥ m 1 for arbitrary blocks m 0 , m 1 (under a random nonce N ).

2. The same tag is valid for m 0 ⊕ 1 ∥ m 1 ⊕ H (with the same nonce N ).

As for CBC-MAC, repeating these two steps leads to an existential forgery attack.

Breaking ΘCB3

ΘCB3 [START_REF] Krovetz | The Software Performance of Authenticated-Encryption Modes[END_REF] is the tweakable block-cipher variant of the authenticated encryption scheme OCB3; OCB3 has been standardized by IETF [START_REF] Krovetz | The OCB Authenticated-Encryption Algorithm[END_REF]. ΘCB3 has the advantage of being secure up to 2 n queries (beyond the birthday bound). When used with an empty message, it becomes a nonce-based MAC:

c i = E i k (m i ) ΘCB3-MAC(N, M ) = F k (N ) ⊕ L-1 i=0 c i
In this description, E is a tweakable block-cipher: each E i is assumed to be an independent block cipher. We omit the details of the F k function for simplicity.

Quantum linearization attack. All the attacks described so far exploit the XOR between a secret value (the internal state or a secret offset) and a value chosen by the attacker.

Variants of those attacks can be mounted against many MACs with this property. However, in ΘCB3 there is no XOR between the message and a sensitive value, and we need a different type of attack.

Our key idea is to linearize the MAC by restricting the block inputs so that the internal state Σ =

L-1 i=0 E i k (m i
) is an affine function. We fix two arbitrary message blocks α 0 , α 1 , 68 Symmetric Cryptanalysis Beyond Primitives with α 0 ̸ = α 1 , and we consider messages of the form

E 0 k E 1 k E 2 k F k m 0 m 1 m 2 N τ
M b = α b[0] ∥ α b[1] ∥ α b[2] ∥ . . . ∥ α b[L-1]
with b ∈ {0, 1} L . We observe that the internal state is an affine function of b:

Σ(M b ) = L i=0 E i k (α b[i] ) = L i=0 E i k (α 0 ) ⊕ b[i] ⊙ (E i k (α 0 ) ⊕ E i k (α 1 ))
In particular, with L > n the function b → Σ(M b ) necessarily has a non-trivial kernel: there exist an L-bit vector s ̸ = 0 with Σ(M b⊕s ) = Σ(M b ) for all b. With L = n + 1, s is likely to be unique. Therefore, we define the following function:

f N : {0, 1} L → {0, 1} n b → ΘCB3-MAC(N, M b ) = F k (N ) ⊕ Σ(M b )
The function has period s, so that we recover it using Simon's algorithm. We obtain forgeries as follows:

1. Query the tag of N, M 0 ∥ m for an arbitrary block m (under a random nonce N ).

2. The same tag is valid for M s ∥ m (with the same nonce N ).

Alternative quantum attacks. We observe that the function f N in ΘCB3 is actually an affine function. Therefore, we can mount alternative attacks using other quantum algorithms: Deutsch's algorithm [START_REF] Deutsch | Quantum theory, the Church-Turing principle and the universal quantum computer[END_REF] or Bernstein-Vazirani's algorithm [START_REF] Bernstein | Quantum Complexity Theory[END_REF]. This is the first application of those algorithms in the context of symmetric cryptography.

Conclusion

These techniques apply to most of the block-cipher-based MACs proposed in the literature: we obtain polynomial attacks in the Q2 setting against CBC-MAC, PMAC, PMAC+, GMAC, LightMAC, LightMAC+, PolyMAC, ZMAC, PMAC_TBC3k. Similarly, we can break the authentication of the authenticated encryption schemes OCB, ΘCB3, GCM, GCM-SIV, GCM-SIV2, EAX.

We also found an efficient attack against Poly1305 using Shor's algorithm based on similar ideas. Those attacks are not a practical threat because they use the Q2 model, assuming that the adversary can query a MAC oracle with a quantum superposition of messages. However, this is a surprising result, because all those constructions have classical proof of security and we didn't expect an exponential speedup in the quantum model for symmetric cryptosystems. In particular, this partially answers an open question by Boneh and Zhandry in 2013 [START_REF] Boneh | Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World[END_REF]: "Do the CBC-MAC or NMAC constructions give quantum-secure PRFs?".

Quantum-secure MACs. Those attacks also motivate the search for efficient quantumsecure MACs. In [START_REF] Song | Quantum Security of NMAC and Related Constructions -PRF Domain Extension Against Quantum attacks[END_REF], Song and Yun have proven that HMAC and NMAC are secure against an exponential number of quantum queries. Therefore, when we designed Saturnin [CDL+20], an authenticated encryption scheme aiming for quantum security, we used a mode based on HMAC.

Building a parallelizable quantum-secure MAC is more challenging. Indeed, the linearization technique is applicable to a large class of constructions, as long as they can be written in form G N ( F i (m i )) with F i arbitrary functions and G N a function potentially depending on a nonce. This includes most of the proposed parallelizable MACs. In [BBC+21] we propose a new authenticated encryption mode that is efficient, parallelizable, and quantum secure: QCB. QCB is similar to ΘCB3, but we make all tweakable block-cipher calls dependent on the nonce to avoid this class of attacks.

The Sum Can Be Weaker Than Each Part

Gaëtan Leurent 1 and Lei Wang 2

1 Inria, France, gaetan.leurent@inria.fr 2 Nanyang Technological University, Singapore, wang.lei@ntu.edu.sg Abstract. In this paper we study the security of summing the outputs of two independent hash functions, in an effort to increase the security of the resulting design, or to hedge against the failure of one of the hash functions. The exclusive-or (XOR) combiner H 1 (M )⊕H 2 (M ) is one of the two most classical combiners, together with the concatenation combiner H 1 (M ) H 2 (M ). While the security of the concatenation of two hash functions is well understood since Joux's seminal work on multicollisions, the security of the sum of two hash functions has been much less studied. The XOR combiner is well known as a good PRF and MAC combiner, and is used in practice in TLS versions 1.0 and 1.1. In a hash function setting, Hoch and Shamir have shown that if the compression functions are modeled as random oracles, or even weak random oracles (i.e. they can easily be inverted -in particular H 1 and H 2 offer no security), H 1 ⊕ H 2 is indifferentiable from a random oracle up to the birthday bound. In this work, we focus on the preimage resistance of the sum of two narrowpipe n-bit hash functions, following the Merkle-Damgård or HAIFA structure (the internal state size and the output size are both n bits). We show a rather surprising result: the sum of two such hash functions, e.g. SHA-512 ⊕ Whirlpool, can never provide n-bit security for preimage resistance. More precisely, we present a generic preimage attack with a complexity of Õ(2 5n/6 ). While it is already known that the XOR combiner is not preserving for preimage resistance (i.e. there might be some instantiations where the hash functions are secure but the sum is not), our result is much stronger: for any narrow-pipe functions, the sum is not preimage resistant. Besides, we also provide concrete preimage attacks on the XOR combiner (and the concatenation combiner) when one or both of the compression functions are weak; this complements Hoch and Shamir's proof by showing its tightness for preimage resistance. Of independent interests, one of our main technical contributions is a novel structure to control simultaneously the behavior of independent hash computations which share the same input message. We hope that breaking the pairwise relationship between their internal states will have applications in related settings.

Keywords: Hash functions, combiners, XOR combiner, preimage attack. c IACR 2015. This article is the final version submitted by the authors to the IACR and to Springer-Verlag on January 30 2015. The version published by Springer-Verlag will be available in the proceedings of Eurocrypt 2015.

Introduction

Hash functions are a very important class of primitive in modern cryptography, used in almost every secure system. A hash function H : {0, 1} * → {0, 1} n takes an arbitrary length input and produces an n-bit output or digest. Hash functions are used in many setting with various security requirements; the general expectation is that a hash function should behave like a random function from {0, 1} * to {0, 1} n . More concretely, the main security notions expected from a hash function are:

Collision resistance. It should be hard to find two messages M = M with H(M ) = H(M ). Second-preimage resistance. Given a message M , it should be hard to find M = M with H(M ) = H(M ). Preimage resistance. Given a target hash value H, it should be hard to find M with H(M ) = H.

Since generic collision attacks require 2 n/2 work, and generic preimage attacks require 2 n work, a secure hash function should have the same level of resistance.

In order to build more secure hash functions, or to protect oneself against future cryptanalysis advances, such as the devastating attacks of Wang et al. against the SHA family [42,41], a practical countermeasure might be to combine two different hash functions. The goal is that the combined hash function can only be broken when both components are weak. In particular, this reasoning was used by the designers of SSL [14] and TLS [8], who combined MD5 and SHA-1 in various ways. More precisely, the Key Derivation Function of TLS v1.0/v1.1 uses a sum of HMAC-MD5 and HMAC-SHA-1. 3 The designers explain [8]: "In order to make the PRF as secure as possible, it uses two hash algorithms in a way which should guarantee its security if either algorithm remains secure."

There are two classical hash function combiners: the concatenation combiner H 1 (M ) H 2 (M ) and the XOR combiner H 1 (M ) ⊕ H 2 (M ). In a seminal work [20], Joux showed that the concatenation combiner with narrow-pipe hash functions offers much less security than could be expected: it has 2n bits of output, but essentially offers the same security as an n-bit hash function. In this work, we carry a similar analysis for the XOR combiner. Previous work has shown that it is indifferentiable from a random oracle up to the birthday bound [17], even if the initial functions are weak; in particular, it has optimal collision resistance of n/2 bits. However, we show that the preimage security is much less than one might expect, with a generic preimage attack with complexity Õ(2 5n/6 ).

Since the goal of a combiner is to keep some security even if one of the functions is found to be weak, it is natural that the two hash functions H 1 and H 2 are independent in practice. Throughout this paper the two hash functions used in a combiner are always assumed to be independent without specifying it explicitly 4 . Iterated hash function. In this paper we consider iterated hash functions, following the Merkle-Damgård construction [30,7] or the more general HAIFA construction [3], as shown in Figure 1. We focus on narrow-pipe designs, i.e. we assume that the internal state size is the same as the output size n. The message M is first split into blocks m 0 , . . . m , and the hash function iterates a series of compression functions h i over an internal state x, with the initial value denoted as IV . Finally, the hash value is computed with a finalization function g:

x 0 = IV x i+1 = h i (x i , m i ) H(M ) = g(x +1 , |M |)
In the following, we assume that the compression function is the same at every step (∀i, h i = h) in order to simplify the notations, but it is straightforward to apply the attack with the corresponding function at each step.

h 0 n m 0 x 0 h 1 n m 1 x 1 h 2 n m 2 x 2 x 3 H(M ) n n |M |

IV g

Fig. 1. Iterated hash function.

Related works

Combiners have been studied in several different settings. For generic attacks, the compression functions are modeled as random functions, in order to devise attacks that don't use any weakness of the compression functions. On the other hand, some work assumes that the compression function is a weak random oracle (that can easily be inverted), and prove that some constructions are still secure in this model. Finally, more theoretical work focus on the notion of robustness, i.e. the existence of a reduction from attacks on the hash functions to attacks on the combiner.

Analysis of the concatenation combiner. The concatenation combiner H 1 (M ) H 2 (M ) is probably the most studied one. In 2004, Joux [20] described surprising attacks on the concatenation of two narrow-pipe hash functions using multicollisions: while the output size is 2n bits, the concatenation can at most provide n/2-bit security for collision resistance and n-bit security for preimage resistance 5 . In particular, the concatenation is not security-amplifying. On the other hand, the concatenation combiner is robust for preimages and collisions, which gives a matching lower bound for generic attacks. Later, Hoch and Shamir [17] evaluated the security of the concatenation combiner with two weak hash functions. More precisely, the two hash functions are narrow-pipe Merkle-Damgård, and the compression functions are modeled as weak random oracles (as defined by Liskov [24]), i.e., the adversary is given additional interfaces to receive (random) preimages of the compression functions. They have proven that in this model, the concatenation combiner is still indifferentiable from a random oracle with n/2-bit security, implying (at least) the same security bound for collision resistance and preimage resistance. The bound is matched by Joux's attack for collisions, but there is a gap with Joux's attack for preimages, with complexity 2 n , which might be interesting to investigate further.

Mendel et al. analyzed some dedicated instantiations of the concatenation combiner [28], in particular using the hash function MD5. We omit the details and refer interested readers to [28].

Analysis of the XOR combiner. The XOR combiner has received less analysis. The work of Hoch and Shamir [17] actually proves the security of the XOR combiner as an intermediate result: it is also indifferentiable from a random oracle up to 2 n/2 queries in the weak random oracle model. In particular, this proves that there are no generic attacks with complexity smaller than 2 n/2 . For collision resistance, the bound is tight, since it is matched with the generic birthday attack bound. On the other hand, for preimage resistance, there exists a gap between the n/2-bit proven bound and the n-bit expected ideal security bound.

To the best of our knowledge, no preimage attacks have been shown against the XOR combiner. Therefore, the preimage security of the XOR combiner against generic attacks is still an open problem, and will be the main topic of our work. We will also consider the preimage security of the XOR combiner with weak hash functions, and study the tightness of Hoch and Shamir's bound.

Robust combiners. In the last years, the general problem of combining two (or more) hash functions H 1 and H 2 has been extensively studied from a theoretical point of view. These works focus on the notion of a robust combiner: a robust combiner is secure with respect to property α as long as one of the underlying hash functions is secure for α. It can be shown that the concatenation combiner is a robust combiner for collision-resistant hash functions and for MACs, while the XOR combiner is robust for PRFs and for MACs [23]. More advanced combiners have been constructed in order to be robust for multiple properties simultaneously [11,12,13]. The notion was mostly studied via the black-box reduction model. A series of results have showed that robust combiners for collision resistance and preimage resistance cannot have an output length significantly shorter than the sum of the output length of the underlying hash functions [4,35,36,31]. Since the XOR combiner is length preserving, this shows that it is not robust for collision resistance and preimage resistance.

Actually, the impossibility results are in part due to the stringent requirement from the black-box reduction model. In order to overcome this limitation, Mittelbach introduced the idealized random oracle model [32]. He gives a construction of a short output combiner with optimal collision and preimage security in this model 6 (assuming that one of the functions is ideal): Cryptophia's short combiner uses the sum of two hash functions with some pre-processing of the messages (to allow non-independent functions).

More generally, we point out that a combiner being non-robust does not necessarily mean there is an attack. The non-robustness results only show that the security of the combiner cannot be proved with a reduction from the security of the hash functions. In particular, the XOR combiner is not robust for collisionresistance, or even collision-resistance preserving. However, Hoch and Shamir's work proves that there are no generic collision attacks on this construction, either with ideal compression function, or even with weak compression functions. This arguably makes the XOR a useful combiner for collision resistance. Regarding preimage security, the non-robustness result does not imply that the XOR of two concrete hash functions is weak, and the simplicity and short output of this construction still make it quite attractive.

Our results

In this work, we study the preimage security of the XOR combiner, the main remaining open problem for classical combiners. We show that, surprisingly, the sum of two narrow-pipe n-bit hash functions can never achieve n-bit security for preimage resistance. More precisely, we find a generic preimage attack with a complexity of Õ(2 5n/6 ). It does not exploit any structural weakness of the compression functions and hence is applicable even if the compression functions are two ideal random oracles. Thus, even if the two hash functions are n-bit secure for preimage resistance, the XOR combiner is at most 5n/6-bit secure for primage resistance. In other words, the sum can be weaker than each part.

The attack is based on a novel technique to break the pairwise relationship between the internal states of the two hash functions. More precisely, the two hash functions H 1 and H 2 share the same input message, and hence the internal states of their iterative compression function computations are related. We control the computation chains of H 1 and H 2 simultaneously by constructing a new message structure M, and two sets of internal states A for H 1 and B for H 2 such that: for any value A from A and any value B from B, we can derive a message M A,B from M such that H 1 (M A,B ) produces A and H 2 (M A,B ) produces B. Hence we can select states from A and B independently. After that, we use a birthday match to find a message block m, a value A from A and a value B from B such that h 1 (A, m) ⊕ h 2 (B, m) is equal to the target hash digest, where h 1 and h 2 are the compression functions of H 1 and H 2 respectively. Finally we derive the message M A,B from M, and output M A,B m as a preimage of the target hash digest.

Our preimage attack is also applicable to Cryptophia's short combiner [32,29]. This construction has been proven to provide optimal collision and preimage resistance, assuming that at least one of the initial functions is a monolithic random oracle, but our attack does not violate the security proof, because we use the fact that both functions have an iterative structures with an n-bit internal state. Still, this shows that with many practical hash functions, the combiner will be weaker that the initial functions. Our results also show that the XOR combiner and Cryptophia's combiner are not robust in the semi-black-box model introduced by Mittelbach [32]7 , even with independant hash functions H 1 and H 2 .

Our analysis on the XOR combiner is also interesting for dedicated hash function design. The hash function family RIPEMD [10] is based on a compression function with two parallel lanes, added together at the end of each compression function. Interestingly, RIPEMD-160 has been quite resilient to cryptanalysis [27,38,25,26], and are still considered secure. Several more recent designs use parallel lanes in a similar way (combining them at the end of each compression function call), such as HAS-V [34], FORK [18] and LANE [19]. It might be tempting to use parallel lanes during the full iteration, and to combine them only at the end. Indeed, the designers of SHA-V [15] used this approach: the 160-bit version of SHA-V has two parallel lanes, combined at the end with a modular sum. This is equivalent to summing two different hash functions, and hence our attack can be applied to SHA-V.

Another contribution of this paper is to present concrete preimage attacks on the XOR combiner with one or both weak hash functions (defined in [24]). The complexity of our attacks is Õ(2 n/2 ). Furthermore, the attack can be extended to the concatenation combiner with two weak hash functions under the same complexity. It can be seen that these attacks match the bound of Hoch and Shamir's security proof [17], and hence fulfill the gaps pointed out in Section 1.1. It implies the tightness of Hoch and Shamir's proof on the classical combiners with weak hash functions for preimage resistance.

Finally, we would like to highlight the technical interests of this paper. We devise a novel structure named interchange structure to simultaneously control two (or more) hash lanes with the same input message, and succeed in further relaxing the pairwise relation between the internal states of lanes. It is indeed a step of technical advance compared with previous extensive studies on this topic, and hence will hopefully have applications or lead to new technical development in related settings. We refer to the open discussions in Section 7 for more details. Finally we conclude the paper and discuss future directions in Section 7.

Overview of the attack

We first give an overview of the techniques and the structures used in the attack, while more detailed descriptions will be given in the following sections. The main idea is to consider several chains of internal states reached by processing a common message M from different starting points (note that the message M is not fixed in advance, but will be determined when building the structure). More precisely, the message M is denoted as the primary message, and divided in several chunks: M = M 0 M 1 . . . (as discussed later, a chunk will consist of several message blocks). We denote chains of internal states for H 1 as a j , and the individual states of the chain as a i j , with h * 1 (a i j , M i ) = a i+1 j . Similarly, we denote chains for

H 2 as b k , with h * 2 (b i k , M i ) = b i+1 k .
When considering both hash functions, message block M i leads from the pair of states (a i j , b i k ) to (a i+1 j , b i+1 k ), which is denoted:

(a i j , b i k ) M i (a i+1 j , b i+1 k ). 7
Switch structure. Next we build special structures called switches in order to jump between chains in a controlled way. A switch allows to jump from a specific pair of chains (a j 0 , b k 0 ) to a different pair of chains (a j 0 , b k 1 ) using a secondary message chunk M i , in addition to the normal transitions using chunk M i of the primary message M :

(a i j , b i k ) M i (a i+1 j , b i+1 k ) : normal transition for each chain (a i j 0 , b i k 0 ) M i (a i+1 j 0 , b i+1 k 1 ) : jump from chains (a j 0 , b k 0 ) to (a j 0 , b k 1 )
In order to simplify the notations, we often omit the chunk index, in order to show only the chains that are affected by the switch. The main message chunk M i and the secondary message chunk M i are determined when building the switch, and the main message defines the next state of all the chains. We note that the secondary message chunk M i should only be used when the state is (a i j 0 , b i k 0 ). A simple example is depicted in Figure 2.

H 1 H 2 a 0 b 1 b 0 a 0 b 1 b 0 (a 0 , b 0 ) M (a 0 , b 0 ) a 0 b 1 b 0 (a 0 , b 1 ) M (a 0 , b 1 ) a 0 b 1 b 0 (a 0 , b 0 ) M (a 0 , b 1 )
Fig. 2. A single switch: jump from (a 0 , b 0 ) to (a 0 , b 1 ) by using M (dashed lines) instead of M (solid lines).

Alternatively, a switch can be designed to jump from (a j 0 , b k 0 ) to (a j 1 , b k 0 ). We defer the details of the construction to Section 3; it can be built with a complexity of Õ(2 n/2 ).

Interchange structure. By combining several simple switches, we can build an interchange structure with starting points IV 1 and IV 2 and ending points A j , j = 0 . . . 2 t -1 and B k , k = 0 . . . 2 t -1 , so that we can select a message ending in any state (A j , B k ). Figure 3 shows one possible way to build such a structure, and Figure 4 shows how to select a given message in the structure. An interchange structure with 2 t chains for each function requires about 2 2t switches. Since we can build a switch for a cost of Õ(2 n/2 ), the total structure is built with Õ(2 2t+n/2 ) operations.

Preimage search. Finally, we can use an interchange structure with ending points A j , j = 0 . . . 2 t -1 and B k , k = 0 . . . 2 t -1 , to build a preimage attack as follows. Let H denote the target value. We select a random message block m, and we compute two lists by evaluating the compression functions after the interchange structure:

IV 1 IV 2 H H B 0 A 0 B 1 A 1 B 2 A 2 B 3 A 3 Fig. 3. Overview of an interchange structure IV 1 IV 2 H H B 0 A 0 B 1 A 1 B 2 A 2 B 3 A 3 M M M M M M M M M M M M M M M
A j = h 1 (A j , m), j = 0 . . . 2 t -1 and B k = H ⊕ h (B k , m), k = 0 . . . 2 t -1 .
We expect a match between the lists with probability 2 2t-n . After about 2 n-2t random choices of m, we get a match (j * , k * ):

h 1 (A j * , m) = H ⊕ h 2 (B k * , m) i.e. h 1 (A j * , m) ⊕ h 2 (B k * , m) = H.
Therefore, we can construct a preimage of H by concatenating the message leading to (A j * , B k * ) in the interchange structure, and the block m (we ignore the finalization function in this section). 9

The complexity of the preimage search is about 2 n-t evaluations of the compression function, using an interchange structure with 2 t end-points.

Complexity analysis. Building the interchange structures requires about 2 2t+n/2 evaluations of the compression function, while the preimage search requires about 2 n-t . The optimal complexity is reached when both steps take the same time, i.e. t = n/6. This gives a complexity of Õ(2 5n/6 ).

The switch structure

We now explain how to build the switch structure at the core of our attack. This construction is strongly based on the multicollision technique of Joux [20].

Given states a i j 0 , b i k 0 and b i k 1 , we want to build message chunks M i and M i in order to have the following transitions:

(a i j 0 , b i k 0 ) M i (a i+1 j 0 , b i+1 k 0 ) (a i j 0 , b i k 1 ) M i (a i+1 j 0 , b i+1 k 1 ) (a i j 0 , b i k 0 ) M i (a i+1 j 0 , b i+1 k 1 ).
The main message chunk M i is used to define the next state of all the remaining chains, while the secondary message chunk M i will be used to jump from chains (a j 0 , b k 0 ) to (a j 0 , b k 1 ). We note that M i will only be used when the state is (a i j 0 , b i k 0 ). In particular, M i and M i must satisfy:

a i+1 j 0 = h * 1 (a i j 0 , M i ) = h * 1 (a i j 0 , M i ) b i+1 k 1 = h * 2 (b i k 1 , M i ) = h * 2 (b i k 0 , M i ) b i+1 k 0 = h * 2 (b i k 0 , M i ) = b i+1 k 1
We first build a multicollision for h * 1 , starting from state a i j 0 , i.e. a large set M of 2 n/2 messages that all reach the same state a i+1 j 0 (∀M ∈ M, h * 1 (a i j 0 , M ) = a i+1 j 0 ). As shown by Joux, this can be done efficiently by sequentially building n/2 collisions.

Next, we evaluate h * 2 (b i k 0 , M ) and h * 2 (b i k 1 , M ) for all the messages M in the set M. With high probability there is match between the sets of values8 . We denote the colliding messages as M i and M i , so that we have h

* 2 (b i k 0 , M i ) = h * 2 (b i k 1 , M i ).
Finally we compute the missing chains using the message m i :

a i+1 j = h * 1 (a i j , m i ), b i+1 k = h * 2 (b i k , m i ).
With high probability all the chains reach distinct values; if this is not the case, we restart the construction with a new multicollision. The full algorithm is shown as Algorithm 1, and illustrated by Figure 5; it requires about n/2 • 2 n/2 evaluations of the compression functions. 5. Building a switch structure. First, M and M are selected from M to generate a collision (defining the new b k 1 ), then b k 0 is evaluated using M .

H 1 H 2 a i j 0 a i+1 j 0 M b i k 0 b i k 1 M M b i+1 k 1 M M b i+1 k 0 M Fig.

The interchange structure

Let us now describe the combination of switch structures into an interchange structure. The goal of this structure is to select the final value of the H 1 computation and the H 2 computation independently. More precisely, the structure defines two sets of final values A j and B k , and a set of messages M jk such that:

(IV 1 , IV 2 ) M jk (A j , B k ).
In order to build this structure, we initialize the first chains with a 0 0 = IV 1 , b 0 0 = IV 2 , and set the other starting points randomly. Then, we use switches to jump for an already reachable pair (a j 0 , b k 0 ) to a different pair (a j 0 , b k 1 ) (or to (a j 1 , b k 0 ), respectively). By using 2 2t -1 switches, we can make all pairs reachable. There are many way to combine the switches; a simple one can be described as follow:

1. first, build switches from (a 0 , b 0 ) to each of the (a 0 , b k )'s; 2. then for each k, build a series of switches from (a 0 , b k ) to all the (a j , b k )'s.

In order to reach the chains (a j , b k ), one would activate the k-th switch in the first part to jump from (a 0 , b 0 ) to (a 0 , b k ), and then the j-th switch in the k-th series of the second part to jump from (a 0 , b k ) to (a j , b k ). This structure is shown in Figure 3 and a pseudo-code description is given by Algorithm 2, where the Interchange functions builds the structure, and the SelectMessage function extracts the message reaching (a j , b k ). The structure can be somewhat optimized using the fact that the extra chains have no prespecified initial values. We show how to take advantage of this in Appendix A, using multicollision structures in addition to the switch structures. However, this doesn't change significantly the complexity: we need (2 t -1)(2 t -1) switches instead of 2 2t -1. In total, we need about n/2 • 2 2t+n/2 evaluations of the compression functions to build a 2 t -interchange structure.

We believe that a 2 t -interchange structure based on switches will need at least Θ(2 2t ) switches, because every switch can only increase the number of reachable 11 Algorithm 1 Building a single switch pairs (a j , b k ) by one. As shown in Appendix A some switches can be saved in the beginning but it seems that new ideas would be needed to reduce the total complexity below Θ(2 2t+n/2 ).

function Switch(h 1 , h 2 , a, b, b ) x ← a M ← ∅ for 0 ≤ i < n/2 do (m, m ) ← Collision(h 1 , x) M ← (M m) ∪ (M m ) x ← h 1 (x, m) end for H ← {} for M ∈ M do y ← h * 2 (b, M ) H[y] ← M end for for M ∈ M do y ← h * 2 (b , M ) if H[y]

Preimage Attack

Finally, we describe the full preimage attack. We first build an interchange structure with 2 t chains for each of H 1 and H 2 . We denote the ending points as A j , j = 0 . . . 2 t -1 and B k , k = 0 . . . 2 t -1 , and we know how to select a message M jk to reach any state (A j , B k ). When adding a message block m to one of the messages M jk in the interchange structure, the output of the combiner

function Interchange(h 1 , h 2 , IV 1 , IV 2 ) a 0 ← IV 1 , b 0 ← IV 2 for 1 ≤ k < T do a k ← $, b k ← $ end for for 1 ≤ j < T do (M, M ) ← Switch(h 1 , h 2 , a 0 , b 0 , b j ) M ← M M ; M ← M M for 0 ≤ k < T do a k ← h * 1 (a k , M ) b k ← h * 2 (b k , M ) end for end for for 1 ≤ j < T do for 1 ≤ i < T do (M, M ) ← Switch(h 2 , h 1 , b j , a 0 , a i ) M ← M M ; M ← M M for 0 ≤ k < T do a k ← h * 1 (a k , M ) b k ← h * 2 (b k , M ) end for end for end for return (M , M ) end function function SelectMessage(M , M , j, k) µ ← M if k = 0 then µ[k -1] ← M [k -1] end if if j = 0 then µ[(k + 1) • (T -1) + j -1] ← M [(k + 1) • (T -1) + j -1] end if return µ end function
can be written as:

H 1 (M jk m) ⊕ H 2 (M jk m) = g 1 (h 1 (A j , m), + 1) ⊕ g 2 (h 2 (B k , m), + 1),
where g 1 and g 2 are the finalization functions of H 1 and H 2 , respectively, and is the length of the messages in the structure.

In order to reach a target value H, we select a random block m, and we evaluate

A j = g 1 (h 1 (A j , m), + 1), j = 0 . . . 2 t -1 and B k = H ⊕ g 2 (h 2 (B k , m), + 13
1), k = 0 . . . 2 t -1 . If there is a match (j * , k * ) between the two lists, we have:

A j * = B k * ⇔ g 1 (h 1 (A j * , m), + 1) = H ⊕ g 2 (h 2 (B k * , m), + 1) ⇔ H 1 (M jk m) ⊕ H 2 (M jk m) = H.
For a random choice of m, we expect that a match exists with probability 2 2t-n , and testing it requires about 2 t operations9 . We will have to repeat this procedure 2 n-2t times on average, therefore the total cost of the preimage search is about 2 n-t evaluations of h 1 and h 2 .

As explained in the previous section, building a 2 t -interchange structure requires about n/2 • 2 2t+n/2 operations. Using t = n/6 we balance the two steps of the attack, and reach the optimal complexity of about n/2 • 2 5n/6 operations for the preimage attack.

Message length and memory complexity

The attack uses messages of length n/2 • 2 2t , and the memory complexity of the attack10 is also n/2 • 2 2t . The optimal choice t = n/6 gives messages of length n/2 • 2 n/3 . The memory requirement is probably not an issue 11 for an attacker that can spend time 2 5n/6 , but the message length can be a problem with some hash functions that don't accept long inputs. For instance SHA-256 is only defined for message with less than 2 64 bits (i.e. 2 55 blocks).

In this case, one can apply the attack with a smaller value of t: this reduces the length of the messages, at the cost of more time spent in the preimage search step. For instance, we can mount a preimage attack against SHA-256 ⊕ BLAKE-256 with complexity 2 232 using t = 24, while the optimal attack with n = 256 would cost only 2 220.3 . Similarly, our attack applied to SHA-512 ⊕ Whirlpool has a complexity of 2 461 , rather than 2 434.7 .

Applications and Extensions

The attack works identically if the hash functions use the HAIFA mode rather than the plain Merkle-Damgård iteration. Also it can easily be extended to H 1 (M ) H 2 (M ) where denotes an easy to invert group operation (for instance, a modular addition rather than the exclusive or). The attack can also be extended to hash functions H 1 and/or H 2 using an internal check-sum, such as the GOST family of hash functions, using pairs of blocks with a constant sum.

Application to the sum of wide-pipe hash functions

The attack can also be used when the internal state size is larger than the output size n. The complexity of building a 2 t -interchange structure is related to as /2 • 2 2t+ /2 . On the other hand, the complexity of the meet-in-the-middle preimage search is related to n as 2 n-t . The optimal complexity is /2 • 2 2n/3+ /6 by matching the two complexities with t = n/3 -/6. Therefore our attack can be applied as long as + 6 log( ) ≤ 2n holds. For instance, we can compute preimages of SHA-224 ⊕ BLAKE-224 with complexity roughly 2 199 .

Application to Cryptophia's short combiner

Our attack can also be applied to Cryptophia's short combiner, as proposed by Mittelbach [32], and to the revised version of Mennink and Preneel [29]. This combiner computes the sum of two hash functions with some pre-processing of the message, to allow non-independent functions:

C(M ) = H 1 m1 1 . . . m1 ⊕ H 2 m2 1 . . . m2 m1 j = H 1 (0 l 1 m j ⊕ k 1 ) ⊕ H 2 (0 l 2 m j ⊕ k 2 ) m2 j = H 1 (1 l 1 m j ⊕ k 1 ) ⊕ H 2 (1 l 2 m j ⊕ k 2 )
where k 1 , k 2 , l 1 , l 2 is a randomly chosen key. The security proof in the ideal model shows that C is optimally preimage resistant if at least one of the hash functions is ideal. However, if both H 1 and H 2 are narrow-pipe, we can apply our preimage attack with complexity Õ(2 5n/6 ). This does not violate the security proof because we need both functions to be narrow-pipe, hence not n-bit ideal 12 . From a practical point of view, though, it shows that in many cases (e.g. using SHA-512 and Whirlpool) the combiner is weaker than the initial functions.

Improvements using weaknesses of the hash functions

If H 1 or H 2 has known cryptographic weaknesses, more efficient attacks are possible. More precisely, if the compression function of one of the hash functions can be inverted 13 in time 2 t , then we can find a preimage of H 1 ⊕ H 2 with complexity only Õ(2 (n+t)/2 ).

The attack is presented using the case, where (at least) one compression function is modeled as a weak compression function defined in [24], as an example. Without loss of the generality, we assume the compression function of H 2 , h 2 (x, y) = z, is such a weak compression function, which is a random oracle with two additional interfaces as below.

• Backward interface. On a query (?, y, z), it returns either a value x uniformly chosen from all the values satisfying h 2 (x, y) = z, or ⊥ if no such x exists.

• Bridging interface. On a query (x, ?, z), it return either a value y uniformly chosen from all the values satisfying h 2 (x, y) = z, or ⊥ if no such y exists.

Note that the inversion of compression function h 2 takes unit time and hence the attack against H 1 ⊕ H 2 takes time Õ(2 n/2 ). The procedure is detailed as follows, which is also illustrated in Figure 6.

Let the target hash digest be denoted as H. We firstly build an n-block long multicollision on H 1 following Joux's approach [20]. Let the final output be denoted as Z. It contains a set of up to 2 n messages that link IV 1 to Z on H 1 . We split every n-block long multicolliding message into halves, and collect the first half n/2-block long messages as a set M 1 and the second half as another set M 2 . Hence for any message M 1 ∈ M 1 and any M 2 ∈ M 2 , the concatenated message M 1 M 2 links IV 1 to Z on H 1 . Secondly, for the messages M 2 ∈ M 2 , we use the additional backward interface of h 2 to carry out backward computations from H ⊕ Z, and get values X such that h * 2 (X, M 2 ) = H ⊕ Z. We store (X, M 2 ) in a table T X . On average T X contains 2 n/2 elements. 14 Finally, for each message M 1 ∈ M 1 , we iteratively compute h 2 forward from IV 2 , and get an internal state Y . We match Y to the elements in T X . A match implies that concatenated M 1 M 2 links IV 2 to H ⊕ Z, and in turn is a preimage of

H 1 (M 1 M 2 ) ⊕ H 2 (M 1 M 2 ) = Z ⊕ H ⊕ Z = H.
The success probability of finding such a match is not negligible since there are 2 n/2 X's and Y 's. The complexity is around n • 2 n/2 that is Õ(2 n/2 ) by ignoring the polynomial factors.

H 1 H 2 IV 1 Z b a ck w a rd s H ⊕ Z IV 2 fo rw a rd s M 1 M 2 M 1 M 2
Fig. 6. Preimage attack on the XOR combiner with a weak H 2 Moreover, the above preimage attack can be extended to the concatenation combiner H 1 H 2 if both H 1 and H 2 are weak by a minor modification. This shows that the proof of Hoch and Shamir [17] is tight for preimage resistance. Here we mainly highlight the modifications. Let the target hash digest be H 1 H 2 , where H 1 is from H 1 and H 2 from H 2 . After we build the multicollision on H 1 and let the output internal state be denoted as Z, we link Z to H 1 by using the bridging interface of h 1 to receive a message m such that h 1 (Z, m) = H 1 . This gives us a set of messages linking IV 1 to H 1 on H 1 . Also note that for the backward computations on H 2 , the starting value should be H 2 . The rest of the attack procedure remains the same. Hence it is easy to get that the complexity is also Õ(2 n/2 ).

Extension to the sum of three or more hash functions

The attack can be extended to the sum of three or more hash functions. In order to attack the sum of k functions, two different strategies are possible: either we use a simpler structure that only gives two degrees of freedom, and fixes k -2 functions to a constant value, or we build an interchange structure to control all the k functions independently.

Controlling only two functions. The easiest way to extend the attack is to use a single chain in the k -2 extra hash functions. The procedure to build a switch is modified in order to use multicollisions for k -1 functions instead a simple multicollisions for one function; this costs O(n k-1 • 2 n/2 ) using Joux's method [20].

As in the basic attack, we need O(t 2 ) switches to generate a 2 t -interchange for two functions, and the preimage search costs O(2 n-t ); the optimal complexity is therefore O(n k-1 • 2 5n/6 ) with t = n/6. Controlling all the functions. Alternatively, we can build a more complex interchange structure in order to control all the functions independently. When attacking three functions, we will use the switch structure to jump from chains (a j 0 , b k 0 , c l 0 ) to (a j 0 , b k 0 , c l 1 ) (or (a j 0 , b k 1 , c l 0 ) or (a j 1 , b k 0 , c l 0 ), respectively). We need 2 3t -1 switches in the interchange structure to reach all the 2 3t triplets of chains (a switch makes only one new triplet reachable). Each switch is built using a 2 n/2 -multicollision on two functions, which can be built for a cost of O(n 2 • 2 n/2 ) following Joux's technique [20]. Therefore we can build a 2 t -interchange for a cost of O(n 2 • 2 3t+n/2 ). More generally, for the sum of k hash functions, we can build an interchange structure for k functions for a cost of O(n k-1 • 2 kt+n/2 ).

In the preimage search phase, we generate k lists of size 2 t , and we need to detect efficiently whether we can combine then to generate a zero sum. This problem can be solved using a algorithm similar to Wagner's generalized birthday algorithm [40]. If k = 2 κ , we find a solution with probability O(2 n-(κ+1)•t ) for a cost of O(k • 2 t ). Therefore the preimage search costs O(k • 2 n-κt ). With k = 4 (i.e. κ = 2), this yields a complexity of O(n 3 • 2 5n/6 ). However, this approach is less efficient than the previous one for k = 3 and for k > 4.

To summarize, attacking the sum of k hash functions (k ≥ 2) costs O(n k-1 • 2 5n/6 ). Controlling chains independently in more than two hash function might be useful for further work, but it doesn't improve the preimage attack on the sum of k hash functions.

Conclusion and open discussions

In this work, we gave the first generic attack on the XOR combiner. Our result is rather surprising: the sum of two ideal narrow-pipe hash functions only has about 5n/6 bits of security against preimage attacks. In particular, the sum is easier to break than the initial functions. Since most practical hash functions are narrow-pipe (e.g. SHA-1, SHA-256, SHA-512, Whirlpool, RIPEMD, GOST, BLAKE, Skein...), the XOR combiner will usually provide a weaker security than the component hash functions.

Moreover, we would like to discuss a few directions for future work.

On controlling multiple hash lanes. Since 2004, several generic attacks have been found against narrow-pipe hash functions, such as the multicollision attack [20], the long-message second preimage attack [22] and the herding attack [21]. There has been extensive work to extend these attacks to more complex constructions with several computation chains, such as the concatenation H 1 (M ) H 2 (M ) and the cascade H 2 (H 1 (M ), M ).

As in our present work, the essential difficulty in those attacks comes from the fact that several lanes of computation share the same input message, and hence their outputs are related. If an adversary considers a naïve set of messages, the set of outputs gives random pairs of n-bit values {(A i , B i ) : i ∈ I}: selecting a value for the first entry of the pair gives a single candidate for the second entry, and the adversary is essentially working with a 2n-bit state. Previous works [33,16,2] have developed various message structures (mostly based on multicollision and diamond structures), in order to relax this relation. They mainly result in a set of messages M such that the corresponding outputs are in a more structured set {(A, B i ) : i ∈ I}: the first entry is a constant value A, but several options B i can be selected for the second entry. For any value (A, B i ), it is then possible to select a message in M so that the first lane reaches A, while the second lane reaches B i . This allows to modify the value of the second lane without affecting the first lane.

Our result is quite stronger: with the interchange structure we have a set of message such that the corresponding outputs are a set {(A i , B j ) : i ∈ I, j ∈ J }, where both lanes have several options that can be selected independently. We hope that our technique will have applications or lead to new technical development in related settings, e.g., the open problem of generic second preimage attacks (with long messages) on the concatenation hash or on the Zipper hash [24].

On extending to practical hash function. Several practical hash functions such as RIPEMD [10] and HAS-V [34] are based on a compression function with more than one independent lanes, which interacts with each other at the end of each compression function call. It is very interesting to investigate if our attack can be further modified to attack these hash functions in future. Again the obstacle comes from the relations between internal states of lanes. Particularly, the internal states of the lanes interact with each other, which makes the relation even tighter and in turn harder to attack.

A Optimized Interchange Structure

We now describe an optimized attack using only (2 t -1)(2 t -1) switches rather than 2 2t -1. The attack also requires multicollision structures, as introduced by Joux [20]. We replace the first 2 t -1 switches with a 2 t -multicollision in H 1 , and we use those messages to initialize all the b k chains in H 2 . We can also optimize the first series of switches in H 2 in the same way: we build a 2 t -multicollision in H 2 starting from b 0 , and we use those messages to initialize the a j chains in H 1 . This is illustrated by Figure 7, and the detailed attack is given as Algorithm 3.

21

Algorithm 3 Optimized T -interchange structure function Interchange(h 1 , h 2 , IV 1 , IV 2 , T ) a 0 ← IV 1 , b 0 ← IV 2 M 0 ← MultiCollision(h 1 , a 0 ) for 0 ≤ k < T do b k ← h * 2 (b 0 , M 0 [k]) end for a 0 ← h * 1 (a 0 , M 0 [0]) M 1 ← MultiCollision(h 2 , b 0 ) for 1 ≤ k < T do a k ← h * 2 (a 0 , M 1 [k]) end for a 0 ← h * 2 (a 0 , M 1 [0]) b 0 ← h * 1 (b 0 , M 1 [0]) for 2 ≤ j < T do for 1 ≤ i < T do (M, M ) ← Switch(h 2 , h 1 , b j , a 0 , a i ) M ← M M ; M ← M M for 0 ≤ k < T do a k ← h * 1 (a k , M ) b k ← h * 2 (b k , M ) end for end for end for return (M 0 , M 1 , M , M ) end function function SelectMessage(M 0 , M 1 , M , M , j, k) if j = 0 then return M 0 [k] M 1 [0] M else if k = 0 then return M 0 [0] M 1 [j] M else µ ← M µ[(k -1) • (T -1) + j -1] ← M [(k -1) • (T -1) + j -1] return M 0 [k] M 1 [0] µ end if end function function MultiCollision(h, x) M ← {} for 0 ≤ i < n/2 do (m, m ) ← Collision(h, x) x ← h(x, m) M ← (M m) ∪ (M m ) end for return M end function IV 1 IV 2 H 1

Generic Attacks on Hash Combiners

Zhenzhen Bao Abstract. Hash combiners are a practical way to make cryptographic hash functions more tolerant to future attacks and compatible with existing infrastructure. A combiner combines two or more hash functions in a way that is hopefully more secure than each of the underlying hash functions, or at least remains secure as long as one of them is secure. Two classical hash combiners are the exclusive-or (XOR) combiner H 1 (M )⊕H 2 (M ) and the concatenation combiner H 1 (M ) H 2 (M ). Both of them process the same message using the two underlying hash functions in parallel. Apart from parallel combiners, there are also cascade constructions sequentially calling the underlying hash functions to process the message repeatedly, such as Hash-Twice H 2 (H 1 (IV, M ), M ) and the Zipper hash H 2 (H 1 (IV, M ), ← -M ), where ← -M is the reverse of the message M . In this work, we study the security of these hash combiners by devising the best-known generic attacks. The results show that the security of most of the combiners is not as high as commonly believed. We summarize our attacks and their computational complexities (ignoring the polynomial factors) as follows: 1. Several generic preimage attacks on the XOR combiner:

-A first attack with a best-case complexity of 2 The last three attacks show that regarding second-preimage resistance, the concatenation and cascade of two n-bit narrow-pipe Merkle-Damgård hash functions do not provide much more security than that can be provided by a single n-bit hash function.

Our main technical contributions include the following:

1. The interchange structure, which enables simultaneously controlling the behaviours of two hash computations sharing the same input. 2. The simultaneous expandable message, which is a set of messages of length covering a whole appropriate range and being multi-collision for both of the underlying hash functions. 3. New ways to exploit the properties of functional graphs of random mappings generated by fixing the message block input to the underlying compression functions.

Keywords

H(M ) = H(M ).
As the birthday and brute-force attack requires 2 n/2 and 2 n computations, respectively, to find a collision and a (second) preimage, a secure hash function is expected to provide the same level of resistance.

Unfortunately, widely deployed standards (such as MD5 and SHA-1) fail to provide the expected resistance because of cryptographic weaknesses [START_REF] Wang | Finding Collisions in the Full SHA-1[END_REF]WY05]. Moreover, Kelsey and Schneier have demonstrated a generic second-preimage attack against all hash functions based on the classical Merkle-Damgård construction (such as MD5, SHA-1, and SHA-2) when the challenge message is long [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2n Work[END_REF]. As a result, countermeasures have been proposed in order to build more tolerant hash functions, and to protect oneself against future attacks, while keeping the same interface for compatibility. A practical way is to combine the outputs of two (or more) independent hash functions to provide better security in case one or even both hash functions are weak. In particular, this reasoning was used by the designers of SSL [FKK11] and TLS [DA99b], who combined MD5 and SHA-1 in various ways. More precisely, the Key Derivation Function of TLS v1.0/v1.1 uses a sum of HMAC-MD5 and HMAC-SHA-1. 7 The designers explain [DA99b], "In order to make the PRF as secure as possible, it uses two hash algorithms in a way which should guarantee its security if either algorithm remains secure." Formally, we call the resulting construction a hash function combiner (or combiner for short). The goal of a hash combiner is to achieve security amplification, i.e., the hash combiner has higher security than its underlying hash functions, or to achieve security robustness, i.e., the hash combiner is secure as long as (at least) one of its underlying hash functions is secure.

There are two classical hash combiners, the concatenation combiner and the exclusive-or (XOR) combiner. Both of them process the same message using two (independent) hash functions H 1 and H 2 in parallel. Then, the former concatenates their outputs, H 1 (M ) H 2 (M ), and the latter XORs them, H 1 (M ) ⊕ H 2 (M ). More generally8 , cryptographers have also studied cascade constructions of two (or more) hash functions, that is, to compute H 1 and H 2 in sequential order. Examples are Hash-Twice, HT (M ) H 2 (H 1 (IV, M ), M ) 9 , and the Zipper hash [Lis06],

H 2 (H 1 (IV, M ), ← - M ),
where ← -M is the message with the same blocks as M but in reversed order. Such kinds of cascade constructions are not strictly black-box hash combiners compared with the XOR combiner and the concatenated combiner. That is because the initial vector of the subsequent hash functions are not fixed as in their specifications. Instead, for such constructions, to get black-box access to the underlying hash functions, the initial vector of these hash functions is required to be an input parameter. However, apart from this point, other parts of the hash functions are all accessed as black boxes by the constructions. Considering that such constructions can be classified into the method of designing hash functions using multiple existing hash functions, and for the sake of conciseness, we regard these cascade constructions of hash functions as hash combiners in this paper. In the sequel, for these combiners, we call the computation of the first (resp. the second) hash function the first (resp. the second) computation pass (or simply, the first pass, resp. the second pass).

In this paper, we study the security of these hash combiners. We focus on combiners of iterated hash functions. Iterated hash functions commonly first pad and split the message M into message blocks of fixed length (e.g., b-bit), i.e., M = m 1 m 2 . . . m L . They then process message blocks by iteratively applying a series of compression function h i . Those compression functions update an internal state, initialized with a public value IV , using the previous state value and the current message block, i.e., x i = h i (x i-1 , m i ). Finally, the internal state is updated by a finalization function which can be either the compression function or another independent function, and the output of the finalization function is outputted as the hash digest. For simplicity of description, we assume that the finalization function is the same as the compression function in the rest of the paper, but we stress that our attacks also work in a straightforward way with an independent finalization function. In this work, we mainly focus on hash functions whose internal state size is equal to its output size, which are known as "narrow-pipe" designs. We will discuss the applicability of our proposed attacks on "wide-pipe" designs whose internal state size is (not much) larger than its output size at the end of the paper. In particular, we consider hash functions following the classical Merkle-Damgård construction [START_REF] Damgård | A Design Principle for Hash Functions[END_REF][START_REF] Ralph | One Way Hash Functions and DES[END_REF] and the more general HAIFA framework [START_REF] Biham | A Framework for Iterative Hash Functions -HAIFA[END_REF], for which we naturally take the length padding mentioned next as the message padding scheme. The Merkle-Damgård construction (MD) applies the same compression function h in all iterations (see Fig. 1) and adds a padding of the message length to the final message block (known as length padding, or Merkle-Damgård strengthening). The HAIFA framework is similar to the MD construction but uses extra inputs to the compression function with the number of message bits hashed so far and a salt value; this is equivalent to using a different compression function for each block. The primary goal of that construction is to thwart some narrow-pipe attacks (e.g., Kelsey and Schneier's long message second-preimage attack on MD hash [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2n Work[END_REF]). HAIFA framework is formally defined as follows:10

x 0 = IV x i = h(x i-1 , m i , #bits, salt) H(M ) = h(x L-1 , m L ). x 0 = IV x i = h(x i-1 , m i ) H(M ) = h(x L-1 , m L ) IV h x 0 n / m 1 / b h x 1 n / m 2 / b • • • • • • n / • • • h x L-2 n / m L-1 / b h x L-1 n / m L / b H(M ) x L n /

Related Works

Combiners have been studied in several settings, including generic attacks and security proof. For generic attacks, the compression functions are modelled as random functions to devise attacks that do not use any weakness of the compression function. Thus, they provide upper bounds on the security of the combiners.

Security proof, which is more theoretical work, focuses on the notion of robustness and security amplification. A robust combiner is secure regarding property α as long as one of the underlying hash functions is secure regarding α. Lines of research for those security notions include the study of advanced combiners in [Her05,CRS + 07,FL07,FL08,FLP08,Her09,Leh10,FLP14]. A series of studies on the minimum output length of robust combiners have shown that robust combiners for collision resistance and preimage resistance cannot have an output length significantly shorter than the sum of the output length of the underlying hash functions [BB06,Pie07,Pie08,Rja09] (more recent works include [MP14,Mit12]).

There are also some works that assume that the compression function is a weak random oracle (i.e., the attacker is given additional interfaces to receive random preimages of the compression functions) and prove that some constructions are still secure in this model [Lis06,[START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF] or provide efficient attacks on the combiners by exploiting weakness of the underlying hash functions [CJ15,JN15].

Analysis of the concatenation combiner. The concatenation combiner

H 1 (M ) H 2 (M ) (see Fig. 2) is probably the most well-known and most studied hash combiner. This combiner was described already in 1993 [Pre93].

IV1 IV2 h1 x0 h2 y0 m1 h1 x1 h2 y1 m2 • • • • • • • • • • • • • • • h1 xi-1 h2 yi-1 mi • • • xi • • • yi • • • h1 xL-1 h2 yL-1 mL H1(M ) H2(M ) H(M )
Fig. 2: The concatenation combiner Generic attacks. In 2004, Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] described surprising attacks on the concatenation of two narrow-pipe iterated hash functions using multi-collisions: while the output size is 2n bits, the concatenation combiner merely provides at most n/2-bit security for collision resistance and n-bit security for preimage resistance 11 (see Sect. 2.1 for a description). In particular, the concatenation combiner is not security-amplifying (it does not increase collision and preimage resistance).

Following the results of Joux (which showed that the concatenation combiner does not increase collision and preimage resistance) and the later results of Kelsey and Schneier (which showed that the second-preimage resistance of the MD construction is less than 2 n ), a natural question is whether there exists a second-preimage attack on the concatenation combiner of MD hash functions that is faster than 2 n . Interestingly, the problem of devising such an attack remained open for a long time despite being explicitly mentioned in several papers including [DP07]. In fact, although the works of [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF][START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2n Work[END_REF] have attracted a significant amount of follow-up research on countermeasures against second-preimage attacks (such as Hash-Twice or dithered hash) and attacks that break them [ABD + 16,ABDK09,ABF + 08], there has been no progress concerning second-preimage attacks on the basic concatenation combiner. In this paper, we try to provide an answer to this question by devising the first second-preimage attack on the concatenation combiner of MD hash functions, which is faster than 2 n . Security proof. From the theoretical side, the concatenation combiner is robust for collision resistance, e.g., a collision

H 1 (M ) H 2 (M ) = H 1 (M ) H 2 (M ) implies H 1 (M ) = H 1 (M ) and H 2 (M ) = H 2 (M ).
Hoch and Shamir [START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF] evaluated the security of the concatenation combiner with two weak hash functions. More precisely, the two hash functions are narrowpipe MD, and the compression functions are modelled as weak random oracles (as defined by Liskov [Lis06]), i.e., the adversary is given additional interfaces to receive (random) preimages of the compression functions. They have proven that in this model, the concatenation combiner is still indifferentiable from a random oracle with n/2-bit security, implying (at least) the same security bound for collision resistance and preimage resistance. The bound is matched by Joux's attack for collisions, but there is a gap with Joux's attack for preimages, with complexity 2 n , which might be interesting to investigate further.

Analysis of dedicated instantiations. Mendel et al. analysed some dedicated instantiations of the concatenation combiner [MRS09], in particular using the hash function MD5. We omit the details and refer interested readers to [MRS09].

Analysis of the XOR combiner. The XOR combiner H 1 (M ) ⊕ H 2 (M ) (see Fig. 3) has received less analysis. 11 The attacks essentially only require one of the functions to be iterated.

116

Symmetric Cryptanalysis Beyond Primitives

IV1 IV2 h1 x0 h2 y0 m1 h1 x1 h2 y1 m2 • • • • • • • • • • • • • • • h1 xi-1 h2 yi-1 mi • • • xi • • • yi • • • h1 xL-1 h2 yL-1 mL H1(M ) H2(M ) H(M )
Fig. 3: The XOR combiner Generic attacks. To the best of our knowledge, no preimage attacks have been shown against the XOR combiner. Therefore, the preimage security of the XOR combiner against generic attacks is still an open problem and will be one of the main topics of our work.

Security proof. Theoretically, the XOR combiner is robust concerning PRF (Pseudo-Random Function) and MAC (Message Authentication Code) in the black-box reduction model [Leh10]. Since the XOR combiner is length-preserving, from the conclusions regarding the minimum output length of robust combiners, it is not robust for collision resistance and preimage resistance. However, the work of Hoch and Shamir [START_REF] Hoch | On the Strength of the Concatenated Hash Combiner When All the Hash Functions Are Weak[END_REF] actually proves the security of the XOR combiner as an intermediate result: it is also indifferentiable from a random oracle up to 2 n/2 queries in the weak random oracle model. In particular, this proves there are no generic attacks with complexity less than 2 n/2 . For collision resistance, the bound is tight, since it is matched with the generic birthday attack bound. On the other hand, for preimage resistance, there exists a gap between the n/2-bit proven bound and the n-bit expected ideal security bound. Note that the non-robustness result regarding preimage security does not imply that the XOR of two concrete hash functions is weak, and the simplicity and short output of this construction still make it quite attractive.

Analysis of Hash-Twice. Hash-Twice is a folklore hash construction that hashes a (padded) message twice, with the output of the first hash value as the value of the initialization vector of the second hash. In its original definition [ABDK09], the two underlying hash functions are identical, i.e., HT (M ) H(H(IV, M ), M ); here, we consider a generalized version, where the underlying hash functions are independent, i.e., HT (M ) H 2 (H 1 (IV, M ), M ) (see Fig. 4).

IV1 xL h1 x0 h2 y0 m1 h1 x1 h2 y1 m2 • • • • • • • • • • • • • • • h1 xi-1 h2 yi-1 mi • • • xi • • • yi • • • h1 xL-1 h2 yL-1 mL xL H(M )
Fig. 4: The Hash-Twice Generic attacks. Towards the three basic security requirements, a second-preimage attack on Hash-Twice (HT (M ) H(H(IV, M ), M )) has been published by . The attack is based on a herding attack, which exploits the diamond structure originally used in the herding attack on a single hash function [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF] (see Sect. 2.3 for an introduction). The complexity of the attack is approximately 2 (n+t)/2 + 2 n-+ 2 n-t , where 2 t is the width of the diamond structure, and 2 is the length of the challenge.

Security proof. To the best of our knowledge, there is no published formal proof regarding the security of Hash-Twice. However, we can claim that they are at least as secure as the original functions: a generic collision attack requires at least 2 n/2 (because we need a collision in one of the compression functions); a preimage attack requires at least 2 n (because we need a preimage for the finalization function); a second-preimage requires at least 2 n/2 (because it implies a collision).

Analysis of the Zipper hash. The Zipper hash has been proposed with the goal of constructing an ideal hash function from weak ideal compression functions (by "weak ideal", it means that the compression function is vulnerable to strong forms of attack but is otherwise random). Similar to Hash-Twice, it cascades two independent hash functions evaluating the same (padded) message. The difference is that the second hash processes the message blocks in reverse order, i.e.,

ZH H 2 (H 1 (IV 1 , M ),
← -M ) (see Fig. 5). Note that the messages are first padded by a padding scheme and split into message blocks, and then they are processed in forward and reverse order sequentially. Thus, the padded message block m L is processed at the end of the first hash computation and at the beginning of the second hash computation, i.e., in the middle of the whole processing procedure. The padding scheme of Zipper was specified to be any injective function of the message [Lis06]. In this paper, and as for all other combiners, we take the length padding of the MD construction as the padding scheme. 5: The Zipper hash Generic attacks. To the best our knowledge, no generic attacks on the Zipper hash regarding the three basic security notions have been shown. However, there are a number of works that consider other security notions, such as multicollision, herding attack or attacks assuming weak compression functions. Examples include [NS07,HS06,ABDK09,CJ15,JN15], some of which also consider the corresponding security of Hash-Twice.

IV 1 H(M ) h 1 x 0 h 2 y 0 m 1 h 1 x 1 h 2 y 1 m 2 • • • • • • • • • • • • • • • h 1 x i-1 h 2 y i-1 m i • • • x i • • • y i • • • h 1 x L-1 h 2 y L-1 m L y L = x L Fig.

8

Security proof. Zipper hash is proved ideal in the sense that the overall hash function is indistinguishable from a random oracle (up to the birthday bound) when instantiated with weak ideal compression functions. More precisely, its provable security is 2 min(b,n)/2 for collision resistance and 2 min(b,n) for (second-) preimage resistance, where b is the size of the message block and n is the size of the internal state and the hash value (considering "narrow-pipe" design).

Our Results

In this work, we study the upper bound of the security of these hash combiners by devising the best-known generic preimage attacks and second-preimage attacks with a long challenge. We do not assume any weakness of the compression functions, i.e., they are accessed as black boxes in our attacks. The compression functions are chosen uniformly at random from all n+b to n-bit functions, which implies that our analysis applies to most compression functions. Table 1 summarizes the updated security status of various hash combiners after integrating our new results. It shows that the security of most combiners is not as high as commonly believed. Regarding certain basic security requirements, these combiners of two (or even more) n-bit hash functions fail to provide more (or even the same) security than that provided by a single n-bit ideal hash function.

Next, we briefly introduce our main attacks on combiners of two narrow-pipe hash functions and their computational complexities (ignoring the polynomial factors). In addition to the attacks summarized next, we also present improved but more complex attacks and apply our techniques to attack combiners of more than two hash functions.

Preimage attacks on the XOR combiner. We present several generic attacks:

-A first attack with a best-case complexity of 2 5n/6 computations obtained for messages of length 2 n/3 . This attack involves a meet-in-the-middle procedure enabled by building a novel technical tool named interchange structure. This structure consists of a sequence of basic building modules named switches among different hash computation lanes such that it breaks the pairwise dependency between the internal states of these hash computations on the same message. This attack is applicable for the XOR combiner with underlying hash functions following a wide range of iterated constructions (e.g., the classical MD construction and the more general HAIFA framework) and for the Cryptophia's short combiner [Mit13,MP14].

-A second attack with a best-case complexity of 2 2n/3 computations obtained for messages of length 2 n/2 . This attack also involves a meet-in-the-middle procedure, but instead of using the interchange structure, it exploits properties of functional graphs of random mappings. The random mappings are generated by fixing the message block input to the underlying compression functions. The functional graphs of these random mappings are formed by successive iteration of the mappings, whose nodes are all possible values of input/output and whose edges are all from preimages to images. We exploited special nodes that are images of a large number of iterations of the mappings. We named them deep iterates because they are located at deep strata in the functional graphs. By exploiting such deep iterates, the variability of the number of iterations provides extra freedom to find a linking message fragment mapping a pair of starting states to a predefined pair of states. When using this freedom, to overcome the hurdle set by the length padding, we construct a structure named simultaneous expandable message, which is a set of messages of length covering a whole appropriate range and being multi-collisions for both of the underlying hash functions. This attack achieves a trade-off of 2 n •L -2/3 between the maximal allowed message length L and the time complexity of attack. This improves the trade-off of 2 n •L -1/2 , obtained by the first interchange-structure-based attack. On the other hand, it only applies when both underlying hash functions combined use the MD construction. -An improvement upon the second attack with a best-case complexity of 2 5n/8 obtained for messages of length 2 5n/8 . In this attack, we exploit more special nodes in functional graphs of random mappings, which are called cyclic nodes, and we utilize a technique named multi-cycles. Linking pairs of states through cyclic nodes and allowing to loop around the cycles makes the attack more efficient. The complexity improvement of the resulting preimage attack is 2 n/24 . We point out that this attack has the limitation that the length of the message must be at least 2 n/2 blocks. Therefore, its practical impact is limited and its main significance is theoretical. This attack shows that the security level regarding preimage resistance of the XOR combiner is quite close to the provable security level 2 n/2 , which is also the level of collision resistance.

These attacks on the XOR combiner show a rather surprising result -regarding preimage resistance, the sum of two n-bit iterated hash functions can never provide n-bit security. In general, the sum is weaker than each of the two hash functions.

Second-preimage attack on the concatenation combiner. We describe the first generic second-preimage attack faster than 2 n on the concatenation combiner of two MD hash functions. The general framework follows that of the long message second-preimage attack on a single MD hash [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2n Work[END_REF]. It is faster than 2 n computations by overcoming two main challenges. The first is to overcome the length padding. We solve this by using the simultaneous expandable message. The second is to speed up the connection from a crafted message to the challenge message on chaining states. In the case of hash combiners, one must connect to the challenge message on a pair of n-bit states, while in the secondpreimage attack on a single MD hash, one needs only to connect on a single n-bit state. Thus, the attempt is essentially to reach a 2n-bit state (in a set of L states, where L is the message length in blocks, and thus L < 2 n ) faster than 10 120 Symmetric Cryptanalysis Beyond Primitives 2 n computations. We solve this by exploiting again deep iterates in functional graphs. In this attack, we choose a pair of deep iterates as target chaining states, such that the connection from our crafted message to the challenge message is more efficient. Indeed, this attack is closely related with our deep-iterates-based preimage attack on the XOR combiners.

We obtain a trade-off between the complexity of the attack and the length of the challenge message. This second-preimage attack is faster than 2 n for input messages of length at least12 2 2n/7 . The best-case complexity13 is 2 3n/4 , obtained for (very) long challenges of length 2 3n/4 . Again, due to these constraints, the practical impact of our second-preimage attack is limited and its main significance is theoretical. Namely, it shows that regarding second-preimage resistance, the concatenation of two n-bit MD hash functions is not as strong as a single n-bit ideal hash function.

Second-preimage attack on the Zipper hash. We show the first generic second-preimage attack on the Zipper hash. This attack combines multiple tools, including Joux's multi-collision, the simultaneous expandable message, deep iterates and multi-cycles in functional graph of random mappings. The general framework is similar to that of above ones on combiners of MD hashes. However, some special specifications of the Zipper hash allow the attacker to choose an optimal configuration on message length for the attack, and to launch a more efficient meet-in-the-middle connecting procedure in the attack. The best-case complexity of this attack is 2 3n/5 , obtained for challenge message of length 2 2n/5 . This result shows that combination of two MD hash functions using a Zipper can be vulnerable to second-preimage attack with long challenges.

Second-preimage attack on Hash-Twice. We give an improved secondpreimage attack on Hash-Twice. This attack also combines multiple tools including Joux's multi-collision, the diamond structure, the interchange structure, the simultaneous expandable message, deep iterates and multi-cycles in functional graphs. Like all our previous functional-graph-based attacks, it improves a previous attack from [ABDK09] because of the efficiency brought by exploiting the special nodes in the functional graphs. The best-case complexity of this attack is 2 13n/22 , obtained for challenge message of length 2 13n/22 . This attack shows that regarding second-preimage resistance, hashing a message twice using two Merkle-Damgård hash functions does not provide much more security compared with hashing the message only once.

Finally, we highlight the technical interests of this paper. We believe that the tools introduced in this paper -the interchange structure, the simultaneous expandable message, deep iterates and multi-cycles in random functional graphs -are important technical advances and will hopefully have further applications or lead to new technical developments in related settings. Particularly, we point out that we can use the interchange structure in order to optimize the complexity of functional-graph-based attacks on the XOR combiner, concatenation combiner, and Hash-Twice. Although this does not lead to a very big improvement, it further demonstrates the wide applicability of this structure in cryptanalysis of hash function combiners. The considered random mappings are from a finite N -set domain to a finite N -set range, and

H Collision Preimage 2nd Preimage (challenge length) Ideal 2 0.5n Birthday 2 n Brute-force 2 n Brute-force HAIFA - - - - - - MD - - - - 2 0.5n [KS05] DS (2 0.5n ) Provable 2 0.5n 2 n 2 0.5n H 1 ⊕ H 2 Collision Preimage 2nd Preimage Ideal 2 0.5n Birthday 2 n Brute-force 2 n Brute-force HAIFA - - 2 0.833n [Sect. 3.1] IS MD - - 2 0.833n [Sect. 3.1] IS - - 2 0.667n [Sect. 4.1] SEM+FGDI - - 2 0.643n [Sect. 4.3] SEM+FGDI+IS - - 2 0.625n [Sect. 5.2] SEM+FGMC - - 2 0.612n [Sect. 5.3] SEM+FGMC+IS Provable 2 0.5n [HS08] 2 0.5n [HS08] 2 0.5n [HS08] H 1 H 2 Collision Preimage 2nd Preimage (challenge length) Ideal 2 n Birthday 2 2n Brute-force 2 2n Brute-force HAIFA 2 0.5n [Jou04] MC 2 n [Jou04] MC MD 2 0.5n [Jou04] MC 2 n [Jou04] MC - - - - 2 0.75n [Sect. 6.1] SEM+FGDI (2 0.75n ) - - - - 2 0.735n [Sect. 6.3] SEM+FGDI+IS (2 0.735n ) Provable 2 0.5n [HS08] 2 0.5n [HS08] 2 0.5n [HS08] Zipper Collision Preimage 2nd Preimage (challenge length) Ideal 2 0.5n Birthday 2 n Brute-force 2 n Brute-force MD - - - - 2 0.625n [Sect. 7] SEM+FGDI [L < 2 n/2 ] (2 0.375n ) - - - - 2 0.6n [Sect. 7] SEM+FGMC [L > 2 n/2 ] (2 0.4n ) Provable 2 0.5r [Lis06] 2 0.5r [Lis06] 2 0.5r [Lis06] Hash- Twice Collision Preimage 2nd Preimage (challenge length) Ideal 2 0.5n Birthday 2 n Brute-force 2 n Brute-force MD - - - - 2 0.667n [ABDK09] EM+MC+DS (2 0.333n ) - - - - 2 0.612n [Sect. 8.3] SEM+IS+DS+FGDI (2 0.5n ) - - - - 2 0.591n [Sect. 8.2] SEM+IS+DS+FGMC (2 0.591n ) Provable 2 0.5 - 2 n - 2
H i (M ) = h * i (IV i , M ) for i ∈ {1, 2}) V : Targeted image m : Message block M : Message chunk [m] q : Message chunk formed by concatenating q message blocks m, with [m] = [m] 1 M q : Message chunk with q message blocks M = m 1 . . .
N = 2 n FG f 1 , FG f 2 :
The functional graphs of random mappings

f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•,
x m -→ x , x M -→ x :
We say that m (resp. M ) maps state x to state x if x = h(x, m)

(resp. x = h * (x, M )) and denote this by x m -→ x (resp. x M -→ x , the compression function h is clear from the context). h [m]
:

An n-bit random mapping obtained by feeding an arbitrary fixed message block m into a compression function h with n-bit state.

Õ : Soft-O, is used as a variant of big O notation that ignores logarithmic factors. Thus, f (n) ∈ Õ(g(n)) is shorthand for ∃k : f (n) ∈ O(g(n) log k g(n)).
Roadmap. Section 2 exhibits preliminaries including generic tools and known attacks on hash constructions. Particularly, sections 2.5, 2.6, 2.7 demonstrate those new tools -the interchange structure, the simultaneous expandable message, deep iterates and multi-cycles in random functional graphs -which make the presented attacks possible. Sections 3, 4, and 5 illustrate preimage attacks on the XOR combiner using interchange structure, deep iterates, and multi-cycles in functional graphs, respectively. Sections 6, 7, and 8 describes the secondpreimage attacks on the concatenation combiner, Zipper hash, and Hash-Twice, respectively. Within the description of each attack, we provide an overview followed by detailed steps. In Section 9, we discuss more applications and extensions of the proposed attacks, including applications to combiners of wide-pipe hash functions and extensions to the combination of more than two hash functions. Section 10 summarizes attacks presented in this paper and discusses open problems.

Preliminaries

In this section, we introduce the technical tools and general concepts used in our attacks. Those tools briefly introduced in Sect. 2.1 through Sect. 2.4 are all existing and well-known tools. Those tools described in detail in Sect. 2.5 through Sect. 2.7 are our new tools exploited in different attacks.

Joux's Multi-Collision (MC) and Its Applications in Attacks on the Concatenation Combiner [Jou04]

In 2004, Joux introduced multi-collisions on narrow-pipe Merkle-Damgård hash functions. Given a hash function H, a multi-collision refers to a set of messages

M = {M 1 , M 2 , . . .} whose hash digests are all the same, i.e., H(M i ) = H(M j )
for any pair M i , M j ∈ M. The computational complexity of generic brute-force search increases exponentially when the target size |M| increases; more precisely, it is approximately 2 (|M|-1)•n/|M| . Utilizing the iterative nature of Merkle-Damgård structure, Joux's algorithm (see Alg. 1, whose pseudo-code is given in Appendix A) is able to find multi-collision of size 2 t with a complexity of t • 2 n/2 , i.e., a complexity not much greater than that of finding a single collision.

Algorithm 1: Building a 2 t -Joux's Multi-Collision

Require: Given an iterated hash function H with a compression function h, and an initial value x 0 .

1. Initialize M MC as a data structure of pairs of message blocks 2. For i = 1, . . . , t: (a) Find a pair of message blocks

(m i , m i ) such that h(x i-1 , m i ) = h(x i-1 , m i ) = x i .
This can be done with a complexity of 2 n/2 due to birthday paradox.

(b) Append (m i , m i ) to M MC 3. Output (x t , M MC ) x 0 m 1 m 1 m 2 m 2 x t m t m t ≡ x 0 x t t It is trivial to see the message set M = {m 1 m 2 • • • m t | m i = m i or m i for i = 1, 2, . . . , t} forms a multi-collision of size 2 t , and the overall complexity is O(t • 2 n/2
). Moreover, a data structure M MC of t pairs of message blocks can fully define the set M of 2 t colliding messages. With Joux's multi-collision at hand, one can immediately deploy a collision attack and a preimage attack on concatenation combiner with complexities n • 2 n/2 and n • 2 n , respectively. The collision attack goes as follows: first, build a 2 n/2 -Joux's multi-collision for one of the underlying hash function (iterated), and then exploit the messages in the structure to launch a birthday attack for the other hash function to find a collision among the outputs. The preimage attack follows a similar framework (see [BGW18] for an illustration and Joux's original paper [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] for more details).

Since its invention, Joux's multi-collisions have been employed in numerous cryptanalysis of hash functions, including the following most relevant ones and works such as [HS06,NS07].

Expandable Message (EM) and the Long Message Second-Preimage Attack [KS05]

In [DA99a], Dean devised a second-preimage attack for long messages on specific Merkle-Damgård hash functions for which it is easy to find fixed points in their compression function. Given a challenge message M = m 1 m 2 . . . m L , the attacker computes the sequence of internal states a 0 , a 1 , . . . , a L generated during the invocation of the compression function on M . A simplified attack would now start from the state x 0 = IV and evaluate the compression function with arbitrary message blocks until a collision h(x 0 , m) = a p is found for some message block m and index p. The attacker can now append the message suffix m p+1 . . . m L to m, hoping to obtain the target hash value H(M ). However, this approach does not work due to the final padding of the message length, which will be different if the message prefixes are of different lengths. The solution of Dean was to compute an expandable message that consists of the initial state x 0 and another state x such that for each length κ (in some range), there is a message M κ of κ blocks that maps x 0 to x. Thus, the algorithm first finds a collision h(x, m) = a p , and the second preimage is computed as

M p-1 m m p+1 . . . m L .
The assumption that it is easy to find fixed points in the compression function is used in efficient construction of the expandable message.

In [START_REF] Kelsey | Second Preimages on n-Bit Hash Functions for Much Less than 2n Work[END_REF], Kelsey and Schneier described a more generic attack that uses multi-collisions of a special form to construct an expandable message, removing the restriction of Dean regarding fixed points. As in Joux's original algorithm, the multi-collisions are constructed iteratively in t steps. In the i-th step, we find a collision between some m i and m i such that |m i | = 1 (it is a single block) and

|m i | = 2 i-1 +1, namely, h(x i-1 , m i ) = h(x i-1 , m i )
. This is done by firstly picking an arbitrary prefix of size 2 i-1 of m i denoted by mi , say [0] 2 i-1 , computing h(x i-1 , mi ) = x i and then looking for a collision h(x i-1 , m i ) = h(x i , mi ) using a final block mi (namely, m i = mi mi ) (see Fig. 6).

x 0 m1 [0] 2 0 m1 m2 [0] 2 1 m2 x t mt [0] 2 t-1 mt ≡ x 0 x t t

Fig. 6: The expandable message and its condensed representation [JN15]

The construction of Kelsey and Schneier gives an expandable message that can be used to generate messages starting from x 0 and reaching x = x t whose (integral) sizes are in the interval [t, 2 t +t-1] (such a message structure is denoted as a (t, 2 t + t -1)-expandable message). A message of length t ≤ κ ≤ 2 t + t -1 is generated by looking at the t-bit binary representation of κt. In iteration i ∈ {1, 2, . . . , t}, we select the long message fragment m i if the i-th LSB of κt is set to 1 (otherwise, we select the single block m i ). In the sequel, we denote this type of expandable message by M EM . Given that the challenge message M is of L ≤ 2 n/2 blocks, the construction of the expandable message in the first phase of the attack requires less than n • 2 n/2 computations, while obtaining the collision with one of the states computed during the computation of M requires approximately 1/L • 2 n computations according to the birthday paradox.

Diamond Structure (DS) [KK06]

Like Joux's multi-collisions and expandable message, the diamond structure is also a type of multi-collision. The difference is that instead of mapping a common starting state to a final state, each message in a diamond maps a different state to a final state. A 2 t -diamond contains 2 t specially structured messages mapping 2 t starting states to a final state, and it forms a complete binary tree of depth t. The 2 t starting states are leaves, and the final state is the root. A 2 t -diamond can be built by launching several collision attacks requiring about

√ t • 2 (n+t) 2 messages and n • √ t • 2 (n+t) 2 computations in total [BSU12].
In the sequel, we denote the set of messages in a diamond by M DS . The diamond was primarily invented by Kelsey and Kohno to devise herding attacks against MD hash functions [START_REF] Kelsey | Herding Hash Functions and the Nostradamus Attack[END_REF], in which the attacker first commits to the digest value of a message using the root of his diamond and later "herds" any given prefix of a message to his commitment by choosing an appropriate message from his diamond as the suffix. Later, Andreeva et al. successfully exploited it to launch herding and/or second-preimage attack beyond MD hash constructions, such as the dithered hash, Hash-Twice, the Zipper hash, and hash trees [ABF + 08,ABDK09,ABD + 16]. Concretely, the second-preimage attack on Hash-Twice in [ABDK09] leverages techniques in herding attack and techniques in the above-mentioned secondpreimage attack. One key point of this attack is that it builds a long Joux's multi-collision in the first pass, exploits messages in this multi-collision to build a diamond structure in the second pass, and finally uses the diamond as a connector to connect one crafted message to the challenge message on some states. Let 2 t be the width of the diamond and 2 be the length of the message; the complexity of this attack is approximately 2 (n+t)/2 + 2 n-+ 2 n-t .

Distinguished Points (DP)

The memory complexity of many algorithms that are based on functional graphs (e.g., parallel collision search [vOW99]) can be reduced by utilizing the distinguished points method (which is attributed to Ron Rivest). Assume that our goal is to detect a collision of a chain (starting from an arbitrary node) with the nodes of G computed in Alg. 5, but without storing all the 2 t nodes in memory. The idea is to define a set of 2 t distinguished points (nodes) using a simple predicate (e.g., the nt LSBs of a node are zero). The nodes of G contain approximately 2 t • 2 t-n = 2 2t-n distinguished points, and only they are stored in memory. A collision of an arbitrary chain with G is expected to occur at depth of about 2 n-t and will be detected at the next distinguished point which is located (approximately) after traversing additional 2 n-t nodes. Consequently, we can detect the collision with a small overhead in time complexity, but a significant saving factor of 2 n-t in memory.

Interestingly, in the specific attack of Sect. 4, the distinguished points method is essential for reducing the time complexity of the algorithm.

Interchange Structure (IS)

In this subsection, we present how to build a structure that enables us to simultaneously control two (or more) hash computation lanes sharing the same input message and succeed in further relaxing the pairwise relation between the internal states of computation lanes. We name the structure the interchange structure.

The main idea is to consider several chains of internal states reached by processing a common message M from different starting points (note that the message M is not fixed in advance, but will be determined when building the structure). More precisely, the message M is denoted as the primary message and divided into several chunks: M = M 0 M 1 . . . (as discussed later, a chunk consists of approximately n/2 message blocks). We denote chains of internal states for H 1 as a j and the individual states of the chain as

a i j , with h * 1 ( a i j , M i ) = a i+1 j . Similarly, we denote chains for H 2 as b k , with h * 2 ( b i k , M i ) = b i+1 k .
When considering both hash functions, message block M i leads from the pair of states

( a i j , b i k ) to ( a i+1 j , b i+1 k ), which is denoted as ( a i j , b i k ) M i ( a i+1 j , b i+1 k ).
Switch Structure. To construct a desired interchange structure, we first create the basic building blocks to jump between chains in a controlled way; we named them switches. A switch allows to jump from a specific pair of chains ( a j 0 , b k 0 ) to a different pair of chains ( a j 0 , b k 1 ) using a secondary message chunk M i , in addition to the normal transitions using chunk M i of the primary message M :

( a i j , b i k ) M i ( a i+1 j , b i+1 k ) : normal transition for each chain ( a i j 0 , b i k 0 ) M i ( a i+1 j 0 , b i+1 k 1 ) : jump from chains ( a j 0 , b k 0 ) to ( a j 0 , b k 1 )
To simplify the notation, we often omit the chunk index to show only the chains that are affected by the switch.

The main message chunk M i and the secondary message chunk M i are determined when building the switch, and the main message defines the next state of all the chains. We note that the secondary message chunk M i should only be used when the state is ( a i j 0 , b i k 0 ). A simple example is depicted in Fig. 7.

H 1 H 2 a 0 b 1 b 0 A single swich: a 0 b 1 b 0 ( a 0 , b 0 ) M ( a 0 , b 0 ) normal transition a 0 b 1 b 0 ( a 0 , b 1 ) M ( a 0 , b 1 ) normal transition a 0 b 1 b 0 ( a 0 , b 0 ) M ( a 0 , b 1 )
jump transition Jump from ( a 0 , b 0 ) to ( a 0 , b 1 ) by using M (dashed lines) instead of M (solid lines).

Fig. 7: A single switch

Alternatively, a switch can be designed to jump from ( a j 0 , b k 0 ) to ( a j 1 , b k 0 ). It can be built with a complexity of Õ(2 n/2 ).

We now explain how to build the switch structure at the core of some of our attacks. This construction is strongly based on the multi-collision technique of Joux presented in Sect.2.1.

Given states a i j 0 , b i k 0 and b i k 1 , we want to build message chunks M i and M i in order to have the following transitions:

( a i j 0 , b i k 0 ) M i ( a i+1 j 0 , b i+1 k 0 ) : normal transition ( a i j 0 , b i k 1 ) M i ( a i+1 j 0 , b i+1 k 1 ) : normal transition ( a i j 0 , b i k 0 ) M i ( a i+1 j 0 , b i+1 k 1 )
: jump transition The main message chunk M i is used to define the next state of all the remaining chains, while the secondary message chunk M i will be used to jump from chains ( a j 0 , b k 0 ) to ( a j 0 , b k 1 ). We note that M i will only be used when the state is ( a i j 0 , b i k 0 ). In particular, M i and M i must satisfy the following:

a i+1 j 0 = h * 1 ( a i j 0 , M i ) = h * 1 ( a i j 0 , M i ) b i+1 k 1 = h * 2 ( b i k 1 , M i ) = h * 2 ( b i k 0 , M i ) b i+1 k 0 = h * 2 ( b i k 0 , M i ) = b i+1 k 1
The full building procedure is shown in Alg. 2 whose pseudo-code is given in Appendix A; it requires approximately n/2 • 2 n/2 evaluations of the compression functions.

Algorithm 2: Building a single switch 1. Build a multi-collision for h * 1 , starting from state a i j 0 , i.e., a set M MC of 2 n/2 messages that all reach the same state a i+1 j 0 (∀M ∈ M MC , h * 1 ( a i j 0 , M ) = a i+1 j 0 ). As shown in Sect. 2.1, this can be done efficiently by sequentially building n/2 collisions. Thus, each M is comprised of n/2 message blocks.

Evaluate h

* 2 ( b i k 0 , M ) and h * 2 ( b i k 1 , M
) for all the messages M in the set M MC . With high probability there is match between the sets of values a . Denote the colliding messages as M i and M i , so that we have

h * 2 ( b i k 0 , M i ) = h * 2 ( b i k 1 , M i ).

Compute the missing chains using the message M

i : a i+1 j = h * 1 ( a i j , M i ), b i+1 k = h * 2 ( b i k , M i ).
With high probability all the chains reach distinct values; if this is not the case, restart the construction with a new multicollision. b Interchange Structure. By combining several simple switches, we can build an interchange structure with starting points IV 1 and IV 2 and ending points

H 1 H 2 a i j0 a i+1 j0 M MC b i k0 b i k1 M MC M MC b i+1 k1 M M b i+1 k0 M First, M
A j | j = 0 . . . 2 t -1 and B k | k = 0 . . . 2 t -1 ,
so that we can select a message ending in any state (A j , B k ). An interchange structure with 2 t chains for each function requires about 2 2t switches. Since we can build a switch for a cost of Õ(2 n/2 ), the total structure is built with Õ(2 2t+n/2 ) operations.

Let us now describe the combination of switch structures into an interchange structure. The goal of this structure is to select the final value of the H 1 computation and the H 2 computation independently. More precisely, the structure defines two sets of final values A j and B k , and a set of messages M jk such that 20

(IV 1 , IV 2 ) M jk (A j , B k ).
IV 1 IV 2 H 1 H 2 B 0 A 0 B 1 A 1 B 2 A 2 B 3 A 3
One possible way to build an interchange structure

IV 1 IV 2 H 1 H 2 B 0 A 0 B 1 A 1 B 2 A 2 B 3 A 3 M M M M M M M M M M M M M M M
Select a given message in the interchange structure Algorithm 3 describes the combination of switches to build an interchange structure. Its pseudo-code is given in Appendix A, where the Interchange functions builds the structure, and the SelectMessage function extracts the message reaching ( a j , b k ).

The structure can be somewhat optimized using the fact that the extra chains have no prespecified initial values. We show how to take advantage of this in Appendix B, using multi-collision structures in addition to the switch structures. However, this does not significantly change the complexity: we need (2 t -1)(2 t -1) switches instead of 2 2t -1. In total, we need approximately n/2 • 2 2t+n/2 evaluations of the compression functions to build a 2 t -interchange structure.

We believe that a 2 t -interchange structure based on switches will need at least Θ(2 2t ) switches, because every switch can only increase the number of reachable pairs ( a j , b k ) by one. As shown in Appendix B some switches can be saved in the beginning, but it seems that new ideas are needed to reduce the total complexity below Θ(2 2t+n/2 ).

Simultaneous Expandable Messages (SEM)

In this subsection, we build a simultaneous expandable message for two MD hash functions basing on the multi-collision described in Sect. 2.1 and the expandable message for a single MD hash function described in Sect. 2.2. This expandable message consists of the initial states (IV 1 , IV 2 ) and final states (x, ŷ) such that for each length κ in some appropriate range (determined below), there is a message M κ of κ blocks that maps (IV 1 , IV 2 ) to (x, ŷ). A similar construction of an expandable message over two hash functions was proposed in the independent paper [JN15] by Jha and Nandi, which analyses the Zipper hash assuming weak compression functions. We describe our construction approach of this simultaneous expandable message in detail next.

We set C ≈ n/2 + log(n) as a parameter that depends on the state size n. Our basic building block consists of two pairs of states (x 0 , y 0 ) and (x 1 , y 1 ) and two message fragments ms and ml that map the state pair (x 0 , y 0 ) to (x 1 , y 1 ). The message ms is the (shorter) message fragment of fixed size C, while ml is of size i > C. We will show how to construct this building block for any state pair (x 0 , y 0 ) and length i > C in Alg. 4.

Given this building block and a positive parameter t, we build an expandable message in the range of

[C(C -1) + tC, C 2 -1 + C(2 t + t -1)
]. This is done by utilizing a sequence of C -1 + t basic building blocks. The first C -1 building blocks are built with parameters i ∈ {C + 1, C + 2, . . . , 2C -1}. It is easy to see that these structures give a (C(C -1), C 2 -1)-expandable message by selecting at most one longer message fragment from the sequence, where the remaining C -2 (or C -1) fragments are of length C. The final t building blocks give a standard expandable message, but it is built in intervals of C. These t building blocks are constructed with parameters i = C(2 j-1 + 1) for j ∈ {1, . . . , t}. See Fig. 8 for a visual illustration.

Given a length κ in the range of [C(C -1)+tC, C 2 -1+C(2 t +t-1)], we can construct a corresponding message by first computing κ (modulo C). We then select the length κ ∈ [C(C -1), C 2 -1] such that κ ≡ κ (modulo C), defining the first C -1 message fragment choices. Finally, we compute (κκ )/C, which is an integer in the range of [t, 2 t + t -1], and select the final t message fragment choices as in a standard expandable message using the binary representation of (κκ )/C. Construction of the Building Block. Given state pair (x 0 , y 0 ) and length i > C, the algorithm for constructing the building block for the expandable message is based on multi-collisions, as described below; its pseudo-code is given in Appendix A.

Algorithm 4: Constructing a building block for an SEM

1. Pick an arbitrary prefix of size i -C blocks, say [0] i-C , and compute

xp = h * 1 (x 0 , [0] i-C ). 2. Find collision (m 1 , m 1 , sp) s.t. h 1 (x 0 , m 1 ) = h 2 (xp, m 1 ) = sp, where m 1
and m 1 are single message blocks. 3. Build a 2 C-1 standard Joux's multi-collision in h 1 starting from sp, and denote its endpoint by x 1 . Altogether, we have a multi-collision in h 1 with 2 C messages that map x 0 to x 1 . Out of these 2 C messages,

22

-2 C-1 are of length C (obtained by first selecting m 1 , i.e., m 1 ×M MC ), and we denote this set of short messages by

M short ; -2 C-1 are of length i (obtained by first selecting [0] i-C m 1 , i.e., ([0] i-C m 1 ) × M MC )
, and we denote this set of long messages by

M long . 4. Evaluate yp = h * 2 (y 0 , [0] i-C
) and store the result. Next, evaluate h 2 from y 0 on the two sets M short and M long (using the stored yp to avoid recomputing h * 2 (y 0 , [0] i-C )) and find a collision between them (such a collision is very likely to occur since C -1 > n/2). The collision gives the required ms ∈ M short and ml ∈ M long of appropriate sizes such that y 1 h * 2 (y 0 , ms) = h * 2 (y 0 , ml) and

x 1 h * 1 (x 0 , ms) = h * 1 (x 0 , ml). x0 y0 H1 H2 sp m1 xp [0] i-C m 1 x1 MMC m1 yp [0] i-C m 1 y1 MMC MMC Mshort Mlong 1 C -1 (i -C) + 1 C -1
The complexity of Step 1 is less than i compression function evaluations. The complexity of Step 2 is approximately 2 n/2 , while the complexity of Step 3 is approximately 2 . In total, the complexity of constructing the basic building block is approximately i + n • 2 n/2 (ignoring small factors).

C • 2 n/2 ≈ n • 2 n/2 . The complexity of Step 4 is approximately i + n • 2 n/
Complexity Analysis of the Full Building Procedure. The full expandable message requires computing C -1 + t building blocks whose sum of length parameters (dominated by the final building block) is approximately C•2 t ≈ n•2 t . Assuming that t < n, we construct C -1 + t ≈ n building blocks, and the total time complexity of constructing the expandable message is approximately n

•2 t + n 2 •2 n/2 . Our attacks require the (C(C -1)+tC, C 2 -1+C(2 t +t-1))-expandable message to extend up to length L, implying that L ≈ n • 2 t and

giving a time complexity of approximately

L + n 2 • 2 n/2 . x0 y0 sp1 m1 xp1 0 m 1 x1 m1 0 m 1 y1 1 C -1 1 + 1 C -1 sp2 m2 xp2 0 m 2 x2 m2 0 m 2 y2 1 C -1 2 + 1 C -1 C -1 [C(C -1), C 2 -1] spC-1+t mC-1+t xpC-1+t 0 m C-1+t xC-1+t mC-1+t 0 m C-1+t yC-1+t 1 C -1 C2 t-1 + 1 C -1 t C[t, 2 t + t -1] [C(C -1) + tC, C 2 -1 + (2 t + t -1)C]-expandable message
Fig. 8: Simultaneous expandable message

Functional Graph (FG) of Random Mappings

In many of our attacks, we evaluate a compression function h with a fixed message input block m (e.g., the zero block) and simplify our notation by defining

f (x) = h [m] (x) = h(x, m).
The mapping f yields a directed functional graph.

The functional graph of a random mapping f is defined via successive iteration on this mapping.

Let f be an element in F N that is the set of all mappings with the set N as both the domain and range. The functional graph of f is a directed graph whose nodes are the elements 0, . . . , N -1 and whose edges are the ordered pairs x, f (x) , for all x ∈ {0, . . . , N -1}. If starting from any x 0 and iterating f , that is x 1 = f (x 0 ), x 2 = f (x 1 ), . . . , we will find that before N iterations, a value x j equal to one of x 0 , x 1 , . . . , x j-1 ; suppose that the collided one is x i . In this case, we say the path

x 0 → x 1 → • • • → x i-1 → x i connects to a cycle x i → x i+1 → • • • → x j-1 → x i .
If we consider all possible starting points x 0 , paths exhibit confluence and form trees; trees grafted on cycles form components; a collection of components forms a functional graph. That is, a functional graph can be viewed as a set of connected components; a component is a cycle of trees; a tree is recursively defined by appending a node to a set of trees; a node is a basic atomic object and is labelled by an integer [FO89].

Structures of functional graph of random mappings have been studied for a long time, and some parameters have accurate asymptotic evaluations [FO89].

Below, we list some of the most relevant ones. These properties have been extensively studied and exploited in cryptography, e.g., in the classical works of Hellman [Hel80] and van Oorschot and Wiener [vOW99], and much more recently in generic attacks on hash-based MACs [DL14,GPSW14,LPW13,PK14,PW14] (refer to [BGW18] for a systematization of knowledge regarding the applications of random functional graphs in generic attacks).

Theorem 1 ([FO89]). The expected number of components, number of cyclic nodes (nodes belong to a cycle), number of terminal nodes (nodes without preim-

24 age: f -1 (x) = ∅),

number of image nodes (nodes with preimage), and number of k-th iterate image nodes (image nodes of the k-th iterate f k of f ) in a random mapping of size N have the following asymptotic forms as

N → ∞: 1. # Components 1 2 log N = 0.5 • n 2. # Cyclic nodes πN/2 ≈ 1.2 • 2 n/2 3. # Terminal nodes e -1 N ≈ 0.37 • 2 n 4. # Image nodes (1-e -1 )N ≈ 0.62•2 n 5. # k-th iterate image nodes (1 - τ k )N , where τ k satisfies the recurrence relation τ 0 = 0, τ k+1 = e -1+τ k
Seen from an arbitrary node x 0 , we call the length (measured by the number of edges) of the path starting from x 0 and before entering a cycle the tail length of x 0 and denote it by λ(x 0 ); term the length of the cycle connected with x 0 the cycle length of x 0 and denote it by µ(x 0 ); name the length of the nonrepeating trajectory of the node x 0 the rho-length of x 0 and denote it by ρ(x 0 ) = λ(x 0 ) + µ(x 0 ).

Theorem 2 ([FO89]

). Seen from a random point (any of the N nodes in the associated functional graph is taken equally likely) in a random mapping of F N , the expected tail length, cycle length, rho-length have the following asymptotic forms:

1. Tail length (λ) πN/8 ≈ 0.62 • 2 n/2 2. Cycle length (µ) πN/8 ≈ 0.62•2 n/2 3. Rho-length (ρ) πN/2 ≈ 1.2 • 2 n/2

Theorem 3 ([FO89]

). The expected maximum cycle length (µ max ), maximum tail length (λ max ) and maximum rho length (ρ max ) in the functional graph of a random mapping of F N satisfy the following: The results from these theorems indicate that in a random mapping, most of the points tend to be grouped together in a single giant component. This component is therefore expected to have very tall trees and a large cycle [FO89].

1. E{µ max | F N } = 0.78248 • 2 n/2 2. E{λ max | F N } = 1.73746 • 2 n/2 3. E{ρ max | F N } = 2.41490 • 2 n/2
A useful algorithm for expanding the functional graph of f is given below (see Alg. 5 whose pseudo-code is given in Appendix A). This algorithm is not new and has been previously used (for example, in [GPSW14,PW14]). It takes an input parameter t ≥ n/2 that determines the number of expanded nodes (and the running time of the algorithm). (a) Pick an arbitrary starting point x 0 and evaluate the chain x i+1 = f (x i ) until it cycles (there exists x i = x j for i = j) or hits a point in G. Add the points of the chain to G.

Deep Iterates in the Functional Graphs (FGDI). Next, we describe our observations on functional graph of random mappings. The efficiencies of our following attacks are mostly based on these observations on special nodes in functional graphs.

In our attacks, we are particularly interested in nodes of f that are located deep in the functional graph. More specifically, x is an iterate of depth i if there exists some ancestor node x such that x = f i (x), i.e., x is an i-th iterate image node (or say i-th iterate for short). If i is relatively large, we say that x is a deep iterate. Deep iterates are usually obtained using chains evaluated from an arbitrary starting point x 0 by computing a sequence of nodes using the relation

x i+1 = f (x i ).
We denote this sequence by x. The following two observations regarding deep iterates make them helpful in the proposed attacks: Observation 1. It is easy to obtain a large set of deep iterates. Specifically, by running Alg. 5 with input parameter t (t ≥ n/2), one can obtain a set of 2 t nodes, among which a constant fraction (Θ(2 t )) are 2 n-t -th iterates. The theoretical reasoning is as follows. After we have executed the algorithm and developed 2 t nodes, then another chain from an arbitrary starting point is expected to collide with the evaluated graph at depth of roughly 2 n-t . This is a direct consequence of the birthday paradox. Moreover, for two chains from two different starting points x and y, the probability that Pr[f

2 n-t (x) = f 2 n-t (y)] = Θ(2 -t ) [DL14, Lemma 1] (note that n -t < n/2).
That is, for t ≥ n/2, when the number of new chains (of length 2 n-t and from arbitrary starting points) is less than 2 t , they are expected to collide with the evaluated graph at distinct points. In particular, this observation implies that most chains developed by the algorithm will be extended to depth Ω(2 n-t ) (without colliding with G of cycling); therefore, a constant fraction of the developed nodes are iterates of depth 2 n-t . In total, the algorithm develops Θ(2 t ) iterates of f of depth 2 n-t in 2 t time. This conclusion was also verified experimentally.

Observation 2.

A deep iterate has a relatively high probability to be encountered during the evaluation of a chain from an arbitrary starting node. Let f 1 and f 2 be two independent n to n-bit mappings. Suppose x (resp. ȳ) is an iterate of depth 2 g in FG f 1 (resp. FG f 2 ); then, it is an endpoint of a chain of states of length 2 g . Let d be in the interval [1, 2 g ] and x 0 (resp. y 0 ) be a random point. Then, according to Lemma 1, Pr[

x d = x ≈ d • 2 -n ] (resp. Pr[y d = ȳ ≈ d • 2 -n ] ),
which is the probability that x (resp. ȳ) will be encountered at distance d from x 0 (resp. y 0 ). Due to the independence of f 1 and f 2 , Pr[

x d = x y d = ȳ] ≈ (d•2 -n ) 2 .
Summing the probabilities of the (disjoint) events over all distances d in the interval [1, 2 g ], we conclude that the probability that x and ȳ will be encountered at the same distance is approximately (

2 g ) 3 • 2 -2n = 2 3g-2n .
The probability calculation in Observation 2 yields the conclusion that we need to compute approximately 2 2n-3g chains from different starting points to find a pair of starting points (x 0 , y 0 ) reaching a pair of 2 g -th iterates (x, ȳ) at the same distance. This conclusion was verified experimentally. Note that since various trials performed by selecting different starting points for the chains are dependent, the proof of this conclusion is incomplete. However, this dependency is negligible in our attacks, and thus we can ignore it. More details can be found in Appendix C.

Lemma 1.

Let f be an n-bit random mapping and x 0 an arbitrary point. Let D ≤ 2 n/2 and define the chain x i = f (x i-1 ) for i ∈ {1, . . . , D} (namely, x D is an iterate of depth D). Let x 0 be a randomly chosen point, and define

x d = f (x d-1 ) for integer d ≥ 1. Then, for any d ∈ {1, . . . , D}, Pr[x d = x D ] = Θ(d • 2 -n ).
Proof. (Sketch.) We can assume that the chains do not cycle (i.e., each chain contains distinct nodes), as D ≤ 2 n/2 . For x d = x D to occur, x d-i should collide with x D-i for14 some 0 ≤ i ≤ d. For a fixed i, the probability for this collision is roughly15 2 -n , and summing over all 0 ≤ i ≤ d (all events are disjointed), we get that the probability is approximately d • 2 -n .

Multi-Cycles in Functional Graphs (FGMC)

Next, we study a property of some more special nodescyclic nodes in random functional graphs. There are efficient cycle search algorithms (with O(2 n/2 ) time complexity) to detect the cycle length and collect cyclic nodes in the largest component of a random functional graph [Jou09, Chapter 7], and cycles has been exploited in generic attacks on hash-based MACs [GPSW14,LPW13]. Here, we exploit them in a new way. Each cyclic node in a functional graph defined by f loops along the cycle when computed by f iteratively and goes back to itself after a (multi-) cycle-length number of function calls. This property can be utilized to provide extra degrees of freedom when estimating the distance of other nodes to a cyclic node in the functional graph, i.e., it can be expanded to a set of discrete values by using multi-cycles. For example, let x and x be two nodes in a component of the functional graph defined by f , x be a cyclic node, and the cycle length of the component be denoted as L. Clearly, there exists a path from x to x as they are in the same component, and the path length is denoted by d. Then, we have the following:

f d (x ) = x; f L (x) = x =⇒ f (d+i•L) (x ) = x for any positive integer i.
Suppose it is limited to use at most t cycles (limitation imposed by the length of the message). Then, the distance from x to x is expanded to a set of t + 1 values {d

+ i • L | i = 0, 1, 2, ..., t}.
Now, let us consider a special case of reaching two deep iterates from two random starting nodes: select two cyclic nodes within the largest components in the functional graphs as the deep iterates. More specifically, let FG f 1 and FG f 2 be two functional graphs defined by f 1 and f 2 . Let x and x 0 be two nodes in a common largest component of FG f 1 , where x is a cyclic node. Let L 1 denote the cycle length of the component and d 1 denote the path length from x 0 to x. Similarly, we define notations ȳ, y 0 , L 2 and d 2 in FG f 2 . We are interested in the probability of linking x 0 to x and y 0 to ȳ at a common distance. Thanks to the usage of multiple cycles, the distance values from x 0 to x and from y 0 to ȳ can be selected from two sets {d

1 + i • L 1 | i = 0, 1, 2, . . . , t} and {d 2 + j • L 2 | j = 0, 1, 2, .
. . t}, respectively. Hence, as long as there exists a pair of integers (i, j) such that 0 ≤ i, j ≤ t and

d 1 + i • L 1 = d 2 + j • L 2 , we obtain a common distance d = d 1 + i • L 1 = d 2 + j • L 2 such that f d 1 (x 0 ) = x, f d 2 (y 0 ) = ȳ.
Next, we evaluate the probability amplification of reaching (x, ȳ) from a random pair (x 0 , y 0 ) at the same distance. Without loss of generality, we assume

L 1 ≤ L 2 . Let ∆L L 2 mod L 1 . Then, it follows that d 1 + i • L 1 = d 2 + j • L 2 =⇒ d 1 -d 2 = j • L 2 -i • L 1 =⇒ (d 1 -d 2 ) mod L 1 = j • ∆L mod L 1
Letting j range over all integer values in internal [0, t], we will collect a set of

t + 1 values D = {j • ∆L mod L 1 | j = 0, 1, .
. . , t}. 16 Since

d 1 = O(2 n/2 ), d 2 = O(2 n/2 ) and L 1 = Θ(2 n/2 ), it follows that |d 1 -d 2 | = O(L 1
), and we assume |d 1d 2 | < L 1 by ignoring the constant factor. Therefore, for a randomly sampled pair (x 0 , y 0 ) that encounters (x, ȳ), we are able to derive a pair of (i, j)

such that d 1 + i • L 1 = d 2 + j • L 2 , as long as their distance bias d 1 -d 2 is in the set D.
In other words, we are able to correct such a distance bias by using multi-cycles. Hereafter, the set D is referred to as the set of correctable distance bias. Thus, the probability of reaching (x, ȳ) from a random pair (x 0 , y 0 ) at a common distance is amplified by roughly t times, where t is the number of cycles to the maximum.

Preimage Attack on XOR Combiners Based on the Interchange Structure

In this section, we introduce our first attack -the preimage attack on the XOR combiner. In this attack, we are given an n-bit target value V , and our goal is to find a message M such that

H 1 (M ) ⊕ H 2 (M ) = V . Notice that, if the goal is to find two messages M 1 and M 2 such that H 1 (M 1 ) ⊕ H 2 (M 2 ) = V ,
we can immediately launch a meet-in-the-middle procedure to find a solution of the equation

H 1 (M 1 ) = H 2 (M 2 ) ⊕ V with 2 n/2 computations.
That is because in the last equation, the left-hand side and right-hand side are independent. By separately computing 2 n/2 values on each side, we obtain 2 n pairs and will find a match with high probability due to the birthday paradox. Thus, the above is essentially to find a collision, which is an easy challenge. However, in the real challenge, the collision must be generated from the same message. Thus, the computations on the two side of the equation are pairwise related, i.e., the computation on one side of the equation can only pair with a single computation on the other side. Consequently, unlike in the easy challenge, 2 n/2 computations on each side can only generate 2 n/2 pairs instead of 2 n . Therefore, to launch a similar meet-in-the-middle procedure as we did in the easy challenge for the real challenge, a crucial part of our attack is to construct a structure breaking the pairwise dependency between the two computations. That structure playing the important role is the interchange structure introduced in Sect. 2.5. Next, we provide an overview of our attack based on the interchange structure and then give detailed attack procedures.

Overview of the Attack

Next, we give an overview of the first preimage attack on the XOR combiner. Let V denote the target value. The two hash functions H 1 and H 2 share the same input message, and hence the internal states of their iterative compression function computations are pairwise related. We first manage to simultaneously control the computation chains of H 1 and H 2 by constructing an interchange structure including a message structure M and two sets of internal states A (for H 1 ) and B (for H 2 ) such that for any state A picked from A and B picked from B, we can easily derive a message M A,B from M such that H 1 (M A,B ) produces A and H 2 (M A,B ) produces B. Hence, we can select states from A and B independently in the next phase of the attack. In the next phase, we use a birthday match to find a message block m, a state A in A and a state B in

B such that h 1 (A, m) ⊕ h 2 (B, m
) equals the target hash digest V , where h 1 and h 2 are the compression functions of H 1 and H 2 respectively. Finally, given states A and B, we derive the message M A,B from M, and output M A,B m as a preimage of V . 17 The birthday match in the second phase of the attack is essentially a meet-in-the-middle procedure enabled by the interchange structure built in the first phase of the attack. Thus, the entire attack is more efficient than a brute-force attack.

Attack 1: Preimage attack on XOR combiner based on the interchange structure

-Phase 1: Build a 2 t -interchange structure using 2 2t switches that enables to jump between chains (see. Sect.2.5). This structure has starting points IV 1 and IV 2 and ending points A j | j = 0 . . . 2 t -1 and

B k | k = 0 . . . 2 t -1
, so that for any state pair (A j , B k ), we can easily select a message ending in it.

-Phase 2: Select a random message block m, and compute two lists by evaluating the compression functions after the interchange structure:

A j = h 1 (A j , m) | j = 0 . . . 2 t -1 and B k = V ⊕ h 2 (B k , m) | k = 0 . . . 2 t -1 .
We expect a match between the lists with probability 2 2t-n . After about 2 n-2t random choices of m, we obtain a match (j * , k * ):

h 1 (A j * , m) = V ⊕ h 2 (B k * , m) i.e. h 1 (A j * , m) ⊕ h 2 (B k * , m) = V.
Therefore, we can construct a preimage of V by concatenating the message leading to (A j * , B k * ) in the interchange structure and m (we ignore the finalization function here).

H 1 H 2 IV 1 IV 2 A 0 B 0 A 1 B 1 A 2 B 2 A 3 B 3 M M M M M M M M M M M = V
The complexity of the preimage search is approximately 2 n-t evaluations of the compression function, using an interchange structure with 2 t endpoints.

Complexity Analysis. Building the interchange structures requires approximately 2 2t+n/2 evaluations of the compression function, while the preimage search requires approximately 2 n-t . The optimal complexity18 is reached when both steps take the same time, i.e., t = n/6. This gives a complexity of Õ(2 5n/6 ). Since it uses messages of length at least n/2 • 2 2t , the optimal complexity is obtained for messages of length at least 2 n/3 . For messages shorter than 2 n/3 , it provides a trade-off of 2 n • L -1/2 between the maximal allowed message length

Details of the Preimage Attack on XOR Combiners Using the Interchange Structure

Now, we describe the full preimage attack in detail. We first build an interchange structure with 2 t chains for each of H 1 and H 2 . We denote the ending points as

A j | j = 0 . . . 2 t -1 and B k | k = 0 . . . 2 t -1
, and we know how to select a message M jk to reach any state (A j , B k ). When adding message fragment m pad, to one of the messages M jk in the interchange structure, where m is a message block and pad is the final block padded with the length L of the preimage message, the output of the combiner can be written as follows:

H 1 (M jk m pad)⊕H 2 (M jk m pad) = h 1 (h 1 (A j , m), pad)⊕h 2 (h 2 (B k , m), pad),
Note that we fix the finalization functions of H 1 and H 2 as their compression functions, h 1 and h 2 , respectively.

To reach a target value V , we select a random block m, and we evaluate

A j = h 1 (h 1 (A j , m), pad) | j = 0 . . . 2 t -1 and B k = V ⊕ h 2 (h 2 (B k , m), pad) | k = 0 . . . 2 t -1 .
If there is a match (j * , k * ) between the two lists, we have the following:

A j * = B k * ⇔ h 1 (h 1 (A j * , m), pad) = V ⊕ h 2 (h 2 (B k * , m), pad) ⇔ H 1 (M jk m pad) ⊕ H 2 (M jk m pad) = V.
For a random choice of m, we expect that a match exists with probability 2 2t-n , and testing it requires approximately 2 t operations19 . We will have to repeat this procedure 2 n-2t times on average; therefore, the total cost of the preimage search is approximately 2 n-t evaluations of h 1 and h 2 .

As explained in the previous section, building a 2 t -interchange structure requires approximately n/2•2 2t+n/2 operations. Using t = n/6, we balance the two steps of the attack and reach the optimal complexity of approximately n/2•2 5n/6 operations for this preimage attack.

Improved Preimage Attack on XOR Combiners Based on Deep Iterates

The first attack works identically for the case in which the combined hash functions use the HAIFA mode, and the case in which they use the MD construction. However, when they are limited to use the MD construction, we can launch a more efficient attack than the first. In this case, pairwise dependency between internal states can be broken efficiently by using repeated message blocks. Explicitly, we use a different approach to get the two sets of states

A = A j | j = 0 . . . 2 t -1 and B = B k | k = 0 . . . 2 t -1 such that for any pair of states (A j , B k | A j ∈ A, B k ∈ B), we can manage to find a message M A,B such that (IV 1 , IV 2 ) M A,B ----→ (A j , B k ).
For convenience, we name such an abstract procedure GenPairableStates, which is implemented and utilized by quite different approaches in different attacks -the first attack implements it using interchange structure, this second attack implements it using deep iterates in functional graphs, and as will be seen, the third attack implements it using cyclic nodes in functional graphs. The first step is to fix an arbitrary message block m to the compression functions, giving rise to n to n-bit random mappings

f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m).
Such random mappings and their functional graphs have many interesting properties and have been extensively studied and used in cryptanalysis, as shown in Sect. 2.7. However, to attack hash combiners, we exploit them in new ways. In this attack, instead of precisely controlling every computational step in chains of equal length to obtain two sets of endpoints as in building an interchange structure, here, we loosely herd computational chains of various length to collect two sets of states. These collected states have large offsets in the chains. These chains are iteratively computed using the above defined random mappings f 1 and f 2 . Thus, the collected states are essentially deep iterates in the functional graphs of f 1 and f 2 , which are introduced in Sect. 2.7. As has been shown in Sect. 2.7, such special states are relatively easy (i.e., with high probability) to be reached from randomly selected starting states. This is where the advantage of the attack mainly comes from.

In this attack, given a pair of such special states (A j , B k ), finding a common message mapping a pair of starting states to them under the two hash computations is not as efficient as selecting a message from an interchange structure in Attack 1. However, collecting those final states by expanding functional graphs is much more efficient than computing endpoints by building an interchange structure. This attack amortizes computational costs to different steps. Thus, it provides better balance between different attack steps. Moreover, it also provides a better trade-off between the message length and time complexity.

However, unlike the interchange-structure-based attack, this approach uses chains of various lengths, which implies that lengths of message fragments in intermediate attack steps are not fixed in advance. However, the length of the preimage needs to be predefined in this attack. Thus, the length padding at the end of the hash computations will be a problem. We overcome this problem using our tool, the simultaneous expandable message for two MD hash functions, which is introduced in Sect. 2.6.

Next, we provide a high-level overview of this attack and then present the detailed attack steps.

Overview of the Attack

Suppose that we are given a target n-bit preimage value V and our goal is to find a message M such that H 1 (M ) ⊕ H 2 (M ) = V . Although the formal problem does not restrict M in any way, several concrete hash functions restrict the length of M . Therefore, we will first assume that the size of M is bounded by a parameter L.

The attack is composed of three main phases. ) and ending with state pair (x, ŷ), such that for each length κ in some appropriate range (which is roughly [n 2 , L]), there is a message M κ of κ blocks that maps (IV 1 , IV 2 ) to (x, ŷ). -Phase 2: Find a set S (of size 2 s ) of tuples of the form ((x, y), w) such that w is a single block, (x, y)

w -→ (a, b), and h 1 (a, pad) ⊕ h 2 (b, pad) = V
, where pad is the final block of the (padded) preimage message of length L. Moreover, (x, y) has a special property that will be defined in the detailed description of this phase.

-Phase 3: Start from (x, ŷ) and compute a message fragment M q of length q (shorter than L -2) such that (x, ŷ)

M q ---→ (x, ȳ) for some ((x, ȳ), m) ∈ S. For this tuple, denote (ā, b) h 1,2 ((x, ȳ), m).
Finally, we pick a message of Lq -2 blocks from M SEM , denoted by

M L-q-2 , giving (IV 0 , IV 1 ) M L-q-2
------→ (x, ŷ), and concatenate M L-q-2 M q m in order to reach the state pair (ā, b) from (IV 1 , IV 2 ) with a message of length L -1. Indeed, we have

(IV 0 , IV 1 ) M L-q-2 ------→ (x, ŷ) M q ---→ (x, ȳ) m -→ (ā, b).
Altogether, we obtain the padded preimage for the XOR combiner: M = M L-q-2 M q m pad.

IV 1 M SEM x IV 2 M SEM ŷ H 1 H 2 ⊕ = V m p a d m p a d x ȳ x 0 m y 0 m [m] q-1 [m] q-1 M L-q-2 M L-q-2 -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6
Complexity Analysis. Denote L = 2 . For parameters g 1 ≥ max(n/2, n -) and s ≥ 0, the complexity of phases of the attack (as computed in their detail description) is given below (ignoring constant factors).

Phase 1: 2 + n 2 • 2 n/2
Phase 2: 2 n+s-g 1 Phase 3:

2 3g 1 /2-s/2 + L • 2 9g 1 /2-2n-3s/2 + L • 2 2g 1 -n = 2 3g 1 /2-s/2 + 2 +9g 1 /2-2n-3s/2 + 2 +2g 1 -n
We balance the time complexities of the second phase and the first term in the expression of the third phase by setting n + s -

g 1 = 3g 1 /2 -s/2, or s = 5g 1 /3 -2n/3
, giving a value of 2 n/3+2g 1 /3 for these terms. Furthermore, + 9g 1 /2 -2n -3s/2 = + 2g 1n, and the time complexity expression of Phase 3 is simplified to be 2 n/3+2g 1 /3 + 2 +2g 1 -n . Since g 1 is a positive factor in all the terms, we optimize the attack by picking the minimal value of g 1 under the restriction g 1 ≥ max(n/2, n -). In case ≤ n/2, we set g 1 = n -and the total time complexity of the attack20 is

2 n/3+2(n-)/3 = 2 n-2 /3 .
The optimal complexity is 2 2n/3 , obtained for messages of length 2 n/2 (see Fig. 12 for a trade-off curve).

Details of the Preimage Attack on XOR Combiners using Deep Iterates

Details of Phase 1 can be found in Sect.2.6. In the following, we describe details of the other two phases.

Details of Phase 2: Finding a Set of Target State Pairs.

In the second phase, we fix an arbitrary message block m, giving rise to the functional graphs

FG f 1 and FG f 2 defined by the random mappings f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m).
Given parameters g 1 ≥ n/2 and s ≥ 0, our goal is to compute a set S (of size 2 s ) of tuples of the form ((x, y), w), where w is a single block such that for each tuple, the following hold:

1. The state x is a 2 n-g 1 -th iterate in FG f 1 , and y is a 2 n-g 1 -th iterate in FG f 2 . 2. (x, y) w -→ (a, b) and h 1 (a, pad) ⊕ h 2 (b, pad) = V ,
where pad is a final block of the (padded) preimage message of length L.

This algorithm resembles the algorithm used in the final phase in previous interchange-structure-based preimage attack (Attack 1 in Sect. 3), as both look for state pairs (x, y) that give h 1 (x, w pad) ⊕ h 2 (y, w pad) = V (for some message block w). The difference is that in previous interchange-structure-based attack, (x, y) is an arbitrary endpoint pair of the interchange structure, while in this case, we look for x and y that are deep iterates.

Phase 2 of Attack 2: Finding a set of target state pairs

1. Fix an arbitrary single-block value m, and construct

f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m).
2. Expand FG f 1 using Alg. 5 with parameter g 1 . Store all encountered 2 n-g 1 -th iterates in a table T 1 . 3. Expand FG f 2 using Alg. 5 with parameter g 1 . Store all encountered 2 n-g 1 -th iterates in a table T 2 . 4. Allocate a set S = ∅. For single-block values w = 0, 1, . . ., perform the following steps until S contains 2 s elements: (a) For each node x ∈ T 1 evaluate h 1 (x, w pad), and store the results in a table T 1 , sorted according h 1 (x, w pad). (b) For each node y ∈ T 2 evaluate h 2 (y, w pad)⊕V , and look for matches

h 2 (y, w pad) ⊕ V = h 1 (x, w pad) with T 1 .
For each match, add the tuple ((x, y), w) to S.

The time complexity of steps 2 and 3 is approximately 2 g 1 . The time complexity of step 4.(a) and step 4.(b) is also bounded by 2 g 1 . We now calculate the expected number of executions of Step 4 until 2 s matches are found and inserted into S.

According to Observation 1 in Sect. 2.7, the expected size of T 1 and T 2 (the number of deep iterates) is close to 2 g 1 . Thus, for each execution of Step 4, the expected number of matches on n-bit values h 2 (y, w pad)

⊕ V = h 1 (x, w pad) is 2 2g 1 -n . Consequently,
Step 4 is executed 2 s+n-2g 1 times in order to obtain 2 s matches. Altogether, the total time complexity of this step is

2 n+s-2g 1 +g 1 = 2 n+s-g 1 .
Details of Phase 3: Hitting a Target State Pair. In the third and final phase, we start from (x, ŷ) and compute a message M q of length q (is valid as long as shorter than L -2) such that (x, ŷ)

M q ---→ (x, ȳ) for some ((x, ȳ), m) ∈ S.
We use in a strong way the fact that states x (and ȳ) in S are deep iterate (of depth 2 n-g 1 ) in FG f 1 (and FG f 2 ).

The goal of this phase is to find a pair of starting points of chains, reaching some ((x, ȳ), m) ∈ S at same distance. This phase is carried out by picking an arbitrary starting message block m, which gives points x 0 = h 1 (x, m) and

y 0 = h 2 (ŷ, m).
We then continue to evaluate the chains x i+1 = h 1 (x i , m) and y j+1 = h 2 (y j , m) up to length at most L -3. We hope to encounter x at some distance q -1 from x 0 and to encounter ȳ at the same distance q -1 from y 0 , where ((x, ȳ), m) ∈ S. In case in which for all pairs of ((x, ȳ), m) ∈ S, x and ȳ are encountered at different distances in the chains, or at least one of them is not encountered at all, we pick a different value for m and start again. Once we find such a value for m and pair of iterates (x, ȳ), this gives the required M q m [m] q-1 .

According to Observation 2 in Sect. 2.7, for a pair of 2 n-g 1 -th iterates x and ȳ, the probability that they will be encountered at the same distance from arbitrary starting points x 0 and y 0 of chains is (2 n-g 1 ) 3 • 2 -2n = 2 n-3g 1 . Since S contains 2 s elements, the probability calculation yields the conclusion that we need to compute about 2 3g 1 -n-s chains from different starting points to find such a value for m generating starting points (x 0 , y 0 ) reaching a pair of deep iterates (x, ȳ) in S at the same distance.

The next question which we address is to what maximal length L should we evaluate chains x and y. As we wish to reach iterates x and ȳ of depth 2 n-g 1 , it can be shown that L = 2 n-g 1 is optimal. Since the total chain length should be less than L -3, this impose the restriction

L = 2 n-g 1 < L -3, or 2 g 1 < 2 n /L.
The naive algorithm described above performs about 2 3g 1 -n-s trials, where each trial evaluates chains of length L = 2 n-g 1 from arbitrary points, giving a total time complexity of approximately 2 3g 1 -n-s+n-g 1 = 2 2g 1 -s . Since g 1 ≥ n/2, the time complexity of this phase is at least 2 n-s , and after making a balance with that of the Phase 2, the time complexity can be 2 3n/4 by setting s = n/4.

However, it is possible to optimize this naive algorithm by further expanding the graphs of f 1 and f 2 . As a result, the evaluated chains are expected to collide with the graphs sooner (before they are evaluated to the full length of 2 n-g 1 ). Once a collision occurs, we use a look-ahead procedure to calculate the distance of the chain's starting point from x (or ȳ) in each tuple ((x, y), w) ∈ S. This look-ahead procedure resembles the one used in attacks on hash-based MACs [GPSW14,PW14] (although the setting and actual algorithm in our case are obviously different).

We define an S-node (for f 1 ) as a node x such that there exists a node y and a message block w such that ((x, y), w) ∈ S. An S-node for f 2 is defined in a similar way. To avoid heavy update operations for the distances from all the S-nodes, we use distinguished points. Essentially, each computed chain is partitioned into intervals according to distinguished points, where each distinguished point stores only the distances to all the S-nodes that are contained in its interval up to the next distinguished point. Given a parameter g 2 > g 1 , the algorithm for this phase is described below.

Phase 3 of Attack 2: Hitting a target state pair

1. Develop (about) 2 g 2 nodes in FG f 1 (and FG f 2 ) (as specified in Alg. 5)
with the following modifications.

-Store only distinguished points for which the ng 2 LSBs are zero.

-Once an S-node is encountered, update its distance in the previously encountered distinguished point (which is defined with high probability a ). -Stop evaluating each chain once it hits a stored distinguished point.

-The evaluated distinguished points for f 1 (resp. f 2 ) are stored in the data structure G 1 (resp. G 2 ).

2. For single-block values m = 0, 1, . . ., compute x 0 = h 1 (x, m) and y 0 = h 2 (ŷ, m) and repeat the following step: (a) Compute chains x and y as specified below.

-First, compute the chains in a standard way by evaluating the compression functions h 1 and h 2 until they hit stored distinguished points in G 1 and G 2 (respectively). -Then, allocate a table T 1 for f 1 (and T 2 for f 2 ) and continue traversing (only) the distinguished points of the chain (using the links in G 1 and G 2 ) up to depth L-2, while updating T 1 (resp. T 2 ): for each visited distinguished point, add all its stored S-nodes to T 1 (resp. T 2 ) with its distance from x 0 (resp. y 0 ). -Once the maximal depth L -2 is reached, sort T 1 and T 2 . Search for nodes x and ȳ that were encountered at the same distance q-1 from x 0 and y 0 (respectively), such that ((x, ȳ), m) ∈ S. If such x ∈ T 1 and ȳ ∈ T 2 exist, return the message M q = m [m] q-1 and m (retrieved from S) as output. Otherwise (no such x and ȳ were found), return to Step 2.

a Since g 2 > g 1 , S-nodes are deeper iterates than distinguished points, and thus distinguished points are likely to be encountered in an arbitrary chain before an S-node.

The time complexity of Step 1 is approximately 2 g 2 (note that we always perform a constant amount of work per developed node).

For time complexity of Step 2, the analysis is as follows. As concluded above, the expected number of values for m we need to test until we find a pair of starting point (x 0 , y 0 ) of chains encounter at the same distance to a pair of 2 n-g 1 -th iterates (x, ȳ) in S is approximately 2 3g 1 -n-s .

The analysis of the complexity of Step 2.(a) is as follows. First, we estimate the expected number of nodes that we visit during the computation of a chain. Initially, we compute approximately 2 n-g 2 nodes until we hit stored distinguished points. Then, we continue by traversing (only) distinguished points up to depth of about L. The expected number of such points is L • 2 g 2 -n . Therefore, we expect to visit approximately 2 n-g 2 + L • 2 g 2 -n nodes while computing a chain. Finally, we need to account for all the S-nodes encountered while traversing the chains of depth L. Basically, there are 2 s S-nodes which are iterates of depth 2 n-g 1 , (essentially) randomly chosen in Phase 2 out of approximately 2 g 1 such deep iterates. As a result, the probability of such a deep iterate to be a S-node is approximately 2 s-g 1 (while other nodes have probability 0). Therefore, while traversing chains of depth L, we expect to encounter at most L • 2 s-g 1 S-nodes (which is a bound on the sizes of T 1 and T 2 ). Altogether, the expected time complexity of a single execution of Step 2.(a) is at most

2 n-g 2 +L•2 g 2 -n +L•2 s-g 1 .
The total time complexity of this phase is 2

g 2 + 2 3g 1 -n-s • (2 n-g 2 + L • 2 g 2 -n + L•2 s-g 1 ) = 2 g 2 +2 3g 1 -g 2 -s +L•2 3g 1 +g 2 -2n-s +L•2 2g 1 -n . We set g 2 = 3g 1 /2-s/2
which balances the first two terms and gives a time complexity of

2 3g 1 /2-s/2 + L • 2 9g 1 /2-2n-3s/2 + L • 2 2g 1 -n .
The time complexity evaluation of the full attack at the beginning of this section shows that for the optimal parameters of this attack, the extra two terms

L • 2 9g 1 /2-2n-3s/2 + L • 2 2g 1 -n
are negligible compared to the other terms in the complexity equation. In other words, the distinguished points method allowed us to resolve with no overhead the complication of keeping track of distances from the S-nodes.

Optimizing the Deep-Iterates-Based Preimage Attack on XOR Combiners using the Interchange Structure

The above deep-iterates-based preimage attack on XOR combiners can be slightly improved using an interchange structure. Recall that the interchange structure helps to break the dependency between two hash computations on a common message. When building a 2 r -interchange structure starting from the pair of endpoints (x, ŷ) of the simultaneous expandable message and ending at two sets of states

A = {A 1 , A 2 , . . . , A 2 r } and B = {B 1 , B 2 , . . . , B 2 r }, any A i ∈
A can make a pair with any B j ∈ B (for any such a pair, one could easily find a common message mapping (x, ŷ) to this pair). Therefore, by using a single message block m to generate two sets of 2 r random starting nodes respectively from A and B, we can get 2 2r pairs of starting nodes. As a result, the required number of samplings on the random massage block m is reduced by a factor of 2 2r . The detailed complexity analysis of the attack using a 2 r -interchange structure is as follows: Denote L = 2 . For parameters g 1 ≥ max(n/2, n -), g 2 ≥ 0, s ≥ 0 and 0 ≤ r ≤ /2 (because the length 2 2r of the interchange structure should be less than the message length 2 ), the complexity of phases of the attack is given below (ignoring constant factors).

Phase 1: 2 + n 2 • 2 n/2
Phase 2: 2 n+s-g 1 Phase 3:

2 g 2 + 2 3g 1 -n-s-2r • 2 r • (2 n-g 2 + 2 +g 2 -n + 2 +s-g 1 ) + 2 n/2+2r = 2 g 2 + 2 3g 1 -g 2 -s-r + 2 3g 1 +g 2 + -2n-s-r + 2 2g 1 + -n-r + 2 n/2+2r
Compared with the complexity of the attack in Sect.4.1, the difference lies in Phase 3. In the complexity formula of Phase 3, the term 2 g 2 is the number of nodes developed in the look-ahead procedure; the term 2 3g 1 -n-s-2r is the required number of samplings on the value of message block m to get pairs of starting nodes, which is reduced by a factor of 2 2r when building a 2 r -interchange structure; the term 2 r • (2 n-g 2 + 2 +g 2 -n + 2 +s-g 1 ) is the time complexity for computing distances of pairs of starting nodes (generated using the same value for m) from all 2 s target nodes; the term 2 n/2+2r is the time complexity for building the 2 r -interchange structure. We first balance the first two terms in Phase 3 by setting

g 2 = 3g 1 -g 2 - s -r, which gives g 2 = 3g 1 /2 -s/2 -r/2.
Thus, the complexity of Phase 3 38 becomes 2 3g 1 /2-s/2-r/2 + 2 9g 1 /2-3s/2-3r/2+ -2n + 2 2g 1 + -n-r + 2 n/2+2r . We then balance Phase 2 and Phase 3 by setting n + s -

g 1 = 3g 1 /2 -s/2 -r/2, which gives s = 5g 1 /3 -r/3 -2n/3.
The sum of all dominant terms turns to be 2 + 2 n/3+2g 1 /3-r/3 + 2 2g 1 + -n-r + 2 n/2+2r . Finally, we pick the minimal value of g 1 under the restriction g 1 ≥ max(n/2, n -). In case ≤ n/2, we set g 1 = n -. The sum of dominant terms turns to be 2

+ 2 n-2 /3-r/3 + 2 n--r + 2 n/2+2r . Considering n -2 /3 -r/3 > n --r always holds, the sum of dominant terms is 2 n-2 /3-r/3 + 2 n/2+2r .
Note that there is a restriction on r, that is, r ≤ /2. As a result (see Fig. 12 for a trade-off curve), -For the case ≤ 3n/11, we have n -2 /3r/3 > n/2 + > n/2 + 2r. We set r = /2 to optimize the complexity. Thus, the sum of dominant terms is 2 n-5 /6 . The optimal complexity is 2 17n/22 obtained for message of length 2 = 2 3n/11 . -For the case 3n/11 < ≤ n/2, we set r = 3n/14 -2 /7 to make a balance, which fulfils r < /2 in this case. The sum of dominant terms is 2 13n/14-4 /7 . The optimal complexity is 2 9n/14 obtained for message of length 2 = 2 n/2 .

Improved Preimage Attack on XOR Combiners Based on Multi-Cycles

When the underlying hash functions use the MD construction, and the maximum length of the message is allowed to exceed 2 n/2 blocks, we can further improve previous deep-iterates-based preimage attack. The idea is that we utilize more special nodes in function graphs, which are called cyclic nodes, and exploit a technique named multi-cycles as introduced in Sect. 2.7. Recall that, in the deep-iterates-based attack, a key step is to find two starting nodes x 0 and y 0 in functional graphs of f 1 and f 2 , such that they reach the selected target nodes x and ȳ at a common distance. We find that when selecting cyclic nodes as target nodes x and ȳ, the probability of a pair of random node (x 0 , y 0 ) reaching them at a common distance can be greatly amplified. Indeed, cyclic nodes are essentially special deep iterates that are located not only deep in the functional graph but also in a cycle of the graph. Therefore, for two cyclic nodes in two independent functional graphs, by looping around the cycles, some differences between distances from two random nodes to the two cyclic nodes can be corrected by the difference between the two cycle lengths. More precisely, if the members of a target node pair (x, ȳ) are both cyclic nodes within the largest components in two functional graphs, the probability of a random pair (x 0 , y 0 ) reaching (x, ȳ) at a common distance is amplified by #C times, the maximum number of cycles that can be used, by using the set of correctable distance bias as stated in Sect. 2.7. Moreover, such a probability amplification comes with almost no increase of complexity at Step 2, which leads to a new complexity trade-off between Steps 2 and 3. Thus, the usage of cyclic nodes and multi-cycles enables us to reduce the computational complexity of preimage attacks on the XOR combiner.

Overview of the Attack

Here, we briefly list the main steps of our preimage attack on the XOR combiner.

Attack 3: Preimage attack on the XOR combiner based on multicycles

-Phase 1: Build a simultaneous expandable message M SEM for H 1 and H 2 , starting from (IV 1 , IV 2 ) and ending with (x, ŷ). -Phase 2: Collect cyclic nodes within the largest components of functional graphs FG f 1 and FG f 2 and compute the set of correctable distance bias

D = {i • ∆L mod L 1 | i = 0, 1, . . . , #C},
where L 1 and L 2 are the cycle lengths of the largest components of FG f 1 and FG f 2 , respectively, and

∆L = L 2 -L 1 mod L 1 .
-Phase 3: Find a set S (of size 2 s ) of tuples of the form ((x, y), w) such that x and y are cyclic nodes located in the largest components of FG f 1 and FG f 2 , respectively, and (x, y)

w -→ (a, b) and h 1 (a, pad)⊕h 2 (b, pad) = V ,
where pad is the final block of the (padded) preimage message of length L, V is the target hash digest.

-Phase 4: Find a message fragment M Link that maps (x, ŷ) to a pair of target nodes (x, ȳ) for some ((x, ȳ), m) ∈ S.

That is done by first start from (x, ŷ), enumerate a message block m to find a pair of states (x 0 , y 0 ) with x 0 = h 1 (x, m) and y 0 = h 2 (ŷ, m), such that in FG f 1 and FG f 2 , their distance difference d 1d 2 mod L 1 from (x, ȳ) for some ((x, ȳ), m) ∈ S belongs to D. Suppose the common distance after correcting by the cycle lengths is

q d 1 +i•L 1 = d 2 +j•L 2 , and define a message fragment M Link m [m] q .
Up to now, we are able to derive a message M L-q-3 from the simultaneous expandable message M SEM with an appropriate length L-q -3 and produce a preimage message:

M M L-q-3 M Link m pad = M L-q-3 m [m] q m pad. such that (IV 1 , IV 2 ) M L-q-3 ------→ (x, ŷ) m [m] q -----→ (x, ȳ) m pad -----→ (H 1 (M ), H 2 (M )) : H 1 (M ) ⊕ H 2 (M ) = V 40 150 Symmetric Cryptanalysis Beyond Primitives IV 1 M SEM x IV 2 M SEM ŷ H 1 H 2 L 1 L 2 loop ⊕ = V m p a d m p a d x ȳ loop x 0 m y 0 m [m] d1 [m] d2 M L-q-3 M L-q-3 -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6
By balancing the complexities of these steps, we obtain an optimal complexity of 2 5n/8 .

Details of the Preimage Attack on the XOR Combiner Using Multi-Cycles

In this section, we present the completed description of the attack procedure and complexity evaluation. We point out the length of our preimage is at least 2 n/2 blocks due to the usage of (multi-) cycles.

Attack Procedure. Denote by V the target hash digest. Suppose the attacker is going to produce a preimage message with a length L. The value of L will be discussed later. The attack procedure is described below.

Detailed Steps of Attack 3

1. Build a simultaneous expandable message structure M SEM with a range of length being roughly [n 2 , L], starting from the initial state pair (IV 1 , IV 2 ) and ending with a pair of final state (x, ŷ) such that for each positive integer κ of an integer interval, there is a message M κ with a block

length κ in M SEM such that (IV 1 , IV 2 ) M κ ---→ (x, ŷ). 2. Fix a single-block message m, and construct f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m).
(a) Run the cycle search algorithm several times to find the cycle length L 1 (resp. L 2 ) and cyclic nodes within the largest components in FG f 1 (resp. FG f 2 ). Store all the cyclic nodes in a table T 1 (resp. T 2 ), denote

T 1 = {x 1 , x 2 , . . . , x L 1 } (resp. T 2 = {y 1 , y 2 , . . . , y L 2 }). Without loss of generality, assume L 1 ≤ L 2 . (b) Compute #C = L/L 1
as the maximum number of cycles that can be used to correct the distance bias. Compute ∆L = L 2 mod L 1 , and then compute the set of correctable distance bias:

D = {i • ∆L mod L 1 | i = 0, 1, 2, . . . , #C}. 3. Find a set S = {((x 1 , ȳ1 ), m1 ), ((x 2 , ȳ2 ), m2 )}, • • • , ((x 2 s , ȳ2 s ), m2 s )
such that xi and ȳi are cyclic nodes respectively located in the largest components of FG f 1 and FG f 2 , and

(x i , y i ) w -→ (a i , b i ) and h 1 (a i , pad) ⊕ h 2 (b i , pad) = V ,
where pad is the final block of the (padded) preimage message of length L, V is the target hash digest. The search procedure is described as follows.

(a) Initialize a set S as empty. (b) Select a random single-block message w. (c) Compute h * 1 (x, w pad) for each cyclic node x in T 1 , and store them in a table T 1 . (d) Similarly, for each cyclic node y in T 2 , compute h * 2 (y, w pad) ⊕ V , and look for matches with elements in T 1 . If it is matched to some

h * 1 (x, w pad), we have h * 2 (y, w pad) ⊕ h * 1 (x, w pad) = V , store ((x, y), w) in S.
(e) If S contains less than 2 s elements, goto Step 3b and repeat the search procedure. Hereafter, we call the pair of nodes (x i , ȳi ) in ((x i , ȳi ), mi ) ∈ S a pair of target nodes. 4. Run Alg.5 with a parameter t to develop 2 t nodes in FG f 1 (resp. FG f 2 ), and store them in a data structure G 1 (resp. G 2 ). Moreover, (a) Store at each node its distance from a particular target node (say target node x1 (resp. ȳ1 ), together with its distance from the cycle (i.e., its height, similar to Phase 3 in Section 5 of [START_REF] Peyrin | Generic Universal Forgery Attack on Iterative Hash-Based MACs[END_REF]). (b) Store the distance of other target nodes xi (resp. ȳi ) to this particular target node x1 (resp. ȳ1 ) in a table T x (resp. T y ) by iterating f 1 (resp.

f 2 ) along the cycle. (c) Thus, when the distance of a node from the particular target node and that from the cycle is known from G 1 (resp. G 2 ), the distances of this node from all the other target nodes can be immediately deduced from T x (resp. T y ). Specifically, suppose the distance of a node x 0 from x1 is d 1 and its height is e 1 , and suppose the distance of a target node xi from x1 is

d i ; then, the distance of x 0 from xi is d 1 -d i if d i ≤ (d 1 -e 1 )
, and L 1 -

d i + d 1 if d i > (d 1 -e 1 )
. 5. Find a message M Link that maps (x, ŷ) to a pair of target nodes (x, ȳ) for some ((x, ȳ), m) ∈ S. We search for such a linking message among a set of special messages:

M Link = m m m • • • m,
where m is a random single-block message, and m is the fixed message at Step 2. The search procedure is as follows.

42

(a) Select a random message block w, and compute x 0 = h 1 (x, w) and

y 0 = h 2 (ŷ, w). (b)
Compute a chain by iteratively applying f 1 (resp. f 2 ) to update x 0 (resp. y 0 ) until either of the following two cases occurs.

-The chain length reaches 2 n-t . In this case, goto Step 5a; -The chain encounters a node stored in G 1 (resp. G 2 ). In this case, compute the distance of x 0 (resp. y 0 ) to every target node xi (resp. ȳi ) as described in Step 4c, and denote it as d xi (resp.

d ȳi ). Examine whether (d xi -d ȳi mod L 1 ) is in D. If it is, set d 1 d xi and d 2 d ȳi , derive the corresponding j and k such that d 1 + j • L 1 = d 2 + k • L 2 holds. Set q d 1 + j • L 1 = d 2 + k • L 2 , and then M Link m [m] q .
Besides, set m w and m mi . Otherwise, goto Step 5a. 6. Derive a message M L-q-3 with a block length of Lq -3 from the expandable message M SEM . 7. Produce a preimage M of the target hash digest V as follows:

M M L-q-3 M Link m pad = M L-q-3 m [m] q m pad.
Complexity Analysis. For parameters L ≥ 2 n/2 , s ≥ 0 and t ≥ 0, the complexity of the steps of the attack is given below (ignore the constant and polynomial factors for simplicity of description).

• Step 1: L + n 2 • 2 n/2 (refer to Sect. 2.6); • Step 2: 2 n/2 + L/L 1 ≈ 2 n/2 + 2 -n/2 • L ≈ 2 n/2 ;
• Step 3: 2 s+n/2 ; One execution of the search procedure has a complexity of L 1 + L 2 , and contributes to

L 1 • L 2 pairs. As L 1 • L 2 = Θ(2 n
), one tuple can be obtained by a constant number of executions. Hence, the number of necessary executions is Θ(2 s ), and the complexity of this step is Θ(2 s+n/2 ).

• Step 4:

2 t + 2 n/2 ;
The complexity of developing 2 t nodes and computing their distance to a particular target node is 2 t (refer to Alg. 5 and Step 4a ). The complexity to compute the distance of all the other target nodes to the particular target node is upper bounded by 2 n/2 (refer to the expectation of the maximum cycle length in Thm. 3). Hence, the complexity of this step is 2 t + 2 n/2 .

• Step 5: 2 2n-t-s /L; One execution of the search procedure requires a time complexity of 2 n-t . Clearly, a constant factor of both chains encounter nodes stored in G 1 and G 2 .

We mainly need to evaluate the probability of deriving a common distance for each chain. For every pair of target nodes (x i , ȳi ), the value of

d x i -d y i is equal to a correctable distance bias in D with a probability of #C • 2 -n/2 ≈ L • 2 -n .
Since there are 2 s pairs of target nodes, the success probability of each chain is L • 2 s-n . Hence, the total number of chains is 2 n-s /L, and the complexity of this step is 2 n-t • 2 n-s /L = 2 2n-t-s /L.

• Steps 6 and 7: O(L).

The overall complexity is computed as (denote

L = 2 ) 2 + 2 s+n/2 + 2 t + 2 t + 2 n/2 + 2 2n-t-s-,
where the complexity of Step 2 is ignored. Now, we search for parameters t and s that give the lowest complexity. First, we balance Step 3 and Step 4 by setting s + n/2 = t. That gives s = tn/2. The complexity becomes (ignoring constant factors) 2 + 2 t + 2 5n/2-2t-. We then make a balance by setting t = 2n -2t + n/2 -, i.e., t = 5n/6 -/3. Thus, the total complexity becomes 2 + 2 5n/6-/3 .

Hence,

for the case n/2 ≤ ≤ 5n/8, the final complexity is 2 5n/6-/3 ; for the case 5n/8 < , the final complexity is 2 .

The optimal complexity is 2 5n/8 , obtained for messages of length 2 5n/8 (see Fig. 12 for a trade-off curve).

Optimizing the Multi-Cycles-Based Preimage Attack on the XOR Combiner Using the Interchange Structure

Again, similar to the previous deep-iterates-based preimage attack, this multicycles-based preimage attack on the XOR combiner can also be improved using an interchange structure. The complexity of the attack using a 2 r -interchange structure is analysed as follows.

Denote L = 2 . For parameters t ≥ n/2, ≥ n/2 and 0 ≤ r ≤ /2 (because the length 2 2r of the interchange structure should be no larger than the message length L = 2 ), the complexity of each step is as follows:

Step 1: 2 + n 2 • 2 n/2 Step 2: 2 n/2 + 2 -n/2
Step 3:

2 s+n/2
Step 4:

2 t + 2 n/2
Step 5:

2 n-t+r • 2 n-s-2r-+ 2 n/2+2r
Step 6: 2

The sum of dominant terms is

2 + 2 s+n/2 + 2 t + 2 2n-t-s-r-+ 2 n/2+2r .
We first balance the last four terms by setting s

+ n/2 = t = 2n -t -s -r -=
n/2 + 2r. Thus, t = 11n/14 -2 /7, s = 2n/7 -2 /7, and r = n/7 -/7. Note that for ≥ n/2, we have n/7 -/7 ≤ n/14 < n/2. Thus, the restriction r ≤ /2 always holds in this setting. The total complexity turns to be 2 + 2 11n/14-2 /7 .

Hence, 44 154 Symmetric Cryptanalysis Beyond Primitives for the case n/2 ≤ ≤ 11n/18, the final complexity is 2 11n/14-2l/7 ; for the case 11n/18 < , the final complexity is 2 .

The optimal complexity is 2 11n/18 , obtained for messages of length 2 11n/18 (see Fig. 12 for a trade-off curve).

Second-Preimage Attack on Concatenation Combiners Based on Deep Iterates

In this section, we introduce the first second-preimage attack faster than 2 n on concatenation combiners of MD hashes.

In this attack, we are given a challenge message M = m 1 m 2 . . . m L , and our goal is to find another message M such that

H 1 (M ) H 2 (M ) = H 1 (M ) H 2 (M ) (or equivalently H 1 (M ) = H 1 (M ) and H 2 (M ) = H 2 (M )).
We denote the sequence of internal states computed during the invocation of

h 1 (respectively, h 2 ) on M by a 0 , a 1 , . . . , a L (respectively, b 0 , b 1 , . . . , b L ).
The general framework of our attack is similar to the one of the long message second-preimage attack on a single MD hash proposed by Kelsey and Schneier and described in Sect.2.2. Namely, we first compute the sequences of internal states a 1 , . . . , a L and b 1 , . . . , b L by applying the compression functions h 1 and h 2 on the challenge message M = m 1 . . . m L . Our goal is then to "connect" to one of the state pairs (a i , b i ) using a different message prefix of the same size. Once we manage to achieve this, we can reuse the same message suffix as in M and obtain a second preimage.

There are two main challenges in this approach, where the main challenge is to connect to some state pair (a i , b i ) generated by M from a different message. The secondary challenge is to ensure that the connected message prefixes are of the same length. We overcome the secondary challenge by building a simultaneous expandable message for two Merkle-Damgård hash functions, as described in Sect. 2.6.

A much more difficult challenge is to actually connect to the challenge message on a state pair (a i , b i ) from a different message of arbitrary (smaller) length. Indeed, the obvious approach of attempting to reach an arbitrary 2n-bit state pair by trying random messages requires more than 2 n time, since the number of target state pairs is equal to the message length which is smaller than 2 n . A more promising approach is to use the interchange structure introduced in Sect.3. Recall that, the interchange structure consists of an initial state pair (a, b), a set of message fragments M and two sets of internal states A (for H 1 ) and B (for H 2 ) such that for any value A ∈ A and any value B ∈ B, it is possible to efficiently construct a message M A,B ∈ M that maps (a, b) to (A, B). Assume that there exists an index i ∈ {1, 2, . . . , L} such that a i ∈ A and b i ∈ B; then, we can connect to (a i , b i ) using M a i ,b i as required. Unfortunately, this does not result in an efficient attack, essentially because the complexity of building an interchange structure for sufficiently large sets A and B is not efficient enough.

Here, as in the deep-iterate-based preimage attack on XOR combiner, we use deep iterates in functional graphs of

f 1 (•) h 1 (•, m) and f 2 h 2 (•, m) (as a
result, it is not applicable when any one of the underlying hash functions are of the HAIFA framework). More specifically, our goal is to find a state pair (a p , b p ) composed of two deep iterates in FG f 1 and FG f 2 , respectively. 21 Once we find such a "special" state pair, we show how to simultaneously reach both of its states in an efficient manner from an arbitrary state pair. Combined with the simultaneous expandable message, this gives the desired second preimage. Next, as in previous attack, we start by providing a high-level overview of the attack and then give technical details.

Overview of the Attack

The attack is composed of three main phases.

Attack 4: Second-preimage attack on the concatenation combiner based on deep iterates

-Phase 1: Build a simultaneous expandable message M SEM for H 1 and H 2 as described in Sect.2.6, starting from the initial state pair (IV 1 , IV 2 ) and ending at a final state pair (x, ŷ).

-Phase 2: Find a pair of states (x, ȳ), a message block m and an index p such that (x, ȳ) m -→ (a p , b p ) (note that the state pair (a p , b p ) is computed during the evaluation of the challenge message). Moreover, the state pair (x, ȳ) should have the special property that will be defined in the detailed description of this phase.

-Phase 3: Start from (x, ŷ) and compute a message fragment M q (shorter than p -1) such that (x, ŷ) M q ---→ (x, ȳ). This phase can be performed efficiently due to the special property of (x, ȳ).

To compute the second preimage, we pick M p-q-1 from the simultaneous expandable message M SEM , giving (IV 0 , IV 1 )

M p-q-1
------→ (x, ŷ), and concatenate M p-q-1 M q m in order to reach the state pair (a p , b p ) from (IV 1 , IV 2 ) with a message of appropriate length p. Indeed, we have

(IV 0 , IV 1 ) M p-q-1 ------→ (x, ŷ) M q ---→ (x, ȳ) m -→ (a p , b p ).
Altogether, we obtain the second preimage:

M = M p-q-1 M q m m p+1 . . . m L . a 0 IV 1 b 0 IV 2 H 1 H 2 a 1 m 1 b 1 m 1 a 2 m 2 b 2 m 2 a p-1 b p-1 a p m p b p m p a L-1 b L-1 a L m L b L m L IV 1 M SEM x IV 2 M SEM ŷ m m x ȳ x 0 m y 0 m [m] q-1 [m] q-1 M p-q-1 M p-q-1 -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6
Complexity Analysis. Denote L = 2 . For a parameter g 1 ≥ max(n/2, n -), the complexity of the phases of the attack (as computed in their detail description) is given below (ignoring constant factors).

Phase 1: L + n 2 • 2 n/2 = 2 + n 2 • 2 n/2
Phase 2:

1/L • 2 2n-g 1 = 2 2n-g 1 - Phase 3: 2 3g 1 /2
We balance the second and third phases by setting 2ng 1 -= 3g 1 /2, or 2n-) . This trade-off holds as long as 2 + n 2 • 2 n/2 ≤ 2 3/5(2n-) , or ≤ 3n/4. The optimal complexity is 2 3 /4 , obtained for = 3n/4 (see Fig. 12 for a trade-off curve). The attack is faster than 2 n (Joux's preimage attack) for 22 > n/3. The message range for which the attack is faster than 2 n can be slightly improved to L ≥ 2 2n/7 using the optimized attack, described in Sect. 6.3.

g 1 = 2/5 • (2n -), giving time complexity of 2 3/5•(

Details of the Second-Preimage Attack on Concatenation Combiners using Deep Iterates

Details of Phase 1 can be found in Sect. 2.6.

Details of Phase 2:

Finding a Target State Pair. In the second phase, we fix an arbitrary message block m, giving rise to the functional graph FG f 1 of a More precisely, due to the minimal-length restriction of the expandable message, matches x = a i with i less than (approximately) C2 ≈ n 2 cannot be exploited in the full attack. Moreover, the maximal exploitable value of i is L -2. However, the fraction of these nodes is very small and can be ignored in the complexity analysis.

f 1 (•) h 1 (•, m) and FG f 2 of f 2 (•) h 2 (•,
The time complexity of steps 2 and 3 (which execute the Alg. 5) is approximately 2 g 1 . The time complexity of step 4.(a) and step 4.(b) is also bounded by 2 g 1 (given that a 1 , . . . , a L and b 1 , . . . , b L are sorted in memory), as the size of T 1 and T 2 is at most 2 g 1 and the number of matches found in each step can only be smaller.

We now calculate the expected number of executions of Step 4 until the required (a p , b p ) is found. According to Observation 1 in Sect. 2.7, the expected size of T 1 and T 2 (that contain iterates of depth 2 n-g 1 ) is close to 2 g 1 . According to the birthday paradox, the expected size of

T 1 is approximately L • 2 g 1 -n . Similarly, the number of matches y = b j is also approximately L • 2 g 1 -n . The probability of a match i = j in Step 4.(b) is computed using a birthday paradox on the L possible indexes, namely, 1/L • (L • 2 g 1 -n ) 2 = L • 2 2g 1 -2n . As a result,
Step 4 is executed approximately 1/L • 2 2n-2g 1 times until the required (a p , b p ) is found (the executions with different blocks m are essentially independent). Altogether, the total time complexity of this step is Details of Phase 3: Hitting the Target State Pair. In the third and final phase, we start from the pair of endpoints (x, ŷ) of the simultaneous expandable message constructed in Phase 1 and compute a message fragment M q of length q < p -1 such that (x, ŷ) M q ---→ (x, ȳ). Like in the deep-iterates-based preimage attack on the XOR combiner, here, we again use in a strong way the fact that the state x (and ȳ) is a deep iterate (of depth 2 n-g 1 ) in the functional graph of

f 1 (x) (f 2 (y)).
This phase is carried out by picking an arbitrary starting message block m, which gives points x 0 = h 1 (x, m) and y 0 = h 2 (ŷ, m). We then continue to evaluate the chains x i = h 1 (x i-1 , m) and y j = h 2 (y j-1 , m) up to a maximal length L = 2 n-g 1 . We hope to encounter x at some distance q -1 from x 0 and to encounter ȳ at the same distance q -1 from y 0 . Given that q -1 < p, this will give the required M = m [m] q-1 (where [m] q-1 denotes the concatenation of q -1 message blocks m), which is of length q < p -1. If x and ȳ are encountered at different distances in the chains, or at least one of them is not encountered at all, we pick a different value for m and start again.

Since x (resp. ȳ) is an iterate of depth 2 n-g 1 in FG f 1 (resp. FG f 2 ), it is an endpoint of a chain of states of length L = 2 n-g 1 (such a chain was computed in Phase 2). According to Observation 2, the probability that x and ȳ will be encountered at the same distance from arbitrary starting points x 0 and y 0 of chains is 2 n-3g 1 . The probability calculation gives rise to the conclusion that we need to compute approximately 2 3g 1 -n chains from different starting points. Each chain is of length up to L = 2 n-g 1 . This gives a total time complexity of about 2 3g 1 -n+n-g 1 = 2 2g 1 . Since g 1 ≥ n/2, the time complexity of the full algorithm is at least 2 n , and the attack is not faster than Joux's preimage attack.

To optimize the algorithm, as we did in the deep-iterates-based preimage attack, we use a look-ahead procedure by further expanding the graphs of f 1 and f 2 . The difference is that since we only select a single pair of deep iterate as the target, we do not use the distinguished point technique 23 24 . We pick a parameter g 2 > g 1 and execute the algorithm below.

Phase 3 of Attack 4: Hitting the target state pair

1. Develop 2 g 2 nodes in FG f 1 (and FG f 2 ) (as specified in Alg. 5) with the following modifications.

-Store at each node its distance from x in FG f 1 (or ȳ in FG f 2 ) (the maximal stored distance is L = 2 n-g 1 ): for each computed chain, once it hits a previously visited node in the graph, obtain its stored distance from x (or ȳ) and update it in all the computed nodes in the current chain up to the maximal value L = 2 n-g 1 . -If a chain does not hit x, then the distance of its nodes is undefined and stored as a special value ⊥. This special value is also used for nodes whose distance from x is greater than L . -The evaluated nodes for FG f 1 (FG f 2 ) are stored in a data structure

G 1 (G 2 ).
2. For single-block values m = 0, 1, . . ., compute x 0 = h 1 (x, m) and y 0 = h 2 (ŷ, m) and repeat the following step: (a) Compute the chains x and y up to maximal length L = 2 n-g 1 or until they hit G 1 and G 2 (respectively).

-If x (or y) does not hit G 1 (G 2 ), return to Step 2.

-Otherwise, once x ( y) hits G 1 (G 2 ), obtain the stored distance from x (ȳ) at the collision point. If the distance to x (or ȳ) is undefined, return to Step 2. -Compute the respective distances i and j of x 0 and y 0 from x and ȳ.

If i = j, return to Step 2. -Otherwise (i = j), denote q = i + 1. If q ≥ p -1, return to Step 2. -Otherwise (q < p -1), return the message M = m [m] i = m [m] q-1 as output. G 1 4 3 2 1 x ⊥ ⊥ ⊥ ⊥ 5 4 3 4 ⊥ ⊥ ⊥ x m x0(3) x1(2) G 2 4 3 2 1 ȳ ⊥ ⊥ ⊥ 4 3 2 ⊥ ⊥ ⊥ ⊥ ŷ m y0(3) y1(2) y2(1)
The time complexity of Step 1 is approximately 2 g 2 . As concluded above, in Step 2, we perform approximately 2 3g 1 -n trials on the value of m before finding two starting points x 0 and y 0 at the same distance from x and ȳ. According to the analysis of Sect. 2.7, each trial requires approximately 2 n-g 2 computation (before hitting G 1 and G 2 ). Therefore, the total time complexity of this phase is 2

g 2 + 2 3g 1 -n • 2 n-g 2 = 2 g 2 + 2 3g 1 -g 2 .
The complexity is minimized by setting g 2 = 3g 1 /2 which balances the two terms and gives a time complexity of

2 3g 1 /2 .
Finally, we note that the memory complexity of this algorithm can be optimized using distinguished points. A detailed way to achieve this has been presented in the closely related algorithm in Sect. 4.2. 50

Optimizing the Deep-Iterates-Based Second-Preimage Attack on Concatenation Combiners using an Interchange Structure

Similar to the deep-iterates-based preimage attack on the XOR combiner, this deep-iterates-based second-preimage attack can also be slightly improved using an interchange structure. The detailed complexity analysis of the attack using a 2 r -interchange structure is as follows: Denote L = 2 . For parameters g 1 ≥ max(n/2, n -), g 2 ≥ 0, and 0 ≤ r ≤ /2 (because the length 2 2r of the interchange structure should be less than the message length 2 ), the complexity of the phases of the attack is (ignoring constant factors)

Phase 1: 2 + n 2 • 2 n/2 Phase 2: 2 2n-g 1 - Phase 3: 2 g 2 + 2 3g 1 -n-2r • 2 r+n-g 2 + 2 n/2+2r = 2 g 2 + 2 3g 1 -g 2 -r + 2 n/2+2r
Compared with the complexity of the attack in Sect.6.1, the difference lies in Phase 3. In the complexity formula of Phase 3, the term 2 g 2 is the number of nodes developed in the look-ahead procedure; the term 2 3g 1 -n-2r is the required number of samplings on the random massage block m when trying to find a pair of starting nodes reaching the pair of 2 n-g 1 -th iterates (x, ȳ) at a common distance; the term 2 r+n-g 2 is the time complexity for computing the distances of a set of 2 r starting nodes (generated using the same value for m) from a target node; and the term 2 n/2+2r is the time complexity for building a 2 r -interchange structure.

We first balance the first two terms in Phase 3 by setting g 2 = 3g 1g 2r, which gives g 2 = 3g 1 /2r/2. The sum of all dominant terms is 2 + 2 2n-g 1 -+ 2 3g 1 /2-r/2 + 2 n/2+2r . For > 7n/17, we set 2ng 1 -= 3g 1 /2r/2 = n/2 + 2r, which gives g 1 = 19n/22 -5 /11 and r = 7n/22 -3 /11. The total complexity is then 2 + 2 25n/22-6 /11 . For > 25n/34, we have 25n/22 -6 /11 < . Thus, the time complexity is 2 for > 25n/34. Note that, g 1 = 19n/22 -5 /11 fulfils the restriction g 1 ≥ max(n/2, n -) for n/4 ≤ ≤ 4n/5, and r = 7n/22 -3 /11 fulfils the restriction 2r < l as long as > 7n/17. Thus, the time complexity is 2 25n/22-6 /11 for 7n/17 < ≤ 25n/34.

For ≤ 7n/17, we directly set r = /2 (the maximum under the restriction 2r < ) to optimize the complexity (because as shown next, the balanced sum 2 2n-g 1 -+ 2 3g 1 /2-r/2 is greater than 2 n/2+2r under the restrictions

g 1 ≥ max(n/2, n -), 2r < and ≤ 7n/17). The formula is 2 2n-g 1 -+ 2 3g 1 /2-/4 + 2 n/2+
. We balance the first two terms by setting 2ng 1 -= 3g 1 /2 -/4, from which we deduced that g 1 = 4n/5 -3 /10 (fulfills the restriction g 1 ≥ max(n/2, n -) as long as > 2n/7). Then, the complexity is 2 6n/5-7 /10 + 2 n/2+ . Since 6n/5 -7 /10 ≥ n/2 + for ≤ 7n/17, the total time complexity is then 2 6n/5-7 /10 . It is no less than 2 n for < 2n/7.

Thus, the final time complexity of this attack using interchange structure is summarized as follows:

-For the case < 2n/7, the complexity is 2 n achieved by Joux's attack; -For the case 2n/7 ≤ ≤ 7n/17, the complexity of this attack is 2 6n/5-7 /10 ; -For the case 7n/17 < ≤ 25n/34, the complexity of this attack is 2 25n/22-6 /11 ; -For the case > 25n/34, the complexity of this attack is 2 .

The optimal complexity is 2 25n/34 , obtained for messages of length 2 25n/34 (see Fig. 12 for a trade-off curve).

Second-Preimage Attack on the Zipper Hash

In this section, we present the first second-preimage attack on the Zipper hash, which is applicable for idealized compression functions and hence a generic attack. Again, the attack is based on the deep iterates and multi-cycles in the functional graphs defined by f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m) with a fixed single-block message value m. The general framework is similar to that of the above ones on combiners of MD hashes. However, some special specifications on the Zipper hash allow the attacker to choose an optimal configuration for the attack and to launch a more efficient connecting phase in the attack. More precisely, as opposed to the two parallel combiners, in the Zipper hash, the message length is placed in the middle of the two passes. Thus, when we first connect our crafted message to the challenge message on an internal state in the second pass, the message prefix of our crafted message is fixed. This prefix does not include the length padding. As a result, the length of our crafted message is not necessarily equal to the length of the challenge message. Thus, we can choose a proper length for our crafted message that optimizes the attack complexity. A further uniqueness of the Zipper hash is that its second pass processes the message blocks in a reversed order. Thus, in the attack, when looking for a pair of nodes (x, y) reaching two predefined nodes of deep iterates (x, ȳ) at a common distance, x and y are computed with different message blocks. This enables us to launch an efficient meet-in-the-middle procedure during the connecting phase. Accordingly, Joux's multi-collision (see Sect.2.1) is used to facilitate the meetin-the-middle procedure, and the previous simultaneous expandable message in Sect.2.6 is fine-tuned to adapt to the Zipper hash.

Overview of the Attack

Given a message M = m 1 • • • m L , the goal of the second-preimage attack on the Zipper hash is to find another message M such that

H 2 (H 1 (IV, M ), ← - M ) = H 2 (H 1 (IV, M ), ←- M ),
where ← -M is a message generated by reversing the order of message blocks of M (we call -Phase 4: Find a message M Link such that (x, ỹ)

← - M the reverse of M ), i.e., ← - M = m L m L-1 • • • m 1 ,
M Link ---→ (x, ȳ) a .
This is a meet-in-the-middle procedure. First, exploit the messages in the two Joux's multi-collisions M MC1 and M MC2 to map (x, ỹ) to two independent sets of starting nodes, compute and store their distances from target node x and ȳ in two tables T 1 and T 2 independently. Then, find a match between T 1 and T 2 (check whether the difference between some stored distances is correctable by values in D), denote the matched distances by d 1 and d 2 , set the common distance

d d 1 +i•L 1 = d 2 +j•L 2
for some i and j, and retrieve the corresponding messages M 2 ∈ M MC2 and M 1 ∈ M MC1 that generate the corresponding starting nodes.

At the end, select a message suffix M q with a proper block length q = Lp -2rd from the simultaneous expandable message M SEM and construct a second preimage M :

m 1 • • • m p M 2 [m] d M 1 M L -p-2r-d . a0 = IV H(M ) = b0 H1 H2 a1 m1 b1 m1 ap-1 bp-1 ap mp bp mp aL-2 bL-2 aL-1 mL-1 bL-1 mL-1 aL mL bL = aL mL x m ŷ m x MMC 2 M2 ȳ |G2| = 2 t MMC 2 r x |G1| = 2 t [m ] d 1 y [m ] d 2 x MMC 1 r ỹ MMC 1 M1 ẍ MSEM MSEM ÿ = h2(h1(ẍ, m L ), m L ) M q M q -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6 -Step 7 ∼ 8 -Step 9
a Rigorously, we should write

ỹ M Link ←---ȳ.
There are two main differences between the attack on the Zipper hash and the second-preimage attack on concatenation combiners (Attack 4) and the preimage attacks on XOR combiners (Attacks 2 and 3). One is that linking x to x and ỹ to ȳ can be carried out independently, resulting in a meet-in-the-middle-like effect. The other is that the message length is embedded inside the expandable message M SEM , which enables us to choose the length of second preimage to optimize the complexity.

Details of the Second-Preimage Attack on the Zipper Hash

In this subsection, we present the detailed procedure of Attack 5.

Detailed Steps of Attack 5

1. Fix an arbitrary single-block message value m and get

f 1 (•) = h 1 (•, m) and f 2 (•) = h 2 (•, m). (a)
, M 2 ) in T 1 and (d 2 , M 1 ) in T 2 such that (d 1 -d 2 mod L 1 ) ∈ D.
The search is a meet-in-the-middle procedure to match elements between T 1 and T 2 . Denote the common distance corrected by values in D by

d d 1 + i • L 1 = d 2 + j • L 2
for some i and j, and the corresponding messages M 1 M 1 and M 2 M 2 (retrieved from T 1 and T 2 ). 9. Derive a message M q with a block length

q = L -p -1 -r -d -r from M SEM , where L is the length of the constructed second-preimage. Construct a message M = m 1 m 2 • • • m p m M 2 [m] d M 1 M q
and output M as a second-preimage.

Complexity Analysis. The complexities of each step in this attack are as follows (ignoring constant factors and the factor n):

Step 1:

2 n/2
Step 2:

2 t
Step 3:

2 n/2
Step 4:

2 + 2 n/2+2 log 2 (n)+1
Step 5:

2 n- Step 6: 2 r • 2 n-t
Step 7:

2 r • 2 n-t
Step 8: 2 r

Step 9: 2

The sum of dominant terms is

2 t + 2 + 2 n-+ 2 r • 2 n-t ,
where 2 t is the complexity for developing more nodes in the look-ahead procedure; 2 is the complexity for building the simultaneous expandable message; 2 r • 2 n-t is the complexity for generating tables T 1 and T 2 .

We first balance the first term with the fourth term by setting t = r + nt, which gives t = n/2 + r/2. As a result, the sum of dominant terms is

2 n/2+r/2 + 2 + 2 n-.
-When the allowed length L of the second preimage is limited by 2 n/2 , we set = n/2 to optimize the complexity. The multi-cycle technique is not applicable. The required number of samplings on pairs of starting nodes before finding one pair reaching any one of the 2 2r pairs of target nodes at a common distance is 2 2n-3n/2 . Thus, it is required that 2 2r = 2 2n-3n/2 = 2 n/2 . This gives r = n/4. The total complexity is then 2 5n/8 for all ≥ 3n/8. -When the allowed length L of the second preimage is not limited and can be greater than 2 n/2 , multi-cycles can be used. In this case, the required number of samplings on pairs of starting nodes before finding one pair reaching any one of the 2 2r pairs of target nodes at a common distance is 2 2n-3n/2-( -n/2) . Thus, 2 2r = 2 n-. This gives r = n/2 -/2. The total complexity is then 2 3n/4-/4 + 2 + 2 n-. We then balance the first two terms by setting 3n/4 -/4 = , which gives = 3n/5.

• For the case < 2n/5, the total complexity is 2 n-;

• For the case 2n/5 ≤ , the total complexity is stabilized at 2 3n/5 . (see Fig. 13 for trade-off curves).

Step 4: Constructing an Expandable Message

The constructing method is similar to that in Sect. 2.6, with slight modifications. Detailed steps and the method used are shown in Alg. 6, where C ≈ n/2+log(n): Algorithm 6: Building and using a simultaneous expandable message applicable to attacks on the Zipper hash

1. x 0 ← x 2. For i ← 1, 2, • • • , C -1 + t:
(a) Build a 2 C-1 standard Joux's multi-collision in h 1 starting from x i-1 , and denote its final endpoint by

sp i . (b) Compute xp i = h * 1 (sp i , [0] s )
, where [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] s is an all-zero message of size s blocks, where

s = i if i ≤ C -1 and s = C2 i-(C-1)-1 if C -1 < i ≤ C -1 + t. (c) Find a collision h 1 (sp i , m i ) = h 1 (xp i , m i ) with single block messages m i , m i . Denote the collision by x i . (d) We obtain a multi-collision in h 1 with 2 C messages that map x i-1 to x i . i. Out of
= C + i if i ≤ C -1 and b = C(2 i-(C-1)-1 + 1) if C -1 < i ≤ C -1 + t.

Denote the last collision state x C-1+t by ẍ, and compute

ÿ = h 2 (h 1 (ẍ, m L ), m L )
, where m L is a message block padded with the length L of the second preimage.

y

C-1+t ← ÿ, M SEMshort ← ∅, M SEMlong ← ∅. 5. For i ← C -1 + t, C -1 + t -1, . . . , 2, 1: (a) For each ms i ∈ M shorti , compute u i = h * 2 (y i , ← - ms i ) where ms i = ms i,1 ms i,2 • • • ms i,C-1 ms i,C and ← - ms i = ms i,C ms i,C-1 • • • ms i,1 . Store each pair (u i , ms i ) in a table U i indexed by u i . The final size of U i is 2 C-1 . (b) For each ml i ∈ M long i , compute v i = h * 2 (y i , ← - ml i ) where ml i = ml i,1 ml i,2 • • • ml i,s-1 ml i,s and ← - ml i = ml i,s ml i,s-1 • • • ml i,1 , where s = C(2 i-(C-1)-1 + 1) if C -1 < i ≤ C -1 + t and s = C + i if 1 ≤ i ≤ C -1. Store each pair (v i , ml i ) in a table V i indexed by v i . The final size of V i is 2 C-1 .

56

(c) Find a match u i = v i between U i and V i , and denote the matched state by y i-1 u i = v i . Combine the corresponding message fragment ms i indexed by y i with M SEMshort and ml i indexed by y i with M SEMlong , i.e., M SEMshort = ms i M SEMshort and M SEMlong = ml i M SEMlong . Then, the whole simultaneous expandable message M SEM can be fully defined by M SEMshort and M SEMlong . For any length κ lying in the appropriate range of [C(C -1)+tC, C 2 -1+C(2 t +t-1)], one can construct a message M κ mapping x to ỹ = y 0 through h 1 and h 2 by picking messages fragment either from M SEMshort or from M SEMlong as also described in Sect.2.6:

1. Select the length κ ∈ [C(C -1), C 2 -1] such that κ = κ mod C,
defining the first C -1 message fragment choices: selecting the message fragment

ms i in M SEMshort for 1 ≤ i ≤ C -1 and i = κ -C; selecting the message fragment ml i in M SEMlong for i = κ -C. 2. Compute kp ← (κ -κ )/C, which is an integer in the range of [t, 2 t + t -1]
, and select the final t message fragment choices as in a standard expandable message using the binary representation of kpt.

x 0 = x ỹ = y 0 sp1 C -1 1 C -1 1 + i x 1 m1 xp1 0 m 1 y 1 m1 m 1 0 sp2 C -1 1 C -1 2 + i x 2 m2 xp2 0 m 2 y 2 m2 m 2 0 C -1 [C(C -1), C 2 -1] spC-1+t C -1 1 C -1 C2 t-1 + 1 x C-1+t mC-1+t xpC-1+t 0 m C-1+t y C-1+t mC-1+t m C-1+t 0 t C[t, 2 t + t -1] [C(C -1) + tC, C 2 -1 + (2 t + t -1)C]-expandable message

Second-Preimage Attack on Hash-Twice

In this section, we present an efficient second-preimage attack on another cascade hash construction -Hash-Twice (a generalized specification HT (M )

H 2 (H 1 (IV, M ), M ))
. Similar to the previous second-preimage attack on Hash-Twice in [ABDK09], this attack builds a diamond structure for one hash function by exploiting messages in a long multi-collision built for the other hash function. Like all our previous functional-graph-based (deep-iterates-based and multi-cycles-based) attacks, it improves the attack from [ABDK09] because of the efficiency brought by exploiting the special nodes in the functional graphs. It follows the same structure as the second-preimage attack on the concatenation 57 combiner, but the result shows that attacking Hash-Twice can be much more efficient than attacking the concatenation combiner. That is mainly because the attack tries to connect to an n-bit internal state in the case of Hash-Twice, instead of a 2n-bit internal state in the case of the concatenation combiner. Note that similar to all previous functional-graph-based attacks, this attack applies when the underlying hash functions use the MD construction.

Overview of the Attack

Given a challenge message M = m 1 m 2 • • • m L , the goal of the secondpreimage attack on Hash-Twice is to find another message M such that -Phase 4: Find a message fragment M Link such that (x, ŷ)

H 2 (H 1 (IV, M ), M ) = H 2 (H 1 (IV, M ), M ).
M Link ---→ (x, ȳ) for some (x, ȳ) ∈ S.
This is done by first build a 2 r -interchange structure M IS starting from (x, ŷ). Denote its two sets of endpoints by X and Y. Then, for states in X and Y, launch a meet-in-the-middle procedure to find a pair of nodes (x 0 , y 0 ) with x 0 = h 1 (x, m) and y 0 = h 1 (y, m) and x ∈ X and y ∈ Y, such that in FG f 1 and FG f 2 , the distance difference of x 0 and y 0 from some targeted nodes (x, ȳ) ∈ S is correctable by the values in D. Denote the common distance after corrected as d. Retrieve the message fragment M I from M IS such that (x, ŷ)

M I --→ (x, y). The desired M Link is then defined as M Link M I m [m] d .

58

At the end, select a message fragment M E ∈ M SEM with a proper block length, and a message fragment M J ∈ M DS such that x M J --→ x, and construct a second preimage:

M M E M Link M J m m p+1 • • • m L = M E M I m [m] d M J m m p+1 • • • m L . a 0 = IV b 0 = a L a 1 m 1 b 1 m 1 a p-1 b p-1 a p m p b p m p a L-1 b L-1 a L m L H(M ) = b L m L IV x M SEM xL ŷ M SEM L 1 L 2 ȳ x1 xi xj x2 s ỹ M MC x M DS m m xL m p+1 • • • m L x 0 m x y 0 m y X Y M IS M IS [m] d1 [m] d2 M I M I M E M E M J M J -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6 -Step 7 -Step 8

Details of the Second-Preimage Attack on Hash-Twice Based on Multi-Cycles, Diamond and Interchange Structure for Long Messages

The detailed steps of the second-preimage attack on Hash-Twice are follows:

Detailed Steps of Attack 6

1. Fix an arbitrary single-block message m and construct

f 1 (•) h 1 (•, m) and f 2 (•) h 2 (•, m).
(a) Run the cycle search algorithm several times to locate the largest cycles in FG f 1 and FG f 2 , and obtain the cycle lengths L 1 and L 2 . Without loss of generality, assume

L 1 ≤ L 2 . (b) Generate a set of 2 s pairs of target nodes S = {(x 1 , ȳ), (x 2 , ȳ), . . . , (x 2 s , ȳ)},
where xi are cyclic nodes randomly located in the largest cycle of FG f 1 and ȳ is a cyclic node in the largest cycle of FG f 2 . (c) Compute the set of correctable distance bias (IV, xL ), and denote their endpoints by (x, ŷ). 6. Build a 2 r -interchange structure M IS starting from (x, ŷ), and denote its two sets of endpoints by X and Y. 7. Find a message fragment M Link such that (x, ŷ) M Link ---→ (x, ȳ) for some (x, ȳ) ∈ S. The search procedure is described as follows. -

D = {j • ∆L mod L 1 | j = 0,
Compute x 0 = h 1 (x , w) -For each of the 2 s target node xi ∈ {x 1 , x2 , • • • , x2 s }
• Derive the distance of x 0 from xi (as described in Step 4c of Attack 3), denote it by d xi .

• Make a match between d xi and elements in T y by checking whether there exists a

d ȳ ∈ T y such that (d xi -d ȳ mod L 1 ) ∈ D. If one exists, retrieve y corresponding to d ȳ from T y . Derive the common distance d d xi + j • L 1 = d ȳ + k • L 2 . Set m w,
x x , y y , and x xi . Retrieve the message fragment M I from M IS such that (x, ŷ)

M I --→ (x, y). Set M Link M I m [m]
= p - (2 t+1 + (2 t -1) 2 • n/2) -1 -d -s • n/2 -1 = p -2 t+1 -(2 t -1) 2 • n/2 -d -s • n/2 -2, select the message fragment M J ∈ M DS such that x M J --→
x, and construct a second preimage:

M M E M Link M J m m p+1 • • • m L = M E M I m [m] d M J m m p+1 • • • m L .
Complexity Analysis. The complexity of each step in this second-preimage attack on Hash-Twice is as follows (denote L = 2 ):

Step 1:

2 n/2
Step 2:

2 t Step 3: n √ s • 2 n/2+s/2
Step 4: 2 n-+ 2

Step 5:

2 + n 2 • 2 n/2
Step 6:

2 n/2+2r
Step 7:

2 r • 2 n-t • 2 n-2r-s-
Step 8: 2

For > n/2, we have 2 n-< 2 n/2 . The sum of dominant terms is (ignoring polynomial factors)

2 t + 2 n/2+s/2 + 2 + 2 n/2+2r + 2 2n-t-r-s-.
We balance different terms by setting

t = n/2 + 2r = n/2 + s/2 = 2n -t - r -s -, i.e., r = t/2 -n/4, s = 2t
n and t = 13n/18 -2 /9. Consequently, the total complexity is approximately 2 + 2 13n/18-2 /9 .

The improved attack is valid for all > n/2 (even when we account for the message length 2 2r of the interchange structure, which should be less the 2 ). The optimal complexity for this attack is 2 13n/22 , obtained when 2 = 2 13n/22 . Compared with the original optimal complexity 2 2n/3 for messages of length 2 13n/22 , the improvement is 2 5n/66 (see Fig. 13 for a trade-off curve).

Details of the Second-Preimage Attack on Hash-Twice Based on Deep-iterates, Diamond and Interchange Structure for Short Messages

Note that for L = 2 ≤ 2 n/2 , we can no longer apply the multi-cycles technique. However, we can still choose deep-iterates with depth less than 2 n/2 as target nodes and selected proper iterate depth to improve the second-preimage attack on Hash-Twice for short messages. The procedure of this new attack is similar to that of the previous attack in Sect.8.2. The difference lies in that in Step 1, we collect a set of 2 s pairs of target nodes {(x 1 , ȳ), (x 2 , ȳ), . . . , (x 2 s , ȳ)}, where xi 's are 2 n-g -th iterate nodes in FG f 1 for 1 ≤ i ≤ 2 s and ȳ is a 2 n-g -th iterate node in FG f 2 . It is required that g ≥ max(n/2, n -). In addition, in Steps 2 and 7, we use the distinguishpoint technique in the look-ahead procedure as we did in the preimage attack on XOR combiner in Sect.4.2. The procedures in other steps are the same as those in Sect.8.2.

In this case, required number of samplings before finding a pair of (x, y) such that they reach one of a target pair of nodes (x i , ȳ) at a common distance changes to be 2 3g-n-s-2r . Consequently, the complexity of Step 7 is 2 r • 2 3g-n-s-2r • (2 n-t + 2 +t-n + 2 +s-g ). Thus, complexity of each step in this second-preimage attack on Hash-Twice for short message is as follows:

Step 1: 2 g

Step 2:

2 t Step 3: n √ s • 2 n/2+s/2
Step 4: 2 n-+ 2

Step 5:

2 + n 2 • 2 n/2
Step 6:

2 n/2+2r
Step 7:

2 3g-t-s-r + 2 3g+t-s-r+ -2n + 2 2g+ -n-r
Step 8: 2

For ≤ n/2, we have 2 n-≥ 2 n/2 . Thus, the sum of dominant terms is

2 g + 2 t + 2 n/2+s/2 + 2 n-+ 2 n/2+2r + 2 3g-s-t-r + 2 3g+t-s-r+ -2n + 2 2g+ -n-r .
We first set t = n/2+s/2 = n/2+2r = 3g-s-t-r, i.e., t = 2g/3+5n/18, s = 4g/3 -4n/9, and r = g/3n/9 to make a balance. The sum of dominant terms is 2 g + 2 2g/3+5n/18 + 2 n-+ 2 2g+ -7n/6 + 2 5g/3+ -8n/9 . We optimize the attack by picking the minimal value of g under the restriction g ≥ max(n/2, n -), i.e., g = n -for ≤ n/2. Consequently, the total complexity becomes (for g = nand < n/2, with the last two terms always less than 2 n-, the distinguished points method allowed us to resolve with no overhead the complication of keeping track of distances from 2 s target nodes):

2 17n/18-2 /3 + 2 n-.
The improved attack is better than that in [ABDK09] for > 5n/12 (in which case 17n/18 -2 /3 < 2n/3, the message length 2 2r of the interchange structure is less the 2 , thus applicable). The optimal complexity for this attack is 2 11n/18 , obtained when = n/2. Compared with the previous best-known complexity 2 2n/3 at message length L = 2 n/2 , the improvement is 2 n/18 (see Fig. 13 for a trade-off curve).

More Applications and Extensions

Applications Beyond MD Construction and Beyond XOR Operation

Application to HAIFA mode. The first preimage attack on the XOR combiner purely bases on interchange structure. Thus, it works identically if the hash functions use the HAIFA mode rather than the plain Merkle-Damgård iteration, whereas the other attacks all based on functional graphs requiring identical compression functions and thus cannot work if the underlying hash functions use the HAIFA mode.

62

Application to Cryptophia's short combiner. All of our attacks on XOR combiner can also be applied to Cryptophia's short combiner, as proposed by Mittelbach [Mit13], and to the revised version of Mennink and Preneel [MP14]. This combiner computes the sum of two hash functions with some pre-processing of the message to allow non-independent functions:

C(M ) = H 1 m1 1 . . . m1 ⊕ H 2 m2 1 . . . m2 m1 j = H 1 (0 l 1 m j ⊕ k 1 ) ⊕ H 2 (0 l 2 m j ⊕ k 2 ) m2 j = H 1 (1 l 1 m j ⊕ k 1 ) ⊕ H 2 (1 l 2 m j ⊕ k 2 )
where k 1 , k 2 , l 1 , l 2 is a randomly chosen key. The security proof in the ideal model shows that C is optimally preimage resistant if at least one of the hash functions is ideal.

However, if both H 1 and H 2 are narrow-pipe, we can apply our preimage attacks with the same corresponding complexity. This does not violate the security proof because we need both functions to be narrow-pipe and hence not n-bit ideal 25 . From a practical point of view, though, they show that in many cases (e.g. using SHA-512 and Whirlpool) the combiner is weaker than the initial functions.

Application beyond XOR. All preimage attacks on XOR combiner can easily be extended to H 1 (M ) H 2 (M ) where denotes an easy to invert group operation (for instance, a modular addition rather than the exclusive or). These attacks can also be extended to hash functions H 1 and/or H 2 using an internal checksum, such as the GOST family of hash functions, using pairs of blocks with a constant sum.

Applications to the Combination of Wide-Pipe Hash Functions

Our attacks can also be used when the internal state size n is (not much) larger than the output size n.

The interchange-structure-based preimage attack on the XOR combiner. In Attack 1, the complexity of building a 2 t -interchange structure is related to n as (n /2) • 2 2t+n /2 . On the other hand, the complexity of the meetin-the-middle preimage search is related to n as 2 n-t . The optimal complexity is (n /2) • 2 2n/3+n /6 by matching the two complexities with t = n/3n /6. Therefore, our attack can be applied as long as n + 6 log(n ) ≤ 2n holds. For instance, we can compute preimages of SHA-224 ⊕ BLAKE-224 using the interchangestructure-based attack with complexity roughly 2 199 .26

The deep-iterates-based preimage attack on the XOR combiner. For parameters g 1 ≥ max(n /2, n -) and s ≥ 0, the complexity of each phase in Attack 2 is as follows:

Phase 1: 2 + n 2 • 2 n /2
Phase 2: 2 n+s-g 1 Phase 3:

2 3g 1 /2-s/2 + 2 +9g 1 /2-2n -3s/2 + 2 +2g 1 -n
We balance the time complexities of different phases similar to what we did before. In case of ≤ n /2, we set g 1 = n -, the total time complexity of the attack is 2 n/3+2n /3-2 /3 + 2 n -. The optimal complexity is 2 n/3+n /3 , 27 obtained for = n /2. It is less than 2 n when n < 2n.

The multi-cycles-based preimage attack on the XOR combiner. The complexity of each detailed step in Attack 3 is no longer related to the output size n but related to the internal state size n except for Step 3. For Step 3, the complexity is 2 s+n-n /2 . For other steps, the complexity can be obtained by simply replacing n with n from the original formula. Then, the overall complexity is approximately (note that ≥ n /2)

2 + 2 s+n-n /2 + 2 t + 2 2n -t-s-.
We balance the last three terms by setting

s + n -n /2 = t = 2n -t -s -, i.e., s = n -2n/3 -/3, t = n /2 + n/3 -/3.
Then, the total complexity is 2 + 2 n /2+n/3-/3 . The optimal complexity is 2 3n /8+n/4 for = 3n /8 + n/4. The complexity is less than 2 n when n /2 < < n and n < 2n.

The deep-iterates-based second-preimage attack on the concatenation combiner. The complexity of Attack 4 is no longer related to the output size n but rather is related to the internal state size n and the message length L = 2 . The time complexity is 2 (3/5)•(2n -) as long as ≤ 3n /4 and is less than 2 n for > 2n -5n/3. Therefore, this attack can be applied when n < 4n/3.

The second-preimage attack on the Zipper hash. The complexity of Attack 5 is no longer related to the output size n but is related to the internal state size n . We can get the complexity by simply replacing n with n in the formula. Accordingly, when the length L of the second preimage is limited by 2 n /2 , the optimal complexity is 2 5n /8 for all ≥ 3n /8. It is less than 2 n when n < 8n/5. When the length L is not limited, the optimal complexity is 2 3n /5 for all ≥ 2n /5. It is less than 2 n when n < 5n/3.

messages with less than 2 64 bits (i.e., 2 55 blocks). In this case, one can apply the attack with a smaller value of t: this reduces the length of the messages at the cost of more time spent in the preimage search step. Thus, to mount a preimage attack against SHA-224 ⊕ BLAKE-224, we should use t = 24 instead of t = 32. Then, the optimal complexity is 2 200 instead of 2 199 . 27 Note that n/3 + n /3 > n /2 when n < 2n.

The second-preimage attack on Hash-Twice. The complexity of Attack 6 is no longer related to the output size n but rather is related to the internal state size n . Accordingly, when the length L = 2 is limited by 2 n /2 , the total complexity is 2 n -+ 2 17n /18-2 /3 . The optimal complexity is 2 11n /18 , obtained for = n /2, which is less than 2 n when n < 18n/11. When the length is not limited, the total complexity is 2 + 2 13n /18-2 /9 . The optimal complexity is 2 13n /22 , obtained for = 13n /22, which is less than 2 n when n < 22n/13.

Extensions to the combination of three or more hash functions

The interchange-structure-based preimage attack on the XOR combiner. The interchange-structure-based attack on the XOR combiner, i.e., Attack 1, can be extended to the sum of three or more hash functions. To attack the sum of k functions, two different strategies are possible: either we use a simpler structure that only gives two degrees of freedom and fixes k -2 functions to a constant value, or we build an interchange structure to control all the k functions independently.

Controlling only two functions. The easiest way to extend the attack is to use a single chain in the k -2 extra hash functions. The procedure to build a switch is modified in order to use multi-collisions for k-1 functions instead a simple multicollisions for one function; this costs O(n k-1 • 2 n/2 ) using Joux's method [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF]. As in the basic attack, we need O(t 2 ) switches to generate a 2 t -interchange for two functions, and the preimage search costs O(2 n-t ); the optimal complexity is therefore O(n k-1 • 2 5n/6 ) with t = n/6. Controlling all the functions. Alternatively, we can build a more complex interchange structure in order to control all the functions independently. When attacking three functions, we will use the switch structure to jump from chains (

a j 0 , b k 0 , c l 0 ) to ( a j 0 , b k 0 , c l 1 ) (or ( a j 0 , b k 1 , c l 0 ) or ( a j 1 , b k 0 , c l 0 )
). We need 2 3t -1 switches in the interchange structure to reach all the 2 3t triplets of chains (a switch makes only one new triplet reachable). Each switch is built using a 2 n/2multi-collision on two functions, which can be built for a cost of O(n 2 • 2 n/2 ) following Joux's technique [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF]. Therefore, we can build a 2 t -interchange for a cost of O(n 2 • 2 3t+n/2 ). More generally, for the sum of k hash functions, we can build an interchange structure for k functions for a cost of O(n k-1 • 2 kt+n/2 ).

In the preimage search phase, we generate k lists of size 2 t , and we need to detect efficiently whether we can combine then to generate a zero-sum. This problem can be solved using an algorithm similar to Wagner's generalized birthday algorithm

[Wag02]. If k = 2 κ , we find a solution with probability O(2 (κ+1)•t-n ) for a cost of O(k • 2 t ). Therefore, the preimage search costs O(k • 2 n-κt ). With k = 4 (i.e., κ = 2), this yields a complexity of O(n 3 • 2 5n/6
). However, this approach is less efficient than the previous one for k = 3 and for k > 4.

To summarize, attacking the sum of k hash functions (k ≥ 2) using interchange structure costs O(n k-1 • 2 5n/6 ). Controlling chains independently in more than two hash function might be useful for further work, but it does not improve the preimage attack on the sum of k hash functions.

The deep-iterates-based preimage attack on the XOR combiner. Suppose the combiner outputs the sum of k hash digests of n bits. To extend Attack 2, one needs to first construct a simultaneous expandable message for k independent hash functions, this costs O(2 + n 2(k-1) • 2 n/2 ) by setting C ≈ (n/2 + log(n)) k-1 (see Fig. 9a).

To extend Phase 2, one collects 2 g 1 deep-iterates for each of the k random functional graphs. Then, tries to find a set of 2 s tuples of k deep-iterates by mapping a single-block message to states whose sum equals the target V . Again, this can be solved using an algorithm similar to Wagner's generalized birthday algorithm, with k lists of size 2 g 1 . Let k = 2 κ , and then finding 2 s tuples costs

O(2 s • k • 2 n-κg 1 ) ≈ 2 n+s-κg 1 .
To extend Phase 3, one expands the k functional graphs independently with parameter g 2 in the look-ahead procedure and then tries to find a tuple of k starting nodes simultaneously hitting one of the 2 s tuples of k deep-iterates obtained in Phase 2. Note that for one tuple of k deep-iterates of depth 2 d in independent random functional graphs, the probability for a tuple of k random nodes reaching them simultaneously is approximately 2 -kn 2 d i=1 i k ≈ 2 (k+1)d-kn . In the attack, d = ng 1 . Thus, the complexity of Phase 3 becomes

2 g 2 + 2 kn-(k+1)(n-g 1 )-s • (2 n-g 2 + 2 l+g 2 -n + 2 l+s-g 1 ) =2 g 2 + 2 (k+1)g 1 -g 2 -s + 2 (k+1)g 1 +g 2 +l-2n-s + 2 kg 1 +l-n
Note that in this attack, the restrictions are ≤ n/2 and g 1 ≥ max(n/2, nl). Thus, the last term in the complexity of Phase 3, i.e., 2 kg 1 +l-n , cannot be less than 2 n for k ≥ 3. In other words, when combining more than two hashes, under any configuration for parameters of the attack, the distinguished points method no longer allowed us to resolve with no overhead the complication of keeping track of distances from the S-nodes. Thus, this extended attack is not more efficient than 2 n .

The multi-cycles-based preimage attack on the XOR combiner. The extension of Attack 3 is very similar to the above extension of the deep-iteratesbased preimage attack. However, because this attack does not need to use the distinguished points method, it can be more efficient than 2 n for k ≥ 3. Let k = 2 κ . Following a similar analysis for the complexity of each step to the above one, we have the following:

Step 1: 2 + n 2(k-1) • 2 n/2
Step 2:

2 n/2 + 2 -n/2
Step 3:

2 s+n-κ•n/2
Step 4: k • 2 t

Step 5: 2 n-t+kn/2-s-

Step 6: 2

We make a balance by setting s

+ n -κ • n/2 = t = n -t + kn/2 -s -, i.e., s = (k + 2κ -2
)n/6 -/3, and t = (kκ)n/6 + 2n/3 -/3. Then, the complexity 66 becomes 2 + 2 (k-κ)n/6+2n/3-/3 . It is optimally 2 (k-κ+4)n/8 by setting = (kκ + 4)n/8 (in this attack, we assume n/2 < < n). Accordingly, it costs less than 2 n computations for k < 7. For k = 3, the optimal complexity is approximately 2 (7-log 2 3)n/8 ≈ 2 0.677n . For k = 4, the optimal complexity is approximately 2 3n/4 ≈ 2 0.75n . For k = 5 and k = 6, this extension is less efficient than the above extended interchange-structure-based attack.

The deep-iterates-based second-preimage attack on the concatenation combiner. Suppose the combiner outputs the concatenation of k hash digests of n bits. The direct way to extend Attack 4 is to simultaneously control k hash functions. To do that, again, one needs to first construct a simultaneous expandable message for k independent hash functions, this costs O(2 + n 2(k-1) • 2 n/2 ) (see Fig. 9a). To extend Phase 2, one collects 2 g 1 deep iterates for each of the k random functional graphs and then tries to find a tuple of k deep iterates hitting k internal states at the same offset p which uniformly distributed in the interval [1,2 ]. The complexity of Phase 2 is 2

g 1 • 2 -• 2 kn-kg 1 = 2 kn-(k-1)g 1 -.
To extend Phase 3, one expands the k functional graphs with parameter g 2 independently and tries to find a tuple of k starting nodes simultaneously hitting the tuple of k deep iterates obtained in Phase 2. As calculated above, for a tuple of k deep iterates of depth 2 n-g 1 in independent random functional graphs, the probability for a tuple of k random nodes reaching them simultaneously is about 2 (k+1)(n-g 1 )-kn . Thus, the complexity of Phase 3 becomes 2 (k+1)g 1 /2 by setting g 2 = (ng 2 ) + kn -(k + 1)(ng 1 ), i.e., g 2 = (k + 1)g 1 /2. After making a balance between different phases by setting g 1 = 2(kn -)/(3k -1), one will find that the optimal complexity is 2 (k+1)n/4 , obtained for l = (k + 1)n/4. Thus, for k ≥ 3, the attack is not more efficient than 2 n . Step 2

Step 3

sp m1 xp [0] i-C m 1 x 1 x1 m1 [0] i-C m 1 y 1 y1 M 1 M 1 C ≈ ( n 2 ) 2 m1 [0] i-C m 1 y 1 M1 M 1 z1 1 n 2 -1 n 2 ( n 2 -1) (i -C) + 1 n 2 -1 n 2 ( n 2 -1) (a) Parallel y1 yp y 1 y0 m1 m 1 [0] i-C 1 n 2 -1 n 2 ( n 2 -1) (i -C) + 1 n 2 -1 n 2 ( n 2 -1) C ≈ ( n 2 ) 2 x1 x 1 x0 m1 m 1 [0] i-C M 1 M 1 z1 z0 m1 m 1 [0] i-C M1 M 1 H1 H2 H3
Step 2

Step 1

Step 3

(b) Zipper (built in the front)

x 1 z 1 H1 H2 H3
Step 1

Step 3

Step 2

sp m1 xp [0] i-C m 1 x1 x0 y1 y0 m1 [0] i-C m 1 M 1 M 1 m1 [0] i-C m 1 z1 z0 M 1 M 1 1 n 2 -1 n 2 ( n 2 -1) (i -C) + 1 n 2 -1 n 2 ( n 2 -1) C ≈ ( n 2 ) 2
(c) Zipper (built at the end) Fig. 9: Construct a building block for a 3-pass simultaneous expandable message

The second-preimage attack on the Zipper hash. When the Zipper hash combines k > 2 hash functions by alternatively forward computing and reverse computing, one can still extend Attack 5.

To construct a simultaneous expandable message adaptable for the Zipper hash, one first constructs partial building blocks for all the computational passes in one direction and then constructs them for all the computational passes in the other direction. Note that in each of the building blocks in a simultaneous expandable message for the Zipper hash, there are two pieces of Joux's multicollisions, each at one of the two ends of the building block. The left Joux's multicollisions are for synchronizing the reverse computations, and the right Joux's multi-collisions are for synchronizing the forward computations. The complexity to build a cascade simultaneous expandable message for k hash functions can be the same as that of building a parallel one, which is approximately O(2 + n 2(k-1) • 2 n/2 ). Note that for even k, the simultaneous expandable message is placed at the end of each pass, and the length of the second preimage encoded in the simultaneous expandable message can be chosen to optimize the attack, while for odd k, the simultaneous expandable message is placed in the front end of each pass (see Fig. 9b and9c).

Next, we take k = 3 for example to briefly describe the extended attack (see Fig. 10). The attack first collects a triple of cyclic nodes (x, ȳ, z), each node located in each of the three random functional graphs generated using the three compression functions. Start from z, we build a 2 r• n 2 -Joux's multicollisions M MC3 , ending with ẑ. By exploiting messages in M MC3 , we can start from x and build a 2 r -Joux's multi-collisions M MC1 , ending with x. This is essentially computing a 2 r -simultaneous Joux's multi-collision starting from state pair (x, z) and ending with (x, ẑ). We denoted it by M MC13 . Start from ȳ, we build a 2 r -Joux's multi-collisions M MC2 for the reverse computation, ending with ŷ. Then, find a message block m mapping ẑ to an internal state c p in the original computation with M . Afterwards, the suffix of the second preimage is fixed to be

m p+1 m p+2 • • • m L .
Starting from ŷ, we compute the cascade simultaneous expandable message. Note that, only after we completed the computation in the second pass (which is a reverse computation in the middle of the two forward computations) and get the terminal point ÿ, can we start the computation in the first and third passes. The first pass starts from IV and the third pass starts from the terminal point of the second pass, i.e., z = ÿ. Because there is only one reverse pass, in each building block, only the right piece of Joux's multi-collision is required (see Fig. 9b, if k ≥ 4, there should be another piece of Joux's multi-collision at the left end in each building block). At last, we launch a meet-in-the-middle procedure using messages in M MC13 and M MC2 , to find a triple of starting nodes (x, y, ž) simultaneously reach the triple of deep-iterates (x, ȳ, z), and output the concatenation of the obtained message fragments.

We analysis the complexity of the extended attack in general supposing that there are k computational passes. Note that, among the k computation passes, there are k/2 forward computations and k/2 reverse computations. We have

r • n 2 ž [m ] d3 z MMC 2 M 2 z MSEM M q ỹ ỹp m ỹL = xL mp+1 • mL y MMC 13 M 1 ȳ [m ] d2 ÿ ŷ MSEM M q MMC 2 r x xp m xL mp+1 • mL x MMC 13 r • n 2 x [ m ] d 1 x MMC 2 M 2 IV MSEM M q
Fig. 10: Second-preimage attacks on 3-pass Zipper 2 2r pairs of starting nodes in the meet-in-the-middle procedure in the extended attack, which is the Cartesian product between the set of 2 r nodes for the forward computations and the set of 2 r nodes for the reverse computations. Let the deep-iterates nodes be of depth 2 d ; then, each pair succeeds with probability 2 (k+1)d-kn without using multi-cycles, and the probability amplified to be 2 (k+1)n/2-kn-n/2+ by using multi-cycles.

If the message length is limited to be no more than 2 n/2 , we cannot use the multi-cycles technique. The success of the attack requires 2r = kn -(k + 1) • d, and the attack complexity is approximately 2 t + 2 + 2 n-+ 2 r • 2 n-t . Setting d = n/2 and = = n/2, we get r = kn/4n/4, and the optimal complexity is 2 kn/8+3n/8 , which is less than 2 n for k < 5. Concretely, the complexity is 2 3n/4 for k = 3 and 2 7n/8 for k = 4.

If the message length is not limited, we can use the multi-cycles technique. The success of the attack requires 2r = kn-(k+1)•n/2+n/2-, i.e., r = kn/4-/2. The attack complexity is approximately 2 t + 2 + 2 n-+ 2 kn/4-/2+n-t . We balance the terms by setting t = kn/4 -/2 + nt = and achieve the optimized complexity 2 kn/10+2n/5 for n -< and = kn/10 + 2n/5. It is less than 2 n when k < 6. Concretely, the complexity is 2 7n/10 , 2 4n/5 , 2 9n/10 for k = 3, 4, 5 respectively.

The second-preimage attack on Hash-Twice. Attack 6 can be extended using two different strategies: either we only build an interchange structure for two of the k computational passes or we build an interchange structure to control all the k computational passes. The second strategies cannot be more efficient than the first. Thus, we only describe the extended attack following the first strategy here.

In the extended attack on hashing k times, the frameworks for constructing the first and last passes are almost identical to that of the original attack (see Fig. 11). We collect 2 s special nodes in the functional graph of the first hash function. We collect one special node in each of the last k -1 hash functions. If the message length is not limited, we select cyclic node as special nodes to be targeted (when using multi-cycles technique, we only consider the correctable distances between two of the k cycles); if the message length is limited, we select deep-iterate nodes as the special nodes to be targeted. We thus get 2 s tuples of k target nodes. From those target nodes in the last k -1 passes, we build a 2 s•n/2simultaneous Joux's multi-collision M MC (that is, a set of messages that is Joux's multi-collision for the k -1 independent hash functions simultaneously, and is a

2 s•(n/2) k-i+1
-Joux's multi-collision for the i-th hash). We herd the 2 s target nodes in the first pass to a single state x by building a diamond using messages in M MC . We try to hit an internal state in the last computational pass from the endpoint of the last Joux's multi-collision. After that, suffix of the second preimage is fixed. We can then compute the final states of the first k -1 passes, which are also initial states of the last k -1 passes. We then start from the initial states in the k computational passes, compute a k-pass simultaneous expandable message (see Fig. 9a). Starting from the terminal states of the simultaneous expandable message, we build an interchange structure in which two of the k passes have 2 r chains and the remaining k -2 passes have a single chain (which essentially is a simultaneous Joux's multi-collision for the remaining k -2 passes). We finally try to use the endpoints of the interchange structure to find a tuple of k starting nodes reaching one of the 2 s tuples of k target nodes at the same distance.

If the message length is limited to be no more than 2 n/2 , we use deep-iterates nodes (with depth 2 n-g , where g ≥ max(n/2, n -)) as targeted nodes in the above extended attack. Following an analysis similar to the one in Sect. 8.3, one finds that the complexity is as follows (ignore the constant and polynomial factors):

Step 1: k • 2 g Step 2: k • 2 t Step 3: n √ s • 2 n/2+s/2 + s • n k-1 • 2 n/2
Step 4: 2 n-+ 2

Step 5:

2 + n 2k+2 • 2 n/2
Step 6:

n k-1 • 2 n/2+2r
Step 7:

2 (k+1)g-t-s-r + 2 (k+1)g+t-s-r+ -2n + 2 kg+ -n-r
In Sect. 8.3, for the case k = 2, we balance the complexity using the first term in the formula of Step 7, because the last two terms in the formula of Step 7 is less than the first term under the best configuration. Here, for the case k ≥ 3, we balance the complexity using the third term in the formula of Step 7, because the third term is greater than the first two terms. Specifically, we set t = n/2 + s/2 = n/2 + 2r = kg +nr, i.e., t = 2kg/3 + 2 /3n/2, s = 4kg/3+4 /3-2n, and r = kg/3+ /3-n/2. The complexity of the dominant terms is 2 g +2 2kg/3+2 /3-n/2 +2 -4kg/3+g-7 /3+3n , in which the mid term is always greater than 2 n for k ≥ 4 under the restrictions g ≥ max(n/2, n-) and ≤ n/2. Thus, the attack can be more efficient than 2 n only for k < 4. For k = 3, we set 70

a 0 = IV b 0 = a L c 0 = b L a 1 m 1 b 1 m 1 c 1 m 1 a p-1 b p-1 c p-1 a p m p b p m p c p m p a L-1 b L-1 c L-1 a L m L b L m L c L m L IV x M SEM xL ŷ M SEM ȳL ẑ M SEM x 0 m x y 0 m y z 0 m ž X Z M IS M IS L 1 L 2 L 3 x1 xi xj x2 s ȳ z ỹ M MC z M MC m x M DS m m xL m p+1 • • • m L ȳL m p+1 • • • m L [m] d1 [m ] d2 [m] d3 M I M I M I M E M E M E M J M J M J -Step 1 -Step 2 -Step 3 -Step 4 -Step 5 -Step 6 -Step 7 -Step 8
Fig. 11: Second-preimage attacks on 3-pass Hash-Twice g = n -to optimize the complexity. In this case, r = k(n -)/3 + /3n/2, which fulfils the restriction 2r ≤ when k ≤ 3. The complexity is then

2 n-+ 2 (4k-3)n/6-2(k-1) /3 .
It is optimally (2k -1)n/6, obtained for = n/2. As a result, for k = 3, the optimal complexity is 2 5n/6 . If the message length is not limited and > n/2, we use the multi-cycles technique. Following an analysis similar to the one in Sect. 8.2, one can find that the complexity is as follows (ignoring the constant and polynomial factors):

Step 1: k • 2 n/2
Step 2: k • 2 t

Step 3:

n √ s • 2 n/2+s/2 + s • n k-1 • 2 n/2
Step 4:

2 n-+ 2 Step 5: 2 + n 2k+2 • 2 n/2
Step 6:

n k-1 • 2 n/2+2r
Step 7:

2 (k+2)n/2-t-r-s- Step 8: 2
We make a balance by setting t = n/2+s/2 = n/2+2r = (k+2)n/2-t-r-s-, i.e., t = (2k + 9)n/18 -2 /9, s = 2kn/9 -4 /9, and r = kn/18 -/9. The complexity is then

2 + 2 (2k+9)n/18-2 /9 .
It is optimally 2 (2k+9)n/22 when = (9 + 2k)n/22. Thus, the attack costs less than 2 n for k < 7. Concretely, it is 2 15n/22 , 2 17n/22 , 2 19n/22 , 2 21n/22 for k = 3, 4, 5, 6 respectively.

Remark. From the above results, in the functional-graph-based attacks, when use a set of deep iterates as targeted states for attacks with short messages, one has to use the distinguished points method, which is not adequately efficient to attack combiners of more than three hash functions. In contrast, when using a set of cyclic nodes for attacks with long messages, one does not need the distinguished points method and thus can extend the attacks to combiners with n-bit output of up to six Merkle-Damgård hash functions.

Summary and Open Problems

In this paper, we study the security of various of hash combiners by devising generic attacks. These attacks show rather surprising results -the security upper bounds of most hash combiners are not as high as commonly believed.

Regarding basic security requirements (preimage resistance, second-preimage resistance), they fail to provide more (or even the same) security than that provided by a single ideal hash function, or even less than that provided by its underlying hash functions. See Tab. 1 for a summary of their current security status. In Fig. 12 and Fig. 13, we summarize their detailed security status by drawing trade-off curves between the length of the message and the complexity of the attacks. From these trade-off curves, for combiners with underlying hash functions using Merkle-Damgård construction, the gaps between the security upper bounds and the security lower bounds provided by security proof are quite narrow. However, that is true only for very long messages. For short messages, the gap remains large. That mainly results from the limitation of the key techniques used in our attacks. Our attacks highly exploit the iterated property of the underlying hash functions. Particularly, most of our attacks exploit properties of functional graphs of random mappings generated by fixing a message block input to the compression functions. Thus, they usually involve iterating the compression functions with fixed message block many times. Therefore, our crafted messages are very long, and they are typically composed of a large number of repeated message blocks (which can be easily recognized).

( 3 8 , 5 8 )
(

2 5 , 3 5 )
(

1 3 , 2 3 )
(

1 2 , 11 18 )
(

5 12 , 2 3 )
( 13 22 , 13 22 )
Length of the original messages (log 2 (L)/n)

Complexity
1: function Switch(h 1 , h 2 , a, b, b ) 2: x ← ∅, M MC ← ∅ 3: (x, M MC ) ← JouxMultiCollision(h 1 , a, n/2) 4:
T ← {} 5:

for each M ∈ M MC do 6:

y ← h * 2 (b, M ), T [y] ← M 7:
end for 8:

for each M ∈ M MC do 9:

y ← h * 2 (b , M ) 10: if T [y] exists then 11: return (T [y], M ) 12:
end if 13: end for 14: end function Algorithm 3 Building and using a T -interchange structure

1: function Interchange(h 1 , h 2 , IV 1 , IV 2 ) 2: a 0 ← IV 1 , b 0 ← IV 2 3: for 1 ≤ k < T do 4: a k ← $, b k ← $ 5:
end for 6:

for 1 ≤ j < T do 7: (M, M ) ← Switch(h 1 , h 2 , a 0 , b 0 , b j ) 8: M ← M M, M ← M M 9:
for 0 ≤ k < T do 10:

a k ← h * 1 (a k , M ), b k ← h * 2 (b k , M ) 11:
end for 12:

end for 13:

for 1 ≤ j < T do 14:

for Algorithm 4 Constructing a building block for a simultaneous expandable message

1 ≤ i < T do 15: (M, M ) ← Switch(h 2 , h 1 , b j , a 0 , a i ) 16: M ← M M, M ← M M 17: for 0 ≤ k < T do 18: a k ← h * 1 (a k , M ), b k ← h * 2 (b k ,
if k = 0 then 28: µ[k -1] ← M [k -1] 29: end if 30: if j = 0 then 31: µ[(k + 1) • (T -1) + j -1] ← M [(k + 1) • (T -1) + j -
1: function SEMblock(x 0 , y 0 , i) 2: xp ← h * 1 (x 0 , [0] i-C ) 3: (sp, m 1 , m 1 ) ← Collision2(h 1 , x 0 , xp) 4: (x 1 , M MC ) ← JouxMultiCollision(h 1 , sp, C -1) 5: M short ← m 1 × M MC , M long ← ([0] i-C m 1 ) × M MC 6: Y short ← ∅ 7:
for each ms ∈ M short do 8:

ys ← h * 2 (y 0 , ms ), Y short ← insert (
1: procedure Gen(t) 2: G ← ∅ 3: while |G| < 2 t do 4: C ← ∅, x ← $ {0, 1, . . . , 2 n -1} \ G 5:
while true do 6:

if x ∈ G or x ∈ C then 7: G ← merge C, go to line 3 8: else C ← insert x, x ← f (x) 9:
end if 10:

end while 11:

end while 12:

return G 13: end procedure

B Optimized Interchange Structure

We now describe an optimized attack using only (2 t -1)(2 t -1) switches rather than 2 2t -1. The attack also requires multi-collision structures, as introduced by Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF].

We replace the first 2 t -1 switches with a 2 t -Joux's multi-collision in H 1 , and we use those messages to initialize all the b k chains in H 2 . We can also optimize the first series of switches in H 2 in the same way: we build a 2 t -multi-collision in H 2 starting from b 0 , and we use those messages to initialize the a j chains in H 1 . This is illustrated by Fig. 14, and the detailed attack is given in Alg. 6.

H 1 H 2 IV 1 IV 2 A 0 B 0 A 1 B 1 A 2 B 2 A 3 B 3 M M M M M M M M M M M
1: function Interchange(h 1 , h 2 , IV 1 , IV 2 , T ) 2: a 0 ← IV 1 , b 0 ← IV 2 3: (a 0 , M MC0 ) ← JouxMultiCollision(h 1 , a 0 , t) 4: for 0 ≤ k < T do 5: b k ← h * 2 (b 0 , M MC0 [k]) 6: end for 7: (b 0 , M MC1 ) ← JouxMultiCollision(h 2 , b 0 , t) 8: a 0 ← h * 1 (a 0 , M MC1 [0]) 9:
for 1 ≤ k < T do 10:

a k ← h * 1 (a 0 , M MC1 [k]) 11: b k ← h * 2 (b k , M MC1 [0]) 12:
end for 13:

for 2 ≤ j < T do 14:

for

1 ≤ i < T do 15: (M, M ) ← Switch(h 2 , h 1 , b j , a 0 , a i ) 16: M ← M M, M ← M M 17: for 0 ≤ k < T do 18: a k ← h * 1 (a k , M ) 19: b k ← h * 2 (b k , M ) 20:
end for 21:

end for 22:

end for 23:

return (M MC0 , M MC1 , M , M ) 24: end function

25: function SelectMessage(M 0 , M 1 , M , M , j, k) 26: if j = 0 then 27: return M 0 [k] M 1 [0] M 28: else if k = 0 then 29: return M 0 [0] M 1 [j] M 30: else 31: µ ← M 32: µ[(k -1) • (T -1) + j -1] ← M [(k -1) • (T -1) + j -1] 33: return M 0 [k] M 1 [0] µ 34:
end if 35: end function

C On Problem Raised by Dependency Between Chain Evaluations

Suppose x and ȳ are both of depth 2 n-g 1 . From Observation 2 in Sect. 2.7, we conclude that the probability of encountering x and ȳ at the same distance in chains (of f 1 and f 2 ) evaluated from x 0 and y 0 is approximately 2 n-3g 1 . Thus, in Sect. 4.2 and Sect. 6.2, we conclude that if the trials of chain evaluations are independent, we need to compute about 2 3g 1 -n chains from different starting points. However, since various trials performed by selecting different starting points for the chains are dependent, it might require further proof for the conclusion. More specifically, when the number of nodes evaluated along chains exceeding 2 n-d , a new chain of length 2 d is very likely to collide with a previously evaluated node due to the birthday paradox (2 d × 2 n-d = 2 n ). Thus, the outcome of this chain evaluation is determined. As a result, new chains are all related with already evaluated chains, and the dependency between them affects the outcome non-negligibly after having evaluated 2 n-d nodes.

However, we notice that in our attacks, the actual birthday bound for the nonnegligible dependency between trials is 2 2n-2d instead of 2 n-d because in each trail, there are two chain evaluations. One is in FG f 1 , and the other is in FG f 2 . The chain evaluation in FG f 1 can be seen as independent with a chain evaluation in FG f 2 . After having evaluated 2 n-d nodes in each of the two functional graphs, there is indeed a high probability for each new chain colliding with previously evaluated chains. However, for a new pair of chain evaluations, the probability for both chains colliding with the chains evaluated in a previous trial is significant only after having evaluated 2 2n-2d nodes due to the birthday paradox. That is, trials cannot be seen as independent only after having evaluated 2 2n-2d nodes. Note that in our attacks, required number of trials is 2 2n-3d , thus the total evaluated number of nodes is 2 2n-3d • 2 d+1 ≈ 2 2n-2d which exactly falls on the birthday bound. Thus, the dependency between the trials is negligible and the complexity analysis of the corresponding attacks is justified.

From Collisions to Chosen-Prefix Collisions Application to Full SHA-1

Gaëtan Leurent 1 and Thomas Peyrin 2,3

1 Inria, France 2 Nanyang Technological University, Singapore 3 Temasek Laboratories, Singapore gaetan.leurent@inria.fr, thomas.peyrin@ntu.edu.sg

Abstract. A chosen-prefix collision attack is a stronger variant of a collision attack, where an arbitrary pair of challenge prefixes are turned into a collision. Chosen-prefix collisions are usually significantly harder to produce than (identical-prefix) collisions, but the practical impact of such an attack is much larger. While many cryptographic constructions rely on collision-resistance for their security proofs, collision attacks are hard to turn into a break of concrete protocols, because the adversary has limited control over the colliding messages. On the other hand, chosenprefix collisions have been shown to threaten certificates (by creating a rogue CA) and many internet protocols (TLS, SSH, IKE).

In this article, we propose new techniques to turn collision attacks into chosen-prefix collision attacks. Our strategy is composed of two phases: first a birthday search that aims at taking the random chaining variable difference (due to the chosen-prefix model) to a set of pre-defined target differences. Then, using a multi-block approach, carefully analysing the clustering effect, we map this new chaining variable difference to a colliding pair of states using techniques developed for collision attacks. We apply those techniques to MD5 and SHA-1, and obtain improved attacks. In particular, we have a chosen-prefix collision attack against SHA-1 with complexity between 2 66.9 and 2 69.4 (depending on assumptions about the cost of finding near-collision blocks), while the bestknown attack has complexity 2 77.1 . This is within a small factor of the complexity of the classical collision attack on SHA-1 (estimated as 2 64.7 ).

This represents yet another warning that industries and users have to move away from using SHA-1 as soon as possible.

Introduction

Cryptographic hash functions are crucial components in many information security systems, used for various purposes such as building digital signature schemes, message authentication codes or password hashing functions. Informally, a cryptographic hash function H is a function that maps an arbitrarily long message M to a fixed-length hash value of size n bits. Hash functions are classically defined as an iterative process, such as the Merkle-Damgård design strategy [Mer90,Dam90]. The message M is first divided into blocks m i of fixed size (after appropriate padding) that will successively update an internal state (also named chaining variable), initialised with a public initial value (IV), using a so-called compression function h. The security of the hash function is closely related to the security of the compression function.

The main security property expected from such functions is collision resistance: it should be hard for an adversary to compute two distinct messages M and M that map to the same hash value H(M ) = H(M ), where "hard" means not faster than the generic birthday attack that can find a collision for any hash function with about 2 n/2 computations. A stronger variant of the collision attack, the so-called chosen-prefix collision attack [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF] is particularly important. The attacker is first challenged with two message prefixes P and P , and its goal is to compute two messages M and M such that H(P M ) = H(P M ), where denotes concatenation. Such collisions are much more dangerous than simple collisions in practice, as they indicate the ability of an attacker to obtain a collision even though random differences (thus potentially some meaningful information) were inserted as message prefix. In particular, this is an important threat in the key application of digital signatures: chosen-prefix collisions for MD5 were introduced in [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF], eventually leading to the creation of colliding X.509 certificates, and later of a rogue certificate authority [SSA + 09]. Chosenprefix collisions have also been shown to break important internet protocols, including TLS, IKE, and SSH [START_REF] Bhargavan | Transcript collision attacks: Breaking authentication in TLS, IKE and SSH[END_REF], because they allow forgeries of the handshake messages.

SHA-1 is one the most famous cryptographic hash functions in the world, having been the NIST and de-facto worldwide hash function standard for nearly two decades until very recently. Largely inspired by MD4 [Riv91] and then MD5 [Riv92], the American National Security Agency (NSA) first designed a 160-bit hash function SHA-0 [START_REF]Secure Hash Standard[END_REF] in 1993, but very slightly tweaked one part of the design two years later to create a corrected version SHA-1 [START_REF]Secure Hash Standard[END_REF]. It remained a standard until its deprecation by the NIST in 2011 (and disallowed to be used for digital signatures at the end of 2013). Meanwhile, hash functions with larger output sizes were standardized as SHA-2 [Nat02] and due to impressive advances in hash function cryptanalysis in 2004, in particular against hash functions of the MD-SHA family [WLF + 05, WY05, WYY05b, WYY05a], the NIST decided to launch a hash design competition that eventually led to the standardization in 2015 of SHA-3 [START_REF]FIPS 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions[END_REF].

There has been a lot of cryptanalysis done on SHA-1. After several first advances on SHA-0 and SHA-1 [CJ98, BCJ + 05], researchers managed to find for the first time in 2004 a theoretical collision attack on the whole hash function, with an estimated cost of 2 69 hash function calls [START_REF] Wang | Finding collisions in the full SHA-1[END_REF]. This attack was extremely complex and involved many details, so the community worked on better evaluating and further improving the actual cost of finding a collision on SHA-1 with these new techniques. Collisions on reduced-step versions of SHA-1 were 2 computed [DMR07, KPS15], or even collisions on the whole SHA-1 compression function [START_REF] Stevens | Freestart collision for full SHA-1[END_REF], which eventually led to the announcement in 2017 of the first SHA-1 collision [SBK + 17]. The best known results are listed in Table 1: the best collision attack against SHA-1 has complexity 2 61 on CPU [Ste13], and 2 64.7 when implemented on GPU [SBK + 17], while the best chosen-prefix collision attack has complexity 2 77.1 [START_REF] Stevens | Freestart collision for full SHA-1[END_REF].

Even though SHA-1 has been broken in 2004, it is still deployed in many security systems, because collision attacks do not seem to directly threaten most protocols, and migration is expensive. Web browsers have recently started to reject certificates with SHA-1 signatures, but there are still many users with older browsers, and many protocols and softwares that allow SHA-1 signatures. Concretely, it is still possible to buy a SHA-1 certificate from a trusted CA, and many email clients accept a SHA-1 certificate when opening a TLS connection. SHA-1 is also widely supported to authenticate TLS handshake messages.

Main SHA-1 cryptanalysis techniques. Attacks against SHA-1 are based on differential cryptanalysis, where an attacker manages to somewhat control the output of the compression function. Several important ideas were used to turn differential cryptanalysis into an effective tool against hash functions: Linearization [CJ98]. In order to build differential trails with high probability, a linearized version of the step function is used. Differential trails with a low-weight output difference δ O can be used to find near-collisions in the compression function (i.e. two outputs that are close to a collision, the distance metric being for example the Hamming distance). Message modification [BC04,[START_REF] Wang | Finding collisions in the full SHA-1[END_REF] In a differential attack against a hash function, the attacker can choose messages that directly satisfy some of the constraints of the path, because there is no secret key. While the conditions in the first steps are easy to satisfy, more advanced techniques have been introduced to extend the usage of these degree of freedom to later rounds in order to speed-up collision search: neutral bits (firstly introduced for cryptanalysis SHA-0 [BC04, BCJ + 05]), message modifications [START_REF] Wang | Finding collisions in the full SHA-1[END_REF] and boomerangs/tunnels [Kli06,JP07]. Non-linear trails [START_REF] Wang | Finding collisions in the full SHA-1[END_REF]. In order to get more flexibility on the differential trails, the first few steps can use non-linearity instead of following the constraints of the linearized step function. This does not affect the complexity of the search for conforming messages (thanks to messages modification techniques), but it allows to build trails from an arbitrary input difference to a good fixed output difference δ O (or its opposite).

Multi-block technique [CJ98, WYY05a]. The multi-block technique takes

advantage of the Davies-Meyer construction used inside the compression function. Indeed, it can be written as h(x, m) = x + E m (x) where E is a block cipher, and + denotes some group operation. Because of this feedforward, an attacker can use several differential trails in E, and several nearcollisions blocks, to iteratively affect the internal state. In particular, using non-linearity in the first steps, he can derive two related trails 0

δ M δ O and δ O -δ M -δ O in E from
a single linear trail, by swapping the message pair.

When conforming messages are found for each block, this leads to a collision because the internal state differences cancel out (see Figure 1). Birthday phase for chosen-prefix collisions [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF]Ste13]. Differential techniques have also been used for chosen-prefix collision attacks. An attacker can relax the last steps of the differential trail to allow a set D of output differences rather than a single δ O . He can also use several differential trails, and use the union of the corresponding sets. Starting from two different prefixes P, P , the chosen-prefix collision attack has two stages (see Figure 2): -In the birthday stage, the attacker uses a generic collision search with message blocks m 0 , m 0 to reach a difference δ = H(P m 0 ) -H(P m 0 ) in D with complexity roughly π • 2 n /|D|. -In the near-collision stage, he builds a differential trail δ -δ using non-linearity in the first steps, and searches a conforming message to build the chosen-prefix collision. Multi-block for chosen-prefix collisions [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF]. If a collection of differential trails affecting separate parts of the internal state is available, chosenprefix collision attacks can be greatly improved. In particular, if an arbitrary input difference δ R can be decomposed as δ R =δ

O + δ

O + • • • + δ (r) (2)
O , where each δ

(i)
O can be reached as the output of a differential trail, the attacker just has to find near-collision blocks with output differences δ

(1) O , . . . , δ (r)
O (see Figure 3). Alternatively, if this only covers a subset of input differences, the multi-block technique is combined with a birthday stage.

Our contributions. In this work, we describe new chosen-prefix collision attacks against the MD-SHA family, using several improvements to reduce the complexity.

1. The main improvement comes from how we use multiple near-collision blocks.

For instance, using two blocks we can start from any difference in the set S := {δ 1 + δ 2 | δ 1 , δ 2 ∈ D}, and cancel it iteratively with a first block following a trail δ 1 + δ 2 -δ 1 and a second block following a trail δ 2 -δ 2 (see Figure 4). The set S grows with the number of blocks: this reduces the cost of the birthday search in exchange for a more expensive near-collision stage. While there are previous chosen-prefix collision attacks using several nearcollision blocks [LPRR07, Pey07, SLdW07, SSA + 09, MRS15], these attacks use a collection of differential trails to impact different parts of the state (each block uses a different trail). On the opposite, our technique can be used with a single differential trail, or a collection of trails without any special property. In particular, previous chosen-prefix collision attacks based on a single trail (against SHA-1 [Ste13] and MD5 [SSA + 09, Section 6]) used only one near-collision block.

4 198 Symmetric Cryptanalysis Beyond Primitives IV H m 1 m 2 δ M -δ M 0 δ I δ O δ O -δ I -δ O 0 δ O 0 N L 1 N L 2 L L
cv • • • m 1 δ (1) M δ (1) I δ (1) O δ R N L 1 L H m r δ (r) M δ (r) I δ (r) O δ R + i δ (i) O = 0 N L r L
Fig. 3. Multi-block chosen-prefix collision attack. We assume that an arbitrary difference δ R can be decomposed as δ R =δ

O + δ

(2)

O + • • • + δ (r) O
, where each δ

(i)
O can be reached as the output of a differential trail.

In addition, we use a clustering technique to optimize the near-collision stage,

taking advantage of multiple ways to cancel a given difference. For instance, let's assume that we have to cancel a difference δ in the internal state that can be written in two different ways:

δ = δ 1 + δ 2 = δ 1 + δ 2 , with δ 1 , δ 1 , δ 2 , δ 2 ∈ D,
knowing trails δ -δ 1 and δ -δ 1 with the same message constraints. Then, an attacker can target simultaneously -δ 1 and -δ 1 for the first nearcollision block (and use either a trail δ 2 -δ 2 or δ 2 -δ 2 for the second block, depending on the first block found). This can reduce the cost of finding the first block by a factor two. This technique can be seen as a generalization of an optimisation used for collision attacks with two blocks, where the first is less constrained and several output differences are allowed (for instance the SHA-1 collision attack of [Ste13] allows 6 output differences, so that the first block is 6 times less expensive than the second).

Using these techniques, we obtain significant improvements to chosen-prefix collision attacks against MD5 and SHA-1.

Application to MD5. We use multiple near-collision blocks to improve the complexity of the chosen-prefix collision attack with a single near-collision block given in [SSA + 09, Section 6]. We start with the same differential trail, and a set D of size 2 25.2 , built in the same way. Using two near-collision blocks, we can target the set S := {δ 1 + δ 2 | δ 1 , δ 2 ∈ D} which contains 2 37.1 elements. This leads to an attack with complexity roughly π • 2 128 /2 37.1 ≈ 2 46.3 , while the best previous attack with two blocks or less required 2 53.2 MD5 computations. However, the best chosen-prefix collision attack against MD5 is still the attack from [SSA + 09] with complexity 2 39.1 using 9 near-collision blocks.

Application to SHA-1. For SHA-1, we start with the attack of Stevens [Ste13], and after using several improvements we obtain a chosen-prefix collision attack with estimated complexity between 2 66.9 and 2 69.4 SHA-1 computations. This is within a small factor of the complexity of a plain collision attack, estimated at 2 64.7 on average [WYY05a, SBK + 17], and orders of magnitude better than the 2 77.1 computations cost of the currently best known chosen-prefix collision attack [Ste13] on SHA-1. We have conducted tests to check that our assumptions are indeed verified in practice.

First, we use a more relaxed version of the differential trail than used in [Ste13], so that we have a set S of size 8768 rather than 192. This directly reduce the attack cost by a factor 6.75, down to 2 74. 3 . Next, we use the multi-block technique to build a large set S and to reduce further the cost of the birthday stage. Using a set S of size 2 29.4 with a near-collision cost at most 12 × 2 64.7 , this reduces the cost of the attack down to 2 68. 6 (with an optimistic estimate). Finally, we use the clustering technique to reduce the near-collision cost. After optimization, we have a set S of 2 32.67 differences that can be reached with a maximum cost of 3.5 × 2 64.7 (with an optimistic estimate), leading to a full attack with complexity 2 66.9 -about five time more expensive than the collision attack.

Function Collision type

Complexity

Ref.

SHA-1 free-start collision 2 [Ste13] 2 66.9 -2 69. 4 New MD5 collision 2 40 [WY05] 2 16 [SSA + 09] chosen-prefix collision (9 blocks) 2 39.1 [SSA + 09] (3 blocks) 2 49 [SSA + 09] (1 block) 2 53.2 [SSA + 09] (2 blocks) 2 46.3 New Table 1. Comparison of previous and new cryptanalysis results on MD5 and SHA-1. A free-start collision is a collision or the compression function only, where the attacker has full control on all the primitive's inputs. Complexities in the table are given in terms of SHA-1 equivalents on a GTX-970 GPU (when possible).

a The attack has a complexity of 2 61 on CPU, and 2 64.7 on GPU

Our result is surprising since we show that the cost to find a chosen-prefix collision for SHA-1 is not much more than a simple collision search. Moreover our work has a strong impact in practice as chosen-prefix collision attacks are much more dangerous than simple collisions (see for example the case of MD5 [SSA + 09]). This is yet another warning that SHA-1 should be totally removed from any security product as soon as possible. The thinking "a collision attack is not directly exploitable, thus we are fine" is clearly wrong for SHA-1, and we give a proof here.

Our method is in essence quite generic, even though a lot of details have to be taken care of in order to make it work. Since most collision attacks on members of the MD-SHA family are built on the same principles as SHA-1 attacks, we believe similar ideas would apply and a collision attack can probably be transformed into a chosen-prefix collision attack for a reasonable extra cost factor. We do not foresee any reason why this technique would not apply to non MD-SHA hash functions as well (except wide-pipe hash functions which would make the birthday part too costly).

Outline. We first consider the impact of this result and give some recommendations in Section 2. Then, we describe SHA-1 and previous cryptanalysis works on this hash function in Section 3. The generic high-level description of our attack is given in Section 4, while the details regarding its application to MD5 and SHA-1 are provided in Sections 5 and 6, respectively. Eventually, we conclude and propose future works in Section 7.

Implications and Recommendations

Our work shows that finding a chosen-prefix collision is much easier than previously expected, and potentially not much harder than a normal collision search for SHA-1. As a real collision has already been computed for this hash function, one can now assume that chosen-prefix collisions are reachable even by medium funded organisations. Since a chosen-prefix collision attack can break many widely used protocols, we strongly urge users to migrate to SHA-2 or SHA-3, and to disable SHA-1 to avoid downgrade attacks.

Cost Estimation. We use the same estimation process as in [SBK + 17]. With an optimistic spot-price scenario on g2.8xlarge instances of Amazon EC2, the authors estimated that the workload spent to find the SHA-1 collision was equivalent to a cost of about US$ 110 K, with 2 63.4 SHA-1 equivalent calls on GTX-970 GPUs. We recall that they found the collision with less computations than expected. Using expected computational cost, the average workload required to find a SHA-1 collision is equivalent to a cost of about US$ 275 K, or 2 64.7 SHA-1 calls. An optimistic analysis of our attack leads to a complexity of 2 66.9 SHA-1 equivalent calls on GTX-970 GPUs, corresponding to a cost of US$ 1.2 M, while a more conservative analysis yields a complexity of 2 69. 4 , or a cost of US$ 7M.

Hardware will improve as well as cryptanalysis and we can expect that collision together with chosen-prefix collision attacks will get cheaper over the years. Migration from SHA-1 to the secure SHA-2 or SHA-3 hash algorithms should now be done as soon as possible, if not already.

Impact of Chosen-prefix Collisions. Chosen-prefix collision attacks have been demonstrated already for MD5, and they are much more dangerous that identical-prefix collision attacks, with a strong impact in practice. In particular, chosen-prefix collision attack on MD5 have been used to generate colliding X.509 certificates [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF] and later a rogue certificate authority [SSA + 09], undermining the security of websites. They have also been shown to threaten important internet protocols, including TLS, IKE, and SSH using forgery of handshake messages. The SLOTH attacks [START_REF] Bhargavan | Transcript collision attacks: Breaking authentication in TLS, IKE and SSH[END_REF] can break various security properties of these protocols using MD5 chosen-prefix collisions, such as client impersonation in TLS 1.2. MD5 has now been removed from most security applications, but the very same threats are now a reality for SHA-1.

However, after these attacks were demonstrated with MD5, countermeasures have been implemented that make the attacks harder to exploit. In particular, CAs are now expected to randomize the serial number of X.509 certificates, which prevents the attack against certificates. Similarly, IKEv2 implementations randomize the SPI of each connection, forcing an attacker to compute the chosen-prefix collision online, after receiving the SPI. Many implementations are also more strict with suspicious looking messages and parameters (such as the cookies used in the IKEv2 attack), and SHA-1 has been depreciated from some protocols (in particular, RFC 8247 depreciates SHA-1 in IKEv2, and SHA-1 has been removed from TLS 1.3).

8

As far as we understand, attacks with an online chosen-prefix collision should still be possible against the SSH and TLS 1.2 handshake. This is still far from practical 4 , but it is nonetheless significantly easier than it should be with sound cryptographic primitives. Moreover, the IKEv2 and X.509 attacks might still be possible against implementations that still use SHA-1 and don't use proper countermeasures, but this requires a careful analysis of every implementation.

Usage of SHA-1. Even if practically broken only very recently, SHA-1 has been theoretically broken since 2004. It is therefore surprising that SHA-1 remains deployed in many security systems. In particular, as long as SHA-1 is allowed, even if it is not used in normal operation, an attacker can use weaknesses in SHA-1 to forge a signature, and the signature will be accepted.

First, SHA-1 is still widely used to authenticate handshake messages in secure protocols such as TLS, SSH or IKE. As shown with the SLOTH attack [START_REF] Bhargavan | Transcript collision attacks: Breaking authentication in TLS, IKE and SSH[END_REF], this allows various attacks using chosen-prefix collision, such as breaking authentication. These protocols have removed support for MD5 after the SLOTH attack, but SHA-1 is still widely supported. Actually, more than 5 5% of the web servers from Alexa's top 1M (including skype.com) prefer to use SHA-1 to authenticate TLS handshake messages.

An important effort is underway to remove SHA-1 certificates from the Web, and major browsers are now refusing to connect to servers still using SHA-1-based certificates. Yet SHA-1-based certificates remains present: according to scans of the top 1 million websites from Alexa by censys.io, there are still about 35 thousand 6 servers with SHA-1 certificates out of 1.2 million servers with HTTPS support. SHA-1-based certificates are also used with other protocols: for instance 700 thousand 7 out of 4.4 million mail servers (with IMAPS) use a SHA-1 certificate. Actually, it is still possible to buy a SHA-1 certificate from a trusted root 8 ! Even though recent web browsers reject those certificates, they are accepted by older browsers and by many clients for other protocols. For instance, the "Mail" application included in Windows 10 still accepts SHA-1 certificates without warnings when opening an IMAPS connection.

Unfortunately, many industry players did not consider moving away from SHA-1 a priority, due to important costs and possible compatibility and bug issues induced by this move. An often-heard argument is that a simple collision attacks against a hash function is not very useful for an attacker, because he doesn't have much control over the colliding messages. Therefore, there seemed to be a long way to go before really useful collision attacks would be found for SHA-1, if ever. Indeed, the current best chosen-prefix collision attack against SHA-1 requires 2 77.1 hash calls [Ste13], thus orders of magnitude harder than the cost of finding a simple collision. Similarly, in the case of MD5, the cost goes from 2 16 to 2 39 for the currently best known collision and chosen-prefix collision attacks. However, this is a dangerous game to play as the history showed that cryptanalysis only keep improving, and attackers will eventually come up with ways to further improve their cryptanalysis techniques. For example, in the case of MD5, collisions for the compression function were found [dB94] in 1993, collisions for the whole hash function were found [WY05] in 2004, colliding X.509 MD5-based certificates were computed [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF] in 2007, and rogue Certificate Authority certificate [SSA + 09] was eventually created in 2009.

Preliminaries

Description of SHA-1

We describe here the SHA-1 hash function, but we refer to [START_REF]Secure Hash Standard[END_REF] for all the complete details.

SHA-1 is a 160-bit hash function based on the well-known Merkle-Damgård paradigm [START_REF] Damgård | A Design Principle for Hash Functions[END_REF][START_REF] Ralph | One Way Hash Functions and DES[END_REF]. The message input is first padded (with message length encoded) to a multiple of 512 bits, and divided into blocks m i of 512 bits each. Then, each block is processed via the SHA-1 compression function h to update a 160-bit chaining variable cv i that is initialised to a constant and public initial value (IV): cv 0 = IV . More precisely, we have cv i+1 = h(cv i , m i+1 ). When all blocks have been processed, the hash output is the last chaining variable.

The compression function is similar to other members of the MD-SHA family of hash functions. It is based on the Davies-Meyer construction, that turns a block cipher E into a compression function: cv i+1 = E m i+1 (cv i ) + cv i , where E k (y) is the encryption of the plaintext y with the key k, and + is a word-wise modular addition.

The internal block cipher is composed of 80 steps (4 rounds of 20 steps each) processing a generalised Feistel network. More precisely, the state is divided into five registers (A i , B i , C i , D i , E i ) of 32-bit each. At each step, an extended message word W i updates the registers as follows:

           A i+1 = (A i ≪ 5) + f i (B i , C i , D i ) + E i + K i + W i B i+1 = A i C i+1 = B i ≫ 2 D i+1 = C i E i+1 = D i
where K i are predetermined constants and f i are boolean functions (in short: IF function for the first round, XOR for the second and fourth round, MAJ for the third round, see Table 2). Since only a single register value is updated 10 204 Symmetric Cryptanalysis Beyond Primitives (A i+1 ), the other registers being only rotated copies, we can express the SHA-1 step function using a single variable:

A i+1 = (A i ≪ 5) + f i (A i-1 , A i-2 ≫ 2, A i-3 ≫ 2) + (A i-4 ≫ 2) + K i + W i .
For this reason, the differential trails figures in this article will only represent A i , the other register values at a certain point of time can be deduced directly.

step i f i (B, C, D) K i 0 ≤ i < 20 f IF = (B ∧ C) ⊕ (B ∧ D) 0x5a827999 20 ≤ i < 40 f XOR = B ⊕ C ⊕ D 0x6ed6eba1 40 ≤ i < 60 f M AJ = (B ∧ C) ⊕ (B ∧ D) ⊕ (C ∧ D) 0x8fabbcdc 60 ≤ i < 80 f XOR = B ⊕ C ⊕ D 0xca62c1d6
Table 2. Boolean functions and constants of SHA-1

The extended message words W i are computed linearly from the incoming 512-bit message block m, the process being called message extension. One first splits m into 16 32-bit words M 0 , . . . , M 15 , and then the W i 's are computed as follows:

W i = M i , for 0 ≤ i ≤ 15 (W i-3 ⊕ W i-8 ⊕ W i-14 ⊕ W i-16 ) ≪ 1, for 16 ≤ i ≤ 79

Previous Works

Collision attacks on SHA-1. We quickly present here without details the previous advances on SHA-1 collision search. First results on SHA-0 and SHA-1 were obtained by linearizing the compression function and constructing differential trails based on the probabilistic event that difference spreads will indeed happen linearly. These linear trails are generated with a succession of so-called local collisions (small message disturbances whose influence is corrected with other message differences inserted in the subsequent SHA-1 steps) that follows the SHA-1 message expansion. However, with this linear construction, impossibilities might appear in the first 20 steps of SHA-1 (for example due to the f IF boolean function that never behaves linearly in some specific situations) and the cheapest linear trail candidates might not be the ones that start and end with the same difference (which is a property required to obtain a collision after the compression function feed-forward). Thus, since [START_REF] Wang | Finding collisions in the full SHA-1[END_REF], collision attacks on SHA-1 are performed using two blocks containing differences. The idea is to simply pick the cheapest linear trail from roughly step 20 to 80, without paying any attention to the f IF constraints or to the input/output differences. Then, the attacker will generate a non-linear differential trail for the first 20 steps in order to connect the actual incoming input difference to the linear part difference at step 20. With two successive blocks using the same linear trail (just ensuring that the output difference of the two blocks have opposite signs), one can see in Figure 1 that a collision is obtained at the end of the second block.

Once the differential trail is set, the attacker can concentrate on finding a pair of messages that follows it for each successive block. For this, he will construct a large number of messages that follow the trail up to some predetermined step, and compute the remaining steps to test whether the output difference is the required one. The computational cost is minimized by using a simple early-abort strategy for the 16 first steps, but also more advanced amortization methods such as neutral bits [BCJ + 05], boomerangs [JP07] or message modification [START_REF] Wang | Finding collisions in the full SHA-1[END_REF] for a few more steps. Usually, the first 20 or so steps do not contribute the complexity of the attack.

Chosen-prefix collision attacks. The first concrete application of a chosenprefix collision attack was proposed in [START_REF] Stevens | Chosen-prefix collisions for MD5 and colliding X.509 certificates for different identities[END_REF] for MD5. This work was also the first to introduce a birthday search phase in order to find such collisions. The idea is to process random message blocks after the challenged prefixes, until the chaining variable difference δ belongs to a large predetermined set S. Since the message blocks after each prefix are chosen independently, this can be done with birthday complexity π • 2 n /|S|. Then, from that difference δ, the authors eventually manage to reach a collision by slowly erasing the unwanted difference bits by successfully applying some near-collision blocks. We note that the starting difference set S during the birthday phase must not be too small, otherwise this phase would be too costly. Moreover, the near-collisions blocks must not be too expensive either, and this will of course depend on the cryptanalysis advancements of the compression function being studied.

Finally, using also this two-phase strategy, in [Ste13] is described a chosenprefix collision attack against the full SHA-1, for a cost of 2 77.1 hash calls. The improvement compared to the generic 2 80 attack is not very large, due to the difficulty for an attacker to generate enough allowable differences that can later be erased efficiently with a near-collisions block. Indeed, the compression function of SHA-1 being much stronger than that of MD5, few potential candidates are found. Actually, Stevens only considers one type of near collision block, following the best differential trail used for the collision attack. By varying the signs of the message and output differences, and by letting some uncontrolled differences spread during the very last steps of the compression function, a set S of 192 allowable differences is obtained. However, having such a small set makes the birthday part by far the most expensive phase of the attack.

In this article, we will use essentially the same strategy: a birthday phase to reach a set S of allowable differences and a near-collision phase to remove the remaining differences. We improve over previous works on several points. First, we further generalise for SHA-1 the set of possible differences that can be obtained for a cheap cost with a single message block. Secondly, we propose a multi-block strategy for SHA-1 that allows to greatly increase the size of the set S. Finally, we study the clustering effect that appears when using a multi-block strategy. This can be utilised by the attacker to select dynamically the allowable differences at the output of each successive blocks, to further reduce the attack complexity. Notably, and in contrary to previous works, our set S is not the direct sum of independent subspaces corresponding to distinct trails. On the opposite, our applications use the same core differential trail for all the near-collision blocks. Overall, we improve substantially previous attack [Ste13] from 2 77.1 SHA-1 calls to only 2 66.9 . Surprisingly, our attack is very close to some sort of optimal since its cost is not much greater than that of finding a simple collision. Our attack being rather generic, we believe that this might be the case for many hash functions, which contradicts the idea that chosen-prefix collisions are much harder to obtain than simple collisions.

One can mention other parallel researches conducted on finding chosen-prefix collision attacks for various hash functions. For example, in [Pey07], the author explains how to compute collisions with random incoming differences in the internal state for the GRINDAHL hash function, the strategy being to slowly remove these differences thanks to the many degrees of freedom available every step. Such a divide-and-conquer technique is not applicable at all to SHA-1 as the degrees of freedom are much fewer and only available at the beginning of the compression function. In [MRS15], inspired by the second-preimage attack against SMASH [LPRR07], the authors proposed a chosen-prefix collision attack on a reduced version of the GROSTL hash function. However, this attack strongly relies on the ability of the attacker to perform a rebound attack, which seems really hard to achieve in the case of SHA-1.

From Collision to Chosen-Prefix Collision

The Chosen-prefix Collision Attack

We assume that the hash function considered is an n-bit narrow pipe primitive, based on a Merkle-Damgård-like operating mode. In addition, we assume that the compression function is built upon a block cipher in a Davies-Meyer mode.

Preparing the attack. The attacker first builds a set S and a graph G; S corresponds to a set of differences that can be cancelled with near-collision blocks, and G is used to find the sequence of blocks needed to cancel a difference in S. We first explain how to execute the attack when S and G are given, and we will explain how to build them in Section 4.2.

The prefixes (stage 1 of Figure 4). The attacker receives the two challenge prefixes and pads them to two prefixes of the same length, to avoid differences in the final length padding. After processing the two padded prefixes starting from the IV, he reaches states cv/cv , and we denote the corresponding difference as δ R . 4. High-level view of the chosen-prefix collision attack

O δ N L 1 L • • • H m r δ (r ) M δ (r ) I δ (r ) O δ + i δ (i) O = 0 N L r L u δ ∈ S Fig.

14

The birthday search (stage 2 of Figure 4). The goal of the attacker is now to find one message block pair (u, u ) to reach a chaining variable pair with a difference δ that belongs to S, the set of acceptable chaining variable differences.

For this stage, we use the parallel collision search algorithm of van Oorschot and Wiener [vW99]. When a memory M C is available, this algorithm can find C collisions in a function f : {0, 1} k → {0, 1} k with complexity π/2 • 2 k • C, and is efficiently parallelizable. It computes chains of iterates of the function f , and stops when the end point is a distinguished point, i.e. it satisfies some easy to detect property. In practice, we stop a chain when x < 2 k • θ, with θ C/2 k , and we store on average the starting points and end points of θ • π/2 • 2 k • C chains (the expected length of a chain is 1/θ). When colliding end points are detected, we restart the corresponding chains to locate the collision point, with an expected cost of 2C/θ, which is small compared to the total complexity if θ C/2 k . In our case, we are looking for message blocks (u, u ) such that h(cv, u)h(cv , u ) ∈ S. Therefore, we need a function f such that a collision in f corresponds to good (u, u ) with high probability. First, we consider a truncation function τ : {0, 1} n → {0, 1} k , so that pairs (x, x ) with xx ∈ S have τ (x) = τ (x ) with high probability:

p = Pr x,x [τ (x) = τ (x ) | x -x ∈ S] ≈ 1.
For functions of the MD-SHA family, the group operation + is a word-wise modular addition, and we build τ by removing bits that are directly affected when adding a value in S, and bits that are affected by a carry with a relatively high probability. This typically leads to p close to one (as seen in previous attacks [SSA + 09, Ste13], and the new attacks in this paper). Then, we build f as:

f (u) := τ (h(cv , pad(u))) if u[0] = 1; τ (h(cv , pad(u))) else.
The probability that a collision in f corresponds to a pair (u, u ) with h(cv, u)h(cv , u ) ∈ S can be estimated as:

p f = 1 2 • Pr x,x [x -x ∈ S | τ (x) = τ (x )] = p 2 • |S|/2 n 2 -k
Finally, we need 1/p f collisions in f , and the total complexity of the birthday stage is on average:

π 2 • 2 k p f = π • 2 n p • |S| ≈ π • 2 n |S| .
The multi-block collision search (stage 3 of Figure 4). The attacker now uses the graph G to build a sequence of near-collision blocks that ends up with a collision. Each node of the graph represents one chaining variable difference in the set S. To each node i of the graph is associated a cost value w i that represents the cost an attacker will expect to pay from this particular chaining variable difference i in order to reach a colliding state (with one or multiple message blocks). Of course, a null cost will be associated with the zero difference (w 0 = 0). A directed edge from node i to node j represents a way for an attacker to reach chaining variable difference j from difference i with a single message block. Note that the graph is acyclic, as we will ensure that the edges will always go to strictly lower costs (i.e. an edge from i to j is only possible if w j < w i ). To each edge is attached the details of the differential trail and message difference to use for that transition to happen. However, a very important point is that all edges going out of a node i will share the same core differential trail (by core differential trail, we mean the entire differential trail except the last steps for which one can usually accept a few divergences in the propagation of the differences). For example, during the attack, from a chaining difference i, an attacker can potentially reach difference j or difference k using the same core differential trail (and thus without having to commit in advance which of the two differences he would like to reach). Thus, in essence, the details of the differential trail and message difference to use can be directly attached to the source node.

Once the attacker hits a starting difference δ ∈ S in the birthday phase, he will pick the corresponding node in G, and use the differential trail and message difference attached to this node. He will use this differential trail until he reaches one of the target nodes (which has necessarily a lower expected cost attached to it). As explained in the next section, targeting several nodes simultaneously reduces the cost of the attack, because it is easier to hit one node out of many than a fixed one. We call this the clustering effect, because we use a cluster of paths in the graph. When a new node is reached, the attacker repeats this process until he eventually reaches the colliding state (i.e. null difference). Overall, the expected computational cost for this phase is the cost attached to the node δ (in practice, when actually computing one collision, he might pay a slightly lower or higher computational cost as the w i 's are expected values).

We note that any suffix message blocks that do not contain differences can of course be added after this colliding state, as the Merkle-Damgård-like mode will maintain the collision throughout the subsequent compression function calls.

Building the Set S and the Graph G

We now describe how the set S and the graph G can be built during the preparation of the attack. For that, we first need to describe what an adversary can do when he tries to attack the compression function. We consider that the attacker knows some good core differential trails for the internal block cipher E, that is differential trails that go from early steps to late steps of E. For each core differential trail CDT i there are several possible output differences δ i j for E. This is typically what happens in the chosen-prefix collision attack on SHA-1 [Ste13] where some differences in the very last steps can be allowed to spread differently than planned, thus generating new output differences. We denote the set of all possible output differences as D (in particular, we have 0 ∈ D, and δ ∈ D ⇐⇒ -δ ∈ D because of symmetries).

We finally assume that any input difference for E can be mapped to any of the core differential trails inside the primitive. In the case of a SHA-1 attack, this is achieved with the non-linear part of the trail in the first steps of the function. As shown in previous works, it allows to map any input difference to any internal difference. The non-linear part has a low probability, but during the near-collision search this is solved using the many degrees of freedom available in the first steps of the function.

Building the graph G . The attacker will first build a graph G and filter it later to create G. The graph G is similar to the graph G: each node will represent a chaining variable difference. A directed edge from node i to node j represents again a way for an attacker to reach chaining variable difference j from difference i with a single message block, stored with the details of the differential trail attached to it, and the cost to find the corresponding block. The differences with G are that (see Figure 5):

-G can potentially be cyclic, as we do not ensure that an edge goes from a higher to a strictly smaller cost; -all outgoing edges from a node i will not necessarily share the same core differential trail; -there can be several edges from i to j, with different core differential trails.

In order to build the graph G , starting from the colliding state δ = 0, we will simply proceed backward. We go through all possible core differential trails for E and their possible output differences δ i j . Due to the feed-forward of the Davies-Meyer construction, all these differences can be used to reach the colliding state by simply forcing their respective opposite -δ i j as input difference of the cipher (since we assumed that any input difference for E can be mapped to any of the core differential trails inside the primitive, this is always possible). Thus, for each such difference δ i j coming from a core differential trail CDT i , we will add a node -δ i j in the graph G , and an edge going from this new node to the colliding state. If a node with that difference already exists in the graph, we add the edge between this node and the colliding state. This means that nodes can have several incoming and outgoing edges.

We iteratively repeat this process again with all the newly created nodes as starting points (instead of the collision state). This will create a bigger and bigger graph as we keep iterating, and the attacker can simply stop when he believes that he has enough nodes in the graph (alternatively, he can set an upper limit on the cost of the nodes to consider, or on the depth of the search, which will naturally limit the size of the graph).

The clustering effect. A simple way to build a graph G for the attack is to keep only the minimal cost paths in the graph G (the corresponding edges form a tree), and to set the cost of the nodes to cost of the minimal path. However,

0 2α α -α -2α 4α 3α -3α -4α 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 2 2 2 2
Fig. 5. Example of a graph G , with a bundle {α, 2α} with costs 1 and 2 (solid green lines), and a bundle {-α, -2α} with costs 1 and 2 (dashed red lines). The corresponding set S is {-4α, -3α, -2α, -α, 0, α, 2α, 3α, 4α}. Fig. 6. The graph G corresponding to G . We show the cost of each edge and each node. In particular, note that use of clustering reduces the cost of node 4α from 4 to 64/27 ≈ 2.37 the attack cost can be greatly improved with the clustering effect: during the last phase of the attack, when the attacker is currently located at a node N , he does not necessarily need to choose in advance which outgoing edge of N he will try to follow. Indeed, the only commitment he needs to make at this point is which core differential trail he will use to go to the next node. Thus, he can simultaneously target several output differences corresponding to the same core differential trail, and the cost to reach one difference out of many is significantly lower than the cost of reaching any given output difference. For instance, when computing the first block of a SHA-1 collision, Stevens [Ste13] allows six output differences with a similar cost, so that the cost to reach one of them is one sixth of the cost to reach a predetermined one.

For a given node, we call bundle of a core differential trail CDT i the grouping of all outgoing edges of that node that use CDT i (see Figure 5). Let B N stand for the set of all bundles of a node N , where each bundle β ∈ B N corresponds to a distinct core differential trail CDT i . Then, for each node of G , we compute its 18 assigned cost as follows 9 :

w N = min β∈B N        1 + (N,j)∈β|w j <w N w j /c β j (N,j)∈β|w j <w N 1/c β j        , (1)
where for an edge (N, j) of the bundle β, c β j represents the cost to find a conforming message pair with difference output j -N for E, and w j is the cost assigned to the node j.

We initialize the costs of the nodes in G using the shortest path in the graph, and update them iteratively until we can't find any more opportunity for improvement.

Building S and G. The graph G is obtained from G by only keeping the edges that goes from a higher to a strictly lower cost (in order to render the graph acyclic), and by only keeping for each node the outgoing edges for the bundle that minimizes the cost w N in (1).

The set S is then finally deduced by harnessing all the differences corresponding to every node in G (one node in G will correspond to one difference in S). In particular, if G includes all nodes at depth at most r, then

S = {δ 1 + δ 2 + • • • + δ r | δ 1 , δ 2 , . . . , δ r ∈ D}.

Application to MD5

Our techniques can easily be applied to MD5, to build an alternative chosenprefix collision attack. We can't reach an attack complexity as low as 2 39 (the best attack from [SSA + 09]), because this would require to build a set S and graph G of size roughly 2 50 , which is impractical. However, when the number of blocks available for the chosen-prefix collision is limited, the complexity of the best-known attack grows; for instance, the chosen-prefix collision used to create a rogue certificate was limited to 3 blocks, and this increased the complexity to 9 In order to explain this formula, we consider that when the adversary uses a bundle β, he has to perform C β operations to find a pair conforming to the core differential trail up to some intermediate step, and those pairs lead to an output difference j -N (i.e. to node j) with probability p β j (with p β j = C β /c β j ). If none of the predetermined output differences is reached (or if the target node reached has a cost w j ≥ w N ), then he stays at node N and will have to still pay w N to reach the colliding state. Thus, we have that:

w N = C β + j∈β|w j <w N p β j • w j +   1 - j∈β|w j <w N p β j   • w N which leads to (1) with c β j = C β /p β j .
2 49 . In this scenario we can improve the currently best-known attack with our multi-block technique using a single differential trail. We start from the single-block chosen-prefix collision attack given in [SSA + 09, Section 6]: this attack uses a high probability trail for MD5 collisions, where the last steps are relaxed to allow a set D of size 2 23.3 . Therefore the birthday stage has complexity roughly π • 2 128 /2 23.3 ≈ 2 53.2 , and the near-collision block is found with a complexity of 2 40.8 . In our analysis, we recomputed the set D used by Stevens et al., but we actually found a set of size 2 24.2 using the same trail, with a maximum cost of 2 26 • 2 14.8 (following [SSA + 09], we only consider output differences with δa = -2 5 , δd = -2 5 + 2 25 , δc = -2 5 mod 2 20 ). Then, we extend D by adding the zero value and the opposite of each value, to generate D := D ∪ -D ∪ {0}. Finally, we build the set S and the graph G corresponding to an attack with at most 2 blocks, with

S := {δ 1 + δ 2 | δ 1 , δ 2 ∈ D }.
Since the cost of the near-collision stage is negligible (at most 2 • 2 40.8 ), we do not need to use clustering, and we can just use the minimal cost paths of G as the graph G.

We find that the set S contains 2 37.1 elements, so that the birthday stage has a complexity of roughly π • 2 128 /2 37.1 ≈ 2 46.3 . Therefore, we have a simple chosen-prefix collision attack with two near-collision blocks with complexity 2 46.3 , while the best previous attack with two blocks or less requires 2 53.2 MD5 computations, and even the best attack with three blocks requires 2 49 MD5 computations.

Application to SHA-1

For the attack on SHA-1, we directly recycle the details of the collision attack from [SBK + 17]: we will use the same linear part for our successive near-collision blocks (even though the very last steps might behave slightly differently as we will explain in this section). We assume that the attacker can generate non-linear parts on the fly and can apply amortization methods just like in [SBK + 17]. In order to validate this assumption, we have tried to generate a non-linear part with several random input differences from S and random input chaining values. In our experiments, we have successfully generated such non-linear part, and we could even make it limited to the very first SHA-1 steps. We discuss this assumption and our experiments in more details in Section 6.3.

We now explain how to apply the framework of Section 4 to a chosen-prefix collision against SHA-1. As mentioned, our attack uses the best core trail known for attacks against SHA-1, as used in previous attacks [Ste13, Ste12, SBK + 17]. This allows us to have a relatively good complexity estimation for the attack, because this trail has been well studied, and a full collision attack with this trail was recently implemented. In the following we denote the complexity to find a block conforming to the trail (with an optimal output difference) as C block . In the case of the recent collision attack, this cost was estimated as C block = 2 64.7 SHA-1 evaluations on a GTX-970 GPU [SBK + 17, Section 5.7]. In this work, we consider several hypothesis for the cost of finding near-collision blocks: an optimistic hypothesis with C block = 2 64. 7 (following [SBK + 17]) and a conservative 20 hypothesis with C block = 2 67.7 . This parameter depends on the difficulty of linking an arbitrary input difference to the core trail, and will be discussed in more detail below.

As in the previous chosen-prefix collision attack on SHA-1 [Ste13], we consider several variants of the core trail by changing some of the message constraints in the last steps (in particular, we flip the sign of some message bits), and we relax the last steps to reach a larger set of output difference. However, we do this more exhaustively than Stevens: he only describes a set D of size 192 with cost at most 1.15 • C block , but we found a set of size 8768 with cost at most 8 • C block , including 576 values with cost at most 1.15 • C block . In particular, this directly leads to an improvement of the single-block chosen-prefix collision from [Ste13], with complexity roughly π • 2 160 /8768 ≈ 2 74.3 , rather than π • 2 160 /192 ≈ 2 77 (ignoring some technical details of the birthday step).

More precisely, we allow the signs of the message differences to not necessarily follow local collision patterns in the last steps. Instead, we consider variants of the trail where each of those constraints is either followed or not. In addition, we fix the sign of some additional state bits to reduce the cost to reach a given output difference. Table 3 compares our message constraints with those used for the second-block of the attack from [SBK + 17]. This leads to 288 differences with optimal probability (2 -19.17 in steps 61 to 79), and 288 with almost optimal probability (2 -19.36 in steps 61 to 79), as listed in Table 4. Moreover, we consider output differences whose cost is higher than the optimal cost C block , up to roughly 8 • C block (we allow a probability up to 2 -22 in steps 61 to 79).

Instead of building the corresponding set of output differences and their probability analytically, we used a heuristic approach. For each choice of the message constraints z i in Table 3 (up to some symmetries), we generated 2 30 intermediate states at step 60, and we computed the corresponding output differences in order to identify high probability ones. We also keep track of the differences reached with the same constraints, to build the corresponding bundles of differences. Next, we used symmetries in the set of differences to verify the consistency of the results, and to increase the precision of the heuristic probabilities. This strategy leads to a set of 8768 possible output differences, grouped in 2304 bundles. We list the output differences with (almost) optimal probability that we have identified in Table 4, with the corresponding bundles (we do not give the set with all considered differences due its large size).

Next, we build the set S of acceptable differences, and the graph G that indicates the sequences of near-collision blocks to use to cancel the differences in S. We first build the graph G as explained in Section 4.2. We use a limit on the cost of the nodes added to graph: we only consider nodes that have a path with cost at most 18 • C block in the graph G (where this cost is computed with a single path, without using clustering). This yield a set of 2 33.78 unique differences. After optimizing the cost with clustering, most of the nodes have a cost at most 4.5 • C block , and we use a subset of the graph by bounding the cost of the near-collision stage. We describe various trade-offs in

W [5] 68 = W [0] 67 ⊕ 1 W [5] 68 = W [0] 67 ⊕ 1 W [30] 72 = W [0] 67 ⊕ 1 W [30] 72 = W [0] 67 ⊕ 1 W [6] 71 = W [1] 70 ⊕ 1 W [6] 71 = W [1] 70 ⊕ 1 W [5] 72 = W [0] 71 ⊕ 1 W [5] 72 = W [0] 71 ⊕ 1 W [30] 76 = W [0] 71 ⊕ 1 W [30] 76 = W [0] 71 ⊕ 1 W [7] 74 = W [2] 73 ⊕ 1 W [7] 74 = W [2] 73 ⊕ 1, W [2] 73 = z W [6] 75 = W [1] 74 ⊕ 1 W [6] 75 = W [1] 74 ⊕ 1 W [6] 76 = W [1] 75 ⊕ 1 W [6] 76 = W [1] 75 ⊕ 1 W [1] 76 = W [0] 76 ⊕ 1 W [1] 76 = z 2 , W [0] 76 = z W [1] 77 = W [0] 77 ⊕ z 1 W [1] 77 = z 4 , W [0] 77 = z W [2] 77 = W [1] 77 ⊕ 1 W [2] 77 = z 6 W [8] 77 = W [3] 76 ⊕ 1, W [3] 76 = z 2 W [3] 76 = z 7 , W [8] 77 = z W [0] 78 = W [7] 74 W [0] 78 = z 9 W [3] 78 = z 3 W [3] 78 = z 10 W [7] 78 = z 4 W [7] 78 = z 11 W [2] 79 = z 5 W [2] 79 = z 12 W [4] 79 = z 6 W [4] 79 = z 13
Table 3. Message constraints in the final steps. The z i are fixed to 0 or 1 to define variant of the trail with distinct output differences. We use three more constraints than [SBK + 17].

reduces the cost of the birthday stage, but increase the cost of the near-collision stage.

We note that the memory requirements of our attack are rather limited: one just has to store the graph, and the chains for the birthday phase. With the parameters we propose, this represents less than 1TB.

Limiting the number of near-collision blocks

The attack above is optimized to minimize the time complexity of the attack, but this can result in long paths in the graph. For instance, when starting from a random difference with cost at most 3.0 • C block , a random path has on average 15.7 near-collision blocks, but the maximal length is 26 near-collision blocks. This might be impractical for some applications of chosen-prefix collision attacks, and the work needed to generate all the differential trails for the near-collision blocks might also be an issue.

Therefore, we propose an alternative attack where we limit the length of the paths in the graph G. This result in a slightly higher complexity, but might be better in practice. More precisely, we first construct a graph with only paths of length 1, and we iteratively build graphs by increasing the length of allowed paths. Note that a given difference can often be reached by many paths of varying length, and the cost of a node decreases when allowing longer paths.

22

Bundle

Output difference

Proba (-log)

B 1 0xffffedea 0xffffff70 0x00000000 0x00000002 0x80000000 19.17 0xffffedee 0xffffff70 0x00000000 0x00000002 0x80000000

19.17 0xffffefea 0xffffff80 0x00000000 0x00000002 0x80000000

19.17 0xffffefee 0xffffff80 0x00000000 0x00000002 0x80000000

19.17 0xffffe5ec 0xffffff30 0x80000000 0x00000002 0x80000000

19.36 0xffffe7ec 0xffffff40 0x80000000 0x00000002 0x80000000

19.36

B 2 0xffffedea 0xffffff70 0x00000000 0xfffffffe 0x80000000 19.17 0xffffedee 0xffffff70 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefea 0xffffff80 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefee 0xffffff80 0x00000000 0xfffffffe 0x80000000

19.17 0xffffe5ec 0xffffff30 0x80000000 0xfffffffe 0x80000000

19.36 0xffffe7ec 0xffffff40 0x80000000 0xfffffffe 0x80000000

19.36 B 3 0xffffedea 0xffffff70 0x00000000 0x00000002 0x80000000 19.17 0xffffedee 0xffffff70 0x00000000 0x00000002 0x80000000

19.17 0xffffefea 0xffffff80 0x00000000 0x00000002 0x80000000

19.17 0xffffefee 0xffffff80 0x00000000 0x00000002 0x80000000

19.17 0xfffff5ec 0xffffffb0 0x80000000 0x00000002 0x80000000

19.36 0xfffff7ec 0xffffffc0 0x80000000 0x00000002 0x80000000

19.36 B 4 0xffffedea 0xffffff70 0x00000000 0xfffffffe 0x80000000 19.17 0xffffedee 0xffffff70 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefea 0xffffff80 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefee 0xffffff80 0x00000000 0xfffffffe 0x80000000

19.17 0xfffff5ec 0xffffffb0 0x80000000 0xfffffffe 0x80000000

19.36 0xfffff7ec 0xffffffc0 0x80000000 0xfffffffe 0x80000000

19.36

B 5 0xffffedaa 0xffffff6e 0x00000000 0x00000002 0x80000000 19.17 0xffffedae 0xffffff6e 0x00000000 0x00000002 0x80000000

19.17 0xffffefaa 0xffffff7e 0x00000000 0x00000002 0x80000000

19.17 0xffffefae 0xffffff7e 0x00000000 0x00000002 0x80000000

19.17 0xffffe5ac 0xffffff2e 0x80000000 0x00000002 0x80000000

19.36 0xffffe7ac 0xffffff3e 0x80000000 0x00000002 0x80000000

19.36 B 6 0xffffedaa 0xffffff6e 0x00000000 0xfffffffe 0x80000000 19.17 0xffffedae 0xffffff6e 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefaa 0xffffff7e 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefae 0xffffff7e 0x00000000 0xfffffffe 0x80000000

19.17 0xffffe5ac 0xffffff2e 0x80000000 0xfffffffe 0x80000000

19.36 0xffffe7ac 0xffffff3e 0x80000000 0xfffffffe 0x80000000

19.36 B 7 0xffffedaa 0xffffff6e 0x00000000 0x00000002 0x80000000 19.17 0xffffedae 0xffffff6e 0x00000000 0x00000002 0x80000000

19.17 0xffffefaa 0xffffff7e 0x00000000 0x00000002 0x80000000

19.17 0xffffefae 0xffffff7e 0x00000000 0x00000002 0x80000000

19.17 0xfffff5ac 0xffffffae 0x80000000 0x00000002 0x80000000

19.36 0xfffff7ac 0xffffffbe 0x80000000 0x00000002 0x80000000

19.36 B 8 0xffffedaa 0xffffff6e 0x00000000 0xfffffffe 0x80000000 19.17 0xffffedae 0xffffff6e 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefaa 0xffffff7e 0x00000000 0xfffffffe 0x80000000

19.17 0xffffefae 0xffffff7e 0x00000000 0xfffffffe 0x80000000

19.17 0xfffff5ac 0xffffffae 0x80000000 0xfffffffe 0x80000000

19.36 0xfffff7ac 0xffffffbe 0x80000000 0xfffffffe 0x80000000

19.36

Table 4. Bundles of trails with (near) optimal cost and the corresponding probability for steps 61-79. For each bundle B i in the table, there are 32 related bundles where we flip some of the messages bits, that can be constructed as:

B 0 = {B i } B 1 = {β + (2 5 , 0, 0, 0, 0) | β ∈ B} B ∈ B 0 ∪ B 0 B 2 = {β + (2 3 , 0, 0, 0, 0) | β ∈ B} B ∈ B 1 ∪ B 1 B 3 = {β + (2 13 , 2 8 , 0, 0, 0) | β ∈ B} B ∈ B 2 ∪ B 2 B 4 = {β + (2 9 , 2 4 , 0, 0, 0) | β ∈ B} B ∈ B 3 ∪ B 3 B 5 = {β + (2 6 , 2, 0, 0, 0) | β ∈ B} B ∈ B 4 ∪ B 4 .
The set used in [Ste13] corresponds to bundles B 1 to B 4 , with extension rules B 1 to B 4 . Note that most output differences appears in several bundles.

23

We have constructed exactly the graph with all paths of length at most 4, and all paths of length at most 8 and cost at most 3.5 • C block ; for larger parameters, we cannot build the full graph, but we can build an approximation by limiting the set of values as in the previous construction. We give the size of the corresponding sub-graphs in Table 6. As we can see, with 8 near-collision blocks we already have a set S almost as large as the set corresponding to the previous attack (cf. Table 5), so that limiting the attack to 8 blocks has a small impact on the complexity. We can even find chosen-prefix collisions with just 4 near-collision blocks with a small cost increase, using a larger threshold on the maximum cost per block. We evaluate the complexity of such attacks in detail in Table 7.

We can also study the sparseness of the values in S to better understand the difficulty of building the differential trails for the near collision blocks. Using the set of size 2 29.71 with a limit of 8 near-collision blocks and a maximum cost of 3.0 • C block , the maximum weight in the differences is 26, and the average is 15.4 (using the non-adjacent form -NAF).

Birthday Stage

For the birthday stage of the attack, we follow the approach given in [Ste13]: we consider a truncation of the SHA-1 state by keeping bits which are likely to contain a difference, and we use the distinguished points technique of [vW99]. Parameters for the birthday step with various choice of G are given in Table 5; we now explain in detail the case where the maximum cost of the near-collision stage is set to 3.0 • C block . First, we truncate the state to 98 bits10 so that for a random pair of values with their difference in S, there is a probability 0.78 that the values collide on 98 bits (this probability has been computed with the tools from [Leu12]). Reciprocally, if two truncated SHA-1 outputs are equal, then their difference is in the set S with probability 2 -31.97 . Therefore, the birthday stage will require on average 2 • 2 31.97 collisions in the following function:

f (r) := τ (h(cv , pad(u))) if u[0] = 1; τ (h(cv , pad(u))) else.
In order to keep the cost of rerunning the trail low, we use chains of average length 2 31 (i.e. a point u is distinguished when u < 2 98-31 ). Therefore, the expected complexity of the birthday stage is11 : Table 7. Trade-offs between the cost of birthday phase and the near-collision phase with a limited number of near-collision blocks (4 or 8).

T = π/2 • 2 98 • 2

Near-Collision Stage

i A i W i
-4: 10110011001011000101111011010101 -3: 110110001100001000100111un01un01 -2: 001010100011010111011unnn1011n11 -1: 00101010111000011un1nn0010n0u111 00: 1010111000111un1u0110n1u0nn0un1n 1011un01010001010101111110-10-u0 01: 10100u101u0u10101n1nu0111n-u1-1u nu1110011101100011110-00-00n0110 02: 1u1u0nn010nuunnu11011uuuu0001uu1 u1nn0u000100010001010111---unn00 03: u1un01uunn1u1010u0u101101nu11uu1 00uuun1111010111100111010000-u1-04: n0110unnnnnnnnnnnnnn11nu1000u1n1 n0nunu00----001----0---1000uu0u1 05: un0n011100--11001--111-1u1uu1u11 10u-1--101110-000-1100-0110n-00-06:

1101-0-101101011110101-10nun01uu --u--u1----------------0101uun-- 07: 0nuu-00----------------0100100uu xun-nu------------1-1----11u0u-- 08: ---u01----------------0--0n010-u ----un------------------------u0 09: 0n--------------------0--1-1--0u xn----------------------0--n-0-- 10: 1--1-1------------------0---1---x-nx-x-------------1-------uxx-- 11: -1n-----------------------0-------u0nn-------------------1-1-u-- 12: ----0---------------------1-----n-nxxu---------------------un--- 13: n---1---------------------------x-uu-0---------------------u---- 14: --n-------------------------------------------------------1-un-- 15: u-1-1---------------------------x-nxn----------------------n---- 16: un0-0-------------------------------u----------------------nu--- Table 8.
Example of a SHA-1 non-linear differential path generated for one of the differences in S. Notations follow [START_REF] De Cannière | Collisions for 70-step SHA-1: On the full cost of collision search[END_REF].

δ = [-2 17 -2 15 + 2 10 -2 8 + 2 5 + 2 6 -2 2 + 2 0 , -2 13 + 2 11 + 2 10 + 2 5 -2 3 , -2 5 + 2 0 , -2 4 -2 0 , 0], with cost 2.954 • C block .
An important parameter to evaluate the cost of the attack is C block , the complexity to find near-collision blocks. An optimistic hypothesis is that we can find them with same complexity as in the attack of [SBK + 17], i.e. C block = 2 64. 7 . As mentioned earlier, we have conducted tests to verify that one can easily find short non-linear differential paths, regardless of the input chaining difference and value, to allow for a good use of neutral bits (one path example is given in Table 8).

We note that our trails are somewhat more constrained than the trails used in the collision attack, because we have denser chaining value differences and we have a few more conditions in the last round, as seen in Table 3. This could lead to fewer degrees of freedom than in the collision attack of Stevens et al., and increase the cost of finding a conforming block. In particular, this can affect the use of accelerating techinques such as neutral bits and boomerangs; boomerangs are the most powerful technique, but they require significant degrees of freedom in the path construction. Therefore, we also consider a conservative complexity estimate, where we assume that boomerangs are no longer available. Since there are three boomerangs in the trail of [SBK + 17], this would give C block = 2 67. 7 .

Our experiments show that that those assumptions are reasonable. The path given in Table 8 is about as constrained as the path used for the second block of the collision attack [SBK + 17] in the first round. In particular, most condition are in the first 6 steps, and don't affect the use of neutral bits, and the same three boomerang are available. In general we expect similar results with a few boomerangs, but this might of course vary depending on the exact chaining input diffence/value.

Finally, with the optimistic hypothesis, the best trade-off is to use a limit of 3.5 • C block , for a total complexity of 2 64.68 + 2 61.70 + 3.5 • C block ≈ 2 66.9

(using C block = 2 64.7 )

With the conservative hypothesis, the best trade-off is to set the limit at 2. There are other trade-offs possible between the various parameters of attack. For instance, we discussed attacks with a limited number of near-collision blocks in Section 6.1; we can now evaluate the complexity of the resulting attacks. If we limit the attack to 8 near-collision blocks, the best trade-offs give the following complexities for the optimistic and conservative hypothesis respectively:

2 65.44 + 2 63.23 + 3.5 • C block ≈ 2 67.2
(using C block = 2 64.7 ) 2 67.20 + 2 64.75 + 2.5 • C block ≈ 2 69.5 (using C block = 2 67.7 )

Even with a limit of only 4 near-collision blocks, we have a relatively small increase of the complexity, with the following trade-offs: 2 66.74 + 2

Conclusion and Future Works

This work puts another nail in the SHA-1 coffin, with almost practical chosenprefix collisions, between five and twenty-six times more expensive than the identical-prefix collisions recently demonstrated. This shows that continued usage of SHA-1 for certificates or for authentication of handshake messages in TLS, SSH or IKE is dangerous, and could already be abused today by a well-motivated adversary. SHA-1 has been broken since 2004, but it is still used in many security systems; we strongly advise users to remove SHA-1 support to avoid downgrade attacks. More generally, our results show that, for some hash functions, chosen-prefix collision attacks are much easier than previously expected, and potentially not much harder than a normal collision search.

Our research opens several new directions. Obviously, future work will have to implement this attack to demonstrate a real chosen-prefix collision for SHA-1. While the computation cost of our attack is somewhat practical, SHA-1 attacks still require a huge computation power (thousands of GPUs in order to obtain the chosen-prefix collision in a reasonable time) and a large implementation effort.

For a concrete demonstration, a good target would be to break a protocol such as TLS or IKE, or to build a rogue certificate authority.

Another research direction is to study how one can improve SHA-1 collision attacks, not only for minimising the cost of finding a simple collision, but to improve our chosen-prefix collision search complexity. In particular, our attack requires the ability to reach many distinct output differences for the compression function. In this paper, to simplify our analysis, we only considered the differential trail from [SBK + 17] because a real collision was found with this trail, and a precise complexity evaluation was conducted. However, it should be possible to increase the pool of available differences, and further reduce the total complexity, by using other (slightly more costly) differential trails.

Finally, a last direction is to evaluate how our strategy actually applies to other hash functions, such as RIPEMD, (reduced-round) SHA-2, or even others. Again, this will require a deep knowledge of the functions studied, as many details might impact the overall complexity. We can however expect that our attack strategy will be applicable mostly on classical Davies-Meier constructions inside a single-pipe Merkle-Damgård operating mode.

In order to make our work easier to verify, we are publishing some additional data and code online at: https://github.com/Cryptosaurus/sha1-cp.

Introduction

Cryptographic hash functions are present in countless security applications and protocols, used for various purposes such as building digital signature schemes, message authentication codes or password hashing functions. In the key application of digital signatures for example, hash functions are classically applied on the message before signing it, as a domain extender and also to provide security guarantees. Informally, a cryptographic hash function H is a function that maps an arbitrarily long message M to a fixed-length hash value (we denote n its bit size). Collision resistance is the main security property expected from a hash function: it should be hard for an adversary to compute a collision (or identicalprefix collision), i.e. two distinct messages M and M that map to the same hash value H(M ) = H(M ), where by "hard" one means not faster than the generic 2 n/2 computations birthday attack.

A cryptanalyst will try to find a collision for the hash function at a reduced cost, but adhoc collision attacks are hard to exploit in practice, because the attacker usually has little control over the value of the actual colliding messages (in particular where the differences are inserted, which are the interesting parts when attacking a digital signature scheme). Thus, one can consider stronger variants of the collision attack more relevant in practice, such as the so-called chosen-prefix collision [25] or CP collision. Two message prefixes P and P are first given as challenge to the adversary, and his goal is to compute two messages M and M such that H(P M ) = H(P M ), where denotes concatenation. With such ability, the attacker can obtain a collision with arbitrarily chosen prefixes, potentially containing meaningful information. A CP collision can also be found generically with 2 n/2 computations (thus 2 80 for a 160-bit hash function like SHA-1), but ad-hoc CP collision attacks are much more difficult to find than plain collision attacks, because of the uncontrolled internal differences created by the prefixes. Yet, a CP collision attack was found for the MD5 hash function [25], eventually leading to the creation of colliding X.509 certificates, and later of a rogue Certificate Authority (CA) [27]. CP collisions have also been shown to break important internet protocols, including TLS, IKE, and SSH [1], because they allow forgeries of the handshake messages if they can be generated extremely quickly.

Largely inspired by MD4 [19] and then MD5 [20], SHA-1 [16] is one the most famous cryptographic hash functions in the world, having been the NIST and de-facto worldwide hash function standard for nearly two decades. It remained a NIST standard until its deprecation in 2011 (and was forbidden for digital signatures at the end of 2013). Indeed, even though its successors SHA-2 or SHA-3 are believed to be secure, SHA-1 has been broken by a theoretical collision attack in 2004 [29]. Due to its high technicality and computational complexity (originally estimated to about 2 69 hash function calls), this attack was only implemented in practice in 2017, using a large GPU cluster [23]. Unfortunately, the SHA-1 deprecation process has been quite slow and one can still observe many uses of SHA-1 in the wild, because it took more than a decade to compute an actual collision, plain collisions are difficult to use directly to attack a protocol, and migration is expensive. Web browsers have recently started to reject certificates with SHA-1 signatures, but there are still many users with older browsers, and many protocols and software that allow SHA-1 signatures. As observed in [12], it is still possible to buy a SHA-1 certificate from a trusted CA, many email clients accept a SHA-1 certificate when opening a TLS connection, and SHA-1 is also widely supported to authenticate TLS handshake messages.

Very recently, a CP collision attack against SHA-1 has been described in [12] (but not implemented), which requires an estimated complexity between 2 66.9 and 2 69.4 SHA-1 computations. It works with a two-phase strategy: given the challenge prefixes and the random differences on the internal state it will induce, the first part of the attack uses a birthday approach to limit the internal state differences to a not-too-big subset (as done in [25,22]). From this subset, reusing basic principles of the various collision search New chosen-prefix collision 2 77.1

[22] 2 67.1

[12] 2 63.4 New a Equivalent to 2 61 SHA-1 on CPU, 2 64.7 on GPU advances on SHA-1, one slowly adds successive message blocks to come closer to a collision, eventually reaching the goal after a dozen blocks. Even though these advances put the CP collisions within practical reach for very well-funded entities, it remains very expensive to conduct and also very difficult to implement as the attack contains many very technical parts.

Our Contributions

In this article, we exhibit the very first chosen-prefix collision against SHA-1, with a direct application to PGP/GnuPG security. Our contributions are threefold.

Complexity improvements. While the work of [12] was mostly about high-level techniques to turn a collision attack into a chosen-prefix collision attack, we have to look at the low-level details to actually implement the attack. This gave us a better understanding of the complexity of the attack, and we managed to significantly improve several parts of the attacks (See Table 1). First, we have improved the use of degrees of freedom (neutral bits [3] and boomerangs [10]) during the search for near-collision blocks. This reduces the computational complexity for both plain and chosen-prefix collision attacks, leading to important savings: on an Nvidia GTX 970, plain collisions can now be computed with a complexity of 2 61.2 rather than 2 64.7 (expressed in terms of SHA-1 equivalents on this GPU). We note that the general ideas underlying these improvements might be interesting for cryptanalysis of algorithms beyond SHA-1.

Second, we improved the graph-based technique of [12] to compute a chosen-prefix collision. Using a larger graph and more heuristic techniques, we can significantly reduce the complexity of a chosen-prefix collision attack, taking full advantage of the improvements on the near-collision block search. This results in a chosen-prefix collision attack with a complexity of 2 63.4 rather than 2 67.1 .

Record computation.

We have implemented the entire chosen-prefix collision attack from [12], with those improvements. This attack is extremely technical, contains many details, various steps, and requires a lot of engineering work. Performing such a largescale computation is still quite expensive, but is accessible with an academic budget. More precisely, we can can rent cheap GPUs from providers that use gaming or mining cards in consumer-grade PCs, rather that the datacenter-grade hardware used by big 4 SHA-1 is a Shambles Table 2: Complexity of the attacks against SHA-1 reported in this paper on several GPUs. The complexity is given in SHA-1 equivalents (using hashcat benchmarks). For the cost evaluation we assume that one GTX 1060 GPU can be rented for a price of US$ 35/month (the two phases of the attack are easily parallelisable): https://web.archive.org/web/ 20191229164814/https://www.gpuserversrental.com/ To attack MD5 SHA-1, we use the multicollision attack of Joux [9] with three phases: (i) a CP collision on SHA-1, (ii) 64 collisions on SHA-1, and (iii) 2 64 evaluations of MD5. cloud providers. This gives a total cost significantly smaller than US$ 100k to compute a chosen-prefix collision. We give more detailed complexity and cost estimates in Table 2.

Function

We have successfully run the computation over a period of two months, using 900 GPUs (Nvidia GTX 1060). Our attack uses one partial block for the birthday stage, and 9 near-collision blocks. We paid US$ 75k to rent the GPUs from GPUserversrental, but the actual price could be smaller because we lost some time tuning the attack. There is also a large variability depending on luck, and GPU rental prices fluctuate with cryptocurrency prices.

PGP/GnuPG impersonation. Finally, in order to demonstrate the practical impact of chosen-prefix collisions, we used our CP collision for a PGP/GnuPG impersonation attack. The chosen prefixes correspond to headers of two PGP identity certificates with keys of different sizes, an RSA-8192 key and an RSA-6144 key. By exploiting properties of the OpenPGP and JPEG format, we can create two public keys (and their corresponding private keys): key A with the victim name, and key B with the attacker name and picture, such that the identity certificate containing the attacker key and picture leads to the same SHA-1 hash as the identity certificate containing the victim key and name. Therefore, the attacker can request a signature of his key and picture from a third party (from the Web of Trust or from a CA) and transfer the signature to key A. The signature stays valid because of the collision, while the attacker controls key A with the name of the victim, and signed by the third party. Therefore, he can impersonate the victim and sign any document in her name.

SHA-1 Usage and Impact

Our work shows that SHA-1 is now fully and practically broken for use in digital signatures. GPU technology improvements and general computation cost decrease will further reduce the cost, making it affordable for any ill-intentioned attacker in the very near future.

SHA-1 usage has significantly decreased in the last years; in particular web browsers now reject certificates signed with SHA-1. However, SHA-1 signatures are still supported in a large number of applications. SHA-1 is the default hash function used for certifying PGP keys in the legacy branch of GnuPG (v 1.4), and those signatures were accepted by the modern branch of GnuPG (v 2.2) before we reported our results. Many non-web TLS clients also accept SHA-1 certificates, and SHA-1 is still allowed for in-protocol signatures in TLS and SSH. Even if actual usage is low (a few percent), the fact that SHA-1 is allowed threatens the security because a man-in-the-middle attacker can downgrade the connection to SHA-1. SHA-1 is also the foundation of the GIT versioning system, and it is still in DNSSEC signatures. There are probably a lot of less known or proprietary protocols that still use SHA-1, but this is more difficult to evaluate.

Outline

We first recall SHA-1 inner workings and previous cryptanalysis on this hash function in Section 2. We then provide improvements over the state-of-the-art SHA-1 collision attacks in Section 3 and Section 4, and we describe the details of the SHA-1 chosen-prefix collision computation in Section 5. Finally, we show a direct application of our CP collision attack with a PGP/GnuPG impersonation (together with discussions on other possible applications) in Section 6. We discuss SHA-1 usage and the impact of our results in Section 7. Eventually, we conclude and propose future works in Section 8.

Preliminaries

In this section, we describe the SHA-1 hash function (we refer to [16] for all the complete details) and summarize the previous cryptanalysis relevant to our new work.

Description of SHA-1

SHA-1 is a 160-bit hash function that follows the well-known Merkle-Damgård [6,15] paradigm. A padding is first applied to the message input (with message length encoded) so that we obtain a multiple of 512 bits, and this bit string is divided into blocks m i of 512 bits each. Then, each block m i is processed via the SHA-1 compression function (denoted h) to update a 160-bit chaining variable (denoted cv i ) that is initialised to a constant and public initial value (denoted IV): cv 0 = IV . More precisely, we have cv i+1 = h(cv i , m i+1 ). When all blocks have eventually been processed, the last chaining variable is the final hash output.

The SHA-1 compression function resembles other members of the MD-SHA family of hash functions. It uses the Davies-Meyer construction, that turns a block cipher E into a compression function: cv i+1 = E mi+1 (cv i ) + cv i , where E k (y) is the encryption of the plaintext y with the key k, and + is a word-wise modular addition.

The internal block cipher is composed of 4 rounds of 20 steps each (for a total of 80 steps), where one step follows a generalised Feistel network. More precisely, the internal state is divided into five registers (A i , B i , C i , D i , E i ) of 32-bit each and at each step, an extended message word W i updates the registers as follows:

           A i+1 = (A i ≪ 5) + f i (B i , C i , D i ) + E i + K i + W i B i+1 = A i C i+1 = B i ≫ 2 D i+1 = C i E i+1 = D i
where K i are predetermined constants and f i are boolean functions (in short: IF function for the first round, XOR for the second and fourth round, MAJ for the third round, see Table 3). Since only a single register value is updated, we can express the SHA-1 step function using a single variable:

A i+1 = (A i ≪ 5) + f i (A i-1 , A i-2 ≫ 2, A i-3 ≫ 2) + (A i-4 ≫ 2) + K i + W i . 6 SHA-1 is a Shambles
step i f i (B, C, D) K i 0 ≤ i < 20 f IF = (B ∧ C) ⊕ (B ∧ D) 0x5a827999 20 ≤ i < 40 XOR = B ⊕ C ⊕ D 0x6ed6eba1 40 ≤ i < 60 M AJ = (B ∧ C) ⊕ (B ∧ D) ⊕ (C ∧ D) 0x8fabbcdc 60 ≤ i < 80 XOR = B ⊕ C ⊕ D 0xca62c1d6
For this reason, the differential trails figures in this article will only represent A i , the other register values at a certain point of time can be deduced directly. The extended message words W i are computed linearly from the incoming 512-bit message block m, the process being called message extension. One first splits m into 16 32-bit words M 0 , . . . , M 15 , and then the W i 's are computed as follows:

W i = M i , for 0 ≤ i ≤ 15 (W i-3 ⊕ W i-8 ⊕ W i-14 ⊕ W i-16 ) ≪ 1, for 16 ≤ i ≤ 79
In the rest of this article, we will use the notation X[j] to refer to bit j of word X.

Previous Works

We recall here the general state-of-the-art collision search strategies that we will use for our CP collision attack. Readers only interested by the applications of our CP collision attack can skip up to Section 6. In the rest of the article, unless stated otherwise, difference will refer to the XOR difference between two bits or the bitwise XOR difference between two words.

Differential Trails

The first results on SHA-0 (the predecessor of SHA-1) and SHA-1 were differential in nature and obtained by building differential paths from a linearization of the compression function (we call these linear paths, in opposition to non-linear paths which have been built without linearization): in order to simplify the analysis the attacker assumes that modular additions and boolean functions f i in the SHA-1 compression function are behaving as an XOR with regards to differential propagation. More precisely, the 32-bit modular addition is replaced by a 32-bit bitwise XOR and the f i functions are replaced by 3-input XOR operations. These assumptions are indeed happening with a certain probability, which will basically consist of the bulk of the final attack cost. Then, in order to further simplify the analysis while trying to minimize the number of differences present in the internal state (which will in turn increase the differential trail probability and therefore improve the final attack cost), these trails are generated with a succession of so-called local collisions: small message disturbances whose influence is immediately corrected with other message differences inserted in the subsequent SHA-1 steps, while following the SHA-1 message expansion. However, in this linearization model, impossibilities might appear in the first 20 steps of SHA-1 (as in some specific cases the f IF boolean function will never behave as a 3-input XOR with regards to differential propagation) and the cheapest trail candidates might not be the ones that start and end with the same difference (which is a property required to obtain directly a 1-block collision after the compression function feed-forward). This strategy could already break the collision resistance of SHA-0, but not yet for SHA-1 (due to a small rotation added in the message expansion of SHA-1, that forces disturbances to spread throughout the rounds). A huge breakthrough then happened in 2005: a team of researchers [29] showed that by generating non-linear differential trails (trails generated without linearizing the SHA-1 step function) for the first 10∼15 steps of the compression function, one could potentially connect any incoming input difference to any fixed difference δ I at step 10∼15. This flexibility allows to remove completely the impossibility issues one could face in the first steps due to the linearization (since this part is now non-linear). Even better, taking advantage of the Davies-Meyer construction used inside the compression function, it actually permits to perform the collision attack on SHA-1 using only two blocks containing differences, while picking the cheapest differential trail from step 10∼15 to 80. With two successive blocks using the same differential trails (just ensuring that the output difference of the two blocks have opposite signs: 0

IV H m 1 m 2 δ M -δ M 0 δ I δ O δ O -δ I -δ O 0 δ O 0 N L 1 N L 2 L L
δ M δ O and δ O -δ M -δ O )
, one can see in Figure 1 that a collision is obtained at the end of the second block because the internal state differences cancel out.

Improving the Efficiency of Collision Search

Once the differential trail is set the attacker must find a pair of messages that follows it. A simple strategy uses an early-abort tree exploration for the 16 first steps, taking advantage of the degrees of freedom in the message, while the remaining steps are probabilistic. More advanced amortization methods (neutral bits [3], boomerangs [11,10] or message modification [29]) are used to control more than 16 steps. Because of this amortization, usually the first 20 or so steps (which hold with a low probability because of the non-linear trail) do not contribute to the final complexity of the attack.

Neutral bits were first introduced for the cryptanalysis of SHA-0 [2,3]. The idea is to find a small message modification (one or a few bits), that does not interact with necessary conditions in the differential path before a certain step x. Once a message pair following the differential path until step x is found, one can get another pair valid until step x by applying the modification. The probability that a modification is neutral until a step x can be pre-analysed before running the attack. A key observation is that any combination of two of more neutral bits until step x is likely to also be neutral until step x.

Boomerangs [10] or tunnels [11] are very similar amortization tools to neutral bits. Basically, they can be seen as neutral bits that are planned in advance. A perturbation built from one or a few local collisions (or relaxed versions) is neutral to the differential path after a few steps with a certain probability, but extra conditions are forced in the internal state and message to increase this probability. Boomerangs are generally more powerful than neutral bits (they can reach later steps than classical neutral bits), but consume more degrees of freedom. For this reason, only a few of them can be used, but their amortization gain is almost a factor 2.

8

SHA-1 is a Shambles Note that a lot of details have to be taken into account when using neutral bits or boomerangs, as many equations between internal state bits and message bits must be fulfilled in order for the differential path to be valid. Thus, they can only be placed at very particular bit positions and steps.

Chosen-prefix Collision Attacks

Chosen-prefix collision attacks are difficult to find for iterated hash functions such as SHA-1, because the attacker's task is then to find a collision while starting from a random difference in the internal state (due to the prefixes pair that is not controlled at all by him). This random difference prevents to use directly the collision search techniques for SHA-1 aforementioned, because the attacker has to erase this random difference somehow and the interesting differential paths are in fact a very small set, where all output differences δ O only have a very low Hamming weight.

The first concrete application of a chosen-prefix collision attack was on MD5 [25] and this work was also the first to introduce a birthday search phase in order to partially avoid the random difference issue. The idea is to process random message blocks after the challenged prefixes, until the chaining variable difference δ belongs to a large predetermined set S. Since the message blocks after each prefix are chosen independently, this can be done with birthday complexity π • 2 n /|S|. Then, from that difference δ, one can reach a collision by slowly erasing the remaining unwanted difference bits by successfully applying some near-collision blocks (see Figure 2). We note that the starting difference set S during the birthday phase must not be too small, otherwise this phase would be too costly. Moreover, the near-collisions blocks must not be too expensive either, and this will of course depend on the cryptanalysis advancements of the compression function being studied. This two-phase strategy was applied in [22] to the full SHA-1, for a cost of 2 77.1 hash calls. The improvement compared to the generic 2 80 attack is not very large, due to the difficulty for an attacker to generate enough allowable differences that can later be erased efficiently with a near-collision block, which makes the birthday part by far the most expensive phase of the attack. In [22] a set S of 192 allowable differences was used, by starting from one type of near collision block and then varying the signs of the message and output differences, and also by letting some uncontrolled differences spread during the very last steps of the compression function.

This was improved in [12] by generalising for SHA-1 the set of possible differences that can be obtained for a cheap cost with a single message block, increasing the set size to 8768 elements. Another crucial improvement from [12] is the utilization of a multi-block strategy for SHA-1 that allows to further greatly increase the size of the set S: the idea is that if an arbitrary input difference δ R can be decomposed as δ R =δ

(1) O + δ (2) O + • • • + δ (r) O , where each δ (i)
O can be reached as the output of a differential trail, the attacker just has to find near-collision blocks with output differences δ

(1) O , . . . , δ (r)
O , where each near-collision block will cancel one of the differences δ

(i)
O composing δ (see Figure 2). In particular, a clustering effect appears with this multi-block strategy, which can be leveraged by the attacker to select dynamically the allowable differences at the output of each successive block, to further reduce the attack complexity. This resulted in an estimated CP collision search complexity in the range of 2 66.9 to 2 69.4 hash evaluations, surprisingly not much greater than that of finding a simple collision.

Improving SHA-1 Collision Attack

Our first contribution is an improvement of the collision attack from Eurocrypt 2013 [22] and its GPU implementation from Crypto 2017 [23]. Through better use of degrees of freedom (message modifications and boomerangs) and code improvements, we gained a

IV 0 cv δR P/P S m1 δ (1) M δ (1) I δ (1) O δ N L1 L • • • H mr δ (r) M δ (r) I δ (r) O δ + i δ (i) O = 0 N Lr L u δ ∈ S
Figure 2: High-level view of a chosen-prefix collision attack. We assume that differences δ ∈ S can be decomposed as δ

= -δ(1) O + δ(2) O + • • • + δ(r) O ,
where each δ(i) O can be reached as the output of a differential trail.

10

SHA-1 is a Shambles factor between 8 and 10 (depending on GPU architecture) on the time needed to find a conforming block. Since this part of our work is very technical, we only give an overview of our results in this section. Technical details can be found in Appendix A and the corresponding code is available at https://github.com/SHA-mbles/sha1-cp.

Analysis of Previous Works

First, we observed some differences between the theoretical analysis of [22] and the practical implementation of [23]. One of the boomerangs (on bit 6 of M 6 ) contradicts one of the conditions used to maximize the probability of the path. Using this boomerang still improves the attack, because the gain in efficiency is larger that the loss in probability, but this affect the complexity evaluation. Similarly, one of the neutral bits used in the GPU code (on bit 11 of M 13 ) contradicts another condition in the differential path, leading to an increase in complexity of a factor 2 0.2 .

In our analysis, we assume that the neutral bit on bit 11 of M 13 is not used, and that the boomerang on bit 6 of M 6 is only used for the last near-collision block, where the speed-up is most noticeable, and we have enough degrees of freedom to include all the boomerangs without difficulty. Therefore we can estimate more accurately the complexity of the previous CP attack [12] as 2 67.1 SHA-1 computations, instead of the range of 2 66.9 to 2 69.4 reported previously.

Additional Boomerangs

We found some additional boomerangs that can be used to speed-up the attack, on bits 4, 5, and 6 of M 11 . Those boomerangs are not used in previous attacks because they interact badly with conditions of the differential trail, but this can be fixed by changing the last correction of the boomerangs to be a modular addition correction instead of an XOR correction.

More precisely, boomerangs are based on local collisions: an initial message difference introduces a difference in the state and another message difference cancels the state difference at a later step. In previous works, both message differences affect a single bit, so that they can be considered either as an XOR difference or as a modular difference. In this work, we only enforce a fixed modular difference for some boomerangs; depending on the value of the initial message, this difference will affect one or several bits (due to carries). Therefore, we can relax some of the conditions and make the additional boomerangs compatible with the differential path.

Precise Conditions of Neutral Bits

We also improved the rate of partial solutions generated by looking more precisely at the effect of each neutral bit. In particular, we found that some neutral bits flip with very high probability a certain condition after the step for which they are considered neutral. Therefore, these bits can be used as message modifications rather than neutral bits: instead of considering both the initial message and the message with the neutral bit applied and to test both of them at the later step, we can directly test the condition and decide which message to consider. Using this bit as message modification instead of neutral bit is more efficient, as one invalid branch in the search tree will be rightfully not explored.

In some cases, we also found that a bit that is neutral up to step i can only break some of the conditions of step i, while the rest will never be impacted. Therefore, we can test the conditions that are not affected before using that neutral bit, so as to avoid unnecessary computations. This strategy can be seen as a more precise neutral bit approach, where All in all, these tricks result in a better exploration of the collision search tree by cutting branches earlier. We give detailed benchmarks results and complexity estimates in Table 4, after implementing our improvements in the code of [23] (where an A i -solution refers to an input pair that is following the differential path until word A i inclusive).

Building Differential Trails

Following [12], we try to reuse as much as possible the previous works on SHA-1, and to keep our differential trail as close as possible to the attack of Stevens et al. [23], out of simplicity. More precisely, for each block of the collision phase, as starting point we reused exactly the same core differential path as in [23]: the difference positions in the message are the same, and the difference positions in the internal state are the same after the first 13 steps (roughly). We also tried to keep difference signs to be the same as much as possible. However, we made some modifications to the boomerangs and neutral bits as explained in the previous subsection.

The starting path skeleton is depicted in Figure 3. For each new block of the nearcollision phase, we:

1. collect the incoming chaining variable and its differences and insert them inside the skeleton; 2. set the signs of the differences in the very last steps (chosen so as to minimize the final collision complexity according to the graph, see Section 4) and generate the linear system of all equations regarding the message words; 3. compute a valid non-linear differential path for the first steps; 4. generate base solutions, i.e. partial solutions up to A 14 , possibly using help of neutral bits; 5. from the base solutions, search for a pair of messages that fulfils the entire differential path, using neutral bits, message modifications and boomerangs.

Steps 1 to 4 are done on CPU because they are not too computationally intensive, but step 5 runs on GPU. We observe that in comparison with the classical collision attack [23], we have fewer degrees of freedom available in our differential paths, due to slightly more linear constraints we imposed on the late-step message bits. Moreover, for the first blocks of the near-collision phase, the attacker will have to handle a denser input difference on the chaining variable, which will render the non-linear part search a little more difficult and little more consuming in terms of freedom degrees. In any cases, we had enough degrees of freedom to find a conforming messages pair for all blocks during the attack.

SHA-1 is a Shambles

i A i W i ______________________________ -4: | | -3: | | -2: | Incoming Chaining Variable | -1: | | 00:
|______________________________| ----xx------------------------x-01:

??????????????????????????????--xx-------------------------x----02:

????????????????????????????????

x-xx-x---------------------xxx--03:

???????????????????????????????? --xxxx-----------------------x--04:

????????????????????????????????

x-xxxx---------------------xx-x-05:

?????????????????????|?|???????? -x------------------------x----06:

?????????????????????|?|???????? --x--x-----------------0-0-xxx--07:

????-------------------0-0?????? xxx-xx------------1-1------x-x--08:

???x------------------|--0?0--?? ----xx------------------------x-09:

???-------------------|--1?1--?? xx----------------------0--x----10:

???--------------------|0|?---??

x-xx-x-------------1-------xxx--11:

?

?x--------------------|0|0----- --x-xx-------------------111-x-- 12: -------------------------111---- x-xxux---------------------xx--- 13: n--------------------------000-- x-xx----------------------1u---- 14: --n------------------------111-- --------------------------1-xx-- 15: u-1-1--------------------------- x-xxx----------------------n---- 16: un0-0--------------------------- ----u----------------------nu--- 17: u--1---------------------------- -xxnn----------------------n---- 18: u-u0---------------------------- --0-n----------------------n-n-- 19: u------------------------------- -xuu-----------------------n---- 20: u-u----------------------------- x-nux----------------------nnu--
Figure 3: Skeleton of starting differential path for all blocks during the near-collision phase of our CP collision attack on SHA-1 (only the first 20 steps are depicted). The MSB's are on the right and "-" stands for no constraint, while the notation "|" on two bits vertically adjacent mean that these two bits must be equal. The other notations are similar to the ones used in [7]. This is only to give a general idea of the differential path used, as several conditions on the message and/or on the internal state are not represented here.

We also remark that the incorporation of the additional short boomerangs reduces the number of neutral bits that can be used in comparison to [23]. Yet, this was not an issue as we still had enough to keep the GPU busy (in stage 5) while the CPU was producing the base solutions (in stage 4), even though our computation cluster is composed of low range CPUs.

Improving SHA-1 CP Collision Attack

In order to take advantage of the low-level improvements to collision attack techniques, we must also improve the high-level chosen-prefix collision attack.

The complexity of the birthday phase depends on the size of the set S of differences that can be erased from the state, therefore we need a larger set. For the near-collision phase, the complexity depends on how we combine the near-collision blocks to erase the difference in the state. We improve the graph techniques of [12] and suggest a more heuristic approach, resulting in a lower average complexity, but without a guaranteed upper bound.

Graph Construction

In order to efficiently erase the differences from the set S, [12] uses a graph where vertices are the state difference in S, and there is an edge between δ and δ if δδ can be obtained as the output difference of the compression function (using a near-collision block). The birthday phase designates a starting node in the graph and we just have to follow a path leading to the zero difference, as illustrated in Figure 4. For each edge, we search for a block with the correct output difference, using near-collision search, with a cost that depends on the target difference. In the following, we denote the cost for the optimal output differences as C block ; it is equivalent to the cost of an identical-prefix collision.

Large graph. We started with the same approach as in [12], building a series of graphs with increasing limits on the number of blocks allowed. More precisely, we consider the set of all nodes that are reachable with a path of cost at most 24 C block and up to 10 blocks. This results in a graph with 2 36.2 nodes1 , which requires 2TB of storage (storing only the nodes and their cost).

Clustering. In order to minimize the complexity of the near-collision phase of the attack, [12] uses a clustering technique to exploit multiple paths in the graph (see Figure 5). Indeed, the near-collision search does not have to commit to a fixed output difference. When two output differences correspond to useful paths in the graph and are compatible with the same differential path, the attacker can run the near-collision search and stop as soon as one of them is obtained.

Concretely, let us assume we have two output differences δ 1 and δ 2 compatible with the same differential trail, that can each be reached with a cost of C block . There are two different ways to erase a difference -δ 1δ 2 in the state:

• a block with difference δ 1 , followed by a block with difference δ 2 ;

• a block with difference δ 2 , followed by a block with difference δ 1 .

If we don't decide in advance the target difference for the first block, the search is expected to reach either δ 1 or δ 2 with a cost of only 0.5 C block , leading to an attack complexity of 1.5 C block rather than 2 C block . In our case, we initially consider nodes at distance up to 24 C block and we run the clustering technique to get a better estimate of the complexity when we don't specify in advance the sequence of differences. After several weeks of computation on a machine with 48 cores and 3TB of RAM, we find that almost 90% of the nodes are actually at distance 6 C block or less, as seen in Table 5.

All the differences in this set are active only on a 64-bit mask. Therefore, we use those bit positions for the birthday phase: we truncate SHA-1 to the remaining 96 bits2 and we generate a large number of partial collisions until one of them corresponds to a difference in the graph.

Bi-directional Graph

Since the CP collision attack is essentially a path search in a graph, we can use a bidirectional search to make the search more efficient. More precisely, when we evaluate the cost of a node, instead of just looking it up in the graph, we recompute all edges starting from the node to see if they reach the graph and compute the cost using the clustering formula. This corresponds to a bi-directional search where we pre-compute in the backwards direction the set of values that go to zero after at most 10 blocks, and during the online phase, we compute one block forward. This is illustrated by Figure 6, where black dots correspond to precomputed nodes stored in the graph, and white dots are only computed during the online phase.

This can be seen as a time-memory trade-off: we use nodes at a distance up to 11 blocks, but we only build explicitly the graph with 10 blocks. Moreover, we can use nodes that are not reachable with a single trail of cost below 24 C block , and that are therefore excluded from our initial graph. Indeed, if there exists a trail such that the cost is below 24 C block when removing an edge, the forward search using that edge will hit the explicit graph, and we can evaluate the distance of the node.

We can't compute exactly the size of this implicit graph, but we can evaluate it experimentally by simulating the birthday phase of the attack. We found that we need on average 2 26.4 attempts before hitting the graph, which corresponds to a graph size of roughly 2 38 (assuming that we detect being in the graph with a probability of 0.75, as was the case with the parameters of [12]).

Implicit Nodes

Following [12], we build the graph using a set D of 8768 potential output differences with high probability (corresponding to a cost up to 8 C block ). However, there are many other output differences that can be useful in our attack, even if they have a lower probability: we can use a block as long as the new state difference gets closer to a collision. Therefore, during the near-collision phase, instead of keeping only blocks with an output difference corresponding to an explicit edge of the graph, we keep all blocks that follow the trail up to step 61 and we look up the new state difference in the graph (using the bi-directional strategy above). With a larger number of usable output differences, the cost of each block decreases (Figure 7).

Again, we can't compute explicitly the complexity of this attack strategy, but we can run simulations. According to our experiments with the graph described above, the average cost of the near-collision phase is only 2 C block , even though most of the nodes in the graph correspond to a cost of 6 C block when following edges that have been explicitly considered.

Finally, we can use this strategy to reduce the number of near-collision blocks used in the attack. In practice, we observed that most of the nodes in our graph can actually be reached with fewer than 11 blocks. In particular, when using output differences that do not correspond to edges of the graph, we often reach an output difference that can be erased with fewer blocks than expected, in particular for the first near-collision blocks.

Chosen-Prefix Collision Computation

Even though we managed to reduce the cost of the chosen-prefix collision for SHA-1 to only 2 63.7 SHA-1 evaluations, performing such a large-scale computation remains very expensive. We show that it can be computed with an academic budget, for a total cost much lower than US$ 100k.

Attack Parameters

Using more blocks for the near-collision blocks part of the attack leads to improved attack complexity, but one can observe that the improvement becomes marginal as the number of block increases. Besides, in order to allow for a practical real-life use of our chosen-prefix collision (see next section), we had to enforce a limit on the total number of blocks.

Using the idea described in the previous section, we have the following parameters for the attack:

• We use a limit of at most 11 blocks, but we aim for 10 blocks at most for the attack (to fit in a 6144-bit key, see next section); • The graph G has size roughly 2 38 , but it is not computed explicitly; • The birthday stage is a parallel collision search algorithm (using the distinguished points technique of [28]) with a mask of 96 bits, and we need about 2 26.4 partial collisions on those 96 bits. Therefore the expected complexity of the birthday phase is √ π2 96 2 26.4 ≈ 2 62 ; • We use chains (consecutive iterations of the function from a starting point during the distinguished points technique) of length 2 28 , resulting in a data complexity of 1 /2 TB to store 2 34 chains; • We expect a cost of 2 C block for the near-collision phase.

In hindsight, we could have use longer chains to reduce the data storage, and to make sorting the data on our cluster easier. We could also have aimed for a lower number of blocks: our collision used only 9 blocks, and we could probably reach 8 or 7 without much impact on the complexity.

Complexity estimate.

Overall, for the attack parameters chosen, the birthday part costs about 2 62.05 SHA-1 computations, while the near-collision part is expected to require 1 C block for the last block, and 1 C block in total for the previous blocks. Appendix D. SHA-1 is a Shambles 239

SHA-1 is a Shambles

As explained in Section A.1, we use the boomerang on M 6 [8] for the last block, so that the expected time to find a conforming block can be estimated directly from the figures of Table 4 as C block = 2 48.5 /r. For the intermediate blocks, we don't use this boomerang, so the rate is reduced to r/1.9 but we only require 2 48.08 A 33 -solutions for one C block . Our simulations show that the total cost for all intermediate blocks is roughly one C block , therefore it will take time C block = 1.9 • 2 48.08 /r. Finally, we can estimate the total attack time as 2 62.05 • h + 2 48.5 + 1.9 • 2 48.08 r , with r the A 33 -solution rate (from Table 4), and h the hash-rate for the birthday phase (from Section 5.3). We give concrete complexity estimates on several GPUs in Table 2.

Our chosen-prefix collision attack is roughly four time as expensive as an identical-prefix attack.

A GPU Cluster

We originally estimated that our attack would cost around US$ 160k by renting GPUs from a cloud provider such as Amazon or Google (using spot or preemptible prices). However, since our computations do not need much communication between the GPUs, nor fancy inter-GPU task scheduling, we can consider renting cheaper GPUs from providers that use gaming or mining cards in consumer-grade PCs, rather that the datacenter-grade hardware used by big cloud providers. Services like gpuserversrental.com rent GTX 1060 or GTX 1080 GPUs for a price below 5 cents per month per CUDA core; which would give a total cost around US$ 75k to compute a chosen-prefix collision.

After some cost analysis, we have concluded that GTX 1060 GPUs offered a very good hashrate/cost ratio at the time of the chosen-prefix collision computation. GPU prices vary significantly depending on cryptocurrency prices, but at the time of writing, a GTX 1060 can be rented for about US$ 35 per month3 . Our attack requires about 107 GPU-years using GTX 1060, which gives an estimated cost of 107 × 35 × 12 US$ 45k to compute a chosen-prefix collision for SHA-1.

Our cluster was made of 150 machines with 6 GPU each (with a mix of GTX 1060 3G, and GTX 1060 6G), and one master node with two 2TB hard drives in a RAID configuration. The master node had a Core i7 CPU, but the GPU nodes had low-end Pentium or Celeron CPU with two cores. Each machine ran Ubuntu Linux, but there was no cluster management software installed (we used clush to run commands on all the nodes). We negotiated a price of US$ 37.8k per month (higher than current prices), and used the cluster for two months.

Cost analysis. We paid US$ 75.6k for our computation, but the cost could be as low as US$ 50k with currently lower GPU prices and less idle time. With the same methods, computing an identical-prefix SHA-1 collision would cost only about US$ 11k. This is clearly within reach of reasonable attackers.

Of course the underlying weakness of SHA-1 has always been present, even if it was not public (and maybe not discovered). We estimate that a PS3 cluster (as used by Stevens et al. [27], and as deployed by the US army4 ) could have implemented this attack for a cost of a few million dollars in 2010, when SHA-1 was still the most widely used hash function. This underlines that the deprection process of SHA-1 should have been much faster after the publication of the first theoretical collision attack in 2004. Looking at the future, this attack will get even cheaper as computation costs decrease. Following Moore's law (that seems to be still valid for GPU 5 ), we estimate that it should cost less than US$ 10k to generate a SHA-1 chosen-prefix collision by 2025.

Birthday Phase

In order to simplify the implementation, we implemented the birthday phase with two distinct steps: in the first step, each GPU computes independently a series of chains, and in the second step we gather all the results, sort them to find collisions in the end-points, and re-run the chain to locate the collisions. Our implementation runs at a speed of h = 3.5GH/s on GTX 1060 GPUs (respectively 3.2 GH/s on GTX 970 and 11 GH/s on GTX 1080 Ti). This is somewhat lower than the hashcat benchmarks reported in Table 2 because hashcat can skip some parts of SHA-1, and we have to keep two SHA-1 states in the registers to implement the birthday phase. Every time we run the second step, we then search the collisions in the graph, to determine whether we have reached a useful starting point (this is run on a separate machine with at least 1TB or RAM, and we let the cluster restart the first step in the meantime).

As shown in Table 6, we ran step 2 four times, and we have been quite unlucky in the birthday phase, only succeeded after finding 2 27.7 collisions, rather than the estimated 2 26.4 . It took us 34 days to compute those chains, which corresponds to a hashrate 2.9 TH/s for our cluster (including downtime).

Interestingly, we got slightly fewer collisions than expected (after a given number of chains): we expected to compute √ π2 96 C SHA-1 to find C partial collisions, but our analysis is off by a factor roughly 2 0.2 . Given the small magnitude of the error, we didn't investigate further, but it could be due to an unknown bug in our code, or an issue in the analysis (such as a failed independence assumption, or an issue with chains that reach a cycle).

Near-collision Phase

The near-collision phase is very technical and very complex. Every time a block is found, we have to prepare the search for the next block. This first requires to traverse the graph G to find the parameters for the next block: we have different constraints in the last steps depending on which output differences are desired. Then, we had to generate a new non-linear part for the early steps, as explained in Section 3.4. We used tools similar to [7], which take a lot of parametrization and trial-and-error to have a proper non-linear part that fits nicely with the core differential path. Finally, some testing and configuration of the GPU code was then required to check how neutral bits and boomerangs behaved in this new configuration. In particular, there were usually some adjustments to make in the 18 SHA-1 is a Shambles GPU code for the more complex conditions in the path that involve several bit positions. The entire preparation process would have potentially to be performed again in case of any issue detected with the path found. This was automated to some extent, but still took between a few hours and a few days of manual work to prepare for each block (it took more time for the first blocks because there are more constraints to build the path, and we were more experienced for the later blocks). Unfortunately, this means that the GPU cluster was not doing useful work during this time. We remark that our attack could have cost less if we had fully automated the entire cryptanalysis process, or if we had improved the search algorithm for the non-linear part of the differential path. This is definitely not impossible to achieve, but it would require a lot of tedious work.

For the last block, we started the computation without the boomerang on M 6 [8], and modified the path and the code after one day to include it. As explained in Section 3, this extra boomerang reduces the quality of A 61 -solutions, so that we need 4 /3 times the number of solutions (2 19.58 instead of 2 19.17 ), but it almost doubles the production rate of these solutions. In total, this reduces the computation time by a factor 1.9/ 4 /3 ≈ 1.4.

As expected, intermediate blocks cost much less than C block (the cost of a block with a pre-determined output difference) because we can target a large number of output differences. Only the last block is expected to cost C block . However, we were quite lucky in this phase of attack, because we found all the blocks after only 0.9 C block , rather than the estimated 2 C block . In particular, the last block was found after only 2 18.2 A 61 -solutions (0.38 C block ), instead of the expected 2 19.58 .

A timeline of the near-collision phase is given in Table 7, and the chosen-prefix collision is given in Appendix B (with the actual messages in Figure 13 and the intermediate differences in Table 9) .

Resources Used

A quick overview of the resources used for each part is given in Table 8. If we evaluate the total useful GPU time spent for the attack, we have roughly:

• 78 years for the birthday phase • 25 years for blocks 1 to 9 This means that roughly 75% of our GPU time was useful. If we convert the attack time to SHA-1 evaluations, we arrive at a total of 2 63.6 , which is quite close to the estimate of 2 63.5 given in Table 2.

Application to PGP Web of Trust

Our demonstration of a chosen-prefix collision targets the PGP/GnuPG Web of Trust. This trust model relies on users signing each other's identity certificate, instead of using a central PKI. For compatibility reasons the legacy branch of GnuPG (version 1.4) still uses SHA-1 by default to sign identity certificates. Therefore, we can impersonate a user using a SHA-1 chosen-prefix collision to forge the signature.More precisely, our goal is to create two PGP keys with different UserIDs, so that key B is a legitimate key for Bob (to be signed by the Web of Trust), but the signature can be transferred to key A which is a forged key with Alice's ID. This will succeed if the hash values of the identity certificates collide, as in previous attacks against X.509 MD5-based certificates [25,27]. Moreover, due to details of the PGP/GnuPG certificate structure, our attack can reuse a single collision to target arbitrary users Alice and Bob: for each victim, the attacker only needs to create a new key embedding the collision, and to collect a SHA-1 signature. This is arguably the first practical attack against a real world security application using weaknesses of SHA-1.

We recall that a chosen-prefix collision attack works as follows: given two arbitrary prefixes P and P , an attacker can generate two messages M and M such that H(P M ) = H(P M ). Note that in classical iterated hash functions such as SHA-1, given an arbitrary suffix X, we still have H(P M X) = H(P M X).

Exploiting a Chosen-prefix Collision

We now focus on the identity certificates that will be hashed and signed. Following RFC 4880 [5], the hash computation done during certificate signing receives the public key packet, then a UserID or user attribute packet, and finally a signature packet and a trailer. The idea of the attack is to build two public keys of different sizes, so that the remaining fields to be signed are misaligned, and we can hide the UserID of key A in another field of key B. Following RFC 4880, the signature packet is protected by a length value at the beginning and at the end, so that we have to use the same signature packet in key A and key B (we cannot stuff data in the hashed subpacket). Therefore, we can only play with the UserID and/or user attribute packets. Still, a user attribute packet with a JPEG image gives us enough freedom to build colliding certificates, because typical JPEG readers 20 SHA-1 is a Shambles ignore any bytes after the End of Image marker (ff d9). This gives us some freedom to stuff arbitrary data in the certificate.

More precisely, we build keys A and B as follows. Key A contains an 8192-bit RSA public key, and a UserID field corresponding to Alice. On the other hand, key B contains a 6144-bit RSA public key, the UserID of Bob and a JPEG image. Therefore, when Bob gets a certification signature of his key, the signer will sign two certificates: one containing his public key and UserID, and another one containing the public key and the image. The public keys A and B and the image are crafted in such a way to generate a collision between the certificates with the key A and Alice's UserID, and the certificate with key B and the image.

Content of Identity Certificates

Figure 8 shows a template of the values included in the identity certificate: those values are hashed when signing a key, and we want the two hashes to collide. In this example, the UserID field of key A contains "Alice <alice@example.com>", and the image in key B is a valid JPEG image that will be padded with junk data after the End of Image marker. The real JPEG file is 181 bytes long6 (from ff d8 to ff d9), and it is padded with 81 bytes, so that the file included in the key is 262 bytes long (here the padding includes 46 bytes corresponding to the end of the modulus of key A, 5 bytes corresponding to the exponent of key A, and 30 bytes corresponding to Alice's UserID).

In Figure 8, we use the following symbols:

01 Bytes with a fixed value are fixed by the specifications, or chosen in advance by the attacker (length of fields, UserID, user attribute, ...) ?? Represent bytes that are determined by the chosen-prefix collision algorithm (the messages M and M to generate a collision) !! Represent bytes that are selected after finding the collision, to generate an RSA modulus with known prime factors .. Represent bytes that are copied from the other certificate ** Represent time-stamps chosen by the attacker $$ Represent the time-stamp chosen by the signer Underlined values correspond to packet headers (type and length).

Attack Procedure

To carry out the attack, we have to perform the following steps:

1. Build a chosen-prefix collision with prefixes "99 04 0d 04 ** ** ** ** 01 20 00"

and "99 03 0d 04 ** ** ** ** 01 18 00", after filling the ** with two arbitrary time-stamps. The chosen-prefix collision must have at most 10 near-collision blocks. This determines the ?? bytes of the keys.

Choose a tiny JPEG image to include in key B (fixed orange bytes), and an arbitrary

UserID to include in key A (fixed yellow bytes) 3. Select "!!" bytes in B to obtain a modulus with known factors 4. Select "!!" bytes in A to obtain a modulus with known factors 5. Generate key B with the modulus and the padded JPEG. Ask for a signature of the key. 6. Copy the signature to key A.

We point out that the chosen-prefix collision is computed before choosing the UserIDs and images that will be used in the attack. Therefore, a single CPC can be reused to 0x0000 99 04 0d 04 ** ** ** ** 01 20 00 ?? ?? ?? ?? ?? 99 03 0d 04 ** ** ** ** 01 18 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

0x0040 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

. . . . . . 0x02c0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Collision here! Arrows show when a value is chosen in one key and copied to the other.

22

SHA-1 is a Shambles attack many different victims. This contrasts with attacks on X.509 certificates [25,27], where the identifier is hashed before the public key.

In order to build the modulus (steps 3 and 4 above), we use the same strategy as in previous works [25,27]. More precisely, the high order bits are fixed by previous steps, and the low-order bits can be chosen freely. Therefore we have to find a modulus in an interval [A, B] with a known factorisation. We select a random prime P (in the order of B -A), and we compute Q = B/P . If Q is a prime, we use P * Q as the modulus: we have A ≤ P * Q ≤ B when P ≤ B -A + 1. This takes a few minutes in practice.

We note that the factors of the modulus are unbalanced. With the template of Figure 8, we expect factors of 88 bits and 6056 bits for Key B, and 368 bits and 7824 bits for key A. In practice we managed to find a CP collision with fewer blocks than in Figure 8, so that key B actually has factors of 1112 bits and 5032 bits. This makes both keys hard to factor. As mentioned in [14], it is possible to find modulus with somewhat larger factors using more advanced techniques.

Example Keys

We show an example of a pair of keys generated with this procedure in Figures 11 and12 from the Appendix. The keys can be examined with pgpdump -i to see that they include the same signature. The files can be directly downloaded from these URLs: Key A: https://SHA-mbles.github.io/alice.asc Key B: https://SHA-mbles.github.io/bob.asc

In our demonstration, we chose a time-stamp far in the future to avoid malicious usage of our collision. However, an attacker that can repeat our work will obviously use a valid time-stamp.

Attack Variant

We also found an alternative attack, exploiting the PGP key format in a slightly different way, where key B contains a short public key followed by a JPEG image. We would consider both the public key and the image as the prefix, and stuff the CPC blocks inside the image (after the EOI marker). This variant leaves a smaller space for the CPC blocks, but the advantage is that key A is less suspicious because it doesn't need to contain a valid JPEG file inside the modulus (the modulus is really made of random-looking blocks). On the other hand, this variant requires to compute a new CPC for each key B.

Other variants might also be possible.

Impact

As explained in Section 7.1, the "classic" branch of GnuPG (v1.4) uses SHA-1 by default for identity certifications, and there is still a non-negligible number of keys signed with SHA-1.

Before our attack was disclosed, SHA-1 signatures were also accepted by the "modern" branch of GnuPG (v2.2). This made the attack usable in practice.

In addition, a single CPC can be reused to attack many different victims, so that the cost of the CPC is just a one-off cost. Given our cost estimation around US$ 50k, this is well within reach of strong adversaries.

SHA-1 Usage and Disclosure

SHA-1 is still used in a surprising number of security applications. It is supported in many secure channel protocols (TLS, SSH), and remains actually used for some fraction of the connections. It is also used for PGP identity certifications, and it is the foundation of GIT versioning system. We expect there are also an important number of proprietary systems using SHA-1, but getting actual data on this is difficult.

Collisions and chosen-prefix collisions do not threaten all those usages (in particular HMAC-SHA-1 seems relatively safe), but there are several settings that are directly affected by chosen-prefix collisions:

• PGP identities can be impersonated if trusted third parties sign identity certificates with SHA-1 (see 7.1) • X.509 certificates could be broken if some CAs issue SHA-1 certificates with predictable serial numbers (see 7.2) • TLS and SSH connections using SHA-1 signatures to authenticate the handshake could be attacked with the SLOTH attack [1] if the CP collision can be generated extremely quickly (see 7.3 and 7.4)

We stress that when a protocol supports several hash functions, those attacks are possible as long as SHA-1 is supported by implementations, even if it is not selected during normal use. A man-in-the-middle attacker will just force the parties to use SHA-1.

More generally, as cryptographers, we recommend to deprecate SHA-1 everywhere, even when there is no direct evidence that this weaknesses can be exploited. SHA-1 has been broken regarding collision resistance for 15 years, and there are better alternatives available, well-studied, and standardized (SHA-2 [17], SHA-3 [18]). There is no good reason to use SHA-1 in modern security software. Attacks only get better over time, and the goal of the cryptanalysis effort is to warn users so that they can deprecate algorithms before the attacks get practical.

As a stopgap measure, the collision-detection library of Stevens and Shumow [26] can be used to detect attack attempts (it successfully detects our attack).

Responsible disclosure.

We have tried to contact the authors of affected software before announcing this attack, but due to limited resources, we could not notify everyone. We detail below the main affected products, some of the responses we received, and countermeasures deployed at the time of writing. More up to date information will be available on the website of the attack: https://sha-mbles.github.io.

SHA-1 Usage in GnuPG

There are currently two supported branches of GnuPG: GnuPGv1 is the "legacy" (or "classic") branch, and GnuPGv2 is the "modern" branch. The first version of GnuPGv2 dates back to 2006, and the "legacy" branch is no longer recommended, but the transition took a long time. In particular, GnuPGv1 was still the default version in Fedora 29 (released in October 2018), and in Ubuntu 16.04 LTS (which is supported until April 2021).

GnuPG supports many different algorithms, including SHA-1. Moreover, SHA-1 is the default algorithm for identity certification in GnuPGv1. This is why we targeted PGP in our demonstration of chosen-prefix collisions. After we disclosed our results to the GnuPG team, SHA-1 signatures have been deprecated in the GnuPGv2 branch.

We have first discussed this attack with the GnuPG developers the 9th of May 2019 and eventually informed them of the newly found chosen-prefix collision the 1st of October 2019. The issue is tracked with CVE number CVE-2019-14855. A countermeasure has been implemented in commit edc36f5, included in GnuPG version 2.2.18 (released on the 25th of November 2019): SHA-1-based identity signatures created after 2019-01-19 are now considered invalid.

SHA-1 is a Shambles

Web of Trust. The original trust model of PGP was the Web of Trust. Instead of using a central PKI, users sign each other's keys to attest of their identity (e.g. when attending a key signing party), and trust such certificates from third parties. A scan of the PGP Web of Trust (i.e. identity certifications on public keyservers) shows that roughly 1% of the identity certifications issued in 2019 use SHA-1. This probably corresponds to usage of GnuPGv1 with the default settings, and would make our attack feasible.

However the Web of Trust does not seem to be widely used anymore. In particular, after the poisoning attack at the end of June 2019 [?], GnuPG 2.2.17 and later do not import identity certificates from public keyservers by default. A major usage of GnuPG is now to authenticate software packages in Linux, but this typically relies on directly trusting the relevant keys without third parties.

CAcert. CAcert (http://cacert.org/) is one of the main CAs for PGP keys, and they still use SHA-1 to sign user keys. We have first contacted them by email on December 14th, and got an answer on January 6th acknowledging this issue. They are now planning a switch to a secure hash function for key certification.

We note that our attack is not directly applicable because CAcert does not sign JPEG images in PGP keys, but using SHA-1 signature is nonetheless an important security risk.

SHA-1 Usage in X.509 Certificates

The CA/Browser Forum decided to sunset SHA-1 in October 2014, and its members are not supposed to issue SHA-1 certificates after 2016. Web browsers have enforced similar rules, and all modern browsers now reject SHA-1 certificates.

However, SHA-1 certificates are still present for legacy purposes, on services that are used by older clients that can not be upgraded. In particular, it remains possible to buy a SHA-1 certificate today, and there are a few recently-issued certificates in use on the web 7 . There are also a few old SHA-1 certificates still in use 8 . Those certificates are rejected by modern web browsers, but they can be accepted by non-web TLS clients. For instance, it seems that the Mail application in Windows 10 can open an IMAP session secured with a SHA-1 certificate without warning. Similarly, OpenSSL still accepts SHA-1 certificates at security level 1 (the default level in most distributions -but Debian Buster has set the default level to 2, which prevents usage of SHA-1 certificates).

Chosen-prefix collisions against MD5 have been able to break the security of certificates in the past, with the creation of a Rogue CA by Stevens et al. [27], and in the wild by the flame malware [21]. If some of the CAs still issuing SHA-1 certificates use predictable serial numbers, a similar attack might be possible today (being located at the beginning of the "to-be-signed" part of the certificate, if the serial number is unpredictable then the CP collision attack is thwarted as a crucial part of the hashed input is not controlled by the attacker).

SHA-1 Usage in TLS

Besides certificates, there are two places where SHA-1 can be used in the TLS protocol: SHA-1 can be used to sign the handshake, and HMAC-SHA-1 can be used to authenticate data in the record protocol.

Handshake. In order to authenticate the TLS handshake, the client and the server sign a copy of the transcript at the end of the handshake. If the hash function used in the signature is weak, an attacker can use chosen-prefix collisions to mount a man-in-the-middle attack and break various properties of the handshake, as shown by the SLOTH attacks [1]. However, this remains far from being a practical attack, because the CP collision has to be computed in a very short time frame, while the session is being established (timeout value is generally set to a few seconds, but can be up to several minutes).

In TLS 1.0 and 1.1, the handshake is hashed with the concatenation of SHA-1 and MD5. Using the multicollision attack from Joux [9], computing a CP collision for MD5 SHA-1 is not much harder than for SHA-1. We give concrete figures in Table 2, showing that this is probably within reach of a well motivated adversary.

In TLS version 1.2, the hash function used is configurable, and is negotiated between the client and the server. MD5 was one of the possible options, but support has been removed after the SLOTH attack. However, SHA-1 is still widely supported, and many servers actually prefer to use SHA-1, even when the client offers better algorithms. Scan results of the top 1M websites show that 3% of them use SHA-1 9 , and this includes many high profile websites. 10 The vast majority of TLS 1.0/1.1 clients offer SHA-1 as an option for the signature.

In TLS version 1.3, MD5 and SHA-1 have been removed.

Ciphersuites. The ciphersuite used in a TLS connection is the result of a negotiation between the client and server, so it is hard to predict exactly. However, thelarge majority of clients and servers support ciphersuites where HMAC-SHA-1 is used to authenticate the packets, at least for interoperability reasons. It seems that usage of HMAC-SHA-1 represents a few percent of all the connections. Telemetry results from Mozilla report about 2% of connections with a HMAC-SHA-1 ciphersuite. 11 In addition, a scan of websites in the Alexa top 1M show that 8% of them would use a HMAC-SHA-1 ciphersuite with the client settings used for the scan 12 . This usage is not threatened by our attack, but we recommend to avoid SHA-1 usage when possible.

OpenSSL. We have first contacted the OpenSSL developers on December 14th.The next version of OpenSSL will no longer allow X.509 certificates signed using SHA-1 at security level 1 and above (commit 68436f0). Since security level 1 is the default configuration for TLS/SSL, this will prevent SHA-1 usage for certificates.

Debian Linux had previously set the default configuration to security level 2 (defined as 112-bit security) in the latest release (Debian Buster); this already prevents dangerous usage of SHA-1 (for certificates and handshake signature).

SHA-1 Usage in SSH

SHA-1's usage in SSH is similar to its usage in TLS. The SSH-2 protocol supports usage of SHA-1 to sign the transcript (at the end of the key exchange), and HMAC-SHA-1 to authenticate the data in the record protocol. As in the TLS case, usage of SHA-1 to sign the transcript has been shown to be potentially vulnerable to the SLOTH attack [1], but SHA-1 is a Shambles this is not practical given the timing constraints (usually just a few seconds, but can be configured to a longer period of time).

Again, the choice of cryptographic algorithms depends on a negotiation between the client and server, so it is hard to know exactly what will be selected. However, scans of the IPv4 space from censys at the time of writing show that roughly 17% of servers use SHA-1 to sign the transcript 13 , and 9% of servers use HMAC-SHA-1 in the record protocol 14 . This mostly corresponds to servers running old versions of SSH daemons.

OpenSSH. Due to our results, since version 8.2 of OpenSSH a "future deprecation notice" is included, explaining that SHA-1 signatures will be disabled in the near-future.

Other Usages of SHA-1

DNSSEC. SHA-1 is still used in DNSSEC, with 18% of the top-level domains using SHA-1 at the time of writing 15 . Since DNSSEC signatures include user-supplied content, CP collisions could be used to attack the DNSSEC system.

GIT. GIT relies heavily on SHA-1 to identify all objects in a repository. It does not necessarily require cryptographic security from SHA-1, but there are certainly some attack scenarios where attacks on SHA-1 would matter. In particular, signed GIT commits are essentially signatures of a SHA-1 hash, so they would be sensitive to collision attacks.

The GIT developers have been working on replacing SHA-1 for a while 16 , and they use a collision detection library [26] to mitigate the risks of collision attacks.

Timestamping. Many timestamping servers apparently support SHA-1, such as: https: //sectigo.com/resources/time-stamping-server

Conclusion and Future Works

This work shows once and for all that SHA-1 should not be used in any security protocol where some kind of collision resistance is to be expected from the hash function. Continued usage of SHA-1 for certificates or for authentication of handshake messages in TLS or SSH is dangerous, and there is a concrete risk of abuse by a well-motivated adversary. SHA-1 has been broken regarding collision resistance since 2004, but it is still used in many security systems. We strongly advise users to remove SHA-1 support to avoid downgrade attacks. We exhibited a practical chosen-prefix collision attack on SHA-1, and performed an actual CP collision computation for a reasonable cost. This cost will decrease over time and in a close future will be so cheap that any ill-intentioned person could afford it.

Our work directly impacts the security of PGP/GnuPG Web of Trust: using our CP collision attack on SHA-1, we have created two PGP keys with different UserIDs and colliding certificates. This allows an attacker to impersonate any user, as long as trusted third parties sign identity certifications with SHA-1.

We also show that gaming or mining GPUs offer a cheap and efficient way to attack symmetric cryptography primitives. In particular, it now costs less than US$ 100k to rent GPUs and break cryptography with a security level of 64 bits (i.e. to compute 2 64 operations of symmetric cryptography). Future works. The cost of our attack is roughly four times the cost of a plain collision attack, so there is limited room for improvements in terms of complexity. The factor 4 could be slightly reduced by changing the parameters of the graph, but this is unlikely to result in an improvement of more than a factor 2. Alternatively, improvements to the near-collision search could improve simultaneously identical-prefix and chosen-prefix collision attacks.

On the other hand, we believe there is some possibility to reduce the number of blocks used in the attack without increasing the complexity much. Firstly, with a better use of the global parameters of the general chosen-prefix collision attack. By playing with the number of blocks, the allowable probabilities and the size of the graph, one could probably find a better configuration. Secondly, by not considering only the core differential trail from [23], but using other interesting ones(for example the ones already used in other previous SHA-1 attacks), we would increase the pool of available differences and in turn reduce the required number of blocks.

A natural future work would be to study other applications of practical chosen-prefix collisions on SHA-1. Different protocols would lead to different constraints for the attacker, and unfortunately SHA-1 remains used on field. What would then be the security impact of our findings on these applications ? What applications could be targeted ?

Finally, it remains to be studied how recent chosen-prefix collision attacks could potentially apply to other hash functions, such as RIPEMD, (reduced-round) SHA-2, or even others.

We are planning to publish code to make our claims easy to verify, but due to the strong impact of this attack, we will wait until counter-measures are more widely implemented.

SHA-1 is a Shambles

A Improving SHA-1 Collision Attack

We now give the technical details of the improvements introduced in Section 3, for readers that are familiar with previous works [22,23,12].

A.1 Boomerangs and Neutral Bits

As explained in [12], an important factor to evaluate the cost of the attack is the number of boomerangs available when looking for a conforming message. The collision attack from Eurocrypt 2013 [22] and its GPU implementation from Crypto 2017 [23] (the "Shattered" attack) use three boomerangs, on bits 6 and 8 of M 6 (red type in Figure 9), and on bit 7 of M 9 (blue type in Figure 9). However, the boomerang on M 6 [8] actually flips the value of W 77 [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] due to the message expansion, and breaks the condition W 77 [0] ⊕ W 77 [2] = 1 listed on Table 5 of [23]. This reduces the probability of the trail on rounds 61-80 by a factor 3 /4, from 2 -19.17 to 2 -19.58 . However, the boomerang almost doubles the number of partial solution produced, so that using it still improves the attack.

In addition, we realized that the "Shattered" attack [23] uses a neutral bit on M 13 [11]. However, this breaks the condition W 76 [0] ⊕ W 76 [1] = 1, and reduces the probability of the trail by a factor roughly 2 0.2 . In our analysis, we assume that this neutral bit has been removed: since it has a very small effect on the number of partial solution produced, it reduces the complexity of the attack by a factor 2 0.2 . In particular, this is why we consider that a collision requires 2 48.5 A 33 -solutions rather than 2 48.7 (where an A i -solution refers to an input pair that is following the differential path until word A i inclusive).

In our chosen-prefix attack, we also need conditions on W 77 [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF], and we decided to remove the boomerang on M 6 [8] in order to keep more control on the output difference and to simplify the attack. In particular, removing this boomerang makes easier the construction of trails with the extra constraints (and we have successfully built trails with the two remaining boomerangs for all successive blocks). This implies that the cost of near-collision blocks increases by a factor 3 /2 compared to the "Shattered" attack, leading to C block = 2 64.9 on a GTX 970 (after gaining a factor 2 0.2 by removing M 13 [11] as a neutral bit). Therefore we can estimate more accurately the complexity of the previous attack [12] as 2 67.1 SHA-1 computations, instead of the range of 2 66.9 to 2 69. 4 reported previously (the optimal attack parameter choice for [12] is then a maximum cost of 3.5

C block ).

As an optimization, we decided to use the boomerang on M 6 [8] for the last block, because the computation of the last block is identical to the second block of an identicalprefix collision attack. In particular, we had no trouble building a path with this boomerang, and this results in a speed-up of a factor 1.9 in the rate of A 33 -solutions. We need to increase the number of solutions by a factor 4 /3 because the solutions are of lower quality, but this still corresponds to a speed-up factor of roughly 1.4. Since the last block represents a significant part of the total computation, this is a worthwhile optimization.

A.2 Additional Boomerangs and Modular Correction

We found out that in addition to previously mentioned boomerangs, we can use very short boomerangs on bits 4, 5, and 6 of M 11 (green type in Figure 9), with a single correction on M 12 . These boomerangs are neutral until step 22, like the boomerang on M 9 . The problem is that they will clash with existing small boomerangs starting at M 6 [6], M 6 [8] and M 9 [7].

More precisely, the boomerang starting at M 11 [4] will flip the message condition "x" from the boomerang starting at M 6 [6], corresponding to the last message correction of the local collision. In order to avoid this issue, we simply change the last correction of the M 6 [6] boomerang to be a modular addition correction instead of an XOR correction. This

i A i W i -1:
--------------------------------00:

-

---------------------------------------------------------------01:

----------------------------------------------------------------02:

----------------------------------------------------------------03:

----------------------------------------------------------------04:

----------------------------------------------------------------05:

---------------------------|------------------------------------06:

---------------------------|---------------------------------x--07:

-----------------------------x--------------------------x-------08:

---------------|---------------0 --------------------------------09:

- x) represents a small boomerang (named AP 1 in [?]) composed of a single local collision starting on M 6 , here positioned at bit j = 2. The blue one (perturbation y) represents another small boomerang used in [22,23], also composed of a single local collision, but starting on M 9 , here positioned at bit j = 14. The green one (perturbation z) represents a new and even smaller boomerang built from a partial local collision starting on M 11 , here positioned at bit j = 25. The MSB's are on the right and "-" stands for no constraint.

--------------|---------------1 -----------------y-------------- 10: ----|------------y-------------- ------------y------------------- 11: ----|--------------0------------ ------z------------------------x 12: ------z------------1------------ -z------------------------------ 13: --------0----------------------- -------------------------------- 14: --------1----------------------- -------------------y------------ 15: -------------------------------- --------------------------------
The letters represent a bit value and its complement is denoted by an upper bar on the corresponding letter. The notation "|" on two bits vertically adjacent mean that these two bits must be equal.

i A i W i -1:
--------------------------------00:

----------------------------------------------------------------01:

----------------------------------------------------------------02:

----------------------------------------------------------------03:

----------------------------------------------------------------04:

----------------------------------------------------------------05:

-

--------------------|-|-------- -------------------------------- 06: ---------------------|-|-------- -----------------------0-0------ 07: -----------------------0-0------ ------------------1-1----------- 08: ----------------------|--0-0---- -------------------------------- 09: ----------------------|--1-1---- ------------------------0------- 10: -----------------------|0|------ -------------------1------------ 11: -----------------------|0|0----- -------------------------111---- 12: -------------------------111---- -------------------------------- 13: ---------------------------000-- --------------------------1----- 14: ---------------------------111-- --------------------------1----- 15:
- ---------------------------------------------------------------Figure 10: Exact conditions required to prepare all the boomerangs' differential paths used for our CP collision attack on SHA-1 with the corresponding constraints forced in order to have probability one in the 16 first steps. The MSB's are on the right and "-" stands for no constraint. The notation "|" on two bits vertically adjacent mean that these two bits must be equal. These conditions basically correspond to very short boomerangs started at M 11 [4], M 11 [5] and M 11 [6], and small boomerangs started at M 6 [6], M 6 [8] and M 9 [7] (boomerang starting perturbations are marked in purple). We remark an extra condition M 13 [5] = 1 in order to potentially correct the clash between boomerangs M 11 [5] and M 9 [7].

32

SHA-1 is a Shambles will naturally correct the perturbation as the step operation involved is indeed a modular addition and the boomerang on M 6 [6] will behave as expected (the condition "x" is actually not needed anymore). This can be seen as a generalization of the boomerang strategy used so far for SHA-1: boomerang corrections can be applied modular addition-wise instead of XOR-wise. This will induce changes in subsequent bits in the corresponding message words because of carry propagations that might naturally occur with a modular addition operation, but as long as these bit changes do not mess with existing message conditions, we are fine 17 . This idea might also be interesting to analyse other hash functions.

Similarly, the boomerang starting at M 11 [6] will flip the message condition "x" from the boomerang starting at M 6 [8], corresponding to the last message correction of the local collision. This is exactly the same situation and we avoid this issue by changing the last correction of the M 6 [8] boomerang to be a modular addition correction instead of an XOR correction.

Finally, the boomerang starting at M 11 [5] will flip the condition "1" in the internal state, required for the boomerang starting at M 9 [7]. This will create an uncontrolled difference when we use the M 9 [7] boomerang, that we correct by introducing a new difference in M 13 [5] (setting the extra condition M 13 [5] = M 9 [7] ⊕ 1 will ensure a proper correction using XOR correction). Note that we perform this further correction only in the case where the boomerang starting at M 11 [5] was triggered. We observe furthermore that the correction on M 13 [5] will maintain a good quality of neutrality for M 11 [5] boomerang. All the conditions required to use the boomerangs are given in Figure 10. Abstract-In response to high-profile attacks that exploit hash function collisions, software vendors have started to phase out the use of MD5 and SHA-1 in third-party digital signature applications such as X.509 certificates. However, weak hash constructions continue to be used in various cryptographic constructions within mainstream protocols such as TLS, IKE, and SSH, because practitioners argue that their use in these protocols relies only on second preimage resistance, and hence is unaffected by collisions. This paper systematically investigates and debunks this argument.

We identify a new class of transcript collision attacks on key exchange protocols that rely on efficient collisionfinding algorithms on the underlying hash constructions. We implement and demonstrate concrete credentialforwarding attacks on TLS 1.2 client authentication, TLS 1.3 server authentication, and TLS channel bindings. We describe almost-practical impersonation and downgrade attacks in TLS 1.1, IKEv2 and SSH-2. As far as we know, these are the first collision-based attacks on the cryptographic constructions used in these popular protocols.

Our practical attacks on TLS were responsibly disclosed (under the name SLOTH) and have resulted in security updates to several TLS libraries. Our analysis demonstrates the urgent need for disabling all uses of weak hash functions in mainstream protocols, and our recommendations have been incorporated in the upcoming Token Binding and TLS 1.3 protocols.

I. INTRODUCTION

Hash functions, such as MD5 and SHA-1, are widely used to build authentication and integrity mechanisms in cryptographic protocols. They are used within publickey certificates, digital signatures, message authentication codes (MAC), and key derivation functions (KDF).

However, recent practical attacks on MD5 and almostpractical attacks on SHA-1 have led researchers and practitioners to question whether these uses of hash functions in popular protocols are still secure.

The first collision on MD5 was demonstrated in 2005 [38], and since then, collision-finding algorithms have gotten much better. Simple MD5 collisions can now be found in seconds on a standard desktop. In response, protocol experts reviewed the use of MD5 in Internet protocols such as Transport Layer Security (TLS) and IPsec [16], [15], [3]. Despite some disagreement on the long-term impact of collisions, they concluded that most uses of hash functions in these protocols were not affected by collisions. Consequently, MD5 continues to be supported (alongside newer, stronger hash algorithms) in protocols like TLS and IPsec.

In 2009, an MD5 collision was used to create a rogue CA certificate [36], hence breaking the security of certificate-based authentication in many protocols. A variant of this attack was used by the Flame malware to disguise itself as a valid Windows Update security patch [34]. Due to these high-profile attacks, there is now consensus among certification authorities and software vendors to stop issuing and accepting new MD5 certificates. Learning from the MD5 experience, software vendors are also pro-actively phasing out SHA-1 certificates, since collisions on SHA-1 are believed to be almost practical [35]. This leaves open the question of what to do about other uses of MD5 and SHA-1 in popular cryptographic protocols. Practitioners commonly believe that collisions only affect non-repudiable signatures (like certificates), but that signatures and MACs used within protocols are safe as long as they include unpredictable contents, such as nonces [16], [15].In these cases, protocol folklore says that a second preimage attack would be required to break these protocols, and such attacks are still considered hard, even for MD5.

Conversely, theoretical cryptographers routinely assume collision-resistance in proofs of security for these protocols. For example, various recent proofs of Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment. NDSS '16, 21-24 TLS [17], [22], [11] assume collision-resistance even though the most popular hash functions used in TLS are MD5 and SHA-1. Whom shall we believe? Either it is the case that cryptographic proofs of these protocols are based on too-strong (i.e. false) assumptions that should be weakened, or that practitioners are wrong and collision resistance is required for protocol security.

This paper seeks to clarify this situation by systematically investigating the use of hash functions in the key exchanges underlying various versions of TLS, IPsec, and SSH. We demonstrate that, contrary to common belief, collisions can be used to break fundamental security guarantees of these protocols. We describe a generic class of attacks called transcript collision attacks, and detail concrete instances of these attacks against realworld applications. In particular, we demonstrate how a man-in-the-middle attacker can impersonate TLS 1.2 clients, TLS 1.3 servers, and IKEv2 initiators. We also show how a network attacker can downgrade TLS 1.1 and SSH-2 [39] connections to use weak ciphers. We implement proofs-of-concept exploit demos for three of these attacks to demonstrate their practicality, and provide attack complexities for the others. We believe that ours are the first hash collision-based attacks on the cryptographic constructions within these protocols.

We do not claim to have found all transcript collision attacks in these protocols; nor do we think that our attack implementations are the most efficient. Still, our results already provide enough evidence for us to strongly recommend that weak hash functions like MD5 and SHA-1 should be immediately disabled from Internet protocols. Partly due to recommendations by us and other researchers, these hash functions and other weak constructions based on them have been removed from the draft version of the TLS 1.3 protocol.

Outline Section II introduces transcript collision attacks on authenticated key exchange protocols. Section III outlines the state-of-the-art in collision-finding algorithms for MD5, SHA-1, and their concatenation. Section IV describe the TLS protocol, and Section V describes concrete attacks on various versions of TLS and three proof-of-concept demos. Section VI describes concrete attacks on IKE and SSH. Section VII summarizes the impact of our attacks and disclosure status. Section VIII concludes.

II. TRANSCRIPT COLLISION ATTACKS ON AUTHENTICATED KEY EXCHANGE

Authenticated Key Exchange (AKE) protocols are executed between two parties, usually called client and server or initiator and responder, in order to establish a shared session key that can be used to encrypt subsequent messages. A typical example is the SIGMA' protocol depicted in Figure 1. This protocol is a variant Fig. 1. SIGMA': A mutually-authenticated key exchange protocol of the basic SIGMA (sign-and-mac) protocol from [21] which served as the inspiration for the key exchanges used in many protocols including IKE, OTR, and JFK.

In SIGMA', the initiator A first sends a message m 1 to B, consisting of Diffie-Hellman public value g x , along with some protocol-specific parameters info A that may include, for example, a nonce, a protocol version, a proposed ciphersuite, etc. B responds with a message m 2 containing its own Diffie-Hellman public value g y and some parameters info B . A and B have now completed an anonymous Diffie-Hellman exchange and can compute the shared secret g xy and use it to derive the session key. However, before using the session key, they authenticate each other by exchanging digital signatures over the protocol transcript hash(m 1 |m 2 ) using their long-term signing keys (sk A , sk B ). (Digital signature algorithms typically hash their arguments before signing them, and we have chosen to make this hashing explict in our presentation of SIGMA'.) By signing the transcript, A and B verify that they agree upon all the elements of the key exchange, and in particular, that a network attacker has not tampered with the messages. Finally, A and B also prove to each other that they know the session key g xy by exchanging MACs computed with this key over their own identities.

Like other AKE protocols, SIGMA' aims to prevent message tampering, peer impersonation, and session key leakage, even if the network and other clients and servers are under the control of the adversary. Formally, authenticating the transcript guarantees matching conversations, that is, that the two parties agree on each others identity and other important protocol parameters.

Transcript Collision Attacks

The alert reader will notice that SIGMA' does not in fact guarantee that A and B agree on the message sequence m 1 |m 2 ; it only guarantees that they agree on the hash of this sequence. What if a network attacker were to tamper with the messages, so that A and B see different message sequences but the hashes of the two sequences is the same? In that case, the protocol will proceed to completion but the integrity and authentication guarantees no longer hold.

Figure 2 illustrates such an attack. The man-in-the-

hash(m 1 |m 2 ) = hash(m 1 |m 2 )
We call this a transcript collision. Now, MitM can simply forward A's signature over this transcript to B and vice versa. A and B will accept the signatures since the hashed transcripts match and the signing keys are correct. However, the MitM knows the session keys (g x y , g xy ) on both connections (since it knows x , y ). Hence, the MitM has fully hijacked both connections and can now send messages to B pretending to be A and to A pretending to be B. This is an impersonation attack that breaks peer authentication.

If the boundaries between the messages m 1 and m 2 are not clearly demarcated, there are a number of trivial attacks that can ensure that m 1 |m 2 = m 1 |m 2 with no need for hash collisions. In the examples of this paper, we will assume that each message (and each message field) is prefixed with its length, so that we can focus on attacks that rely on weaknesses in the hash function.

A Generic Transcript Collision

The main challenge in implementing the attack in Figure 2 is that the MitM has to compute the messages m 1 and m 2 after receiving m 1 but before the responder has sent its response m 2 . The feasibility of the attack depends on the contents and formats of these messages.

Suppose the responder B always sends the same message m 2 for every request; that is, it uses the same (static) Diffie-Hellman value g y and same parameters info B . (This situation occurs, for example in protocols like QUIC, where the server uses a static configuration.) In that case, after receiving m 1 , the MitM can compute a transcript collision by finding x , y , info A , info B such that hash(m 1 |m 2 ) = hash(m 1 |m 2 ). The amount of work required to find such a collision depends on the hash function. As we will see in the next section, such collisions require 2 N/2 work for hash functions that produce N bits. Hence, for MD5, such a collision would require the MitM to compute 2 64 MD5 hashes, which may well be achievable by powerful adversaries.

A Chosen-Prefix Transcript Collision We now consider a more efficient attack that works even when B sends an unpredictable m 2 containing a fresh (ephemeral) Diffie-Hellman value g y and a previously unknown info B . However, we assume that the length of m 2 (M ) is fixed and known to MitM. Moreover, suppose that in the second message of SIGMA', info B is allowed to have arbitrary length and arbitrary contents. That is, even if info B has junk data at the end, A will accept the message. Specifically, suppose that info B = len B |data B where data B is opaque data that will be ignored by A. (We will see several examples of such "collision-friendly" messages in TLS, IKE, and SSH.) Finally, we assume that the hash function uses the Merkle-Damgård construction [29], [7], so that it obeys the length extension property: if hash(x) = hash(y) then hash(x|z) = hash(y|z). (Strictly speaking, this property only holds when the lengths of x, y are equal and a multiple of the hash function block size.) Under all these conditions, MitM can compute a transcript collision by finding two collision bitstrings C 1 , C 2 of L 1 and L 2 bytes respectively, such that:

hash(m 1 | [g y | info B len B |C 1 |-] m 2 ) = hash([g x | info A C 2 ] m 1 )
where len B = L 1 + M . Note that we have left empty space (written -) of size M bytes that still needs to be filled after C 1 in info B . As we will see in the next section, this kind of collision is called a chosen-prefix collision and is typically achievable with far less work than a generic collision attack. For example, a chosenprefix collision in MD5 requires the MitM to compute about 2 39 MD5 hashes, which takes only a few CPU hours.

After receiving m 1 from A and computing C 1 , C 2 , MitM now sends m 1 to B. When B responds with m 2 (of size M bytes), MitM now stuffs m 2 at the end of info B (in place of -) and sends m 2 to A. Due to the length extension property, we have:

hash(m 1 | [g y | info B len B |C 1 |m 2 ] m 2 ) = hash([g x | info A C 2 ] m 1 |m 2 ) 3
That is, the MitM has obtained a transcript collision and the impersonation attack succeeds.

The attack here exploits hash collisions in combination with flexible protocol-specific message formats, and as we will see, this is one of the main novel tricks that we use to mount various attacks in this paper.

Other Transcript Collisions The transcript collisions described above are not the only attacks possible on such protocols. In some cases, MitM may not be able to use its own Diffie-Hellman values g x , g y but it may still be able to tamper with the protocol parameters (e.g. ciphersuites) in info A , info B . In such cases, the MitM does not have full control over either connection (i.e. it cannot impersonate A or B) because it does know the session keys, but it may still be able to downgrade the protocol parameters to use weak, breakable ciphers.

In other cases, the message format may lend itself to simpler common-prefix collisions that require even less work than chosen-prefix collisions. Such collisions on MD5 can be found in seconds even on standard desktops. In the next section, we will discuss these different types of collisions in more detail (some technical details of previous results are given in the Appendix), and in the remainder of the paper, we will exploit them to mount transcript collision attacks on real-world protocols.

III. HASH FUNCTION CRYPTANALYSIS

A hash function H : {0, 1} * → {0, 1} N maps arbitrary length binary strings to strings of N bits. Broadly speaking, a cryptographic hash function is expected to behave like a randomly selected function from the set of all functions from {0, 1}

* to {0, 1} N ; building input/output values with specific properties should be as hard for H as for a random function. More concretely, a cryptographic hash functions should meet four goals: 1) Preimage resistance: Given a target value H, it should be hard to find x such that H(x) = H 2) Second-preimage resistance: Given an input

x, it should be hard to find a second input x = x such that H(x ) = H(x) 3) Chosen-prefix collision resistance: Given prefixes P and P , it should be hard to find a pair of values x, x such that H(P |x ) = H(P |x). 4) Collision resistance: For a hash function H, it should be hard to find a pair of inputs x = x such that H(x ) = H(x).

The expected security of a hash function is defined as the complexity of the best generic attack, i.e. the best attack that works on any hash function, without using any specific property of the design. For preimages or second-preimages, the best attack is a brute-force search: an adversary has to try about 2 N random inputs in order to find a preimage. However, for collisions, there is a generic attack with complexity 2 N/2 because of the birthday paradox. If an adversary computes the images of a set of 2 N/2 inputs, this defines about 2 N pairs of inputs, and there is a high probability that one of these pairs is a collision.

Generic collision attacks While a naive collision attack requires to store 2 N/2 images of the hash function, it is possible to mount a parallel and memory-less attack with a very small overhead [37]. This generic collision attack is very powerful: it can use meaningful messages, and can easily be used for chosen-prefix collisions (see details in Appendix).

Concatenation To strengthen protocols against collisions in any one hash function, it may be tempting to use a combination of two independent hash functions. For example, TLS versions up to 1.1 use a concatenation of MD5 and SHA-1. While the output length of this construction is 288 bits, it does not offer the security of a 288-bit hash function. In particular, Joux described a multi-collision attack that breaks the concatenation of two hash functions with roughly the same effort as breaking the strongest one of the two [18]. Chosen-prefix collision: 2 77 [18] Shortcut collision attack usually return messages with random-looking blocks that are not controlled by the adversary. This makes it harder to use these messages in a real attack, but we will see that in many cases we can still have meaningful messages by stuffing the random blocks in non-significant sections.

Shortcut collision attacks

Implementation of attacks Since generic collision attacks can be easily parallelized and require little memory, they can efficiently be implemented in GPUs.

In particular, an attack against MD5 require 2 64 computations. This is well within reach for a motivated adversary: it would cost around $165 000 on Amazon EC2 (using a spot price of 8 ¢/h for a g2.2xlarge instance doing 2.5 GH/s). Dedicated hardware would be significantly more efficient, but require a large investment. As a point of comparison, the current Bitcoin network is able to compute up to 2 59 SHA-256 hashes per second.

We have implemented this attack against the 96-bit MAC used for the Finished message of TLS 1.1. Our demo took 20 days using four Tesla K20Xm GPUs, which is comparable to the expected time we can derive from hash function benchmarks.

For a chosen-prefix collision, an important part of the computation is spend constructed differential paths, and this is much harder to parallelize on GPU. We used the HashClash software [33] by Marc Stevens to perform this computation. Stevens et al.'s estimate that the chosen-collision attack should require 2 39 hash computations, or 35 core-hours [36]. In order to build the collision as fast as possible, we modified the software to take better advantage of parallelism. The hashclash software spends most of its time building differential paths, with a forward step, a backward step, and a connection step. We realized that the backward step uses a limited number of potential starting points, and we precomputed the results for all possible starting points. In addition, we merged the forward and connection steps, in order to avoid the serialization and deserialization of the result. With these optimisations, we can build a chosen-prefix collision in one hour with a 48 cores machine, using a few gigabytes of RAM (the original code required at least 3 hours). We believe the time can be further reduced, but this will require a significant rewrite of the hashclash software to allow parallelism across several machines, or to rewrite it for GPUs.

IV. THE TLS HANDSHAKE PROTOCOL

The Transport Layer Security protocol (TLS) [8] is perhaps the most widely used secure channel protocol. Many versions of TLS are used on the Internet; the latest released version is TLS 1.2 [8], while TLS 1.3 [9] is currently undergoing standardization at the IETF.

Figure 3 depicts a typical handshake in TLS (in versions 1.0 to 1.2). The client first sends a hello message CH that contains a fresh random client nonce n c and various protocol parameters ex c , including the protocol version, supported list of ciphersuites, and various protocol extensions. Each extension is prefixed by its length and can contain a payload of up to 2 16 bytes. Notably, the client hello may include extensions that the server does not understand or support, and the server will ignore them.

The server responds to the client hello with a series of messages (from SH to SHD). The server hello SH contains a fresh server nonce n s and parameters ex s , including the server's chosen version, ciphersuite, and protocol extensions. In most ciphersuites, the server then sends its public-key certificate SC. In Ephemeral Diffie-Hellman (DHE) ciphersuites, SC is followed by a server Fig. 3. TLS 1.2: A mutually-authenticated DHE handshake. Fields shown in red indicate parts of the handshake that can contain arbitrarylength opaque data (useful for stuffing collision blocks). Handshake transcripts (log 1 , log 2 , log 3 ) refer to the concatenation of all messages up to (and including) the current one. Messages SCR, CC, CCV are optional and only appear when client certificate authentication is used. NPN is optional and only appears when the client and server support the next-protocol-negotiation extension. The tls-unique channel binding is a connection identifier that may be used by applications to bind user authentication tokens, such as cookies and passwords, to the underlying TLS channel to prevent credential forwarding. key exchange message SKE that contains an ephemeral public value g y along with a description of the Diffie-Hellman group chosen by the server, including the prime p and generator g. The server signs these values to protect then from tampering and to prove that it knows the private key (sk S ) for the certificate: sign(sk S , hash(n c |n s |p|g|g y ))

The signature and hash algorithm used for this signature is chosen by the server based on its certificate as well as the supported algorithms indicated by the client within an optional signature-algorithms extension in the client hello. In TLS versions before 1.2, the hash algorithm was fixed to be MD5 | SHA-1 but TLS 1.2 allows clients and servers to choose any hash algorithm they both support (MD5, SHA-1, SHA-256, etc.) Hence in TLS 1.2, each digital signature is prefixed with identifiers for the chosen signature and hash algorithm.

If the server wants the client to authenticate itself with a public-key certificate, it then sends a certificate request message SCR indicating the certificate types and signature algorithms it supports, as well as an optional list of distinguished names dn for the client certification authorities that it trusts. As with hello extensions, each distinguished name can be 2 16 bytes long and can contain arbitrary data that the client will ignore if it does not recognize the name. The server's message flight then ends with the server hello done message SHD.

The client then sends its own certificate CC if the 5 server asked for it, and its own Diffie-Hellman key share g x in a client key exchange message CKE. If the client sent a certificate, it must prove that it knows the private key sk C by sending a client certificate verify CCV message with a signature over the full message log up to this point in the protocol:

sign(sk C , hash(CH|SH|SC|SKE|SCR|SHD|CC|CKE)) log 1
At this point, the client and server both derive a session master secret ms and authenticated encryption keys for both directions (k 1 , k 2 ). The client sends a change cipher spec message to indicate that the subsequent messages it sends will be encrypted (with k 1 .) This message is not technically part of the handshake protocol and does not appear in the authenticated transcript, and so it is not shown in Figure 3.

If the client and server both indicate support for the next-protocol-negotiation extension [24] in their hello messages, the client then sends an encrypted extensions message NPN containing a selected application layer protocol (e.g. http/1.1 or spdy/3). The protocol name is ASCII-encoded and then padded to the nearest multiple of 32 bytes (to avoid leaking information via the encrypted message length.)

The client then sends an encrypted finished message CFIN containing a MAC of the full handshake log log 2 using the master secret ms. In TLS 1.0 and 1.1, this MAC is computed using a combination of HMAC-MD5 and HMAC-SHA-1, whereas in TLS 1.2, it uses HMAC-SHA-256. In all these versions, the result of the MAC is then truncated to 12 bytes (96 bits):

mac 96 (ms, hash(CH|SH|SC|SKE|SCR|SHD|CC|CKE|CCV|NPN)) log 2
When a server receives CFIN, it verifies that the client agrees with it on the full message log and on the master secret. It responds by sending its own change cipher spec message to turn on encryption and a server finished message SFIN that contains a 96-bit MAC over the full handshake log log 3 using the master secret ms.

At the end of the handshake, both client and server have authenticated each other, proved knowledge of the master secret, and agreed upon the message log. They can now start encrypting application data to each other using the connection keys (k 1 , k 2 ).

In most common TLS usage scenarios, clients are not authenticated using certificates. The handshake authenticates only the server and the client-side user is authenticated within the application using a challengeresponse protocol based on a password or some other bearer token (e.g. HTTP cookie). Such application-level authentication protocols are known to be vulnerable to a general class of credential forwarding attacks unless the application-level credential is channel bound to the TLS connection (e.g. see [5]. In such attacks, a client C connects to a malicious server M and authenticates with some credential over TLS, but M forwards the authentication message over another TLS channel to S, thereby logging in as C at S. The attack is prevented if the authentication protocol embeds a unique identifier for the underlying TLS channel, so that a message sent over one channel cannot be forwarded over another. One such identifier, called tls-unique, defined in [2], uses the contents of the CFIN message as a unique identifier for the TLS connection. This tls-unique channel binding is used by a number of emerging applicationlevel authentication protocols, such as SCRAM [28], FIDO [14], and Token Binding [32], specifically to avoid credential-forwarding attacks.

V. TRANSCRIPT COLLISION ATTACKS ON TLS

As we saw in the previous section, TLS uses a variety of hash constructions to implement key security mechanisms like client and server authentication, handshake integrity, and channel binding. We now demonstrate weaknesses in these constructions and show how they can be exploited to mount practical transcript collision attacks on real-world clients and servers.

A. Breaking TLS 1.2 Client Authentication using a Chosen-Prefix Transcript Collision

Suppose a client C uses the same certificate to connect to two different servers A and S. We show that if A is malicious, it can force C to create a signature (in CCV) that A can use to impersonate C at S, as depicted in Figure 4. Here, A acts as a man-in-themiddle between C and S. Note, however, that A uses its own certificate cert a and does not rely on knowing any long-term secrets belonging to C or S.

Recall that the client signs the transcript hash(log c 1 ); so the key idea of the attack is to compute a collision between this client-side transcript and the server-side transcript hash(log s 1 ), even though the two connections see different message sequences. When the MitM A receives a client hello from C, it responds with its own hello SH , certificate SC , key exchange SKE . It then initiates a connection with the server S by sending a carefully crafted client hello CH . A now runs both connections in parallel. It will receive a hello SH, certificate SC, key exchange SKE, and certificate request SCR from S. We assume that the length of these messages SH|SC|SKE|SCR is fixed (= M ) and is known in advance.

Note that A needs to choose CH before it receives any messages from S. A can compute CH and SCR as follows. A uses a chosen-prefix collision to find two bitstrings (C 1 , C 2 ) of length L 1 and L 2 bytes respectively ))

Furthermore, we set the length of dn in SCR to be L 1 + M , so that it still has M bytes (denoted by -) that need to be filled in after C 1 . Now, A sends CH to S, receives SH|SC|SKE|SCR in response, and stuffs these messages into the remaining M bytes in SCR and sends it to C. At this point the hash of the message transcripts in the two connections coincide, assuming that the hash function satisfies the length extension property:

hash(CH|SH|SC |SKE |SCR (C 1 |SH|SC|SKE|SCR dn )) = hash(CH (n c , C 2 ex c )|SH|SC|SKE|SCR)
From this message onwards, the hash of the handshake log in both connections will remain the same. A then forwards the sever hello done SHD to C. In response, C sends a certificate CC, a key exchange CKE, and a certificate verify CCV that contains a signature over the transcript hash(log c 1 ) which is now the same as hash(log s 1 ). A simply forwards these messages to S, pretending to be C, and S accepts these messages.

Controlling the master secret Even though S has accept C's certificate on its connection with A, A cannot complete the connection unless it knows the master secret on its connection with S. The master secret is computed from g xy so A needs to know the x corresponding the g x that C sent in its key exchange message CKE. In order to accomplish this task, we rely on a key forcing attack in the DHE handshake.

When A sends SKE to C, it does not send a valid Diffie-Hellman group (p, g). Instead, it chooses an arbitrary public value k = g x and sets p = k 2k and g = k. This p value is clearly not a prime, and it has the property that no matter what private value x is generated by C, we will have g x mod p = k. Hence, by choosing such a bogus Diffie-Hellman group, A can force C to send a CKE with a public value that it controls.

To complete the attack, we assume that S always uses the same Diffie-Hellman group (p, g). A chooses some x and sets k = g x mod p. It then sends SKE to C with the bogus group (k 2k, k) and the public value k. Now, the CKE sent by C will contain k, and A will forward it to S. A will then forward C's signature CCV as usual. The master secret between A and S will be derived from g x y mod p, but A knows x and hence can compute this value. Consequently, A can complete the handshake and impersonate C at S.

We observe that the attack here relies on the client not validating the Diffie-Hellman groups it receives from the server. From our experiments, we find that most TLS libraries do not validate the groups they receive in the server key exchange, probably because checking for primality is expensive. In some libraries, the value k 2 -k is rejected because it is an even number. In those cases, we find that we can use p = k 2 -1 and with 50% probability, the client will compute g x = k, allowing the attack to succeed. This weakness in TLS-DHE has been noted before [6] and a new protocol extension aims to fix it by allowing only well-known Diffie-Hellman groups [12]. However, an optional extension cannot prevent our attack scenario, since A could always pretend to not support the extension and mount the attack anyway.

Note that the attack only relies on DHE between C and A; the connection between A and S can use ECDHE or RSA and the attack would still work. In other words, such transcript collisions can also be used to mount cross-protocol attacks in the sense of [26].

Attack Complexity

The transcript collision attack requires A to compute a chosen-prefix collision for the hash function used in the client signature. In TLS 7 versions before 1.2, the default hash function is a concatenation of MD5 and SHA-1 and hence requires computing 2 77 MD5 and SHA-1 hashes. In TLS 1.2, if the signature uses SHA-1, the cost is 2 77 hashes. Remarkably, TLS 1.2 also allows RSA-MD5 signatures, and for such signatures, the cost of the collision is only 2 39 MD5 hashes. Below, we describe our proofof-concept implementation that relies on RSA-MD5.

Note that these cost estimates are per-connection because the collision needs to be computed once for each client nonce n c . Usually, these nonces are generated with a strong random number generator. However, in some cases the client random can become predictable due to implementation bugs (e.g. see CVE-2015-0285 in OpenSSL). We also observe that it is commonly believed that these nonces only need to be unique, not unpredictable. For example, the OpenSSL library uses RAND_pseudo_bytes to generate the client and server random, whereas it uses RAND_bytes to generate other key material; the former succeeds even when there is not enough entropy in the system. If the client nonce were predictable, or if it were to be repeated with high frequency, the collision can be computed offline at leisure, making SHA-1 collisions almost feasible. Even though our attack below does not rely on predictable nonces, it offers yet another justification for the need for strongly random nonces in TLS.

Implementing a Proof-Of-Concept

To implement the attack, we need a client that is willing to sign with RSA-MD5 and a server that is willing to accept such signatures. We found a number of TLS libraries that support RSA-MD5 client signatures, including certain versions of OpenSSL, GnuTLS, Oracle and IBM Java, and BouncyCastle. (See Section VII for more details.) In particular, all major Java web application servers and the default TLS servers on Red Hat Enterprise Linux (6 and 7) accept RSA-MD5 signatures.

For our demo, we set up a man-in-the-middle attack between a standard Java HTTPS client and a Java HTTPS server (with default configurations.) The MitM implements Figure 4. In order to setup the collision while preserving the TLS message formats, the attacker needs to carefully set the length fields in various places in CH and SCR . For example, in CH it needs to set consistent lengths for the full hello message, for the extensions field, and for the last extension. Furthermore, the MitM needs to make sure that the two prefixes have a length that is a multiple of the MD5 block size (512 bits). To achieve this, we fill up the last extension in CH and the last distinguished name in SCR with enough zero bytes until the prefixes are block-aligned.

As explained in Section III, the chosen-prefix collision can be be computed in one hour on a 48 core workstation using a modified version of the hashclash software [33]. In our demo, A accepts the client hello and then keeps the client-side TLS connection alive until a collision has been found. Most TLS connections can be kept alive by sending regular warning alerts; Java clients are willing to keep the connection open indefinitely. Keeping the client waiting for an hour is not always practical, but we note that some unsupervised TLS clients (such as git) are used to perform longrunning connections to web APIs, and long connection times may not be noticed. In any case, the collision search scales well with computational power and can be significantly sped up by a powerful adversary.

Once the collision has been found, A connects to S to completes the attack and is able to impersonate C at S and read and write data that only C should have access to. Hence, the demo shows that A is able to break TLS 1.2 client authentication between mainstream TLS clients and servers. The precise handshake traces exhibiting the collision are available from our website.

B. Breaking TLS 1.2 Server Authentication using a Generic Transcript Collision

The key to our attack above on TLS 1.2 client authentication is that the client is willing to sign the hash of the full message log, and the format of various TLS messages is flexible enough to allow the attacker to stuff meaningless collision blocks and server-side messages into them. A similar chosen-prefix transcript collision attack would not work on TLS 1.2 server authentication because the server signature transcript does not contain flexible-size elements.

In DHE handshakes, the signature covers only the client and server nonces and the server's Diffie-Hellman key share: sign(sk S , hash(n c |n s |p|g|g y )). So, the only part of the signed value that the attacker may control is the client nonce n c which is fixed-length (32 bytes), half the size of one MD5 block. This prevents the use of shortcut collision attacks against MD5, but generic attacks based on the small 128-bit MD5 hash length are still possible, and not too far from being practical.

Collecting and storing signatures. To mount a transcript collision attack on TLS 1.2 server authentication, an attacker first has to collect a large number, say 2 x , of RSA-MD5 signatures signed by the server. The attacker may do this by passively observing RSA-MD5 connections to the server, but since such connections may be rare, it may have to actively connect to the server to obtain a sufficient number of signatures. Once these signatures (and the corresponding hashes) have been collected and stored, the attacker can impersonate the server to any client.

Upon receiving a client hello message including the client nonce n c , the attacker chooses a DH secret y and computes the MD5 hashes of the transcripts n c |n s |p|g|g y for a series of random server nonces n s , until the hash matches a value that was collected previously. Finding this collision requires the attacker to compute about 2 128-x MD5 hashes and then look them up in the stored signature database. When a match is found, the stored signature can be used by the attacker to forge the server's SKE message for the current connection, and hence impersonate the server.

The complexity of this attack on TLS 1.2 server authentication is therefore 2 128-x MD5 hashes per connection, in addition to 2 x connections performed before-hand, and 2 x storage. The attacker can trade-off between these costs-the more signatures he can collect, the less he has to compute per connection. For example, if it is feasible to collect, store, and search through 2 64 signatures, then the per-connection cost is 2 64 hashes. Although we have described the attack in terms of MD5, a similar but more expensive attack can be mounted on RSA-SHA1 server signatures, which would require 2 160-x computation per-connection.

Practical Impact of the Attack. Both the precomputation and per-connection cost of the attack is currently out of reach for academic researchers, but might be within the capabilities of well-resourced adversaries.

A prerequisite for the attack is to find servers that would be willing to sign their SKE messages with RSA-MD5. Internet-wide scans show that about 31% of the Alexa top 1 million websites support RSA-MD5 signatures. 1 This subset includes popular websites hosted by Akamai, such as microsoft.com.

A second question is whether TLS clients would accept RSA-MD5 signatures. Most popular web browsers and TLS libraries do not offer RSA-MD5 as one of the supported signature algorithm in the client hello. This might lead one to believe that they would not accept RSA-MD5 server signatures. However, we found and reported security bugs in NSS (the library used by Firefox and some versions of Chrome), GnuTLS (used in curl and git), and BouncyCastle; these libraries (and applications that rely on them) incorrectly accept RSA-MD5 signatures even if they have been explicitly disabled. For example, Firefox will accept an RSA-MD5 signature from a website, even though it is not supposed to. Furthermore, other TLS libraries such as versions of OpenSSL (up to version 1.0.1e), mbedTLS, and Java routinely offer and accept RSA-MD5 signatures.

Conseqently, if an attacker has the resources to achieve the server impersonation attack, a large number of TLS clients would be affected. To err on the safe side, we recommend that TLS libraries should immediately disable all MD5-based signatures.

Exploiting predictable nonces and keys. We observe that the precomputation in the above attack can be avoided if the server uses a predictable nonce n s and predictable DH parameters p, g, g y . In this case, the attacker only has to perform 2 64 computations online. How realistic is this assumption? Many TLS implementations allow DH keys to be reused; in OpenSSL, for example, keys are reused by default unless the application sets the SSL_OP_SINGLE_DH_USE flag. For such servers, the parameters are clearly predictable.

That leaves the server nonce, and as we noted for clients, a bug in the use of the random number generator could lead to predictable nonces. Alternatively, the server may support a recent TLS variant called Snap-Start [23] that allows the client (and hence the attacker) to choose the server nonce. That said, we do not know of any deployed TLS 1.2 implementation that uses predictable nonces, but this section serves as a warning to implementors that strongly random nonces are needed in TLS, and not just for preventing replays.

C. Breaking TLS 1.3 Client and Server Authentication using a Chosen-Prefix Transcript Collision

From the viewpoint of transcript collisions, TLS 1.2 server signatures may seem stronger than client signatures, but not signing enough leads to other security problems. For example, the server becomes vulnerable to cross-protocol attacks [26] and to downgrade attacks like Logjam [1]. In response to such attacks, the new design of TLS 1.3 requires the server to sign the full handshake log, including the negotiated parameters.

Figure 5 illustrates the standard one-round-trip (1-RTT) message flow in the current draft (version 10) of the TLS 1.3 specification. In comparison to TLS 1.2, this protocol flips the order in which the DH key shares are sent, so that the handshake can complete in one round trip. The key shares are sent within extensions in the hello messages CH and SH. The server no longer sends an SKE message. Instead, it sends a new server certificate verify message SCV just before the finished message. The SCV contains a signature over the hash of the full message log up to this point (log 2 ). Another departure from TLS 1.2 is that all handshake messages after SH are encrypted, in order to protect the privacy of the client and server certificates from passive attackers.

We demonstrate a chosen-prefix transcript collision on TLS 1.3 that breaks both client and server signatures, enabling a full man-in-the-middle attack on the protocol. The attack is similar in spirit to the one on TLS 1.2 client signatures; we use the flexible formats of the client and server hello messages to create a trascript collision immediately after the server hello SH.

The client C wants to connect to S, but its messages are intercepted by a network attacker A. After A receives the client's CH, it sends its own CH to the server, receives the servers SH, and sends its own SH to the client. A now knows the Diffie-Hellman shared secrets on both connections, and it has chosen CH and SH such that hash(CH|SH ) = hash(CH |SH). Consequently, A can now simply forward all hanshake messages between C and S, and both client and server authentication will succeed. A will need to decrypt and reencrypt these messages, but it can do so because it knows the encryption keys on both connections. More importantly, once the handshake is complete, A can read and tamper with application data in both directions.

To compute CH and SH , A needs to find a chosenprefix collision C 1 , C 2 of length L 1 and L 2 bytes respectively such that C 1 appears within the last extension of of SH and C 2 appears as the last extension of CH :

hash(CH|SH (n s , g y , C 1 |- ex s )) = hash(CH (n c , g x , C 2 ex c
))

Suppose we know that the server S will respond to CH with a server hello message SH of known length M . Then in SH , we set the length of ex s to L 1 + M so that there is room for M more bytes after C 1 . Once A receives SH from S, it stuffs this message within this extra space in SH and sends it to C. Hence, after the server hello, the handshake transcripts at the client and server have the same hash. Moreover, due to the length extension property of the hash function, all subsequent handshake hashes collide. So, A can forward S's signature in SCV to C and C's signature in CCV to S, and both will be accepted, even though the DH keys have been tampered with by a man-in-the-middle.

Implementing a Proof-Of-Concept Up to draft 7, the TLS 1.3 specification explicitly allowed RSA-MD5 signatures. We wrote a proof-of-concept attack demo based on our own simple prototype implementation of TLS 1.3 that signs with RSA-MD5. As with TLS 1.2 client authentication, we found the chosen-prefix collision in roughly one hour on a single workstation.

As we observed when discussing TLS 1.2, a large number of TLS servers and clients support RSA-MD5 signatures. Consequently, we believe that if TLS 1.3 draft 7 were to be implemented today, it is quite likely that many of its clients and servers would be vulnerable to our man-in-the-middle attack. However, this attack vector was removed from TLS 1.3, at least partly due to our findings, when draft 8 of the protocol explicitly deprecated MD5-based signatures.

D. Downgrading TLS 1.0-1.1 to Weak Ciphersuites using a Chosen-Prefix Transcript Collision

In TLS, the integrity of the handshake depends upon the MACs exchanged in the Finished messages. If these MACs were broken, the attacker would be free to modify the hello messages to downgrade the connection to an old protocol version or weak ciphersuite, or to delete important extensions such as the renegotiation indication countermeasure [11].

Recall that the Finished MACs are computed over the hash of the full handshake trascript (hash(log 2 ) and hash(log 3 ) in Figure 3). In TLS 1.0 and 1.1, this hash function is the concatenation of MD5 and SHA-1. As we saw in Section III, a chosen-prefix collision on this construction can be computed with 2 77 work. We find a man-in-the-middle transcript collision attack on serverauthenticated TLS 1.1 that is similar to the TLS 1.3 attack. A network attacker modifies the client and server hellos so that the handshake hashes collide immediately after these two messages; the rest of the handshake is left unchanged. The client authenticates the server and the handshake completes successfully, and although the attacker does not know the master secret, it can downgrade the connection to use any weak algorithm that both the client and server support, but prefer not to use, such as an EXPORT ciphersuite [1], or a weak encryption algorithm like RC4.

A similar transcript collision attack appears in DTLS 1.0, a UDP-based variant of TLS 1.1. In DTLS, the attack can be made even more efficient by exploiting its cookie mechanism. In response to a client hello CH, a DTLS server can send a hello verify request message HVR containing a cookie. The client is meant to restart the handshake by sending the exact same client hello message but with this cookie included in it. Since the HVR is not authenticated, the arbitrary-length cookie field allows any network attacker to inject data into the transcript, after a known prefix of a fixed length. This allows the chosen-prefix attack to be transformed to an almost common prefix attack, similar to the cookiebased attack on IKEv2 in Section VI-A.

E. Breaking the tls-unique Channel Binding using a Generic Transcript Collision

Suppose an application-level authentication protocol at C binds its login credential to the tls-unique channel binding [2], so that when the credential is sent from C to A, it cannot be used by A at S. We demonstrate how the attacker A could use a generic collision attack to break this protection. The attacker sends a SKE to C that contains a bogus group (k 2 -1, k), thereby forcing the client to send k x mod (k 2 -1) = k in its client key exchange CKE. On the server side, the attacker can send its own CKE containing any Diffie-Hellman value. Hence, the MitM knows the master secrets ms c , ms s and connection keys on both connections.

The goal of the attacker is to make sure that the contents of the client finished message (i.e. the tls-unique) coincide on both connections: mac 96 (ms c , log c

2 ) = mac 96 (ms s , log s

2 )

The attacker can use any controlled part of the transcript, but we will set things up carefully so that he can compute the collision as late as possible, in order to reduce the size of the messages to hash. More precisely, we use the certificate request SCR on the client-side and the NPN message on the server side, which are sent when all other messages in the transcript are already fixed. The attacker uses C 1 as the last distinguished name in SCR and C 2 as the padding in the NPN message (after the protocol name "http/1.1"), and computes (C 1 , C 2 ) such that the MAC coincides. Once this collision is found, the MitM sends these two messages on the corresponding connections and completes the handshakes. A can then impersonate C at S by forwarding any application-level channel-bound credentials sent by C (for A) to S.

Implementing a Proof-Of-Concept We implemented a man-in-the-middle attacker to demonstrate the attack.

We used an OpenSSL client as C and the main Google website as S, since this website supports the nextprotocol-negotiation protocol extension. After receiving the client hello CH from the client and the server hello done SHD from the server-side, the MitM runs a generic collision search to compute SCR and NPN.

For the collision search, we implemented the TLS PRF mac 96 function using the CUDA framework for NVIDIA GPUs. In TLS versions up to 1.1, this construction is built using MD5 and SHA-1; in TLS 1.2 the construction uses SHA-256. However, the strength of the hash function is immaterial because what we are attacking is the truncated 96-bit MAC. The underlying hash function does not matter. Following the analysis explain in Section III, it should require about 2 48 computations on average to get a collision.

Our implementation run at 160 MH/s for TLS 1.1 and 113 MH/s for TLS 1.2 on a Tesla K20Xm GPU. This is comparable to the expected speed we can derive from benchmarks of MD5, SHA-1 and SHA-256 on this GPU.It took 20 days to find a collision for TLS 1.1, using four Tesla K20Xm GPUs. Our demo evaluated the PRF about 2 49.9 times, which is rather unlucky: it should take half that number on average. We note that the generic collision attack is completely parallelizable and hence the time for finding a collision can be brought down to an arbitrarily small number by throwing enough computational power at it. Using Amazon EC2, this should cost about $140 for TLS 1.1, and $200 for TLS 1.2. The transcripts are available on our website. Truncated HMAC is not collision-resistant A more general lesson to be taken from our attack on tls-unique is that there are many uses of HMAC in cryptographic protocols that are not protected from collisions in the underlying hash function. For example, although HMAC-MD5 may be a good MAC, it is not collision-resistant when the key is known to the attacker. Similarly, when HMAC-SHA256 is truncated to 96 bits, it may still be a good MAC, but it is certainly not a good hash function (since collisions can still be found in 2 48 steps). Consequently, when inspecting the use of hash functions in Internet protocols, it would be a mistake to assume that all uses of HMAC are safe; it is important to look both at the mechanism and its intended security goal. In some cases, we may need HMAC to be both a MAC and a collision-resistant hash function.

VI. TRANSCRIPT COLLISIONS IN IKE AND SSH

Although the bulk of this paper has focused on collisions in TLS, similar attacks apply to other mainstream protocols like IKEv1, IKEv2, and SSH. We describe two exemplary attacks here.

A. Breaking IKEv2 Initiator Authentication using a Precomputed Common-Prefix Transcript Collision

Figure 7 depicts the IKEv2 authenticated key exchange protocol, which is similar to the SIGMA' protocol discussed in Section II. The initiator first sends an SA INIT request containing its Diffie-Hellman value g x , nonce n i , and proposed cryptographic parameters SA i , info i . The responder replies with its own public value g y , nonce n r and parameters SA r , info r . Alternatively, the responder may send a cookie ck, thereby asking the initiator to restart the protocol by sending the same SA INIT request but with ck included in it.

After the SA INIT exchange, the initiator and responder authenticate each other by signing a portion of the message transcript. Notably the initiator signs: However, the attacker has chosen ck in a way that the hash of m 1 is the same as the hash of a tampered SA INIT request m 1 that contains the attacker's Diffie-Hellman public value g x . The attacker sends this tampered request m 1 to the responder and upon receiving a response, it tampers with the response to replace R's Diffie-Hellman key g y with its own key g y . Note that the attacker does not tamper with the nonces n i , n r .

hash(SA INIT(ck|SA i |g x |n i |info i ) m1 |n r |mac(k i , ID i ))
At this point, the attacker knows the shared secrets g x y , g xy and encryption keys on the two connections. Moreover the hash used in the signature transcript collides all the way to the mac(k i , ID i ). To complete the attack, the attacker must ensure that k i is that same at I and R. It can ensure this by choosing x , y such that g x y = g xy (as discussed below). Thereafter, it can forward I's signature to R and hence impersonate I.

Implementing the Attack To implement the attack, we must first find a collision between m 1 and m 1 . We observe that in IKEv2 the length of the cookie is supposed to be at most 64 octets but we found that many implementations allow cookies of up to 2 16 bytes. We can use this flexibility in computing long collisions.

The attacker finds two length-prefixed bitstrings

(C 1 , C 2 ) of L bytes each such that hash(SA INIT([C 1 |-] ck |-)) = hash(SA INIT( C 2 ck |-))
where the length of ck is set to L+M , that is, ck has M empty bytes ready to fill in. We set M to the length of the bitstring SA i |g x |n i that the attacker wants to send to R in its tampered SA INIT request m 1 . The idea is that the attacker can now stuff the tampered message into ck, and can stuff the original message into info i to obtain a transcript collision:

hash(SA INIT([C1|SA i |g x |ni] ck |SAi|g x |ni|info i )|-) = hash(SA INIT([C2] ck |SA i |g x |ni|[SAi|g x |ni|info i ] info i )|-)
The collision (C 1 , C 2 ) can be found easily as a chosenprefix collision attack. Since the collision occurs before any unpredictable value has been included in the message, it can be computed offline; that is, it does not have to be computed while a connection is live. The collision can then be used to break any number of connections between I and R. Such collisions are easy to compute for MD5, but we found that even though MD5 signatures are allowed by the standard, they are not commonly supported by IKEv2 implementations. However, SHA-1 signatures are mandatory for all IKEv2 implementations, so an offline chosenprefix collision on SHA-1 is enough to mount the attack. The best known complexity of such collisions is currently 2 77 , which may be feasible for a powerful adversary (especially if better shortcut attacks on SHA-1 are discovered).

We also observe that the two prefixes are very similar: we only need the length of the cookie to be different. Following the format of IKE message, the length field is on bytes 22 and 23 of the hashed transcript, and all previous bytes must have a fixed value. Hence, we can almost use a common-prefix collision attack, if the collision algorithm introduces a difference in bytes 22-23, and no difference in preceding bytes. For MD5, the most efficient collision attacks do not have a compatible message difference, but it seems possible to build a dedicated attack with complexity below 2 39 . However, for SHA-1, all known collision attacks use differences in every message words, and are thus unsuitable.

The final step to implement the attack is to ensure that g xy = g x y . To achieve this, we rely on a small subgroup confinement attack. To see a simple example, suppose the attacker chose x = y = 0; then the two shared secrets would have the value 1. This specific solution would not work in practice because most IKEv2 implementations validate the received Diffie-Hellman public value to ensure that it is larger than 1 and smaller than p -1. However, many IKEv2 implementations support the Diffie-Hellman groups 22-24 that are known to have many small subgroups. These implementations do not validate the incoming public value, and hence are susceptible to similar small subgroup confinement attacks, as discussed in [5]. To complete our transcript collision attack, the MitM can use one such small subgroup to ensure that the shared values on the two connections are the same with high probability.

B. Breaking IKEv1 Initiator Authentication with a Generic Transcript Collision

IKEv1, the predecessor of IKEv2, and is also vulnerable to transcript collision attacks. We briefly outline one attack, without giving more details for lack of space. The initiator's signature in IKEv1 is computed as:

sign(sk I , prf(prf(n i |n r , g xy ), g x |g y |c i |c r |SA i |ID i ))
A commonly-used PRF function in IKEv1 is HMAC-MD5, and we find a generic transcript collision attack on the outer PRF value that allows initiator impersonation. A man-in-the-middle attacker intercepts a connection between I and R; it tries out many random g y values on the client-side, and many random values

C. Downgrading SSH-2 to Weak Ciphersuites with a Chosen-Prefix Transcript Collision

Figure 8 depicts the SSH-2 [39] protocol, which implements yet another variation of an authenticated Diffie-Hellman protocol. The client and server exchange identification strings V c , V s , negotiate protocol parameters I c , I s , and perform a Diffie-Hellman exchange g x , g y . To authenticate the exchange, clients and servers sign a session hash, defined as:

H = hash(V c |V s |I c |I s |pk S |g x |g y |g xy )
We show that a target collision on this hash value can allow downgrade attaks.

Figure 12 in Appendix depicts a downgrade attack on SSH-2. The network attacker tampers with the key exchange message I c in one direction and with I s in the other. It chooses their values in a way such that the following hashes coincide

hash(V c |V s |I c | C 1 |- I s ) = hash(V c |V s | C 2 I c )
Using this collision, we leave enough space empty in I s to stuff the real I s inside. Consequently the session hashes on the two sides coincide and the connection is completed. In this attack, the MitM does not tamper with the Diffie-Hellman values and hence it does not know the connection keys. However, it manages to 13 tamper with both I c and I s , and can therefore downgrade the negotiate ciphersuite to a weak cryptographic algorithm that the attacker knows how to break.

Implementing the target collision for SSH-2 requires a chosen-prefix attack on SHA-1 which is still considered impractical (at least 2 77 work). Moreover, since the two tampered fields I c and I s are meant to be strings (not bitstrings), we cannot use arbitrary collisions. Still, we find this attack to be an interesting illustration of the use of transcipt collisions for downgrade attacks.

SSH-2 has a peculiar session hash construction, with the shared secret g xy placed at the end. This makes certain kinds of collision attacks more difficult, but we note that this construction is not particularly secure; since it includes the shared secret, the session hash needs to be non-leaking in addition to being collisionresistant [4]. Moreover, if the SSH server reuses its Diffie-Hellman public value, this secret suffix becomes vulnerable to key recovery attacks like on APOP [25].

Other variations of SSH allow for more tampering, which may enable new attacks. The SSH Diffie-Hellman Group Exchange protocol [10] allows SSH servers to choose any Diffie-Hellman group for use in the key exchange. So, like in our TLS attacks, a man-in-themiddle attacker can send a bogus or weak group to the client, and use it to control more fields in the session hash and mount new transcript collision attacks.

VII. SLOTH: RESPONSIBLE DISCLOSURE AND IMPACT

Table I summarizes the attacks discussed in this paper. Three of our attacks on TLS are already practical; others are within the reach of powerful adversaries.

Our attacks on TLS were publicly disclosed under the acronym SLOTH (security losses from obsolete and truncated transcript hashes) and were assigned a protocol-level CVE-2015-7575. We informed the authors of affected protocol specifications and developers for various TLS libraries. We recommended that protocols and implementations should stop using MD5based signatures and other weak hash constructions. Our disclosure and recommendations resulted in the following security updates:

1) TLS 1.3 draft 7 stopped truncating the Finished MACs and started using the full HMAC output. 2) TLS 1.3 draft 8 deprecated MD5 signatures.

3) The Token Binding Protocol draft 2 removed tls-unique and moved to a stronger channel binding. 4) Akamai servers disabled support or RSA-MD5 client and server signatures. MD5 signatures in the default configuration. 9) Oracle and IBM are updating the TLS implementation in their Java runtimes to disable MD5 signatures in the default configuration. 10) mbedTLS is being updated to disable MD5 server signatures; MD5 client signatures were already disabled.

These changes impact the Firefox and Android browsers, about 31% of web servers, most Java application servers and their clients, and many other custom applications that use less well-known TLS libraries. We are maintaining a website with the currently known attacks, affected software, and disclosure status at our website: http://sloth-attack.org .

VIII. CONCLUSIONS

We have demonstrated that the use of MD5 and truncated HMACs for authenticating transcripts in various Internet protocols leads to exploitable chosen-prefix and generic collision attacks. We also showed several unsafe uses of SHA-1 that will become dangerous when more efficient collision-finding algorithms for SHA-1 are discovered. In all cases, the complexity of our transcript collision attacks are significantly lower than the estimated work for a second preimage attack on the underlying hash function. This definitively settles the debate on whether the security of mainstream cryptographic protocols depend on collision resistance. The answer is yes, cryptographers were right. Except in rare cases, mainstream protocols do require collision resistance for protection against man-in-the-middle transcript collision attacks. Consequently, we strongly recommend that weak hash functions like MD5 and SHA-1 should not just be deprecated; they should be forcefully disabled in existing protocols.

An open research question is whether it is possible to design key exchange protocols that will be resilient to new collision attacks. One strategy is to use a commitment scheme (like ZRTP [40]) that would make it more difficult for a man-in-the-middle to tamper with the transcript. However, such schemes may still be vulnerable to certain shortcut collisions [19]. For signatures, randomized hashing [13] provides a different way forward but its integration into a complex protocol like TLS would need to be carefully analyzed. We now give more details about attacks against hash function, considering both generic attacks and dedicated attacks against widely-used functions MD5 and SHA-1. The main results are summarizex in Table II.

H Collision CPC Generic 2 N/2 2 N/2 H1|H2 2 N 1 /2 N2/2 + 2 N 2 /2 2 N 1 /2 N2/2 + 2 N 2 /
Generic collision attacks While a basic collision attack requires to compute and store 2 N/2 images of the hash function, it is possible to mount a parallel and memory-less attack with a very small overhead. The main idea was introduced by Pollard as the Rho algorithm for factorization [30] and discrete logarithms [31], and was later generalized to collision search. The hash function is first restricted from {0, 1} * → {0, 1} N to {0, 1} N → {0, 1} N , so that it can be iterated. After some number of steps, a chain of iterations reaches a cycle, and the graph will have the shape of the greek letter ρ. On average, the cycle has length O(2 N/2 ) and is reached after O(2 N/2 ) steps. The point where the tail of the meets with the cycle reveals a collision in the hash function. It can be detected in time O(2 N/2 ) with little or no memory, using various cycle detection methods, such as Floyd's algorithm [20] (also known as tortoise and hare). Some variants of this attack using distinguished points can be parallelized efficiently. We now describe a parallel version of Pollard's Lambda algorithm, as described by van Oorschot and Wiener [37], using c CPUs. Each CPU will compute iteration chains of the function H, and stop when reaching a distinguished point, that is a point with some easy to test property. For instance, we stop a computation when the ending point satisfies x < 2 N/2 αc for some small constant α, so that the expected length of a chain is 2 N/2 /αc. When a chain is finished, we store the starting point, the length, and the ending point. We generate αc chains in this way, so that the function has been evaluated about 2 N/2 times, and there is a high probability that there was a collision. The important idea of this attack is that if a given point is reached by two different chains, both chain will stop at the same distinguished point. Therefore, we look at the ending points of the chains, and when a collision is detected, we restart the chains from the starting point in

H 1 H 2 IV 1 h 1 x 0 x 0 x 1 x 1 x 2 x 2 x 3 x 3 x 4 x 4 x 5 x 5 IV 2 h 2 M M Fig. 9. Multi-collision attack SHA-1 MD5 IV 1 IV 1 x 0 x 0 h 1 IV 2 IV 2 x 0 x 0 h 2 M M Fig. 10. CPC attack against MD5 | SHA-1
order to locate the collision. This attack requires about 2 N/2 evaluations of H, and a memory of αc when using c CPUs.

This attack can be tweaked for a chosen-prefix collision attack using an auxiliary function g : {0, 1} N → {0, 1} N defined as:

g(x) = H(P |x) if x is even H(P |x) if x is odd.
Collisions in g can be found with the previous techniques. With probability 1/2 a collision is g is between an even x and an odd x (or vice versa), this implies a chosen-prefix collision H(P |x) = H(P |x ). An accurate complexity analysis is provided in [37]: a collision is expected to be found after π2 N /2 evaluations. For a chosen-prefix collision, we expect to find two collisions in g after √ π2 N evaluations.

Concatenation Collisions in the concatenation of two hash functions H 1 |H 2 can be found with roughly the same effort as breaking the strongest one of the two, using the multi-collision technique of Joux [18].

The adversary first finds a collision pair (x 0 , x 0 ) for H 1 , starting from the initialization value of H 1 . Then it finds a collision pair (x 1 , x 1 ) starting from H 1 (x 0 ) = H 1 (x 0 ). This defines 4 messages with the same H 1 -digest:

x 0 |x 1 , x 0 |x 1 , x 0 |x 1 , x 0 |x 1 . After N 2 /2
steps, this defines a set of 2 N2/2 messages with the same H 1 -digest. With high probability, two of these messages have the same H 2 -digest as well (see Figure 9). Therefore, one can find a collision in H 1 |H 2 with a complexity only N 2 /2 × 2 N1/2 + 2 N2/2 . For MD5 | SHA-1, this translates to 2 80 , roughly as much as a generic collision attack on SHA-1.

Better attacks against MD5 | SHA-1 result from the combination of Joux's multicollision technique with shortcut attacks against SHA-1. A collision attack can be build for a cost of 64 × 2 61 + 2 64 ≈ 2 67 (building sequentially 64 collisions for MD5). For a chosenprefix collision, we first perform a chosen-prefix collision against SHA-1, to generate messages (x, x ) such that SHA-1(P |x) = SHA-1(P |x ). Then we build a multicollision in SHA-1 starting from this value, and we evaluate MD5 over a set of 2 64 messages in order to find a collision. The total cost is about 2 77 + 64 × 2 61 + 2 64 ≈ 2 77 (see Figure 10).

Moreover it has been shown that it is possible to combine cryptanalytic shortcuts both on SHA-1 and MD5, assuming that collision attacks against SHA-1 improve in the future [27]. This may allow collision attacks against MD5 | SHA-1 with less than 2 64 work. Table II summarizes the currently-known complexities for computing various hash collisions. Symmetric Cryptanalysis Beyond Primitives

B. Transcript Collision Attacks on IKEv2 and SSH-2

New Generic Attacks Against Hash-based MACs

Gaëtan Leurent 1 , Thomas Peyrin 2 , and Lei Wang 2

1 Université Catholique de Louvain, Belgium gaetan.leurent@uclouvain.be 2 Nanyang Technological University, Singapore thomas.peyrin@gmail.com wang.lei@ntu.edu.sg Abstract. In this paper we study the security of hash-based MAC algorithms (such as HMAC and NMAC) above the birthday bound. Up to the birthday bound, HMAC and NMAC are proven to be secure under reasonable assumptions on the hash function. On the other hand, if an n-bit MAC is built from a hash function with a l-bit state (l ≥ n), there is a well-known existential forgery attack with complexity 2 l/2 . However, the remaining security after 2 l/2 computations is not well understood. In particular it is widely assumed that if the underlying hash function is sound, then a generic universal forgery attack should require 2 n computations and some distinguishing (e.g. distinguishing-H but not distinguishing-R) and state-recovery attacks should also require 2 l computations (or 2 k if k < l). In this work, we show that above the birthday bound, hash-based MACs offer significantly less security than previously believed. Our main result is a generic distinguishing-H and state-recovery attack against hashbased MACs with a complexity of only Õ(2 l/2 ). In addition, we show a key-recovery attack with complexity Õ(2 3l/4 ) against HMAC used with a hash functions with an internal checksum, such as GOST. This surprising result shows that the use of a checksum might actually weaken a hash function when used in a MAC. We stress that our attacks are generic, and they are in fact more efficient than some previous attacks proposed on MACs instanciated with concrete hash functions.

Introduction

Message Authentication Codes (MACs) are crucial components in many security systems. A MAC is a function that takes a k-bit secret key K and an arbitrarily long message M as inputs, and outputs a fixed-length tag of size n bits. The tag is used to authenticate the message, and will be verified by the receiving party using the same key K. Common MAC algorithms are built from block ciphers (e.g. CBC-MAC), from hash functions (e.g. HMAC), or from universal 1 hash functions (e.g. UMAC). In this paper we study MAC algorithms based on hash functions.

As a cryptographic primitive, a MAC algorithm should meet some security requirements. It should be impossible to recover the secret key except by exhaustive search, and it should be computationally impossible to forge a valid MAC without knowing the secret key, the message being chosen by the attacker (existential forgery) or given as a challenge (universal forgery). In addition, cryptanalysts have also studied security notions based on distinguishing games. Informally, the distinguishing-R game is to distinguish a MAC construction from a random function, while the distinguishing-H game is to distinguish a known MAC construction (e.g. HMAC) instantiated with a known component (e.g. SHA-1) under a random key from the same construction instantiated with a random component (e.g. HMAC with a fixed input length random function).

One of the best known MAC algorithm is HMAC [2], designed by Bellare et al. in 1996. HMAC is now widely standardized (by ANSI, IETF, ISO and NIST), and widely deployed, in particular for banking processes or Internet protocols (e.g. SSL, TLS, SSH, IPSec). It is a single-key version of the NMAC construction, the latter being built upon a keyed iterative hash function H K , while HMAC uses an unkeyed iterative hash function H:

NMAC(K out , K in , M ) = H K out (H K in (M )) HMAC(K, M ) = H(K ⊕ opad H(K ⊕ ipad M ))
where opad and ipad are predetermined constants, and where K in denotes the inner key and K out the outer one.

More generally, a MAC algorithm based on a hash function uses the key at the beginning and/or at the end of the computation, and updates an l-bit state with a compression function. The security of MAC algorithms is an important topic, and both positive and negative results are known. On the one hand, there is a generic attack with complexity 2 l/2 based on internal collisions and length extension [17]. This gives an existential forgery attack, and a distinguishing-H attack. One the other hand, we have security proofs for several MAC algorithms such as HMAC and sandwich-MAC [2,1,26]. Roughly speaking, the proofs show that some MAC algorithms are secure up to the birthday bound (2 l/2 ) under various assumptions on the compression function and hash function.

Thanks to those results, one may consider that the security of hash-based MAC algorithms is well understood. However, there is still a strong interest in the security above the birthday bound. In particular, it is very common to expect security 2 k for key recovery attacks if the hash function is sound; the Encyclopedia of Cryptography and Security article on HMAC states explicitly [16] "A generic key recovery attack requires 2 n/2 known text-MAC pairs and 2 n+1 time" (assuming n = l = k). Indeed, key recovery attacks against HMAC with a concrete hash function with complexity between 2 l/2 and 2 l have been considered as important results [9,24,27]. Similarly, the best known dinstinguishing-H and state-recovery attacks have a complexity of 2 l (or 2 k if k < l), and distinguishing-2 Table 1. Comparison of our generic attacks on HMAC, and some previous attacks on concrete hash function. We measure the complexity as the number of calls to the compression function (i.e. number of messages times message length) 2 64 full version

The MD5 and GOST specifications allow arbitrary-length messages † The SHA-1 and HAVAL specifications limits the message length to 2 64 bits (and 2 64 bits is 2 54 blocks) H attacks on HMAC with a concrete hash function with complexity between 2 l/2 and 2 l have been considered as important results [12,18,25].

Our contributions. In this paper we revisit the security of hash-based MAC above the birthday bound. We describe a generic distinguishing-H attack in the single key model and with complexity of only O(2 l/2 ) computations, thus putting an end to the long time belief of the cryptography community that the best generic distinguishing-H on NMAC and HMAC requires Ω(2 l ) operations. Instead, we show that a distinguishing-H attack is not harder than a distinguishing-R attack. Our results actually invalidate some of the recently published cryptanalysis works on HMAC when instantiated with real hash functions [12,18,25] Our method is based on a cycle length detection, like the work of Peyrin et. al [14], but our utilization is quite different and much less restrictive: instead of iterating many times HMAC with small messages and a special related-key, we will use only a few iterations with very long messages composed of almost the same message blocks to observe the cycle and deduct information from it. Overall, unlike in [14], our technique works in the single-key model, for both HMAC and NMAC, and can be applied for any key size. In addition, leveraging our new ideas, we provide a single-key internal state recovery for any hash-based MAC with only O(l • log(l) • 2 l/2 ) computations.

We also introduce a different approach to reduce the length of the queried messages for distinguishing-H and internal-state-recovery attacks. Due to the limited space, we only give a quick overview of these shorter-message attacks, and refer the reader to the full version of this paper for more details.

Finally, this internal state recovery can be transformed into a single-key key recovery attack on HMAC with complexity O(l • 2 3l/4 ) when instantiated with a hash function using a checksum, such as the GOST hash function [6]. A surprising corollary to our results is that incorporating a checksum to a hash function seems to actually reduce the security of the overall HMAC design.

We give an overview of our results, and a comparison with some previous analysis in Table 1.

The description of HMAC/NMAC algorithms and their security are given in Section 2 and we recall in Section 3 the cycle-detection ideas from [14]. Then, we provide in Section 4 the generic distinguishing-H attack. We give in Sections 5 and 6 internal state recovery methods, and finally describe our results when the hash function incorporates a checksum in Section 7.

Hash-based MAC algorithms

In this paper, we study a category of MAC algorithms based on hash functions, where the key is used at the beginning and at the end of the computation, as described in Figure 1. More precisely, we consider algorithms where: the message processing is done by updating an internal state x using a compression function h; the state is initialized with a key dependent value I k ; and the tag is computed from the last state x p and the key K by an output function g.

x 0 = I K x i+1 = h(x i , m i ) MAC K (M ) = g(K, x p , |M |)
In particular, this description covers NMAC/HMAC [2], envelope-MAC [21], and sandwich-MAC [26]. The results described in Sections 4 and 5 can be applied to any hash-based MAC, but we focus on HMAC for our explanations because it is the most widely used hash-based MAC, and its security has been widely analyzed already. On the other hand the result of Section 7 is specific to MAC algorithms that process the key as part of the message, such as HMAC.

Description of NMAC and HMAC

A hash function H is a function that takes an arbitrary length input message M and outputs a fixed hash value of size n bits.

Virtually every hash function in use today follows an iterated structure like the classical Merkle-Damgård construction [13,4]. Iterative hash functions are built upon successive applications of a so-called compression function h, that takes a b-bit message block and a l-bit chaining value as inputs and outputs a l-bit value (where l ≥ n). An output function can be included to derive the n-bit hash output from the last chaining variable and from the message length. When l > n (resp. when l = n) we say that the hash function is wide pipe (resp. narrow pipe). The message M is first padded and then divided into blocks m i of b bits each. Then, the message blocks are successively used to update the l-bit internal state x i with the compression function h. Once all the message blocks have been processed, the output function g is applied to the last internal state value x p .

4 280 Symmetric Cryptanalysis Beyond Primitives h l m 0 x 0 h l m 1 x 1 h l m 2 x 2 x 3 MAC K (M ) l n |M | I K g K
x 0 = IV x i+1 = h(x i , m i ) hash = g(x p , |M |)
The MAC algorithm NMAC [2] uses two l-bit keys K out and K in . NMAC replaces the public IV of a hash function H by a secret key K to produce a keyed hash function H K (M ). NMAC is then defined as:

NMAC(K out , K in , M ) = H K out (H K in (M )).
The MAC algorithm HMAC [2] is a single-key version of NMAC, with K out = h(IV, K ⊕ opad) and K in = h(IV, K ⊕ ipad), where opad and ipad are b-bit constants. However, a very interesting property of HMAC for practical utilization is that it can use any key size and can be instantiated with an unkeyed hash function (like MD5, SHA-1, etc. which have a fixed IV ):

HMAC(K, M ) = H(K ⊕ opad H(K ⊕ ipad M )).
where denotes the concatenation operation. For simplicity of the description and without loss of generality concerning our attacks, in the rest of this article we assume that the key can fit in one compression function message block, i.e. k ≤ b (note that K is actually padded to b bits if k < b).

Security of NMAC and HMAC

In [1], Bellare proved that the NMAC construction is a pseudo-random function (PRF) under the sole assumption that the internal compression function h (keyed by the chaining variable input) is a PRF. The result can be transposed to HMAC as well under the extra assumption that h is also a PRF when keyed by the message input.

Concerning key recovery attacks, an adversary should not be able to recover the key in less than 2 k computations for both HMAC and NMAC. In the case of NMAC one can attack the two keys K out and K in independently by first finding an internal collision and then using this colliding pair information to brute force the first key K in , and finally the second one K out .

Universal or existential forgery attacks should cost 2 n computations for a perfectly secure n-bit MAC. However, the iterated nature of the hash functions used inside NMAC or HMAC allows a simple existential forgery attack requiring only 2 l/2 computations [17]. Indeed, with 2 l/2 queries, an adversary can first find an internal collision between two messages (M, M ) of the same length during the first hash call. Then, any extra block m added to both of these two messages will lead again to an internal collision. Thus, the attacker can simply forge a valid MAC by only querying for M m and deducing that M m will have the same MAC value.

Concerning distinguishers on HMAC or NMAC, two types have been discussed in the literature: Distinguishing-R and Distinguishing-H attacks, defined below: Distinguishing-R. Let F n be the set of n-bit output functions. We denote F K the oracle on which the adversary A can make queries. The oracle is instantiated either with F K = HMAC K (with K being a randomly chosen k-bit key) or with a randomly chosen function R K from F n . The goal of the adversary is to distinguish between the two cases and its advantage is given by

Adv(A) = |Pr[A(HMAC K ) = 1] -Pr[A(R K ) = 1]| .
Obviously the collision-based forgery attack detailed above gives directly a distinguishing-R attack on NMAC and HMAC. Thus, the expected security of HMAC and NMAC against distinguishing-R attacks is 2 l/2 computations.

Distinguishing-H. The attacker is given access to an oracle HMAC K and the compression function of the HMAC oracle is instantiated either with a known dedicated compression function h or with a random chosen function r from F b+l l (the set of (b + l)-bit to l-bit functions), which we denote HMAC h K and HMAC r K respectively. The goal of the adversary is to distinguish between the two cases and its advantage is given by

Adv(A) = Pr[A(HMAC h K ) = 1] -Pr[A(HMAC r K ) = 1] .
The distinguishing-H notion was introduced by Kim et al. [12] for situations where the attacker wants to check which cryptographic hash function is embedded in HMAC. To the best of our knowledge, the best known generic distinguishing-H attack requires 2 l computations.

Related-key attacks. At Asiacrypt 2012 [14], a new type of generic distinguishing (distinguishing-R or distinguishing-H) and forgery attacks for HMAC was proposed. These attacks are in the related-key model and can apply even to widepipe proposals, but they only work for HMAC, and only when a special restrictive criterion is verified: the attacker must be able to force a specific difference between the inner and the outer keys (with the predefined values of opad and ipad in HMAC, this criterion is verified when k = b). The idea is to compare the cycle length when iterating the HMAC construction on small messages with a key K, and the cycle length when iterating with a key K = K ⊕ opad ⊕ ipad.

Attacks on instantiations with concrete hash functions. Because of its widespread use in many security applications, HMAC has also been carefully scrutinized when instantiated with a concrete hash function, exploiting weaknesses of some existing hash function. In parallel to the recent impressive advances on hash function cryptanalysis, the community analyzed the possible impact on the security of HMAC when instantiated with standards such as MD4 [19], MD5 [20], SHA-1 [22] or HAVAL. In particular, key-recovery attacks have been found on HMAC-MD4 [9,24] and HMAC-HAVAL [27]. Concerning the distinguishing-H notion, one can cite for example the works from Kim et al. [12], Rechberger et al. [18] and Wang et al. [25].

However, to put these attacks in perspective, it is important to know the complexity of generic attacks, that work even with a good hash function.

Cycle detection for HMAC

Our new attacks are based on some well-known properties of random functions.

Random mapping properties on a finite set

Let us consider a random function f mapping n bits to n bits and we denote N = 2 n . We would like to know the structure of the functional graph defined by the successive iteration of this function, for example the expected number of components, cycles, etc. First, it is easy to see that each component will contain a single cycle with several trees linked to it. This has already been studied for a long time, and in particular we recall two theorems from Flajolet and Odlyzko [7].

Theorem 1 ([7, Th. 2]). The expectations of the number of components, number of cyclic points, number of terminal points, number of image points, and number of k-th iterate image points in a random mapping of size N have the asymptotic forms, as N → ∞:

(i) # Components: 1 2 log N (ii) # Cyclic nodes: πN/2 (iii) # Terminal nodes: e -1 N (iv) # Image points: (1 -e -1 )N (v) # k-th iterate images: (1 -τ k )N , with τ 0 = 0, τ k+1 = e -1+τ k .
In particular, a random mapping has only a logarithmic number of distinct components, and the number of cyclic points follows the square root of N . By choosing a random starting point P and iterating the function f , one will follow a path in the functional graph starting from P , that will eventually connect to the cycle of the component in which P belongs, and we call tail length the number of points in this path. Similarly, we call cycle length the number of nodes in the cycle. Finally, the number of points in the non-repeating trajectory from P is called the rho length, and we call α-node of the path the node that connects the tail and the cycle.

Theorem 2 ([7, Th. 3]). Seen from a random point in a random mapping of size N , the expectations of the tail length, cycle length, rho length, tree size, component size, and predecessors size have the following asymptotic forms:

(i) Tail length (λ): πN/8 (ii) Cycle length (µ): πN/8 (iii) Rho length (ρ = λ + µ): πN/2 (iv) Tree size: N/3 (v) Component size: 2N/3 (vi) Predecessors size: πN/8
One can see that, surprisingly, in a random mapping most of the points tend to be grouped together in a single giant component, and there is a giant tree with a significant proportion of the points. The asymptotic expectation of the maximal features is given by Flajolet and Sedgewick [8].

Theorem 3 ([8, VII.14]). In a random mapping of size N , the largest tree has an expected size of δ 1 N with δ 1 ≈ 0.48 and the largest component has an expected size of δ 2 N with δ 2 ≈ 0.7582.

These statistical properties will be useful to understand the advantage of our attacks. We show the functional graph of a simple random-looking function in Figure 4 in the Appendix.

Using cycle-detection to obtain some secret information

In this article and as in [14], we will study the functional graph structure of a function to derive a distinguisher or obtain some secret information. More precisely, in [14] Peyrin et al. observed that the functional graph structure of HMAC was the same when instantiated with a key K or with a related key K = K ⊕ ipad ⊕ opad (note that in order to be able to query this related-key K , the key K has to be of size b or b -1, which is quite restrictive). This is a property that should not exist for a randomly chosen function and they were able to detect this cycle structure by measuring the cycle length in both cases K and K , and therefore obtaining a distinguishing-R attack for HMAC in the related-key model. In practice, the attacker can build and observe the functional graph of HMAC by simply successively querying the previous n-bit output as new message input.

In this work, instead of studying the structure of the functional graph of HMAC directly, we will instead study the functional graph of the internal compression 8 function h with a fixed message block: we denote h M (X) = h(X, M ). We aim to obtain some information on h M that we can propagate outside the HMAC structure. This is therefore perfectly suited for a distinguishing-H attack, which requires the attacker to exhibit a property of h when embedded inside the HMAC construction. We can traverse the functional graph of h M by querying the HMAC oracle with a long message composed of many repetitions of the fixed message block M . The issue is now to detect some properties of the functional graph of h M inside HMAC and without knowing the secret key. We explain how to do that in the next section.

Distinguishing-H attack for hash-based MACs

In the rest of the article, we use the notation [x] k to represent the successive concatenation of k message blocks x, with [x] = [x] 1 .

General description

In order to derive a distinguishing-H attack, we need to do some offline computations with the target compression function h and use this information to compare online with the function embedded in the MAC oracle. We use the structure of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] to derive our attack (of course we can choose any fixed message block). We can travel in the graph by querying the oracle using consecutive [0] message blocks. However, since the key is unknown, we do not know where we start or where we stop in this graph. We have seen in the previous section that the functional graph of a random function is likely to have a giant component containing most of the nodes. We found that the cycle size of the giant component of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] is a property that can be efficiently tested.

More precisely, we first compute the cycle size of the giant component of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] offline; we denote it as L. Then, we measure the cycle size of the giant component of the unknown function by querying the MAC oracle with long messages composed of many consecutive [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] message blocks. If no length padding is used in the hash function, this is quite simple: we just compare MAC([0] 2 l/2 ) and MAC([0] 2 l/2 +L ). With a good probability, the sequence of 2 l/2 zero block is sufficiently long to enter the cycle, and if the cycle has length L, the two MAC outputs will collide.

Unfortunately, this method does not work because the lengths of the messages are different, and thus the last message block with the length padding will be different and prevent the cycle collision to propagate to the MAC output. We will use a trick to overcome this issue, even though the basic method remains the same. The idea is to build a message M going twice inside the cycle of the giant component, so that we can add L [0] message blocks in the first cycle to obtain a message M 1 and L [0] message blocks in the second cycle to obtain M 2 . This is depicted in Figure 2: M 1 will cycle L [0] message blocks in the first cycle (red dotted arrows), while M 2 will cycle L [0] message blocks in the second cycle (blue dashed arrows), and thus they will both have the same length overall.

To perform the distinguishing-H attack, the adversary simply randomly selects an initial message block m and query

M 1 = m [0] 2 l/2 [1] [0] 2 l/2 +L and M 2 = m [0] 2 l/2 +L [1] [0] 2 l/2
to the MAC oracle, and deduce that the target function is used to instantiate the oracle if the two MAC values are colliding. The [1] message block is used to quit the cycle and randomize the entry point to return again in the giant component. We give below a detailed attack procedure and complexity analysis.

Fig. 2. Distinguishing-H attack

This attack is very interesting as the first generic distinguishing-H attack on HMAC and NMAC with a complexity lower than 2 l . However, we note that the very long message length might be a limitation. In theory this is of no importance and our attack is indeed valid, but in practice some hash functions forbid message inputs longer than a certain length. To address this issue we provide an alternative attack in the full version of this paper, using shorter messages, at the cost of a higher complexity.

Detailed attack process

1. (offline) Search for a cycle in the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] and denote L its length. 2. (online) Choose a random message block m and query the HMAC value of the two messages

M 1 = m [0] 2 l/2 [1] [0] 2 l/2 +L and M 2 = m [0] 2 l/2 +L [1] [0] 2 l/2 . 3.
If the HMAC values of M 1 and M 2 collide then output 1, otherwise output 0.

Complexity and success probability analysis

We would like to evaluate the complexity of the attack. The first step will require about 2 l/2 offline computations to find the cycle for the target compression function h. It is important to note that we can run this first step several times 10 in order to ensure that we are using the cycle from the largest component of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] . The second step makes two queries of about 2 l/2 + 2 l/2 + L 3 • 2 l/2 message blocks each. Therefore, the overall complexity of the attack is about 2 l/2+3 compression function computations.

Next, we evaluate the advantage of the adversary in winning the distinguishing-H game defined in Section 2.2. We start with the case where the oracle is instantiated with the real compression function h. The adversary will output 1 if a collision happens between the HMAC computations of M 1 and M 2 . Such a collision can happen when the following conditions are satisfied:

• The processing of the random block m sets us in the same component (of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] ) as in the offline computation. Since we ensured that the largest component was found during the offline computation, and since it has an average size of 0.7582 • 2 l elements according to Theorem 2, this event will happen with probability 0.7582. • The 2 l/2 [0] message blocks concatenated after m are enough to reach the cycle of the component, i.e. the tail length when reaching the first cycle is smaller than 2 l/2 . Since the average tail length is less than 2 l/2 elements, this will happen with probability more than 1/2. • The processing of the block [1] sets us in the same component (of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] ) as in the offline computation; again the probability is 0.7582. • The 2 l/2 [0] message blocks concatenated after [1] are enough to reach the cycle of the component; again this happens with probability 1/2.

The collision probability is then (0.7582) 2 × 1/4 0.14 and thus we have that Pr[A(HMAC h K ) = 1] ≥ 0.14. In the case where the oracle is instantiated with a random function r, the adversary will output 1 if and only if a random HMAC collision happens between messages M 1 and M 2 . Such a collision can be obtained if the processing of any of the last [0] 2 l/2 blocks of the two messages leads to an internal collision, therefore with negligible probability 2 l/2 • 2 -l = 2 -l/2 . Overall, the adversary advantage is equal to Adv(A) = 0.14 -2 -l/2 0.14.

Internal state recovery for NMAC and HMAC

This section extends the distinguishing-H attack in order to build an internal state recovery attack.

General description

In order to extent the distinguishing-H attack to a state recovery attack, we observe that there is a high probability that the α-node reached in the online phase is the root of the giant tree of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] . More precisely, we can locate the largest tree and the corresponding α-node in the offline phase, by repeating the cycle search a few times. We note that δ 1 + δ 2 > 1, therefore the largest tree is in the largest component with asymptotic probability one (see with shorter messages. The attacks of Sections 4 and 5 have a complexity of O(2 l/2 ) using a small number of messages of length 2 l/2 ; on the other hand the alternative attack has a complexity O(2 3l/4 ) using 2 l/2 messages of length 2 l/4 . More generally, if the message size is limited to 2 s blocks (s ≤ l/4), then the attack requires 2 l-2s messages. Due to space constraints, we only give a brief description of this attack here.

Entropy loss in collisions finding

While the previous attacks are based on detecting cycles in the graph of a random function, this alternative attack is based on the fact that finding collisions by iterating a random function does not give a random collision: some particular collisions are much more likely to be found than others. This fact is well known in the context of collision search; for instance van Oorschot and Wiener [23] recommend to randomize the function regularly when looking for a large number of collisions. In this attack, we exploit this property to our advantage: first we use a collision finding algorithm to locate collisions in h M with a fixed M; then we query the MAC oracle with messages with long repetitions of the block M and we detect collisions in the internal state; since the collisions found in this way are not randomly distributed, there is a good probability that we will reach one the collisions that was previously detected in the offline phase. Actually, the attacks of Sections 4 and 5 can also be seen as following this stategy: we use a collision finding algorithm based on cycle detection (following Pollard's rho algorithm), and we know that with a good probability, the collision found will be the root of the giant tree. For the alternative attack, we use a collision finding algorithm similar to [23], but using using fixed length chains. In the full version of the paper, we study the entropy of the distribution of collisions found in this way, and we show that when using chains of length 2 s , we need about 2 l/2-s collisions in order to have a match between the online and offline steps. This translates to an attack complexity of 2 l-s , with s ≤ l/4.

Key recovery for HMAC based on a hash function with an internal checksum

In this section we study HMAC used with a hash function with an internal checksum, such as GOST. We first show that the checksum does not prevent the distinguishing-H and state recovery attack, but more surprisingly the checksum actually allows to mount a full key-recovery attack significantly more efficient than exhaustive search. A hash function with an internal checksum computes the sum of all message blocks, and uses this sum as an extra input to the finalization function. The sum can be computed for any group operation, but it will usually be an XOR sum or a modular addition. We use the XOR sum Sum ⊕ to present our attack, but it is applicable with any group operation.

The checksum technique has been used to enhance the security of a hash function, assuming that controlling the checksum would be an additional challenge for an adversary. While previous work argued its effectiveness [10], our result reveals a surprising fact that incorporating a checksum into a hash function could even weaken its security in some applications such as HMAC.

A notable example of a hash function with a checksum is the GOST hash function, which has been standardized by the Russian Government [6] and by IETF [5]. HMAC-GOST has also been standardized by IETF [15] and is implemented in OpenSSL. GOST uses parameters n = l = b, and uses a separate call to process the message length, as follows:

x 0 = IV x i+1 = h(x i , m i ) x * = h(x p , |M |) σ 0 = 0 σ i+1 = σ i ⊕ m i hash = g(x * , σ p )
If this section we describe the attack on GOST-like functions following this structure; Figure 3 shows an HMAC computation with a GOST-like hash function. We give more general attacks when the output is computed as g(x p , |M |, σ p ) in the full version of this paper.

IV K ⊕ ipad h l M 0 x 0 h l M 1 x 1 h l M 2 x 2 σ 3 x 3 x * l |M | h h l g H(K ⊕ ipad ) •
Fig. 3. HMAC based on a hash function with a checksum (dashed lines) and a length-padding block. We only detail the first hash function call.

General description

In HMAC, K ⊕ ipad is prepended to a message M , and (K ⊕ ipad) M is hashed by the underlying hash function H. Therefore, the final checksum value is

σ p = Sum ⊕ ((K ⊕ ipad) M ) = K ⊕ ipad ⊕ Sum ⊕ (M ).
In this attack, we use the state recovery attack to recover the internal state x * before the checksum is used and we take advantage of the fact that the value σ p actually contains the key, but can still be controlled by changing the message. We use this to inject a known difference in the checksum, and to perform a kind of related key attack on the finalization function g, even though we have access to a single HMAC key.

More precisely, we use Joux's multicollision attack [11] to generate a large set of messages with the same value x for x * , but with different values of the checksum. We detect MAC-collisions among those messages, and we assume that the collisions happens when processing the checksum of the internal hash function. For each such collision, we have g(x, K ⊕ ipad ⊕ Sum ⊕ (M )) = g(x, K ⊕ ipad ⊕ Sum ⊕ (M )), and we compute the input difference ∆M = Sum ⊕ (M ) ⊕ Sum ⊕ (M ).

Finally, we compute g(x, m) offline for a large set of random values m, and we collect collisions. Again, we compute the input difference ∆m = m ⊕ m for each collision, and we match ∆m to the previously stored ∆M . When a match is found between the differences we look for the corresponding values and we have K ⊕ ipad ⊕ Sum ⊕ (M ) = m (or m ) with high probability. This gives the value of the key K.

State recovery with a checksum. First, we note that the checksum σ does not prevent the state recovery attacks of Section 5; the complexity only depend on the size l of the state x. Indeed, the attack of Section 5 is based on detecting collisions between pairs of messages

M 1 = m [0] 2 l/2 [k] [0] 2 l/2 +L and M 2 = m [0] 2 l/2 +L [k] [0] 2 l/2
. Since the messages have the same checksum, a collision in the state will be preserved. More generally, the attacks can easily be adapted to use only message with a fixed sum. For instance, we can use random messages with two identical blocks in the attack of Section 5, and messages of the form

m m [0] 2 l/2 [k] [k] [0] 2 l/2 +L have a checksum of zero.
Recovering the state of a short message. Unfortunately, the state we recover will correspond to a rather long message (e.g. 2 l/2 blocks), and all the queries based on this message will be expensive. In order to overcome this issue, we use the known state x M after a long message M to recover the state after a short one. More precisely, we generate a set of 2 l/4 long messages by appending a random message blocks m twice to M . Note that Sum ⊕ (M m m) = Sum ⊕ (M ). Meanwhile, we generate a set of 2 3l/4 two-block messages m 1 m 2 , with m 1 ⊕ m 2 = Sum ⊕ (M ). We query these two sets to the HMAC oracle and collect collisions between a long and a short message. We expect that one collision correspond to a collision in the value x * before the finalization function g. We can compute the value x * for the long message from the known state x M after processing M . This will correspond to the state after processing the message m 1 m 2 and its padding block, or equivalently, after processing the message m 1 m 2 [2] (because the length block is processed with the same compression function). We can verify that the state is correctly recovered by generating a collision m m, m m offline from the state x * , and comparing

HMAC(m 1 m 2 [2] m m) and HMAC(m 1 m 2 [2] m m ).

Detailed attack process

For simplicity of the description, we omit the padding block in the following description, and we refer to the previous paragraphs for the details of how to deal with the padding.

1. Recover an internal state value x r after processing a message M r through HMAC. Refer to Section 5 for the detailed process. 2. (online) Choose 2 l/4 one-block random messages m, query M r m m to HMAC and store m and the corresponding tag. 3. (online) Choose 2 3l/4 one-block random messages m, query (Sum ⊕ (M r ) ⊕ m) m to HMAC and look for a match between the tag value and one of the stored tag values in Step 2. For a colliding pair (Sum ⊕ (M r )⊕m) m and M r m m , denote Sum ⊕ (M r )⊕ m m as M 1 and h(h(x r , m ), m ) as x 1 . Generate a collision h(h(x 1 , u), u) = h(h(x 1 , u ), u ). Query M 1 u u and M 1 u u and compare the tags. If they are equal, the internal state after processing M 1 (before the checksum block) is x 1 . 4. (offline) Generate 2 3l/4 messages that all collide on the internal state before the checksum block by Joux's multicollision. More precisely, choose 2 l/2 random message m and compute h(x 1 , m) to find a collision h(x 1 , m 1 ) = h(x 1 , m 1 ) = x 2 . Then iterate this procedure to find a collision h(x i , m i ) = h(x i , m i ) = x i+1 for i ≤ 3l/4. Denote the value of x 3l/4+1 by x. 5. (online) Query the set of messages in Step 4 to HMAC in order to collect tag collisions. For each collision M and M , compute the checksum difference ∆M = Sum ⊕ (M ) ⊕ Sum ⊕ (M ), and store (Sum ⊕ (M ), ∆M ). 6. (offline) Choose a set of 2 3l/4 one-block random message m, compute g(x, m) and collect collisions. For each collision m and m , compute the difference ∆m = m ⊕ m and match ∆m to the stored ∆M at Step 5. If a match is found, mark Sum ⊕ (M ) ⊕ ipad ⊕ m and Sum ⊕ (M ) ⊕ ipad ⊕ m ⊕ ∆m as potential key candidates. 7. (offline) filter the correct key from the potential candidates by verifying a valid message/tag pair.

Complexity and success probability analysis

We need to evaluate the complexity of our key recovery attack.

Step 1:

O(l • log(l) • 2 l/2 ) Step 2: 2 3l/4
Step 3:

2 • 2 3l/4
Step 4: 3l/4 • 2 l/2

Step 5: 3l/4 • 2 3l/4 Step 6: 2 3l/4

Step 7:

O(1)
Overall, the fifth step dominates the complexity, and the total complexity is about 3l/4 • 2 3l/4 compression function computations.

Next we evaluate the success probability of our method. The first step succeeds with a probability almost 1 after several trials. Steps 2 and 3 need to guarantee a collision between a long and a short message. Since there are 2 l pairs, one such collision occurs with a probability of 1

-(1 -2 -l ) 2 l ≈ 1 -1/e ≈ 0.63.
The success probability of producing no less than 2 l/2 collisions at each of steps 5 and 6 is 0.5 since the expected number of collisions is 2 l/2 . Thus the overall success probability is no less than 0.16.

Conclusion

Our results show that the security of HMAC and hash-based MAC above the birthday bound is significantly weaker than previously expected. First, we show that distinguishing-H and state-recovery attacks are not much harder than a distinguishing-R attack, contrary to previous beliefs. Second, we show that the use of a checksum can allow a key-recovery attack against HMAC with complexity only Õ(2 3l/4 ). In particular, this attack is applicable to HMAC-GOST, a standardized construction.

We give a comparison of our attacks and previous attack against concrete instances of HMAC in Table 1, showing that some attacks against concrete instances are in fact less efficient than our generic attacks.

As future works, it would be interesting to find other applications of the internal state recovery for HMAC. Moreover, we expect further applications of the analysis of the functional graph, as it might be possible to use other distinguishing properties, such as the tail length, the distance of a node from the cycle, etc. MAC algorithms are an important symmetric cryptography primitive, used to verify the integrity and authenticity of messages. The sender of a message uses a MAC function to compute a tag from the message and a shared secret key. The tag is appended to the message and the receiver can recompute the tag using the key, and reject the message when it does not match the received one. The main security requirement of a MAC is the resistance to existential forgery. Namely, after querying the MAC oracle to obtain the tags of some carefully chosen messages, it should be hard for an adversary to forge a valid tag for a different message.

One of the most widely used MAC algorithms in practice is HMAC, a MAC construction using a hash function designed by Bellare, Canetti and Krawczyk in 1996 [4]. The algorithm has been standardized by ANSI, IETF, ISO and NIST, and is widely deployed to secure internet communications (e.g. SSL/TLS, SSH, IPSec). As these protocols are widely used, the security of HMAC has been extensively studied, and several security proofs [3,4] show that it gives a secure MAC and a secure PRF up to the birthday bound (assuming good properties of the underlying compression function). At the same time, there is a simple existential forgery attack on any iterative MAC with an -bit state, with complexity 2 /2 , matching the security proof. Nevertheless, security beyond the birthday bound for stronger attacks (such as state-recovery and universal forgery) is still an important topic.

Surprisingly, the security of HMAC beyond the birthday bound has not been thoroughly studied until 2012, when Peyrin and Sasaki described an attack on HMAC in the related-key setting [23]. Later work focused on single-key security, and included a paper by Naito, Sasaki, Wang and Yasuda [21], which described state-recovery attacks with complexity 2 / . At Asiacrypt 2013, Leurent, Peyrin and Wang [19] gave state-recovery attacks with complexity 2 /2 , closing the gap with the security proof. Later, at Eurocrypt 2014, Peyrin and Wang [24] described a universal forgery attack with complexity as low as 2 5 /6 , a result that was further improved to 2 3 /4 at CRYPTO 2014 [11], showing that even this very strong attack is possible with significantly less than 2 work. Some of the generic attacks have also been used as a first step to build specific attacks against HMAC with the concrete hash function Whirlpool [12,13].

These results show that more work is needed to better understand the exact security provided by HMAC and hash-based MACs in general.

Our results

In this paper, we provide several important contributions to the security analysis of HMAC and similar hash-based MAC constructions. In particular, we devise improved attacks when HMAC is used with many popular concrete hash functions, and in several cases our attacks are the first to be applicable to HMAC Fig. 1 Tradeoffs between the message length and the complexity for state-recovery attacks with the given hash function. Some results with concrete instantiations are summarized in Table 1. 1As a first contribution, we focus on the HAIFA [5] mode of operation, used in many hash function designs such as BLAKE [1,2], Skein [8], or Streebog [7]. The HAIFA construction uses a block counter to tweak the compression functions, such that they resemble independent random functions, in order to thwart some narrow-pipe attacks (e.g. the second-preimage attack of Kelsey and Schneier [16]). Indeed, the previous attacks against HMAC [19,24] use in a very strong way the assumption that the same compression function is applied to all the message blocks, and thus they cannot be applied to HAIFA. In this work, we present the first state-recovery attack on HMAC using these hash functions, whose optimal complexity is 2 4 /5 .

1 2 /4 2 /2 2 /2
In an interesting application of our state-recovery attack on HAIFA (given in Section 8), we show how to extend it into a key-recovery attack on the new Russian standard Streebog, recovering the 512-bit key of HMAC-Streebog with a complexity of 2 417 . This key-recovery attack is similar to the one of [19] for Merkle-Damgård, and confirms its surprising observation: adding internal checksums in a hash function (such as Streebog) weakens the design when used in HMAC, even for hash functions based on the HAIFA mode.

As a second contribution of this paper, we revisit the results of the full version of [19] for Merkle-Damgård hash functions (given in [18]), and we prove the conjectures used in its short message attacks. Some of our proofs are of independent interest, as they give insight into the behavior of classical collision search algorithms for random functions. These proofs explain for the first time an interesting phenomenon experimentally observed in several previous works match with low probability (which does not lead to efficient attacks), we only match special states, which have a higher probability to be equal. These special states are the result of iterating random functions using chains, computed by applying the compression function on a fixed message from arbitrary initial states. In this paper, we exploit two types of special states which were also exploited in [19]: states on which two evaluated chains collide, and states on which a single chain collides with itself to form a cycle. We also introduce a third type of special states, which result from the reduction of the image space that occurs when applying a fixed sequence of random functions. This is used in some of our new attacks, and in particular against HAIFA.

As described above, after we compute special states both online and offline, we need to match them in order to recover an online state. However, since the online states are unknown, the matching cannot be performed directly, and we are forced to match the nodes indirectly using filters. A filter for a node (state) is a property that identifies it with high probability, i.e., once the filters of two nodes match, then the nodes themselves match with high probability. Since the complexity of the matching steps in a state-recovery attack depends on the complexity of building a filter for a node and testing a filter on a node, we are interested in building filters efficiently. In this paper, we use two types of filters: collision filters (which were also used in [19]) and diamond filters, which exploit the diamond structure (introduced in [15]) in order to build filters for a large set of nodes with reduced average complexity. In fact, we use a novel online construction of the diamond structure via the MAC oracle, whereas such a structure is typically computed offline. In particular, we show that despite the fact that the online diamond filter increases the complexity of building the filter, the complexity of the actual matching phase is significantly reduced, and gives improved attacks in many cases.

Complexity evaluation

The complexity of our attacks is calculated in terms of the number of compression function evaluations of the underlying hash functions. Similarly to related papers in the field, we assume that sorting a table can be performed in linear time, while searching a sorted table takes constant time. As the complexities of all our attacks are exponential in the state size , we mostly use the big-O and soft-O ( Õ) notation to estimate them (which is common practice in analysis of exponential-time algorithms). These estimations ignore small constants and polynomial factors in (which are generally linear in our attacks). An exception to this is the more precise complexity evaluation for the attack on HMAC-Streebog, given in Appendix B.

Outline

The paper is organized as follows. We begin with a description of HMAC in Section 2. We then describe and analyze the algorithms used to compute special states in Section 3, and the filters we use in our attacks in Section 4.

Next, we present a simple attack against HMAC with a HAIFA hash function in Section 5, and revisit the results of [19] in Section 6, presenting new tradeoffs for attacks on Merkle-Damgård hash functions. In Section 7, we give more complex attacks for shorter messages. Our key-recovery attack on HMAC with GOST R 34.11-2012 (Streebog) is described is Section 8. Finally, in Section 9, we present our universal forgery attacks with short queries, and conclude in Section 10.

HMAC and Hash-based MACs

In this paper we study MAC algorithms based on a hash function, such as HMAC. Using a hash function H, HMAC is defined as HMAC(K, M ) = H(K ⊕ opad H(K ⊕ ipad M )), as shown in Figure 2. More generally, we consider a class of iterative designs based on a family of compression functions h i and a finalization function g, represented by Figure 3. We denote the -bit internal state as x i and the n-bit output tag as t. The message M is divided into p blocks m i , and the MAC is computed as:

x 0 = I K x i+1 = h i (x i , m i ) t = g(K, x p , |M |).
The message processing updates the internal state starting from a key-dependant value I K , and the output is produced with a key-dependant finalization function g. In particular, we note that the state update does not depend on the key. Our description covers HMAC [4], Sandwich-MAC [27] and envelope-MAC [26] with any common hash function. The hash function can use the message length in the finalization process, which is a common practice, and the round function can depend on a block counter, as in the HAIFA mode. If the hash function uses the plain Merkle-Damgård mode, the round functions h i are all identical (this is the model analyzed in previous attacks [19,24]).

In this work, we assume that with very high probability, an arbitrary collision on the tag of two messages of the same length is a result of a collision on the final internal states x p . This greatly simplifies the description of the attacks, and does not restrict the scope of our results. This assumption can be realized by altering the original scheme such that the new tag length is made larger than . Indeed, from a function MAC 1 (K, M ) with an output of n bits, we can build a function MAC 2 (K, M ) with a 2n-bit output by appending message blocks [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] and [1] to

M , as MAC 2 (K, M ) = MAC 1 (K, M [0]) MAC 1 (K, M [1]).
Our attacks applied to MAC 2 can immediately be turned to attacks on MAC 1 with a multiplicative penalty of 2.

In our attacks, we evaluate chains of the compression function h (or h i for HAIFA) with a fixed message input block [b] (usually [b] = [0]), and typically simplify our notation and define f

(x) = h(x, [b]) (or f i (x) = h i (x, [b]
) for HAIFA). We assume that the function f (or each f i ) is chosen from all -bit mappings uniformly at random. This implies that our analysis captures most (but not all) choices of underlying hash functions.

IV K ⊕ ipad h 1 M 0 x 0 h 2 M 1 x 1 h 3 M 2 x 2 x 3 |M | h 0 g IV K ⊕ opad h 0 h 1 g n t
Fig. 2 HMAC with a HAIFA hash function. There are two hash function calls, each of them using the key at the beginning. 3 Hash-based MAC with HAIFA. Only the initial value and the final transformation are keyed.

h 0 m 0 x 0 h 1 m 1 x 1 h 2 m 2 x 2 x 3 MAC K (M ) n |M | I K g K Fig.

Description and Analysis of Collision Search Algorithms

In this section, we describe the collision search algorithms which are used in our state-recovery attacks in order to compute special states. We then analyze these algorithms (assuming they are applied to random functions) and prove the two conjectures of [19]. Lemma 1 proves the first conjecture, while Lemma 3 proves the second conjecture.

Collision search algorithms

We use standard collision search algorithms which evaluate chains starting from arbitrary points. Namely, a chain -→ x starts from x 0 , and is constructed iteratively by the equation x i = f i (x i-1 ) up to i = 2 s for a fixed value of s.

We consider two different types of collisions between two chains -→ x and -→ y : free-offset collisions (x i = y j for any i, j, with all the f i 's being equal), and same-offset collisions (x i = y i ).

Free-offset collision search

When searching offline for collisions in iterations of a single random function f , we evaluate 2 t chains starting from arbitrary points, and extended to length 2 s . Assuming that 2 s • 2 t+s ≤ 2 (i.e., 2s + t ≤ ), then we are at (or below) the birthday paradox threshold and therefore each of the chains is not expected to collide with more than one other chain in the structure. This implies that the structure contains a total of about 2 t+s distinct points, and (according to the birthday paradox) we expect it to contain a total of 2 c = Θ(22(t+s)-) collisions. We can easily recover all of these collisions in O(2 t+s ) = O(2 (c+ )/2 ) time by storing all the evaluated points and checking for collisions in memory.

We note that we can reduce the memory requirements of the algorithm by using the parallel collision search algorithm of van Oorschot and Wiener [22]. However, in this paper, we generally focus on time complexity and do not try to optimize the memory complexity of our attacks.

Cycle search

Cycles are created when a chain collides with itself while iterating a single random function f . In order to search offline for a cycle of length O(2 s ) (for s ≤ /2), we evaluate 2 -2s chains starting from arbitrary points, and extended to length 2 s . The probability that a chain collides with itself to form a cycle is equal (up to a constant factor) to the probability that its first half (of length 2 s-1 ) collides with its second half, which occurs with probability Θ(2 2s-). Thus, we expect to find a cycle within the evaluated 2 -2s chains.

Same-offset collision search

While free-offset collisions are the most general form of collisions, they cannot always be efficiently detected and exploited by our attacks. In particular, they cannot be efficiently detected in queries to the online oracle (as a collision between messages of different lengths would lead to different values after the finalization function). Furthermore, if the hash function uses the HAIFA iteration mode, it is also not clear how to exploit free-offset collisions offline, as the colliding chains do not merge after the collision (and thus we do not have any easily detectable non-random property).

In the cases above, we are forced to only use collisions that occur at the same offset. When computing 2 t chains of length 2 s , a pair of chains collides at the same offset with probability of roughly 2 s-. As we have 2 2t pairs 2 of chains, we expect to find about 2 2t+s-same-offset collisions.

We note that the computation above assumes that pairs of chains behave (almost) independently, which is the case when the total number of collisions in the structure of chains is relatively small. More precisely, the computation assumes that a constant fraction of the chains do not collide with any other chain, so that the chain structure contains Θ(2 s+t ) distinct points. When the iteration functions f i are all equal, the condition reduces to 2s + t ≤ (as calculated for free-offset collision search). However, when the iteration functions f i are distinct, we only have to consider collisions at the same offset. In order to collect the 2 2t+s-same-offset collisions, we require that a constant fraction of the chains do not collide with any other chains, implying that 2t + s -< t, or s + t ≤ .

Locating collisions online. Online collisions are detected by sorting and comparing the tags obtained by querying the MAC oracle with chains of a fixed length 2 s . If we find two massages such that MAC(M ) = MAC(M ), we can easily compute the message prefix that gives the (unknown) collision state, as described in [19]. Namely, if we denote by M |i the i-block prefix of M , then we find the smallest i such that MAC(M |i ) = MAC(M |i ) using binary search. This algorithm queries the MAC oracle with O(s) messages of length O(2 s ), and thus the time complexity of locating a collision online is s • 2 s = Õ(2 s ).

Analysis of the collision search algorithms

In this section, we provide useful lemmas regarding the collision search algorithms described above. These lemmas are used in order to estimate the collision probability of special states that are calculated by our attacks and thus to bound their complexity. Lemmas 1, 2 and 5 can generally be considered as common knowledge in the field. Perhaps, the most interesting results in this section are lemmas 3 and 4. These lemmas show that the probability of our collision search algorithms to reach the same collision twice from different arbitrary starting points, is perhaps higher than one would expect. This phenomenon was already observed in previous works such as [22], but to the best of our knowledge, this is the first time that this phenomenon is formally proved. Lemma 1 Let s ≤ /2 be a non-negative integer. Let f 1 , f 2 , . . . , f 2 s be a sequence of random functions over the set of 2 elements, and

g i f i •. . .•f 2 •f 1
(with the f i being either all identical, or completely independent). Then, the images of two arbitrary inputs to g 2 s collide with probability of about 2 s-, i.e. Pr x,y [g 2 s (x) = g 2 s (y)] = Θ(2 s-).

Proof Let x and y be two arbitrary points, x i = g i (x) and y i = g i (y) (or equivalently x 0 = x, x i = f i (x i-1 ) and y 0 = y, y i = f i (y i-1 )). We first deal with the case of independent functions f i . As all f i are random functions, we have a pair of random points (x i , y i ) for each offset. The probability that none of the pairs collide is (1 -2 -) 2 s . The event g 2 s (x) = g 2 s (y) is equivalent to having (at least) one collision between the pairs, which occurs with probability 1

-(1 -2 -) 2 s = Θ(2 s-) (given s ≤ ).
When the functions f i are identical, the analysis is similar, but one also needs to consider dependencies between the sequences of points which are caused by collisions x i = y j for i = j (and also cycles of the form x i = x j ). However, since s ≤ /2, we are below (or at) the birthday bound and therefore such collisions occur with at most a (small) constant probability, and their asymptotic contribution to the value of Pr x,y [g 2 s (x) = g 2 s (y)] can be neglected. Lemma 2 Let s ≤ /2 be a non-negative integer. Let f be a random function, then with high probability the image size of the function

f i is O(2 /i).
Proof We will show that the expected image size of f i is upper bounded by 2 • 2 /i. Since the image size is positive, this upper bound proves the lemma, as for some α > 1 the probability that the image size is more than 2α • 2 /i is at most 1/α.

We calculate this expectation based on Theorem 2 of [9], which asserts that the expected image size of f i is (1τ i )2 , where τ 0 = 0 and τ i+1 = e -1+τ i . We show by induction on i ≥ 1 that τ i > 1 -(2/i), which implies that the expected image size of f i is less than 2 • 2 /i, as required. The base is i = 1, for which indeed τ 1 = e -1 > -1. Next, we need to prove that τ i+1 > 1 -(2/(i + 1)), or e -1+τ i > 1 -(2/(i + 1)). According to the assumption, it is sufficient to show that e -2/i > 1 -(2/(i + 1)), or equivalently -2/i > ln(1 -(2/(i + 1))). This inequality can be deduced from the inequality ln(1 + x) < x/(x/2 + 1) for -1 < x < 0 (see inequality (2) in [20]), by plugging in x = -2/(i + 1). Lemma 3 Let x and ŷ be two random collisions (same-offset or free-offset) found by a collision search algorithm using 2 t chains of length 2 s , with a fixed -bit random function f such that 2s + t ≤ . Then Pr [x = ŷ] = Θ(2 2s-).

Proof First, we note that we generally have 4 cases to analyze, according to whether x and ŷ were found using a free-offset, or a same-offset collision search algorithm. However, the number of cases can be reduced to 3, as we have 2 symmetric cases, where one collision is free-offset, and the other is same-offset.

In this proof, we assume that x is a same-offset collision and ŷ is a free-offset collision (this is the configuration used in our attacks). However, the proof can easily be adapted to the 2 other settings. As previously noted, when 2s + t ≤ each evaluated chain is not expected to collide with more than one different chain, and the pairs of chains can essentially be analyzed independently. Given a collision x, We denote by A the event that 2 new chains of length 2 s , starting from arbitrary points (y 0 , y 0 ), also collide on x. Below, we show that Pr[A] = Θ(2 2(2s-) ). Denote by B the event that the chains starting from (y 0 , y 0 ) collide (on x or any other point), then Pr[B] = Θ(2 2s-). We are interested in calculating the conditional probability Pr[A|B] = Pr [x = ŷ], and we have Pr

[A|B] = Pr[A ∩ B]/ Pr[B] = Pr[A]/ Pr[B] = Θ(2 2(2s-)-(2s-) ) = Θ(2 2s-), as required.
We are left to show that Pr[A] = Θ(2 2(2s-) ). Denote the starting points of the chains which collide on x by (x 0 , x 0 ), and the actual corresponding probability. The chain -→ y will cycle with entry point x if y 0 , y 1 , . . . , y 2 s -j collides with x 0 , x 1 , . . . , x i . This occurs with probability of about 2 2s-(when 0.25 • 2 s ≤ i, j ≤ 0.75 • 2 s , the two chains are of length Θ(2 s )), which proves that Pr [∃i , j | y i = y j and y i +1 = y j +1 = x] = Ω(2 2s-). On the other hand, the probability that two chains of length at most 2 s collide is at most (roughly) 2 2s-, and therefore Pr [∃i , j | y i = y j and y i +1 = y j +1 = x] = Θ(2 2s-).

Filters

We describe the two types of filters that we use in our attacks in order to match (known) states computed offline with unknown states computed online by the MAC oracle.

Collision filters

A simple collision filter was introduced in [19], and is also used in our work.

A collision filter for an offline state x is a pair of message blocks (b, b ), with b = b , such that we obtain the same state after processing these blocks from x (i.e. h(x, b) = h(x, b )). In order to build the filter, we find a collision in the underlying hash function by evaluating its compression function with state x, and about 2 /2 different messages blocks b. We apply the filter online on an unknown node x -obtained after processing a message m -by checking whether the tags of m b and m b collide. If the state obtained after processing m is not x, the tags of m b and m b collide with probability only 2 -n < 2 -; therefore the collision filter identifies the state x with high probability.

The complexity of building a collision filter offline is O(2 /2 ). Testing the filter online requires querying the MAC oracle with m b and m b ; assuming that the length of m is 2 s , this requires O(2 s ) time.

Diamond filters

In order to build filters for 2 t nodes, we can build a collision filter for each one of them separately, requiring a total of O(2 t+ /2 ) time. However, this process can be optimized using the diamond structure, introduced by Kelsey and Kohno in the herding attack [15]. We now recall the details of this construction.

The diamond structure is built from a set of 2 t states x i , constructing a set of messages m i of length O(t), such that iterating the compression function from any state x i using message m i leads to a fixed final state y. The structure is built in O(t) iterations, where each iteration processes a layer of nodes and outputs a smaller layer to be processed by the next iteration. This process terminates once the layer contains only one node, which is denoted by y.

Starting from the first layer with 2 t points, we evaluate the compression function from each point x i with about 2 ( -t)/2 random message blocks. This gives a total of about 2 ( +t)/2 random values, and we expect them to contain about 2 t collisions. Each collision allows matching two different values x i , x j and to send them to a common value in the next layer, such that its size is reduced by a factor about 2. The message m i for a state x i is constructed by concatenating the O(t) message blocks on its path leading to y. According to the detailed analysis of [17], the time complexity of building the structure is Θ(2 ( +t)/2 ). Note that for a HAIFA hash function, the nodes of each layer in the structure must be built using the same function and therefore they must have the same offset.

x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7
Once we finish building the diamond structure, we construct a standard collision filter for the final node y, using message blocks ([b], [b ]). Thus, building a diamond filter offline for 2 t states requires O(2 ( +t)/2 ) time, which is faster than the O(2 t+ /2 ) time required to build a collision filter for each node separately.

In order to test the filter for a state x i (in the first layer of the diamond structure) on the unknown node x obtained after processing a message m online, we simply check whether the tags of m m i [b] and m m i [b ] collide. Assuming that the length of m is 2 s , then the online test requires O(t + 2 s ) time. Note that for a HAIFA hash function, the online and offline nodes tested for equality must have the same offset.

Online diamond filter

A novel observation that we use in this paper, is that in some attacks it is more efficient to build the diamond structure online by calling the MAC oracle. Namely, we construct a diamond structure for the set of 2 t states x i , where (the unknown) x i is a result of querying the MAC oracle with a message M i . Note that the online construction is indeed possible, as the construction algorithm does not explicitly require the value of x i , but rather builds the corresponding m i by testing for collisions between the states (which can be detected according to collisions in the corresponding tags). However, testing for collisions online requires that all the messages M i for which we build the online diamond filter are of the same length (both for HAIFA and Merkle-Damgård hash functions). Assuming that the messages M i are of length 2 s , building this construction requires O(2 s+(t+ )/2 ) calls to the compression function.

In order to test the filter for an unknown online state x i on a known state x , we simply evaluate the compression function from

x on m i [b] and m i [b ],
and check whether the resulting two states are equal. Thus, the offline test requires O(t) time.

I k 2 s M i x i m i
5 Internal State-recovery for HMAC with HAIFA

In this section, we describe the first internal state-recovery attack applicable to HAIFA. Our attack has a complexity of Õ(2 -s ) using messages of length 2 s , but this only applies with s ≤ /5; the lowest complexity we can reach is roughly 2 4 /5 . We note that attacks against HAIFA can also be used to attack a Merkle-Damgård hash function, giving more freedom in the queried messages by removing the requirement for long sequences of identical blocks as in [19].

In this attack, we fix a long sequence of "random" functions in order to reduce the entropy of the image states, based on Lemma 1. We then use an online diamond structure to match the states computed online with states that are compute offline. The detailed attack is as follows:

(offline) Test each image point x obtained in

Step 2 against each of the unknown states of X. If a match is found, then with high probability the state reached after the corresponding M i is x .

I k 1 2 s 2 u [i] C Online structure 2 s 2 t $ C Offline structure
We detect a match between the grey points ( ) using the diamond test built online.

Complexity analysis. In Step 3, we match the set X of size 2 u (implicitly computed during Step 1), and a set of size 2 t (computed during Step 2). We compare 2 t+u pairs of points, and each pair collides with probability 2 s- according to Lemma 1. Therefore, the attack is successful with high probability if t + u ≥s. We now assume that t =su, and evaluate the complexity of each step of the attack:

Step 1:

2 s+u/2+ /2
Step 2:

2 s+t = 2 -u Step 3: 2 t+u • u = 2 -s • u
The lowest complexity is reached when all the steps of the attack have the same complexity with s = u = /5. More generally, we assume that s ≤ /5 and set u = s to balance steps 2 and 3. This gives an attack with complexity Õ(2 -s ) since s + u/2 + /2 = 3s/2 + /2 ≤ 4 /5 ≤s.

6 New Tradeoffs for Merkle-Damgård

In this section, we revisit the results of [19], and give more flexible tradeoffs for various message lengths.

Tradeoff based on iteration chains

In this attack, we match special states obtained using collision based on Lemma 3. This attack extends the original tradeoff of [19] by using two improved techniques. First, while [19] used a same-offset offline collision search, we use a more general free-offset offline collision search which enables us to find collisions more efficiently. Secondly, while [19] used collision filters, we use a more efficient diamond filter. 1. (offline) Use free-offset collision search from 2 -2s starting points with chains of length 2 s , and find 2 c collisions (denoted by the set X). 2. (offline) Build a diamond filter for the points in X. 3. (online) Query the oracle with 2 t messages M i = [i] [0] 2 s . Sort the tags, and locate 1 collision among the tags. 4. (online) Use a binary search to find the message prefix giving the unknown online collision state ŷ. 5. (online) Match the unknown online state ŷ with each offline state in X using the diamond filter. If a match with x ∈ X is found, then with very high probability ŷ = x.

16 Itai Dinur, Gaëtan Leurent

2 s 2 -2s {2 c collisions} $ [0] * Offline structure I k 2 s 1 2 t [i] {1 collision} [0] * Online structure
We generate collisions offline using free-offset collision search, build a diamond filter for the collision points ( ), and recover the state of an online collision.

Complexity analysis. In Step 1, we use free-offset collision search with 2 -2s starting points and chains of length 2 s , and thus according to Section 3.1, we find 2 -2s collisions (i.e. c = -2s). Furthermore, according to Lemma 3, ŷ ∈ X with high probability, in which case the attack succeeds.

In Step 3, we use same-offset collision search with 2 t starting points and chains of length 2 s , and thus according to Section 3.1, we find 2 2t+s-collisions. As we require one collision, we have t = (s)/2. We now compute the complexity of each step of the attack:

Step 1:

2 -s
Step 2:

2 /2+c/2 = 2 -s
Step 3:

2 t+s = 2 ( +s)/2
Step 4:

s • 2 s
Step 5:

2 c+s = 2 -s
With s ≤ /3, we have ( + s)/2 ≤ 2/3 • ≤s, and the complexity of the attack is O(2 -s ).

Tradeoff based on cycles

We now generalize the cycle-based state-recovery attack of [19] which exploits the main cycle of approximate length 2 /2 in the graph of the random mapping in order to construct two colliding messages of the same length (thus having equal tags, which can be detected at the output). The attack of [19] uses messages of length 2 /2 and has a complexity of 2 /2 . Our attack uses the same idea of [19], but searches for (potentially) shorter cycles using (potentially) shorter messages of length 2 s for s ≤ /2. The complexity of the attack 2 2 -3s .

M = [b] [0] 2 s [1] [0] 2 s +L and M = [b] [0] 2 s +L [1] [0] 2 s (both of length 1+2 s +1+2 s +L = 2+2 s+1 +L), until MAC(M ) = MAC(M ). 3. (online) Define M i = [b] [0] i [1] [0] 2 s +L and M i = [b] [0] i+L [1] [0] 2 s ,
and use a binary search to find the minimum value of i such that M i and M i have the same MAC. Use the collision filter to test whether the state reached after [b] [0] i is equal to x.

Complexity analysis. The intuition behind this attack is the same as the cycle-based attack from [19]. Step 2 will be successful if the message

M 0 = [b] [0] 2 s [1] [0]
2 s reaches the cycle of length L twice: once after processing [b] [0] 2 s and again after processing the full message M . Indeed, if this is the case, then adding L zero blocks in the first cycle (in message M ) or in the second cycle (in message M ) does not change the state reached before the finalization function. In addition, M and M have the same length 2 + 2 s+1 + L which allows the collision to be propagated to the output (a simple attack that enters the cycle only once would not work because of the different lengths).

More formally, we need the two following conditions to be satisfied. First, the states obtained after evaluating the prefixes [b] [0] 2 s and [b] [0] 2 s +L must collide. This occurs if one of the states computed during the evaluation of [b] [0] 2 s collides with x (and thus enters the cycle of length L), which has probability Θ(2 2s-) according to Lemma 5. Secondly, the states obtained after evaluating the suffixes [1] [0] 2 s +L and [1] [0] 2 s must also collide. Similarly to the previous case, this occurs if one of the states computed during the evaluation of [1] [0] 2 s collides with x. Again, this event occurs with probability Θ(2 2s-) according to Lemma 5. Thus, the success probability of Step 2 is Ω(2 2(2s-) ) (if fact, it is Θ(2 2(2s-) )), and we need to repeat it for O(2 2( -2s) ) different values of [b] for the attack to succeed with high probability. Consequently, the time complexity of Step 2 is O(2 2( -2s)+s ) = O(2 2 -3s ).

Step 3 will detect the minimum i such that M i reaches the cycle, therefore the i-th state is the entry point of the cycle. Step 3 is expected to be run once for the correct pair, but each block value b can lead to an internal collision (at a common offset) without reaching the cycle with probability about 2 s-, according to Lemma 1. Thus, Step 3 is run 2 2( -2s)+s-= 2 -3s times with false positives.

The time complexity of all the steps is summarized below.

Step 1:

2 -2s+s = 2 -s
Step 2:

2 2•( -2s)+s = 2 2 -3s
Step 3:

2 s • s • (1 + 2 -3s ) = (2 s + 2 -2s ) • s
Since s ≤ /2, the complexity of the attack is O(2 2 -3s ).

Shorter Message Attacks

In this section, we describe more complex attacks that can reach a tradeoff of 2 -2s for relatively small values of s. These attacks are useful in cases where the message length of the underlying hash function is very restricted (e.g. the SHA-2 family), and moreover they play an important role in the key-recovery attack on HMAC with the GOST R 34.11-2012 hash function (described in Section 8). In order to reach a complexity of 2 -2s , we combine the idea of building filters in the online phase with the use of collisions as special states (using the results of Lemma 3 for Merkle-Damgård and Lemma 4 for HAIFA).

In the case of Merkle-Damgård with identical compression functions, we reach a complexity of 2 -2s for s ≤ /8, i.e. the optimal complexity of this attack is 2 3/4• . With the HAIFA mode of operation, we reach a complexity of 2 -2s for s ≤ /10 i.e. the optimal complexity of 2 4/5• , matching the optimal complexity of the attack of Section 5.

Merkle-Damgård

Attack 4: Short message attack for HMAC with Merkle-Damgård Complexity Õ(2 -2s ), with s ≤ /8 (min: 2 3 /4 ) 1. (online) Query the oracle with 2 u messages M i = [i] [0] 2 s , and locate 2 c 1 collisions. 2. (online) For each collision (i, j), use a binary search to find the distance (offset) d ij from the starting point to the collision, and denote the (unknown) state reached after M i (or M j ) by y ij . Denote the set of all y ij (containing about 2 c 1 states) by Y . Build an online diamond filter for all the states in Y . 3. (offline) Run a free-offset collision search algorithm from 2 t starting points with chains of length 2 s , and locate 2 c 2 collisions. 4. (offline) For each offline collision x, match its iterates with all points y ij ∈ Y : iterate the compression function with a zero message starting from x (up to 2 s times), and match iterate 2 sd ij (i.e., f 2 s -d ij (x)) with y ij using the diamond filter. If a match is found, then with high probability

y ij = f 2 s -d ij (x). I k 2 s 1 2 u [i] {2 c 1 collisions} [0] * Online structure 2 t 2 s {2 c 2 collisions} $ [0] * Offline structure
We generate collisions, build an online diamond filter for their endpoints, and match them with iterates of collisions found offline. Complexity analysis. Using similar analysis to Section 6.1, we have c 1 = 2u + s -(as a pair of chains collides at the same offset with probability 2 s-, and we have 2 2u such pairs) and c 2 = 2t + 2s -. The attack succeeds if the sets of collisions found online and offline intersect. According to Lemma 3, this occurs with high probability if c 1 + c 2 ≥ -2s. In the following, we assume c 1 + c 2 = -2s.

Step 1:

2 u+s = 2 s/2+c 1 /2+ /2
Step 2:

2 s+c 1 /2+ /2 = 2 -c 2 /2
Step 3:

2 t+s = 2 /2+c 2 /2
Step 4:

2 c 2 +s + 2 c 1 +c 2 • c 1 = 2 c 2 +s + 2 -2s • c 1
The best tradeoffs are achieved by balancing steps 2 and 3, i.e. with c 2 = /2, implying that c 1 = /2 -2s. This reduces the complexity to:

Step 1:

2 3 /4-s/2
Step 2:

2 3 /4
Step 3:

2 3 /4
Step 4:

2 /2+s + 2 -2s • /2
With s ≤ /8, we have /2 + s ≤ 5 /8 and 3 /4 ≤ -2s; therefore the complexity of the attack is Õ(2 -2s ).

We note that the complexity can be reduced to a minimum of O(2 3 /4 ) (without logarithmic factors) by using messages which are slightly longer than 2 /8 . In particular, this gives optimal attacks for functions of the SHA-2 family.

HAIFA

The general structure of the attack on HAIFA is similar to one of the previous attack on Merkle-Damgård. The main difference between the attacks is that we are forced to use same-offset collision search offline, rather than free-offset collision search as in the previous attack.

Attack 5: Short message attack for HMAC with HAIFA Complexity Õ(2 -2s ), with s ≤ /10 (min: 2 4 /5 ) Denote the set of all y ij (containing about 2 c 1 states) by Y . Build an online diamond filter for all the states in Y . 3. (offline) Run a same-offset collision search algorithm by computing the compression function with the message C from 2 t arbitrary starting points, and locate 2 c 2 collisions. 4. (offline) For each offline collision x, match the endpoint of its chain with all online collisions y ij ∈ Y that occur at the same offset as x. More precisely, for each x with offset d, use the diamond filter to test only the endpoint of its chain (at offset 2 s ) with the corresponding collisions in Y that occur at offset d ij = d. If a match with some y ij is found, then with high probability the state reached after M i and M j is the endpoint of the offline collision x.

I k 2 s 1 2 u [i] {2 c 1 collisions} C 2 t 2 s {2 c 2 collisions} $ C Offline structure Online structure
We generate collisions and build an online diamond filter, and match the endpoints with offline collisions endpoints using the collision offset as a first filter.

Analysis. The attack succeeds in case there is a match between the set of collisions detected online and offline that occur at the same offset. According to Lemma 4, this match occurs with high probability when c 1 + c 2 ≥s, and thus we assume that c 1 + c 2 =s.

Complexity analysis.

Similarly to the analysis of the previous attack on Merkle-Damgård, we have c 1 = 2u + s -, but as we use same-offset collision search offline, we can detect a smaller number of c 2 = 2t + scollisions. We note that the online collision offsets d ij are essentially uniform (see Lemma 1), and therefore in Step 4, each offline collision x at offset d is matched with about 2 c 1 • 2 -s states in Y .

Step 1:

2 u+s = 2 s/2+c 1 /2+ /2
Step 2:

2 s+c 1 /2+ /2 = 2 -c 2 /2+s/2
Step 3:

2 s+t = 2 s/2+c 2 /2+ /2
Step 4:

2 c 1 +c 2 -s • c 1 = 2 -2s • c 1
The optimal tradeoffs are achieved by balancing steps 2 and 3, i.e. with c 2 = /2, implying that c 1 = /2s. This reduces the complexity to:

Step 1:

2 3 /4
Step 2:

2 3 /4+s/2
Step 3:

2 3 /4+s/2
Step 4:

2 -2s • /2
With s ≤ /10, we have 3 /4 + s/2 ≤ 4 /5 ≤ -2s; therefore the complexity of the attack is Õ(2 -2s ).

8 Key-Recovery Attack on HMAC with GOST R 34.11-2012 (Streebog)

In this section we are interested in hash functions that use an internal checksum, as shown in Figure 4. In [19], the state-recovery attack on HMAC with a Merkle-Damgård hash function was extended into a key-recovery attack, in case the hash function uses an internal checksum like the GOST R 34.11-94 hash function.

Here, we show that a similar attack can be applied to a hash function based on HAIFA with an internal checksum. Namely, the state-recovery attack (with complexity 2 4 /5 ) can be extended into a key-recovery attack (with complexity 2 4 /5 ).

In particular, this attack is applicable to the standard GOST R 34.11-2012 (aka Streebog), and gives a key-recovery attack with complexity 2 417 for its 512-bit version. This result shows that HMAC-GOST R 34.11-2012 is weaker than HMAC-SHA-512 (for which no key-recovery attack better than exhaustive search is known).

Description of the attack

The attack uses the same framework as [19], exploiting the structure of hash functions with a checksum. We target the finalization function in the first hash function call. The input state value x can be recovered using the previous state-recovery attacks, and we exploit the fact that the checksum value is key dependant, but can be controlled by injecting differences in the message: σ = K ⊕ ipad ⊕ Sum ⊕ (M ). This allows for attacks which are somewhat similar to related-key attacks.

More precisely, we first generate a large set of messages of length L, leading to the same state x , but with different checksums σ. Then, we consider collisions in the function σ → g(x , L, σ), which can be detected using online calls to the MAC oracle. At the same time, we can also generate such collisions offline since x and L are known. Moreover, if we find two collisions with the same difference in the σ input, there is a high probability that the actual σ values are the same, because the other inputs to g (x and L) are fixed (on average, we expect a single collision with a fixed difference). Once we find an online collision and an offline collision with the same difference, we can therefore recover the value of K by exploiting the equation σ = K ⊕ ipad ⊕ Sum ⊕ (M ).

Detailed attack process

The first step of the attack uses the state-recovery attack of Section 7.2. However, unlike hash functions without checksums, equal tags of arbitrary messages of the same length (but with different checksums) do not imply equality (with high probability) of the states reached after the messages are processed. Therefore, we execute Attack 5 with the modifications below that ensure we only compare tags of messages with a fixed checksum.

IV K ⊕ ipad h 1 M 0 x 0 h 2 M 1 x 1 h 3 M 2 x 2 x |M | h 0 g IV K ⊕ opad h 0 h 1 g 2 n t
Fig. 4 HMAC based on a hash function with a block counter and a checksum (dashed lines).

• In step 1, we use

M i = [i] [i] C
• In step 2, when building the diamond structure, we extend the messages by m m. We do the same when building a collision pair for the endpoint of the diamond. • For the offline steps, we ignore the checksum, and only look for collisions in the iterated state.

Attack 6: Key-recovery attack against HMAC with a GOST-like hash function Complexity Õ(2 4 /5 ) 0. Execute Attack 5 to recover a state x 1 obtained after processing some message M 1 , with |M 1 | = s = /10. 1. (offline) Starting from state x 1 , use Joux's multicollision attack [14] to generate a set of 2 7 /10 messages that all collide on an internal state before the checksum block, but with different checksums. Denote the final state as x , and the length of the messages as L.

(online) Query the MAC oracle with the set of messages from

Step 1 and collect collisions (2 2•7 /10-= 2 2 /5 collisions are expected).

For each collision (M, M ), compute the checksum difference ∆M = Sum ⊕ (M ) ⊕ Sum ⊕ (M ), and store (∆M, Sum ⊕ (M )). 3. (offline) Choose a set of 2 4 /5 one-block random checksums σ, compute g(x , L, σ) and collect collisions (2 3 /5 collisions are expected). For each collision (σ, σ ), compute the difference σ ⊕ σ and compare it with the stored ∆M from Step 2. If a match is found, consider Sum ⊕ (M ) ⊕ σ ⊕ ipad and Sum ⊕ (M ) ⊕ σ ⊕ ipad as potential key candidates, and test them using a known tag.

Analysis. Since we have 2 2 /5 collisions in Step 2 and 2 3 /5 collisions in Step 3, there is a high probability to find a match which is likely to reveal the key.

Complexity.

Step 0:

Õ(2 4 /5 )
Step 1:

• 2 /2
Step 2:

2 s+7 /10 = 2 4 /5
Step 3:

2 4 /5
The total complexity is Õ(24 /5 ). In Appendix B, we give a more precise complexity evaluation of this attack and show that it requires less than 2 417 operations on average when applied to Streebog (with = 512).

Significance of short message attacks. The efficient state-recovery attack for short messages is an important factor here, as the message length directly influences the time complexity of the attack in Step 2. In fact, state-recovery attacks with complexity 2 -s as in Section 5 (or in [19], for the Merkle-Damgård construction) can only reach complexity 2 5 /6 for key-recovery, while the attacks with complexity 2 -2s (described in Section 7) allow to reach complexity 2 4 /5 . We note that in GOST R 34.11-94 (which is based on Merkle-Damgård as opposed to HAIFA) the message length is processed with the same function as the other blocks. This (in addition to some padding properties) allowed the attack of [19] to deduce the state of a short message from the state of a long message. Therefore, unlike our key-recovery attack on HMAC with GOST R 34.11-2012, efficient state-recovery attacks for short messages did not play an important role in the key-recovery attack on HMAC with GOST R 34.11-94 [19].

Universal Forgery Attacks with Short Queries

In the setting of universal forgery attacks the adversary receives a challenge message C at the beginning of the game. The goal of the adversary is to predict the tag of the challenge by interacting with the MAC oracle, but without querying for the actual challenge C.

We now revisit the universal forgery attack of Peyrin and Wang [24]. This attack has two phases, where in the first phase the adversary recovers one of the internal states computed by the MAC oracle on the challenge C. In the second phase, the adversary uses a second-preimage attack on long messages in order to generate a different message C known to have the same tag as the challenge. Thus, by querying the MAC oracle for C , the adversary can forge the tag of C. The first phase of the attack is the most expensive; the attack of [24] requires Õ(2 5 /6 ) computations, which has been improved to Õ(2 3 /4 ) in [11] using a heuristic assumption on the functional graph of random functions.

The main drawback of those attacks is that its first phase uses very long queries to the MAC oracle, regardless of the length of the challenge. 4 Therefore, the attack is inapplicable to many concrete HMAC instantiations where the hash function limits the message length (such as HMAC-SHA-1 and HMAC-SHA-2).

In this section, we use the tools developed in this paper to devise two universal forgery attacks using shorter queries to the MAC oracle. For a challenge of length 2 s , our first universal forgery attack has a complexity of Õ(2 -s ) with s ≤ /7, using queries to the MAC oracle of length of at most 2 2s (which is significantly smaller than 2 /2 for any s ≤ /7). Thus, the optimal complexity of this attack is Õ(2 6 /7 ), obtained with a challenge of length at least 2 /7 and queries of length 2 2 /7 . Our second universal forgery attack has a complexity of only Õ(2 -s/2 ). However, it is applicable for any s ≤ 2 /5, using queries to the MAC oracle of length of at most 2 s . Thus, this attack has an improved optimal complexity of Õ(2 4 /5 ), which is obtained with a challenge of length at least 2 2 /5 and queries of length 2 2 /5 .

In order to devise our attacks, we construct new state-recovery algorithms, but reuse the second phase from [24] (i.e., the second-preimage attack) in both of the attacks. Thus, in the following, we concentrate on the state-recovery algorithms. For the sake of completeness, we describe the second phase of the attack in Appendix A. Since its complexity is about 2 -s for any s ≤ /2, it does not add a significant factor to the total time complexity. 9.1 A universal forgery attack based on the reduction of the image-set size Directly matching the 2 s states computed by the MAC oracle on the challenge message with some states evaluated offline is too expensive. Therefore, we first compute and match the images of the states under iterations of a fixed function (as images match with higher probability than arbitrary states). Then, we use the initial matching of the images to efficiently match and recover an actual state that is computed by the MAC oracle on the challenge message. The 2-phase matching used in the attack resembles the approach used in [11,24], but the main difference is that the first phase of the matching does not exploit cycles in the functional graph. Moreover, the second phase of the matching is performed using an efficient binary search matching algorithm (Algorithm 1, whose pseudo-code is give in Appendix C). This algorithm can be simplified using a heuristic assumption on the number of nodes that need to be matched in the second phase (such an assumption was made explicitly in [11], and more implicitly in [6]). However, the analysis of Algorithm 1 is more rigorous and does not require any conjecture.

We denote the challenge message by C, and the first κ blocks of C by C |κ . The details of the (first phase of the) universal forgery attack are as follows. Each chain is extended until it cycles or collides with a previous chain. Consider the set X of the 2 2s -iterates of f (namely images of f 2 2s in the structure). According to Lemma 2, this set contains (no more than) about 2 -2s distinct points. Build an online diamond filter for X. 3. (offline) Match all the points x ∈ X with the 2 s points in Y . 4. (offline) For each match between x ∈ X and an online state in Y (obtained using M i ), use an additional matching algorithm to test the actual message C |i : call the binary search matching algorithm (Algorithm 1) with:

• input message M i = C |i [0] 2 2s -i ;
• the tree rooted at x (obtained by disconnecting the edge between x and f (x) from the graph and considering all the points that merge into x); • and distance 2 2si. If the algorithm returns a match y , then with high probability the state obtained after processing C |i is equal to y .

I k 2 s 2 2s -2 s 2 s C
Online structure Offline structure

2 2s 2 2s {2 -s points} {2 -2s images ( )}
We efficiently detect a match between the challenge points ( ) and the offline structure, by first matching X ( ) and Y ( ).

Algorithm 1: Binary search matching Inputs: distance d, message M of length d > d whose last d blocks are zero, tree of chains computed with the zero block that merge into the root x Output: node y in the tree with distance d to x that is equal to the state reached after evaluating M |d -d (NULL if y does not exist) 1. Denote by Size(u) the number of nodes in the tree whose root is u.

Traverse the tree rooted at x (backwards) for at most d steps until a leaf or a collision is encountered:

• If a total of d steps were traversed, denote the node at distance d from x by z. Build a collision filter for z and test it on M |d -d . If they match, return y = z, otherwise go to Step 2. • If a leaf is encountered (before d steps were traversed), denote the current node by z and go to Step 2.

• If colliding states z 1 , z 2 such that f (z 1 ) = f (z 2 ) = z are en- countered, then if Size(z 1 ) ≥ Size(x)/2 continue traversing z 1 in Step 1. Otherwise, if Size(z 2 ) ≥ Size(x)/2 continue traversing z 2 in Step 1. a
Otherwise (sizes of trees rooted at z 1 and z 2 are small), let d(z) denote the distance of z from x. Build collision filters for z 1 and z 2 and test them on

M |d -d(z 1 ) (note that d(z 1 ) = d(z 2 ) = d(z) + 1).
If there is no match, go to Step 2. Otherwise, assume without loss of generality that the match is with z 1 . Call the algorithm recursively with input message M |d -d(z 1 ) , tree rooted at z 1 , and distance dd(z 1 ) (note that Size(z 1 ) < Size(x)/2). 2. Backtrack (by cutting off half of the tree): Denote by z the current node in the traversal. Let z be the first ancestor of z (in the direction of the root x) for which there is a collision f (z ) = f (z ) for some z . If there is no such z , return NULL. Otherwise, call the algorithm recursively with input message M , tree rooted at x with z cut off, and distance d (note that Size(z ) ≥ Size(x)/2).

a The algorithm can be easily generalized to deal with collisions between t ≥ 2 states by analyzing all t nodes in the t-way collision (looking for a child whose subtree size is at least half of the total tree size, and building filters for all the children if required). As the maximal value of t in an -bit random mapping is not expected to exceed , such collisions only add (up to) a logarithmic factor to the total complexity of the algorithm.

Analysis. The offline structure of Step 2 contains 2 -s distinct points, and thus according to the birthday paradox, it covers one of the 2 s points of the challenge with high probability. In this case, the attack will successfully recover the state of the covered point with high probability, since the 2 2s -iterate of the covered point is also covered by the offline structure and will be matched in Step 3. 5The analysis of Algorithm 1 used in Step 4 is based on the following property: the size of the tree parameter is cut by at least half in every recursive call, where in each such recursive call we traverse at most d ≤ 2 2s nodes and compute and test a small constant number of collision filters. Since the initial tree has at most 2 nodes, there are at most recursive calls in Algorithm 1 (for a single call in Step 4). The complexity of each recursive call is dominated by building a few offline collision filters, and therefore the complexity of Algorithm 1 is about • 2 /2 (note that testing the filter online has complexity 2 2s < 2 /2 , and traversing nodes in each recursive call has complexity at most d ≤ 2 2s < 2 /2 ).

Since we have 2 s points in Y and all the points in X are distinct, there are at most 2 s matches in Step 3, and the time complexity of Step 4 is at most

• 2 /2 • 2 s = • 2 /2+s .
Complexity.

Step 1:

2 2s+s/2+ /2 = 2 /2+5s/2
Step 2:

2 -s
Step 3:

s • 2 -2s+s = s • 2 -s
Step 4:

• 2 /2+s
With s ≤ /7, we have /2 + 5s/2 ≤ 6 /7 ≤s; the complexity of the first phase of the universal forgery attack is Õ(2 -s ). Since the second phase has a similar complexity, this is also the complexity of the full attack.

A universal forgery attack using collisions

In this attack, we devise a different algorithm which recovers one of the states computed during the MAC computation on the challenge message. The main idea here is to begin with a state-recovery attack in order to determine the value of some online states. Then, we use iterates of a fixed function on the challenge states and on the known points, and detect (online) collisions between the two sets of iterates. This allows to determine the values of several iterates of challenge states, and removes the need for online filters (that are required in the first matching phase of the previous attack). Next, we evaluate some states offline and execute the second matching phase on offline iterates that match the online challenge iterates. This allow to recover an actual challenge state (the second phase matching uses Algorithm 1 as the previous attack).

M i = C |i [0] 2 s+1 -i
, and sort the tags. 2. (online) Execute state-recovery Attack 2 using messages of length min(2 s , 2 /3 ), and denote by W a message of length 2 s whose last computed state is recovered. a 3. (online) Query the oracle with 2 v messages W j = W [j] 0 2 s -1 , sort the tags, and locate 2 c collisions with the tags computed using the messages M i . For each collision of tags between M i and W j , the state reached after M i is known, because the state reached after W is already known. We denote the set of those states as X. 4. (offline) Compute a structure of chains containing a total of 2 -c points.

Each chain is extended until it cycles or collides with a previous chain. 5. (online) For each offline point in the structure y which matches a point in X (corresponding to M i ), call the binary search matching algorithm (Algorithm 1) with inputs:

• message M i ;

• the tree rooted at y (obtained by disconnecting the edge between y and f (y) from the graph and considering all the points that merge into y); • and distance 2 s+1i. If the algorithm returns a match y , then with high probability the state obtained after processing C |i is equal to y .

I k 2 s 2 s 2 s C [0] * I k 2 v 2 s 1 2 s -1 W [i] [0] * Online structure {2 c collisions} Offline structure 2 s 2 s {2 -c points} {2 -s images ( )}
We match the known points in X ( ) and Y ( ) in order to detect a match between the challenge points ( ) and the offline structure. a In case s > /3, we first recover the last computed state of a message of size 2 /3 , and then complement it arbitrarily to a length of 2 s .

Analysis. In Step 3 of the attack, we find 2 c collisions between pairs of chains, where the prefix of one chain in each pair is some challenge prefix C |i . Thus, the 2 c collisions cover 2 c such challenge prefixes, and moreover, the offline structure computed in Step 4 contains 2 -c points. Thus, according to the birthday paradox, with high probability the offline structure covers one of the states obtained after the computation of such a prefix C |i . Since iterate 2 s+1i of C |i is also covered by the offline structure, 6 then the state corresponding to C |i will be recovered in Step 5.

In order to calculate the value of c, note that the online structure computed in Step 1 contains 2 s chains, each of length at least 2 s , and thus another arbitrary chain of length 2 s collides with one of the chains in this structure at the same offset with probability of about 2 2s-(see Lemma 1). Since the structure computed in Step 3 contains 2 v such chains, the expected number of detected collisions between the structures is 2 c = 2 2s+v-, i.e., c = 2s + v -.

In Step 5, we call Algorithm 1 at most 2 c times (at most once for each online collision), and each invocation has complexity • 2 /2 (the analysis of Algorithm 1 is essentially the same as in the previous attack). In total, the complexity of Step 5 is

• 2 c+ /2 = • 2 2s+v-/2 .
Step 1:

2 2s
Step 2:

max(2 -s , 2 2 /3 )
Step 3:

2 v+s
Step 4:

2 -c = 2 2 -2s-v
Step 5:

• 2 2s+v-/2
We balance steps 3 and 4 by setting v + s = 2 -2sv, or v = -3s/2. This yield c = s/2, a complexity of 2 -s/2 for steps 3 and 4, and 2 /2+s/2 for Step 5. This gives a total complexity of O(2 -s/2 ) for any s ≤ 2 /5.

Conclusions and Open Problems

In this paper, we provided improved analysis of HMAC and similar hash-based MAC constructions. More specifically, we devised the first state-recovery attacks for HMAC with hash functions based on the HAIFA mode, and provided improved tradeoffs between the message length and the complexity of state-recovery attacks for HMAC with Merkle-Damgård hash functions. Finally, we presented the first universal forgery attacks which can be applied with short queries to the MAC oracle. Since it is widely deployed, our attacks have many applications to HMAC constructions used in practice, built using GOST, the SHA family, and other concrete hash functions.

We give a more concrete application of some of these results in Section 8, with a key-recovery attack against HMAC with the new Russian standard GOST R 34.11-2012. In particular this attack requires a key-recovery attack against HMAC with HAIFA hash functions, and improved tradeoffs for short messages.

Our results raise several interesting future work items such as devising efficient universal forgery attacks on HMAC built using hash functions based on the HAIFA mode, or proving that this mode provides resistance against such attacks (perhaps under certain natural assumptions). At the same time, it would be useful to find additional applications of our algorithms to related cryptosystems (such as various modes of operation) where some level of security beyond the birthday bound is required. A The Second Phase of the Universal Forgery Attacks [24] In this section we describe the second phase of our universal forgery attacks, which is identical to the second phase of the attack of [24]. Recall the we are given a challenge message C = m 1 m 2 . . . m 2 s of length 2 s blocks and our goal is to predict the tag of C by querying the MAC oracle with queries that are different from C. We denote the internal states computed by the MAC oracle on the challenge C by y 0 , y 1 , . . . , y 2 s . In the first phase of the attack, we recover one of these internal states, which we denote by y p . We assume that p ≤ 2 s-1 . This can be assured by running the first phase of the attack only on the first half of the blocks of C, which results in a small constant penalty in the complexity of the attack.

In the second phase of the attack we use a second-preimage attack on long messages in order to generate a different message C which has the same tag as the challenge. The second-preimage attack is based on the one by Kelsey and Schneier [16]. The attack uses a structure known as an (i, j)-expandable message (for integers i < j), proposed in [16]. An (i, j)-expandable message is composed of an arbitrary initial state x and a final state z where for each integer d such that i ≤ d ≤ j, there is an efficiently computable message of d blocks M d = m 1 m 2 . . . m d that links x to z, namely, z = h(. . . h(h(x, m 1 ), m 2 ) . . . , m d ). Assuming that i ≤ l/2 (which is the case in our attack), an (i, 2 i )-expandable message can be constructed from any initial state x in complexity of • 2 /2 . The details of how to construct this structure are found in [16].

Complexity.

Step 1:

2 s-1

Step 2:

• 2 /2
Step 3:

2 -s
Step 4:

2 s
Step 5:

2 s
For s ≤ /2 the total complexity is Õ(2 -s ) as required.

B Concrete Complexity of HMAC-Streebog Key-Recovery

In this section we calculate with better precision (taking into account constants and logarithmic factors) an upper bound on the expected complexity of Attack 6 (applied to Streebog with = 512). While the analysis can be refined to give slightly better complexity, our calculations demonstrate that the constants involved in our attacks are indeed small. Attack 6 is dominated by Step 0, which uses Attack 5, with s = /10. Therefore, we start with a concrete analysis of Attack 5.

Attack 5. The most expensive steps are 2 and 4, where we match two sets by building and using a diamond filter. In order to optimize the attack, we use parameters c 1 = /2s and c 2 = /2 + α for a small constant α (e.g. α = 4), and run steps 1 and 3 until we have the required number of collisions (2 c 1 and 2 c 2 ).

The expected value of u required to generate 2 c 1 collisions in Step 1 is roughly u = (c 1 +s + 1)/2, accounting for the factor 1 2 in the number of message pairs. Similarly, the expected value of t in Step 3 is t = (c 2 +s + 1)/2. This results in a complexity that is still negligible compared to steps 2 and 4, in spite of the small constants added (2 3 /4+1/2 for Step 1 and 2 3 /4+(s+α+1)/2 for Step 3).

With these parameters the online diamond filter for the set of size 2 c 1 will have depth c 1 , and require less than 8 e e-1 2 c 1 /1+ /2 evaluations of the MAC (following [17]). Since each query has 2 s blocks, the total complexity is 8 e e-1 2 s+c 1 /2+ /2 < 2 3 /4+s/2+3.7 for Step 2.

Finally, in Step 4, we use only collisions with an offset d such that d ≥ 2 s-1 , to simplify the analysis (we keep about 2 c 2 -1 = 2 /2+3 offline collisions). Following Lemma 4, we fix an offline collision x (with preimages x d and x d ) and we evaluate the probability that a random pair of chains y 0 , y 0 reaches the same collision, under the condition that y 0 , y 0 collide at the same offset d. Let A denotes the event that y 0 , y 0 collide on x and B the event that they collide at offset d on an arbitrary point (all collisions are same-offset collisions). We first evaluate the probability that the chains starting at y 0 and y 0 reach x d or x d , and then the probability that y 0 , y 0 collide on x (namely Pr[A]).

Pr[y 0 x d ] ≤ (1 -2 -) 2 s-1 ≤ e -2 s-1- Pr[y 0 x d ] = 1 -Pr[y 0 x d ] ≥ 1 -e -2 s-1-≈ 2 s-1- Pr[A] ≥ Pr[y 0 x d ] • Pr[y 0 x d ] + Pr[y 0 x d ] • Pr[y 0 x d ] ≥ 2 2s-2 -1
We have Pr

[B] ≤ 2 -, hence Pr[A|B] = Pr[A∩B]/ Pr[B] ≥ 2 2s--1 .
Therefore, the matching of Step 4 is expected to succeed after less than 2 -2s+1 attempts on average (the actual complexity without the restriction d ≥ 2 s-1 is slightly smaller). Since each match requires to follow a path in a diamond of length c 1 , the total complexity is less than c 1 •2 -2s+1 ≤ •2 -2s on average. This results in the following complexities:

Step 1:

2 3 /4+1/2
Step 2: 2 3 /4+s/2+3.7

Step 3:

2 3 /4+s/2+(α+1)/2
Step 4:

• 2 -2s
In particular, with = 512 and s = 54, we obtain a complexity of 2 415.1 .

Attack 6.

Let us now examine the full key-recovery attack, using a short message M 1 of length 2 s . We run Step 2 until we gather 2 2 /5 collisions, which requires about 2 7 /10+1/2 calls to the MAC on average. Similarly, we run Step 3 until we recover the key; this should require 2 3 /5 collisions on average, i.e. 2 4 /5+1/2 evaluations of the compression function. Since Step 0 still dominates, we use s = 54 to minimize the complexity:

Step 0:

2 415.1
Step 1:

• 2 /2 = 2 247
Step 2: 2 s+7 /10+1/2 = 2 412.9

Step 3:

2 4 /5+1/2 = 2 410.1
Therefore, the expected complexity is less than 2 416 . Finally, recall from Section 2 that our attacks use a modified scheme MAC 2 (K,

M ) = MAC 1 (K, M [0]) MAC 1 (K, M [1]
), which results in a multiplicative penalty of at most 2. Hence, the total expected complexity is less than 2 417 .

On the Practical (In-)Security of 64-bit Block Ciphers

Collision Attacks on HTTP over TLS and OpenVPN

Karthikeyan Bhargavan

Inria, France karthikeyan.bhargavan@inria.fr

Gaëtan Leurent

Inria, France gaetan.leurent@inria.fr ABSTRACT While modern block ciphers, such as AES, have a block size of at least 128 bits, there are many 64-bit block ciphers, such as 3DES and Blowfish, that are still widely supported in Internet security protocols such as TLS, SSH, and IPsec. When used in CBC mode, these ciphers are known to be susceptible to collision attacks when they are used to encrypt around 2 32 blocks of data (the so-called birthday bound). This threat has traditionally been dismissed as impractical since it requires some prior knowledge of the plaintext and even then, it only leaks a few secret bits per gigabyte. Indeed, practical collision attacks have never been demonstrated against any mainstream security protocol, leading to the continued use of 64-bit ciphers on the Internet.

In this work, we demonstrate two concrete attacks that exploit collisions on short block ciphers. First, we present an attack on the use of 3DES in HTTPS that can be used to recover a secret session cookie. Second, we show how a similar attack on Blowfish can be used to recover HTTP BasicAuth credentials sent over OpenVPN connections. In our proof-of-concept demos, the attacker needs to capture about 785GB of data, which takes between 19-38 hours in our setting. This complexity is comparable to the recent RC4 attacks on TLS: the only fully implemented attack takes 75 hours. We evaluate the impact of our attacks by measuring the use of 64-bit block ciphers in real-world protocols. We discuss mitigations, such as disabling all 64-bit block ciphers, and report on the response of various software vendors to our responsible disclosure of these attacks.

INTRODUCTION

Internet protocols such as TLS [13], SSH [34], and IPsec [18] are agile, in the sense that they are designed to support a wide variety of ciphersuites: combinations of key exchange protocols, encryption schemes, authentication modes, etc. Each protocol implementation may choose to support a different subset of ciphersuites, but two implementations can still interoperate if they can negotiate a common cipher-Publication rights licensed to ACM. ACM acknowledges that this contribution was authored or co-authored by an employee, contractor or affiliate of a national government. As such, the Government retains a nonexclusive, royalty-free right to publish or reproduce this article, or to allow others to do so, for Government purposes only.

CCS '16, October 24-28, 2016, Vienna, Austria. suite. When it works well, protocol agility can enable a graceful transition from old cryptographic algorithms to new ones. A server can, for example, offer AES-GCM to modern clients while still supporting legacy ciphers like 3DES for older clients that have not yet been upgraded. However, a negative consequence of agility is that old ciphers may never be removed, resulting in implementations that support a few strong modern ciphers, followed by a long tail of obsolete ciphers that are still supported for backwards compatibility, but are known to be cryptographically weak. For example, the OpenSSL library supports five versions of TLS and hundreds of ciphersuites, even though many of these ciphersuites include weak algorithms like RC4 and MD5.

There are several reasons why practitioners do not consider theoretical weaknesses in cryptographic to be sufficient for their removal from mainstream protocols. First, even if an obsolete primitive is supported, it will typically only be negotiated if one of the parties does not support a modern alternative, in which case, the obsolete cipher is still better than nothing. Second, the attack may not be applicable to the way the primitive is used in the protocol, or it may require too much computation to be considered practical. Third, the attack may require special knowledge about the structure or the content of the plaintext stream which may be difficult to obtain in general. Consequently, protocol implementations tend to support legacy ciphers until a concrete attack is demonstrated in a common usage of the protocol.

Attacks on Legacy Crypto. A series of recent attacks on TLS have conclusively shown that this line of defense for legacy ciphers is fatally flawed. Leaving old protocol versions and obsolete cryptographic algorithms enabled can lead to devastating attacks, such as BEAST [15] (on CBC encryption in TLS 1.0), CRIME [28] (on TLS compression), Lucky13 [4] (on CBC padding in TLS 1.2), POODLE [11] (on CBC padding in SSL 3.0), RC4 NOMORE [3,19,32] (on keystream biases in RC4), FREAK [9] (on export-grade RSA keys), Logjam [2] (on export-grade Diffie-Hellman groups), SLOTH [10] (on MD5 signatures), and DROWN [5] (on RSA-PKCS#1v1.5 encryption in SSL 2.0).

These attacks follow a common pattern. Each attack is based on a classic cryptographic weakness that was known to cryptographers for years or even decades in advance, but had not been demonstrated in real-world TLS scenarios. So these works showed that with modern network speeds and computing power, the computational effort required to exploit the theoretical weakness is feasible even for academic researchers. Furthermore, many of these attacks (e.g. BEAST, CRIME, RC4 NOMORE) can be made more efficient by relying on a new HTTPS attacker model introduced by BEAST. Figure 1 depicts this Beastly attacker model, where a network attacker uses JavaScript to implement an adaptive chosen-plaintext adversary who can mix in his plaintext with the user's secret values, and then use his network vantage point to actively or passively attack the ciphertext.

The final element of each attack is finding clients and servers who are willing to negotiate the legacy cipher. Some of the attacked algorithms (e.g. RC4) and protocol versions (e.g. SSL 3.0) were highly popular before the attack and have since been deprecated. Other weak algorithms (e.g. export ciphers) and versions (e.g. SSL 2.0) had already been deprecated years ago and were never expected to be negotiated between modern clients and servers. Surprisingly however, in many cases the attacker is able to force the negotiation of a weak algorithm via a downgrade attack by exploiting protocol flaws (e.g. Logjam, SLOTH) or implementation bugs (e.g. FREAK, DROWN). One lesson to take from these downgrade attacks is that relying on the negotiation protocol to avoid legacy ciphers is error-prone and dangerous. When a concrete attack against a legacy cipher is discovered, the only safe mitigation is to fully remove the weak cipher from all implementations.

These previous attacks evaluated a variety of obsolete cryptographic constructions and provided enough evidence of their dangers for them to be disabled in popular implementations. We believe that it is important for the research community to be vigilant and to continue to investigate the strength of the weakest ciphers still supported by mainstream protocols. For example, the attacks on RC4 have resulted in RC4 being removed as the default fallback cipher for TLS implementations, and this role has now fallen to 3DES, which is a 28 year old 64-bit block cipher with known weaknesses. However, the practical security of 64-bit block ciphers as used in TLS and other protocols has not been previously studied. This work aims to address this gap and to provide concrete attacks and firm guidance on the use of such ciphers.

Collision Attacks on 64-bit Block Ciphers. The security of a block cipher is often reduced to the key size k: the best attack should be the exhaustive search of the key, with complexity 2 k . However, the block size n is also an important security parameter, defining the amount of data that can be encrypted under the same key. This is particularly im-portant when using common modes of operation: we require block ciphers to be secure with up to 2 n queries, but most modes of operation (e.g. CBC, CTR, GCM, OCB, etc.) are unsafe with more than 2 n/2 blocks of message (the so-called birthday bound). In particular, when these many blocks are encrypted under a key in CBC mode, the probability of collisions between two ciphertext blocks becomes significant, and each ciphertext collision reveals the XOR of the two corresponding plaintext blocks from the stream. Consequently, if the attacker can guess one of the plaintext blocks, he can recover the plaintext in the other block. While this attack is well-known to researchers [30,25], it is often disregarded by practitioners because it require known plaintext, and reveals only a few bits of a large datastream.

With a modern block cipher with 128-bit blocks such as AES, the birthday bound corresponds to 256 EB (2 68 bytes). While this is leaves a safe margin for common uses of cryptography today, the resulting security is still lower than could be expected of 128-bit security and might be an issue in the future. As a point of comparison, Google is estimated to store around 16 EB (2 64 bytes), and the global Internet traffic is expected to reach 1 ZB (2 70 bytes) per year in 2016.

More strikingly, the birthday bound corresponds to only 32 GB for a block cipher with 64-bit blocks, and there are many real-world protocol scenarios in which this amount of data may be sent under a 64-bit cipher: e.g. 3G telephone connections (UMTS), which are encrypted with KASUMI, OpenVPN tunnels, which uses Blowfish as the default cipher, and Internet standards like TLS, SSH, and IPsec that use 3DES and Blowfish as legacy ciphers for interoperability. In all these scenarios, 32 GB of data can be transferred in less than one hour with a fast connection.

More recently, 64-bit ciphers have become common in the field of lightweight cryptography for applications, such as embedded systems and smart devices, where resources are too constrained to use conventional block ciphers. For instance, PRESENT [12] and HIGHT [20] have been standardized by ISO recently (in ISO/IEC 29192 and ISO/IEC 18033-3, respectively).

Our Results. In this work, we study the concrete impact of birthday attacks against 64-bit block-ciphers as used in popular protocols. We present the first concrete attacks based on ciphertext collisions on mainstream Internet protocols.

We focus on two concrete use cases. First, we consider the use of OpenVPN to secure HTTP connections between a web browser and a website, where the website asks the user for HTTP BasicAuth (user/password) authentication. OpenVPN uses Blowfish in CBC mode by default, and we show how one can use the Beastly attacker scenario to generate a lot of traffic including the BasicAuth in every request, until collisions collisions in the Blowfish ciphertext reveal the BasicAuth token (i.e. the password). We demonstrate a proof-of-concept attack between a Firefox client and an nginx server connected via OpenVPN. The attack requires about 785GB, which takes 19 hours in our setting to recover the 16-byte authorization token.

Second, we consider the use of TLS to secure HTTP connections between a browser and an HTTPS website that sets secure session cookies on the browser. We find that 3DES is supported by nearly 90% of HTTPS servers and by all mainstream TLS clients. In practice, however, 3DES is less preferred than AES and negotiated by only 1-2% of HTTPS connections. For such connections, we demonstrate an attack, again using the Beastly attacker setup, that can recover the secret 16-byte session cookie sent by the browser with every HTTPS request to the target server. We demonstrate the attack between a Firefox browser and an IIS 6.0 server (Windows Server 2003 R2 SP2), both in their default up-to-date configuration. This attack also requires 785GB, which takes 38 hours in our setting.

Our attacks demonstrate that collision-based attacks on 64-bit block ciphers are practically exploitable. We suggest two mitigations for the attack. Considering the low negotiation probability of 3DES in TLS, we recommend disabling it in popular clients and servers. For protocols where 64bit ciphers cannot yet be deprecated, we recommend using strict rekeying limits to mitigate the attack. In response to our attacks, mainstream TLS libraries, web browsers, and OpenVPN have begun implementing these mitigations.

Outline. Section 2 provides background on collision attacks on block ciphers and estimates their success probability under various conditions. Section 3 investigates the usage of 64bit ciphers in various Internet protocols, and specifically in HTTPS. Section 4 shows how block cipher collisions in the encrypted stream can be used to attack HTTP. Section 4.4 and 4.5 describe our proof-of-concept attacks on OpenVPN and HTTPS, respectively. Section 5 discusses the impact of our attacks and their mitigations.

COLLISION ATTACKS ON BLOCK CI-PHERS

Block ciphers like AES and 3DES are widely used for symmetric encryption in security protocols. Mathematically, a block cipher with a κ-bit key and n-bit blocks defines of family of permutations of n-bit strings, indexed by the key. The main security notion is that a block cipher should behave like a pseudo-random permutation (PRP) family: the block cipher Ek with a random key k should be hard to distinguish from a random permutation.

Block ciphers operate on blocks of fixed size, n bits, usually with n = 64 (DES, 3DES, Blowfish, IDEA, KASUMI, PRESENT, ...) or n = 128 (AES, Camellia, Twofish, Serpent, SEED, ...). In order to deal with arbitrary-length messages, they are used within a mode of operation. A mode divides the message M into n-bit blocks mi, and process the blocks one by one through the block cipher E with various chaining rules, to produce ciphertext blocks ci and/or an authentication tag τ . Several modes have been widely studied and standardized [16] for encryption (CBC, CFB, OFB, CTR), authentication (CBC-MAC, PMAC) and authenticated encryption (OCB, CCM, GCM).

Security at the Birthday Bound

While block ciphers are required to resist any attack with up to 2 n data and 2 κ time, most modes of operation are only proven secure up to 2 n/2 blocks of plaintext, a limit that is commonly called the birthday bound. Indeed, there are attacks matching this limit. In CBC mode, the probability of collisions between two n-bit ciphertext blocks becomes significant after 2 n/2 blocks because of the birthday paradox. Rogaway summarizes the situation as follows [30, page 36 Do birthday-bound attacks on CBC, CFB, and OFB actually matter? They are of relatively little concern when the blockcipher has a blocksize of n = 128 bits, but the attacks can be a serious concern when employing a blockcipher of n = 64 bits, requiring relatively frequent rekeying to keep σ 2 32 .

More recently, McGrew investigated plaintext recovery attacks on 64-bit ciphers in CBC, CFB, and CTR modes. He studied the mount of information leakage by assuming that the attacker can observe all the ciphertext in an encrypted stream and he has some (incomplete) knowledge of the plaintext [25]. This theoretical analysis resulted in new security recommendations for IPsec [26], but they did not trigger any significant changes in mainstream deployments of 64-bit ciphers in IPsec, TLS, or SSH. Arguably the main reason for the limited impact of these attacks is that they were never implemented against a popular protocol under real-world conditions.

Following McGrew, we explain theoretical attacks against the CBC and CTR modes (the two most widely used encryption modes) in more detail below. In the rest of the paper, we will show that these attacks can be exploited to mount concrete attacks on HTTP over TLS and OpenVPN.

Plaintext recovery attack against CBC

The CBC mode is one of the oldest encryption modes, and still widely used. The message M is divided into blocks mi, 0 ≤ i < (see Figure 2) and is encrypted as:

ci = Ek(mi ⊕ ci-1),
where c-1 is an initialization value usually denoted as IV. For simplicity, here we assume that all message sizes are a multiple of the block size.

When encrypting a sequence of messages M (j) , each message should be encrypted with a fresh random IV c (j) -1 . It is important that the IV can not be predicted by an adversary who can encrypt chosen messages; otherwise, it can lead to attacks, as first observed by Rogaway in 1995 [29], and subsequently exploited in the BEAST attack [15] in 2011 on TLS versions prior to 1.1.

CBC has been proven secure up to 2 n/2 blocks of messages [7,27]. On the other hand there is a simple birthday attack against CBC: after 2 n/2 message blocks encrypted with the same key (in the same message or in different messages), a collision between two ciphertext blocks c (j) i = c (j ) i is expected. Since Ek is a permutation, a collision in the output means that the inputs are the same (m

(j) i ⊕ c (j) i-1 = m (j ) i ⊕ c (j ) i -1
), which reveals the xor of two plaintext blocks:

m (j) i ⊕ m (j ) i = c (j) i-1 ⊕ c (j ) i -1 .
Success probability. In general, with 2 d blocks of data, the probability that there is at least one collision is (using D = 2 d and N = 2 n ):

p = 1 - D-1 i=0 N -i N ≥ 1 - D-1 i=0 e -i/N using 1 -x ≤ e -x ≥ 1 -e -D(D-1)/2N
In particular, with d > n/2, we have p ≥ 1e -1/2 ≈ 0.39. With larger values of d, the probably grows very close to 1:

p ≥ 1 - 2N D(D -1) + 2N using 1 -e -x > x x + 1 ≥ 1 - 2N D 2 since D 2 < D(D -1) + 2N p ≥ 1 -2 n-2d+1
On the other hand, when d < n/2 we can use:

p ≥ D(D -1) 4N ≈ 2 2d-n-2 using e -x < 1 -x/2
Furthermore, with 2 d blocks of data the expected number of collisions is roughly 2 2d-n-1 .

Distinguishing attack against CTR

The counter mode CTR is another popular mode of operation for encryption, first proposed by Diffie and Hellman [14]. In particular, it provides the encryption part of authenticated encryption modes CCM and GCM, and a variant of counter mode is used in 3G telephony (f8). The counter mode actually builds a stream cipher out of a block cipher: a counter is encrypted to generate key-stream that is xored with the message. More precisely, the message M is divided into blocks mi, 0 ≤ i < which are encrypted as:

ci = Ek(IV + i) ⊕ mi,
where IV is the initial value of the counter (see Figure 3).

If the encryption function Ek is a pseudo-random function, rather than a pseudo-random permutation, then CTR is secure up to 2 n blocks [6]. However, in the common case where Ek is a permutation, CTR is proven secure only up to 2 n/2 blocks, and there is matching distinguishing attack with complexity 2 n/2 . If a message where all the plaintext blocks are equal is encrypted, then all the ciphertext blocks will be pairwise different. Indeed, all the Ek(IV + i) are unique, because Ek is a permutation. This enables the attacker to distinguish the counter mode from an ideal encryption scheme, because a collision between two ciphertext blocks becomes likely (with probability about 0.39). More interestingly, if the attacker has prior knowledge about the plaintext (such as a IV + 0 [25].

It is interesting to compare the collision attacks against CBC and CTR. Both attacks have the same complexity, and show that the proofs are tight. However, the loss of security is quite different: an attacker can immediately recover some bits of information from the attack against CBC, while the attack against the counter mode requires a lot more work to recover any plaintext. In the remainder of this paper, we investigate on the practical impact of the CBC attack, but similar techniques (with higher complexity and more assumptions on the plaintext) may be used to attack CTR and GCM mode encryption in protocols like TLS and SSH.

Rekeying before the Birthday Bound

The main countermeasure against birthday attacks is to change the key frequently, before reaching the birthday bound under any single key. For instance, if the key is changed after 2 n/2-16 blocks, a birthday attack against a given only succeeds with probability 2 -32 , and an attacker has to collect 2 32 different sessions to mount an attack with high probability.

If implemented properly, this is an effective security measure to strengthen block ciphers with a small block-size. We stress than the key must be changed well before 2 n/2 blocks, despite misleading recommendations in published standards. For instance, ISO recommends [21]:

Generally, for a block cipher with block size of n bits, the maximum amount of plaintext that can be encrypted before rekeying must take place is 2 (n/2) blocks, due to the birthday paradox. As long as the implementation of a specific block cipher do not exceed these limits, using the block cipher will be safe. This is incorrect, because collisions can be found with high probability (close to 0.39) with only 2 n/2 blocks. Indeed, we will show that our concrete attacks also work against connections that are rekeyed close to the birthday bound.

Towards a Practical Attack on CBC

The CBC attack reveals the xor of two plaintext block, and in many contexts, this may not be sufficient for a practical attack. However, an effective attack can be mounted when the following conditions are fulfilled: (1) some high-value secret data is sent repeatedly; and (2) some fraction of the plaintext is known. In this case, there is a chance that a collision leaks the xor between a valuable secret and a known block; this would immediately reveal the secret. More precisely, this attack is expected to succeed (i.e. to recover one block of a high-value secret) with high probability as soon as 2 s blocks of secret and 2 t known blocks are encrypted, with s + t ≥ n.

To mount the attack in practice, an adversary would collect and store all the traffic, then sort the ciphertext blocks to find collisions. Assuming that the adversary knows the position of the secret blocks and of the known blocks in the stream, he can quickly see which collisions are useful, and recover the secret values by xoring with the known plaintext.

Attack Complexity. Let us denote the known fraction of the data as α and the secret and valuable fraction of the traffic as β (with fraction 1αβ that is neither known nor valuable to the attacker). In order to recover some secret information, an attacker must collect roughly1 /2αβ collisions, so that one collision is between a valuable secret block and a known block. Following the analysis of Section 2.2, this requires about 1 /αβ • 2 n/2 blocks of data.

For instance, with n = 64, in an optimal case for the adversary half of the traffic is known, and half of the traffic is highly valuable (α = β = 1/2). In this case, a collision an attack requires about:

1 /αβ • 2 n/2 = 2 • 2 n/2 = 2 33
blocks of data, which corresponds to just 64 GB. For a more concrete scenario, let us assume that the messages are HTTP queries of 512 bytes (64 blocs), with a secret 8-byte cookie (1 block), and that the remaining of the message is known, i.e. α = 63 /64 ≈ 1, β = 1 /64. The number of blocks needed by an attacker is roughly: 35 which correspond to 256 GB.

1 /αβ • 2 n/2 ≈ 8 • 2 n/2 = 2
Rekeying at the Birthday Bound. The attack can also be carried out when rekeying is used, if the keys are changed with low frequency. In particular, even if the keys are changed before 2 n/2 blocks are encrypted, there is still a non-negligible probability that a collision occurs.

More precisely, let us assume that keys are rotated after encrypting 2 r blocks (r ≤ n/2). As explained in Section 2.2, the probability to have a collision between 2 r blocks is at least 2 2r-n-2 . Therefore, an attacker needs 1 /2αβ • 2 n+2-2r sessions (i.e. 1 /2αβ • 2 n+2-r blocks) to collect an interesting collision. In practice, the attacker would collect all the data in a session, sort it to find collisions, and can discard the data before collecting data from the next session.

In an optimal setting for the attacker (α = β = 1/2), if the keys are changed after 2 n/2 blocks as recommended by ISO [21] (r = n/2), the number of blocks needed by an attacker is roughly: 35 which correspond to 256 TB. In the HTTP example above, the number of blocks needed is roughly: 39 which correspond to 4 TB. Therefore rekeying just before 2 n/2 blocks only has a limited impact on collision attacks.

1 /2αβ • 2 n+2-r = 2 • 2 n/2+2 = 2
1 /2αβ • 2 n+2-r ≈ 32 • 2 n/2+2 = 2
Optimal Rekeying Strategies. The optimal use of rekeying has been studied by Abdalla and Bellare in [1], with the goal of increasing the encryption threshold (the number of blocks that can be encrypted before the advantage of an adversary becomes significant). Their result depend on the key size κ and the block size n. When n = κ, the optimal strategy is to rekey after 2 n/3 blocks, leading to an encryption threshold of 2 2n/3 (rather than 2 n/2 without rekeying). Concrete figures for AES-based modes are also given in [24].

On the other hand, when κ ≥ 2n (as is the case for 3DES and Blowfish-128), the optimal strategy is to rekey for every block. Assuming a perfect rekeying function, this leads to an encryption threshold of 2 n (rather than 2 n/2 ). In actual protocols such as TLS or OpenVPN, rekeying requires a new key exchange, which can be quite expensive. Therefore, rekeying should probably be implemented with a fixed limit, in the order of a few megabytes. We can compute the encryption threshold when rekeying every 2 r blocks as 2 n-r (this figure correspond to the optimal case for an adversary, with α = β = 1/2). For example, by rekeying every megabyte, a client and server can exchange a petabyte of data before collision attacks become significant.

Exploiting Repeated Messages. We now assume that a fixed message of 2 u blocks is sent repeatedly (this will be the case for the concrete attacks we describe in Sections 4.4 and 4.5). The attacker's goal is to recover the full message, assuming that α • 2 u blocks are known or predictable.

If there is a single unknown block, we can use the previous analysis with α ≈ 1 and β = 2 -u : an attacker need roughly 2 (n+u)/2 blocks. Indeed, this should lead to roughly 2 u-1 collisions, and there is a good chance that one of these collision is between the secret block and a known block. For a more accurate analysis, we can use the results of van Oorschot and Wiener [31], which gives an expected complexity of π /2 • 2 (n+u-1)/2 blocks to find 2 u-1 collisions.

If there are a few unknown blocks (k = (1α) • 2 u ), the number of encrypted blocks required to recover them can be approximated as:

√ Hk • π /2 • 2 (n+u-1)/2 ,
because the number of collision required follows the harmonic numbers 1 Hk = k i=1 1 /i. On the other hand, if α is small, the attacker can use collisions to derive equations between the plaintext blocks, even if both blocks are unknown. Each collision reveals the xor between two plaintext blocks, which can seen as an edge in a graph whose vertexes are the plaintext blocks. If we model the graph as a random graph with 2 u vertexes, we know that with high probability, the graph will be fully connected when there are more than Θ(u/2 • 2 u ) edges [17]. At this point, all plaintext blocks can be recovered from a single known block. Therefore, the expected attack complexity becomes: In particular, we will apply this attack to break the security of encrypted HTTP connections when an authentication token is send with every request. We use the Beastly attacker of Figure 1 to generate a large number of requests, where the headers are mostly predictable or even controlled by the attacker (α ≈ 1), who can then recover the authentication token by observing collisions in the encrypted traffic.

√ u • π /2 • 2 (n+u-

64-BIT BLOCK CIPHER USAGE ON THE INTERNET

Many of the most influential Internet security protocols, such as TLS, SSH, and IPsec were standardized at a time when 64-bit block ciphers, such as 3DES and Blowfish, were still considered strong. Consequently, these ciphers are still widely supported on the Internet. In this section, we investigate the real-world usage of these ciphers in order to quantify the feasibility and practical impact of our attacks.

Block Ciphers in Internet Standards

Table 1 summarizes the support for various block ciphers in several versions of the TLS, SSH, and IPsec standards. The table shows that protocols that were standardized before 2000 typically supported only 64-bit ciphers (primarily 3DES), although later protocol extensions enabled 128-bit ciphers (primarily AES). Still, old versions of these protocols remain quite popular on the web. Notably, each standard specifies a mandatory cipher that "MUST" be supported for interoperability, and in most of these specifications, the mandatory encryption algorithm is 3DES. This means that all implementations of TLS, SSH, and IPsec must implement 3DES, and unless the user explicitly disables it, they will offer to negotiate 3DES with their peers.

For example, in TLS 1.0 and 1.1, 3DES is the mandatory encryption algorithm, so all TLS libraries implement it and a vast majority of web servers support it. Although TLS 1.2 changed the mandatory cipher to AES, it still explicitly recommends 3DES as secure [13,Sec. 7.3]:

If you negotiate 3DES with a 1024-bit RSA key exchange with a host whose certificate you have verified, you can expect to be that secure.

As a result, mainstream TLS libraries still treat 3DES to be at the same security level as AES-128. For example, until we disclosed the attacks in this paper, OpenSSL included 3DES ciphersuites in its HIGH-security list (it has now been moved to MEDIUM). Moreover, while the use of RC4 in TLS has been explicitly deprecated in RFC7465 in response to recent attacks, 3DES continues to be trusted by TLS libraries.

In fact, it has even started being recommended as the new backup cipher in place of RC4.2 TLS does not mandate rekeying for short block ciphers, and so TLS libraries leave the decision to rekey to their applications.

In SSH version 1, the strongest available ciphers are all 64bit block ciphers: 3DES, Blowfish, and IDEA, and although SSH 2 introduced AES-based ciphers, it still labeled 3DES as the mandatory cipher. Consequently, popular implementations such as OpenSSH still use 3DES as the default cipher for SSH-1 connections, and 3DES continues to be the most widely supports cipher in SSH. 3 SSH standards recommend that implementations rekey after every 1GB of data, or after every 2 n/4 blocks [8], but many popular SSH clients do not implement this feature.

The early IPSec specifications also widely used and recommended 3DES. For example, RFC4835 recommended 3DES as a mandatory (MUST) algorithm until 2007, although the more recent RFC7321 has downgraded it to a "MAY". Consequently, most IPSec libraries continue to support 3DES, and since IPSec deployments tend to be stable over a long period of time within corporate networks, we anticipate that the algorithm may continue to be supported on IPSec networks for the foreseeable future.

In summary, short block ciphers and 3DES in particular have widespread support in major secure transport protocols, making them vulnerable to the attacks described in this paper. However, to evaluate the real-world impact of this vulnerability, the key question is whether these ciphers are actually used in connections between popular clients and servers. In the rest of this section, we attempt to quantify this usage.

3DES and Blowfish usage in VPNs

TLS, SSH, and IPSec are often used to implement tunnels or virtual private networks (VPNs) across untrusted network connections. We have already discussed the widespread support for 64-bit block ciphers in these protocols, but estimating whether these ciphers are actually negotiated in practice is hard, because unlike web servers, most VPN services are not publicly accessible, and each VPN server may use its own configuration. However, we found a few VPN solutions that use 64-bit ciphers by default.

IPsec. Most IPSec-based VPN clients support 3DES for interoperability. Notably, some versions of Microsoft's L2TP VPN client use 3DES by default 4 ; some versions of MAC OS X negotiate 3DES with certain VPN servers5 ; and some versions of CISCO IPsec VPN devices implement hardware optimizations for 3DES and consequently prefer it over other ciphers. 6OpenVPN. OpenVPN is a popular open-source VPN solution originally written by James Yonan. The default encryption for the transport protocol of OpenVPN is Blowfish, a 64-bit cipher, in CBC mode. OpenVPN supports two different ways of generating session keys to encrypt the messages. In pre-shared-key mode, static keys are used for all the traf-Firefox Version fic. In particular, there is no limit to the lifetime of those keys. In TLS mode, session keys are generated with a TLS handshake, using certificates to authenticate the peers. The session keys are updated periodically, with limits on the number of packets, the number of bytes, or a session time.

The default configuration rekeys the tunnel every hour. In addition, the tunnel is rekeyed shortly before 2 32 packets in TLS mode, because the packet counter is a 32-bit integer. In pre-shared-key mode, the packet counter is a 64-bit integer.

3DES usage in HTTPS

3DES is the second most widely supported cipher (after AES) in HTTPS servers, with about 87% of servers supporting it. 7 Furthermore, all popular web browsers support 3DES. The cipher that is actually negotiated for a TLS connection is chosen by the server, based on its local preference order and on the order in which the client advertises its ciphersuites. Since most modern browsers and servers prefer AES over 3DES, we find evidence that 1-2% of all TLS connections likely use 3DES in CBC mode, as detailed below.

Browser Telemetry. Telemetry data from Mozilla Firefox (given in Table 2) show that 3DES is used for more than 1% of HTTPS connections from Firefox browsers. Interestingly, the use of 3DES with Firefox has actually increased recently, as a consequence of the removal of RC4 from the list of supported ciphers in version 36 (following [3] and RFC 7465). Indeed a number of servers are configured to use, in order of preference, first RC4, then 3DES, and now use 3DES with Firefox.

Other browser vendors have privately reported the following telemetry data to us. Microsoft sees 1.2% 3DES connections for Internet Explorer and Edge, but only 0.8% system wide (the lower value can be explained by the fact that some applications still support RC4). Google Chrome sees 1.1% of connections using 3DES, but this number peaked at 1.6% soon after RC4 was disabled. If a web server runs on IIS 6.0 (i.e. Windows XP or Windows Server 2003), it will offer only RC4 and 3DES ciphersuites, unless support for AES ciphersuites has been added. If a modern web browser visits the website over HTTPS, the connection will use 3DES. According to web server surveys9 , IIS 6.0 powers about 1.9% of SSL enabled web servers, but it is likely used even more within corporate networks, and these servers would not appear in public scans.

Long-lived HTTPS connections. In order to mount the attack in practice, we need to find client and servers that not only negotiate the use of 3DES, but also exchange a large number of HTTP request in the same TLS connection (without rekeying). This is possible using a persistent HTTP connection, as defined in HTTP/1.1 (Keep-Alive).

On the client side, all browsers that we tested (Firefox, Chrome, Opera) will reuse a TLS connection as long as the server keeps it open. On the server side, we found that a number of HTTP servers will close the TLS connection even when it is still active. In particular, Apache and Nginx limit the number of requests sent in the same connection, with a maximum of 100 in the default configuration 10 the other hand, IIS does not seem to have such a limit. In practice, many high profile servers accept a very large number of requests in a single TLS connection. We made some experiments using a simple Perl script to send simple HTTP requests over a TLS connection, using pipelining to maximize the throughput. As seen in Table 4, we found that about half of the servers in Alexa's top 10 support a large number of requests without rekeying. For a better estimate of the number of vulnerable servers, we tested servers from Alexa's top 10k that negotiate 3DES with a modern client. We identified 11483 different HTTPS servers 11 , and found that 226 of them (1.9%) negotiate 3DES with a modern client. Moreover, 72 of these (0.6% of the total) also accept to keep a connection open for at least 800k requests. Consequently, the duration of the attack is not unrealistic, at least from the viewpoint of browsers and servers, and we estimate that at least 0.6% of HTTPS connections are vulnerable to our attacks. Downgrading to 3DES. From our measurements, only 1-2% of HTTPS connections use 3DES, and perhaps even fewer of these connections are to servers that allow longlived TLS connections. However, ignoring the danger posed by 3DES would be dangerous for several reasons. 3DES is typically the second or third most preferred encryption algorithms in HTTPS, so any change in the client or server configurations, say in response to some future attack on AES, would cause a large number of connections to fallback to 3DES. Furthermore, as recent downgrade attacks on TLS (e.g. FREAK) have demonstrated, protocol and implementation flaws can sometimes cause a weaker cipher to be negotiated. For example, if a downgrade attack from TLS 1.2 to SSL 3 becomes possible, then the strongest SSL 3 cipher that can be negotiated may well be 3DES. As an example, we describe a downgrade attack to 3DES that is currently possible on TLS connections. Although it does not enable our full attack, it nevertheless serves as a useful warning for practitioners. [23] is an optimization to the TLS handshake that reduces its latency. A client implementing False Start will start sending data before receiving the Finished message from the server. This allows an attacker to force the selection of a ciphersuite by tampering with the ServerHello message (he can replace AES by 3DES, for example) and the client will start sending data before verifying that the ciphersuite was really selected by the authentic server. If the client is willing to send millions of requests and gigabytes of data before finishing the handshake, this could allow our attack even against a server that would not select a 3DES ciphersuite. While 3DES ciphersuite are not recommended for use with False Start in the RFC draft [23], it turns out that they are white-listed for use with False Start with Internet Explorer. We have informed the Microsoft security team and they decided to remove 3DES from this white-list.

Downgrading False Start. TLS False Start

ATTACKING AUTHENTICATED HTTP OVER TLS AND OPENVPN

We now demonstrate concrete attacks against authenticated HTTP sessions even when they are secured by TLS or OpenVPN. First, we identify a few examples of secret authentication credentials that are repeatedly sent by the browser on every request. We then show how we can recover these secrets using block cipher collisions.

HTTP bearer tokens

Cookie-based Sessions. Modern HTTPS websites use a variety of methods to manage authenticated sessions with their clients. The most popular mechanism is secure cookies as specified in RFC6265. Once a user has logged in, the server sets a cookie containing a secret value on the user's browser. The browser will then send the cookie on all subsequent requests to the website, implicitly authenticating the user. For example, if domain.com sets a cookie C=XXXX, a subsequent HTTPS request from the browser looks like: Cookies are sensitive, because an attacker who obtains a session cookie can then log in as the user from a different browser. The cookie acts as a bearer token that carries the user's delegated credential. Except for its short-lived nature, it has the same security requirements as a password. Indeed, many websites, such as Facebook, use cookies with very long expiry times, making cookie theft even more attractive.

A cookie for a website is normally included in all requests to that website whether that request was initiated by the user, or a script on the website, or even by a different website. Browsers sometimes impose stricter rules for this last category of requests, called cross-origin or cross-domain requests. For example, XmlHttpRequests sent from one domain to another may not have cookies attached. However, cross-domain requests for images or iframes will still send cookies. HTTP BasicAuth. On corporate networks and even on the web, many websites are protected using the HTTP Basic Authentication mechanism specified in RFC7617. When the server asks for Basic authentication, the browser prompts the user to enter a username and password into a special dialog and then sends this information (in plaintext) as an HTTP header of the form:

Authorization: Basic dGVzdDoxMjPCow=
Once a user has entered his login information once, the browser will typically cache this information and use it on all subsequent requests to the server. Notably, even if a different website creates a cross-domain request to the authenticated server, the BasicAuth credentials will be automatically sent by the browser.

BasicAuth credentials contain the user's password and are hence security-critical. One should only use this authentication mechanism over HTTPS but a number of corporate websites use BasicAuth over HTTP, under the assumption that their users can only access the website over a VPN or some other secure connection.

OAuth and OpenID Connect Access Tokens. With the growth in popularity of single sign-on protocols, many websites now allow users to login with third-party credentials, such as OAuth or OpenID Connect tokens, issued by major websites like Google and Facebook. These tokens are effectively bearer tokens that must then be attached to all authentication and authorization requests and are sent either within the URI or in an Authorization header. While the use of these tokens is specific to each website, an attacker can usually repeatedly trigger the sending of these tokens by re-initiating the login sequence. An attacker who steals one of these tokens can then impersonate the user as well as retrieve sensitive data about the user from the login provider.

The Beastly Attack Scenario

Our attack scenario, depicted in Figure 1, is similar to the setup used in recent attacks on RC4 [3,19,32]. The attacker wants to steal some bearer token that is being repeatedly sent by a browser to a website secured with HTTPS, or an HTTP website accessed through a VPN. We assume that the attacker can control some JavaScript on a web page loaded by the user's browser, either by actively tampering with an HTTP response on the wire, or by hosting a malicious website that the user is fooled into visiting. We also assume that the attacker can observe all the encrypted traffic between the target browser and the secure website.

We further assume that the data is encrypted with a 64-bit block cipher in CBC mode (either an HTTPS connection where the client and server have negotiated 3DES, or an HTTP connection though a VPN encrypted with Blowfish or 3DES). Suppose the victim is already logged in to a website and has a session cookie. The attacker runs malicious JavaScript code on the victim's browser that repeatedly sends HTTP queries to the target website server, each containing the session cookie. If he sends close to 2 32 queries, a collision is expected between a ciphertext block corresponding to the cookie (ci), and a known block (cj), containing a known part of the query. The collision attack against CBC reveals the session cookie: pi = pj ⊕ ci-1 ⊕ cj-1.

Note that most of the traffic generated by the attacker is known or predictable. The requested URL is chosen by the attacker, and all the headers excepted the cookie are predictable and can be observed in any plaintext HTTP traffic. We will assume that the Cookie takes 16-bytes, i.e. two blocks, and that the attacker has aligned the cookie to a block boundary using other headers. As explained in Section 2.2, if a query contains 2 u known blocks, the number of encrypted blocks required for the attack is about:

√ H2 • π/2 • 2 (n+u-1)/2 .
In practice, an HTTP query is about 512 bytes (64 blocks), which implies a total complexity of 2 35.1 blocks (2 29.1 queries), and a total captured trace of size 280 GB. However, the attack can be made faster by using larger queries: this increases the total amount of data to capture, but it reduces the total number of queries. Since the speed of clients and servers is dependent on the number of queries, a larger query size can result in a faster attack overall. In our experiments, we got good results with 4 kB queries (512 blocks). In this setting, the attack requires 2 36.6 blocks (785 GB), but this corresponds to only 2 27.6 queries: increasing the requests size by a factor 8 (from 512 bytes to 4 kB) increases the total data to capture by a factor √ 8, and reduces the number of queries needed by a factor √ 8. In practice large queries can be produced by adding a long query string to the URL.

Proof-of-concept Code

The attacker code consists of two parts: a JavaScript program that sends a large number of HTTP requests, and a network adversary who processes the resulting ciphertext to recovers a 16-byte secret.

Man-in-the-browser code. We experimented with hidden <img> tags in a web-page with Javascript code to the onload event to reload the images repeatedly, and web workers issuing XmlHttpRequests. Cookies are automatically inserted when loading images from a different domain, and are also included in cross-domain XmlHttpRequests if the withCredentials property is set to true (this is only allowed for synchronous request, and the request result can not be read, but these restrictions don't prevent our attack). According to our experiments, request are generated faster using XmlHttpRequest. In order to avoid caching, we request a non-cacheable resource. Alternatively, we can include a unique query string in each URL, but the responses are still cached by the client and this can affect the query rate. We experimented with several browsers, and we obtained the best results with Firefox Developer Edition 47.0a212 .

Recovering collisions. We captured the encrypted packets with tcpdump and used a C++ program to extract the ciphertext blocks (using libpcap). In both the HTTPS attack and the OpenVPN attack, each HTTP query is sent in a separate encrypted record, which contain the plaintext at a fixed position, as well as some extra information (packet number, padding, MAC, ...). Therefore, it is easy to know to which plaintext block corresponds each ciphertext block, and to align the cookie to a block limit.

After capturing all the traffic, the C++ program sorts the ciphertext blocks in order to locate collisions. Since the amount of data is quite large (hundreds of gigabytes), we use the external sort implementation of the stxxl library. With a NAS storage, sorting the data took around four hours.

Attacking Basic Auth over OpenVPN

To demonstrate the attack against OpenVPN, we use a preshared-key tunnel between two physical machines running Linux, with Firefox Developer Edition 47.0a2 on one side, and an nginx server on the other side. Access to the server is protected by BasicAuth, and the user has entered his credentials. Using the default OpenVPN settings, the tunnel is encrypted with Blowfish in CBC mode.

We use the Javascript code described in the previous section to send a large number of requests to the server though the tunnel. We found that increasing the size of the request to 4 kB does not significantly reduce the query rate, but reduces the number of queries required for the attack. In our setting, the browser generates about 2900 requests per second, using several web Worker running in parallel. We expect the first collision after roughly 2 32.3 blocks (40 GB), i.e. one hour. In practice, we detected the first collision early, after only 30 minutes (2 31.3 blocks); as expected, the predicted xor difference was correct. The full attack needs about 2 36.6 blocks (785 GB) to recover a two-block secret out of 4 kB messages; this should take about 19 hours in this setting. In our demo, it took 18.6 hours and 705 GB, and we successfully recovered the 16-byte authentication token.

OpenVPN in TLS mode. In TLS mode, OpenVPN rekeys the tunnel every hour with the default settings (as apposed to the pre-shared-key mode used above that doesn't do any rekeying). With our experimental setting, this means we can only capture about 2 23.3 requests encrypted with a given key, i.e. 2 32.3 blocks. Therefore, we expect to detect a collision with probability close13 to 1/2. In order to recover a two-byte secret out of 4 kB messages, we need about 384 collisions as explained in Section 2.2. Therefore, this attack will take roughly 768 hours, or 32 days.

This illustrate the point that keys should be changed well before reaching 2 32 blocks: if each session is broken after 2 32 blocks, there is still a collision with probability roughly 1-e -1/2 ≈ 0.4. This increases the time required by the attack to 40 days, but it will still succeed with high probability.

Attacking Secure Cookies over HTTPS

The attack against HTTPS connection is very similar to the attack against OpenVPN, as long as we have a client and server that negotiate 3DES, and that keep a connection open for a long time.

Vulnerable Websites. As detailed in Section 3.3, about 0.6% of the top Alexa 100K websites support 3DES and allow long-lived HTTPS connections. This list contains many high-profile e-commerce and banking websites, including the ones shown in Table 5. In addition, we found a number of domains were the server serving domain.com will use 3DES, but it just redirects the client to a better configured server for www.domain.com. This could still open the way for our attacks, if sessioncookies for www.domain.com are set at the top-level domain and hence also sent to domain.tld. The last three websites in Table 5 belong to this category.

Proof-of-Concept Attack Demo. In our setup we use Firefox Developer Edition 47.0a2 running on Linux and an IIS 6.0 server in a Windows Server 2003 R2 SP2 Virtual machine. The default configuration of IIS 6.0 with all recommended updates offers only RC4 and 3DES ciphers, and will use 3DES with Firefox and other recent browsers where RC4 is disabled. Moreover, IIS 6.0 supports HTTP/1.1 and keeps an active connection open for an arbitrary long time.

We use the Javascript code described in Section 4.3, but we note that with several Workers running in parallel (or several <img> tags), modern browsers open a few parallel connec-Corporate Table 5: High-value websites that negotiate 3DES with modern browsers, and accept at least 1 million requests in the same TLS session tions to the server (typically, 6) and split the requests over these connections. For our attack, we need to maximize the throughput over a single connection. This can be achieved by disturbing some of the connections so that most of request are send in a single. In our setup, we used iptables rules to limit the rate of all connections except one. In a real attack, this would be done by an active man-in-the-middle, but a passive man-in-the-middle can also mount the attack -it will just take more time to collect the data.

On Firefox Developer Edition 47.0a2, with a few dozen Workers running in parallel, we can send up to 2000 requests per second in a single TLS connection. To further reduce the time needed for the attack, we inject a padding cookie to expand the requests to 4 KB (512 blocks). In our setting this reduces the rate to 1500 requests per second, but it still leads to a faster attack. Again, we expect the first collision after roughly 2 32.3 blocks (40 GB), i.e. 2 23.3 queries. This should take slightly less than two hours.

In our experiment, we were lucky to detect the first collision after only 25 minutes (2 20.1 requests), and we verified that the collision revealed the xor of two plaintexts blocks. As seen previously, the full attack should require 2 36.6 blocks (785 GB) to recover a two-block cookie, which should take 38 hours in our setting. Experimentally, we recovered the two-block cookie after only 30.5 hours and 610 GB.

Note that special care must be taken to recover the first block of a TLS fragment. When a collision involves the first ciphertext block (c

(j) i = c (j ) 0
), this gives an equation involving the IV (c

(j) i-1 = c (j ) -1
). In particular, this requires special treatment for TLS 1.0, because the IV of a given of a given record is not explicitly included in the message: it is the last ciphertext block of the previous record.

Our attack above relied on knowing most of the plaintext, but if we have enough data we can even recover most of the plaintext using just a single known block. In our experiment, after 65 hours (2 28.3 requests, 1.3TB) we can recover 492 blocks out of 510, assuming a single known plaintext block.

IMPACT AND MITIGATION

We have demonstrated the first concrete attacks on mainstream Internet protocols that exploit block cipher collisions. Our attacks can recover valuable secrets such as HTTP cookies and passwords in under 40 hours. Our attacks impact a majority of OpenVPN connections and an estimated 0.6% of HTTPS connections to popular websites. We expect that our attacks also impact a number of SSH and IPsec connections, but we do not have concrete measurements for these protocols. Like many recent attacks on TLS, such a BEAST and RC4 NOMORE, the underlying principles behind our attacks were well known to cryptographers. Our goal is to raise awareness among practitioners about the vulnerabilities of short block ciphers and on safe ways of using them.

Comparison with RC4 attacks

Our attack scenario is very similar to the setup of the recent attacks on the use of RC4 in HTTPS. We use the same man-in-the-browser setting to generate a large number of HTTP requests, and the data complexity of our attacks is comparable to these prior works:

• the first attack by Al Fardan et al. [3] uses between 2 28 and 2 32 sessions, with rekeying for each session, to recover the first 220 bytes a the message (but the cookie is not usually in these 220 bytes);

• the second attack by Al Fardan et al. [3] uses between 2 33 and 2 34 request, in the same TLS session or in different sessions, to recover a cookie;

• Garman et al. [19] improved the first attack to require only 2 26 sessions when targeting a BasicAuth password, using a better guessing strategy;

• the latest attack by Vanhoef and Piessens [32] requires 2 30.2 requests, in the same TLS session or in different sessions, to recover a cookie.

In comparison, our attack requires only 2 29.1 short queries of 512 bytes (280 GB in total), which can be reduced to 2 27.6 longer queries of 4 kB (785 GB in total). However, these numbers are for the case when all the data is encrypted within the same session. Even if the amount of data sent on a single connection is limited, as long as the limit is close enough to the birthday bound, we can still mount our attacks across multiple parallel and sequential sessions, albeit with a higher data and time complexity.

Mitigation

The obvious way to avoid these attacks is to stop using legacy 64-bit block-ciphers. There is no good reason to configure a VPN or an HTTPS server to prefer 3DES (or Blowfish) over AES. AES is more secure, is a FIPS standard, and will almost certainly be faster: it is implemented in hardware in most server and desktop CPUs, and can be implemented efficiently in dedicated hardware when an extremely high throughput is required.

On the other hand, there are specific uses of cryptography were 128-bit block ciphers can not be used, because of legacy reasons, or due to the relatively large hardware footprint of 128-bit ciphers (in this case, lightweight 64-bit block ciphers such as PRESENT or HIGHT would typically be used). In these scenarios, protocol designers should pay close attention to the issue of birthday attacks. In particular, they should verify that the amount of data encrypted with a fixed key is significantly smaller than 2 32 blocks, or use modes that provide security beyond the birthday bound, such as CENC [22] or PMAC plus [33].

Concretely, we recommend the following measures to prevent our attack:

1. Web servers and VPNs should be configured to prefer 128-bit ciphers. According to our scans, about 1.1% of the top 100k web server from Alexa, and 0.5% of the top 1 million, support AES but prefer to use 3DES.

2. Web browsers should offer 3DES as a fallback-only cipher, to avoid using it with servers that support AES but prefer 3DES.

3. TLS libraries and web browsers and servers should limit the length of TLS sessions with a 64-bit cipher. This could be done in TLS renegotiation, or in some cases by closing the connection and starting a new one (i.e. limiting HTTP/1.1 Keep-Alive, SPDY, and HTTP/2 with 3DES ciphersuites).

Responsible Disclosure

We have communicated our results and concerns to the OpenVPN team, and to various website owners, browser vendors, and TLS libraries. They all acknowledged the issue, and are working on implementing countermeasures. The TLS vulnerability received CVE number CVE-2016-2183. OpenVPN will display a warning to users who choose to use 64-bit ciphers and encourage them to transition to AES-GCM (cipher negotiation is also being implemented in the 2.4 branch). It will also implement a default renegotiation limit of 64MB when used in TLS mode. OpenSSL has moved 3DES ciphersuites from the HIGH category to MEDIUM in the 1.0.2 branch, and will disable it by default in the upcoming 1.1.0 release. Akamai will offer an option for web server administrators to drop 3DES from the offered ciphers. Apple has disabled 3DES on icloud.com and is recommending that all its customers disable 3DES on their websites.

Currently, most browsers see about 1% of their connections using 3DES, and vendors consider this number too high to simply disable 3DES on the client side, since too many websites would be broken. So, they are instead considering implementing data limits per connection to force rekeying, or offering 3DES ciphersuites only in a fallback negotiation if no AES ciphersuite is acceptable to the server. Mozilla is implementing data limits for all ciphersuites: https://bugzilla.mozilla.org/show bug.cgi?id=1268745 . Microsoft has removed 3DES from the False Start whitelist: https://technet.microsoft.com/library/security/3155527.aspx More details about implemented countermeasures will be added to our webpage as they become available: http://sweet32.info

The Missing Difference Problem, and its Applications to Counter Mode Encryption

Gaëtan Leurent and Ferdinand Sibleyras

Inria, France {gaetan.leurent,ferdinand.sibleyras}@inria.fr Abstract. The counter mode (CTR) is a simple, efficient and widely used encryption mode using a block cipher. It comes with a security proof that guarantees no attacks up to the birthday bound (i.e. as long as the number of encrypted blocks σ satisfies σ 2 n/2 ), and a matching attack that can distinguish plaintext/ciphertext pairs from random using about 2 n/2 blocks of data. The main goal of this paper is to study attacks against the counter mode beyond this simple distinguisher. We focus on message recovery attacks, with realistic assumptions about the capabilities of an adversary, and evaluate the full time complexity of the attacks rather than just the query complexity. Our main result is an attack to recover a block of message with complexity Õ(2 n/2 ). This shows that the actual security of CTR is similar to that of CBC, where collision attacks are well known to reveal information about the message. To achieve this result, we study a simple algorithmic problem related to the security of the CTR mode: the missing difference problem. We give efficient algorithms for this problem in two practically relevant cases: where the missing difference is known to be in some linear subspace, and when the amount of data is higher than strictly required. As a further application, we show that the second algorithm can also be used to break some polynomial MACs such as GMAC and Poly1305, with a universal forgery attack with complexity Õ(2 2n/3 ).

Introduction

Block ciphers (such as DES or the AES) are probably the most widely used cryptographic primitives. Formally, a block cipher is just a keyed family of permutations over n-bit blocks, but when combined with a mode of operation, it can provide confidentiality (e.g. using CBC, or CTR), authenticity (e.g. using CBC-MAC, CMAC, or GMAC), or authenticated encryption (e.g. using GCM, CCM, or OCB). A mode of operation defines how to divide a message into blocks, and how to process the blocks one by one with some chaining rule.

The security of block ciphers is studied with cryptanalysis, with classical techniques such as differential [8] and linear [27] cryptanalysis, dedicated techniques like the SQUARE attack [9], and ad-hoc improvements for specific targets. This allows to evaluate the security margin of block ciphers, and today we have a high confidence that AES or Blowfish are as secure as a family of pseudo-random permutations with the same parameters (key size and block size).

On the other hand, modes of operation are mostly studied with security proofs, in order to determine conditions where using a particular mode of operation is safe. However, exceeding those conditions doesn't imply that there is an attack, and even when there is one, it can range from a weak distinguisher to a devastating key recovery. In order to get a better understanding of the security of modes of operations, we must combine lower bound on the security from security proofs, and upper bounds from attacks.

In particular, most of the modes used today are sensible to birthday attacks because of collisions; those attacks can even be practical with 64-bit block ciphers, as shown in [7], but security proofs don't tell us how dangerous the attacks are. For instance, the CBC and CTR modes have been proven secure against chosen plaintext attacks up to σ 2 n/2 blocks of encrypted data [5,35]. Formally, the security statements bound the maximum advantage of an attacker against the modes as follows:

Adv CPA CBC-E ≤ Adv prp E + σ 2 /2 n , Adv CPA CTR-E ≤ Adv prp E + σ 2 /2 n+1
. Both statement are essentially the same, and become moot when σ reaches 2 n/2 , but attacks can actually be quite different.

More precisely, the CBC mode is defined as

c i = E(m i ⊕ c i-1 )
, with E a block cipher. A collision between two ciphertext blocks c i = c j is expected after 2 n/2 blocks, and reveals the xor of two plaintext blocks: m i ⊕ m j = c i-1 ⊕ c j-1 . On the other hand, the counter mode is defined as c i = E(i) ⊕ m i . There are no collisions in the inputs/outputs of E, but this can actually be used by a distinguisher. Indeed, if an adversary has access to 2 n/2 known plaintext/ciphertext pairs, he can recover E(i) = c i ⊕ m i and detect that the values are unique (because E is a permutation), while collisions would be expected with a random ciphertext. Both attacks have the same complexity, and show that the corresponding proofs are tight. However, the loss of security is quite different: the attack against CBC lets an attacker recover message blocks from collisions (as shown in practice in [7]), but the attack against the counter mode hardly reveals any useful information.

In general, there is a folklore belief that the leakage of the CTR mode is not as bad as the leakage of the CBC mode. For instance, Ferguson, Schneier and Kohno wrote [15,Section 4.8.2] (in the context of a 128-bit block cipher):

CTR leaks very little data. [...] It would be reasonable to limit the cipher mode to 2 60 blocks, which allows you to encrypt 2 64 bytes but restricts the leakage to a small fraction of a bit. When using CBC mode you should be a bit more restrictive. [...] We suggest limiting CBC encryption to 2 32 blocks or so.

2

Our contribution. The main goal of this paper is to study attacks against the counter mode beyond the simple distinguisher given above. This is an important security issue, because uses of the CTR mode with 64-bit block ciphers could be attacked in practice. We consider generic attacks that work for any instance of the block cipher E, and assume that E behaves as a pseudo-random permutation. The complexity of the attacks will be determined by the block size n, rather than the key size, and we focus on the asymptotic complexity, using the Big-O notation O(), and the Soft-O notation Õ() (ignoring logarithmic factors).

We consider message recovery attacks, where an attacker tries to recover secret information contained in the message, rather than recovering the encryption key k. Following recent attacks against HTTPS [12,2,7], we assume that a fixed message containing both known blocks and secret blocks is encrypted multiple times (this is common with web cookies, for instance). As shown by McGrew [28], this kind of attack against the CTR mode can be written as a simple algorithmic problem: the missing difference problem, defined as follows: given two functions f, g : X → {0, 1} n , with the promise that there exists a unique S ∈ {0, 1} n such that ∀(x, y), f (x) ⊕ g(y) = S, recover S. We further assume that f and g behave like random functions, and that we are given a set S ⊆ {0, 1} n , such that S ∈ S (S represents prior knowledge about the secret). In an attack against the counter mode, f outputs correspond to known keystream blocks, while g outputs correspond to encryptions of S.

In the information theoretic setting, this problem can be solved with Õ(2 n/2 ) queries for any set S, and requires at least Ω(2 n/2 ) queries when |S| ≥ 2. However, the analysis is more complex when taking into account the cost of the computations required to recover S. McGrew introduces two algorithms for this problem: a sieving algorithm with Õ(2 n/2 ) queries and time Õ(2 n ), and a searching algorithm that can be optimized to time and query complexity Õ(2 n/2 |S|). Our main contribution is to give better algorithms for this problem:

1. An algorithm with Õ(2 n/2 ) queries and time Õ(2 n/2 + 2 dim S ), in the case where S is (a subset of) a linear subspace of {0, 1} n . In particular, when S is a linear subspace of dimension n/2, we reach a time and query complexity of Õ(2 n/2 ), while the searching algorithm of McGrew has a time and query complexity of Õ(2 3n/4 ). 2. An algorithm with time and query complexity Õ(2 2n/3 ) for any S. In particular, with S = {0, 1} n , the best previous algorithm had a time complexity of Õ(2 n ).

We also show new applications of these algorithms. The first algorithm leads to an efficient message recovery attack with complexity Õ(2 n/2 ) against the CTR mode, assuming that the adversary can control the position of the secret, by splitting it across block boundaries (following ideas of [32] and [12]). The second algorithm can be used to recover the polynomial key in some polynomial based MACs such as GMAC and Poly1305, leading to a universal forgery attack with complexity Õ(2 2n/3 ). As far as we know, this is the first universal forgery attack against those MACs with complexity below 2 n . Related works. There are several known results about the security of mode of operation beyond the birthday bound, when the proof is not applicable. For encryption modes, the security of the CBC mode beyond the birthday bound is well understood: collision attacks reveal the XOR of two message blocks, and can exploited in practice [7]. Other modes that allow collisions (eg. CFB) have the same properties. The goal of this paper is to study the security of modes that don't have collisions, to get a similar understanding of their security.

Many interesting attacks have also been found against authentication modes. In 1995, Preneel and van Oorschot [31] gave a generic collision attack against all deterministic iterated message authentication codes (MACs), leading to existential forgeries with complexity O(2 n/2 ). Later, a number of more advanced generic attacks have been described, with stronger outcomes than existential forgeries, starting with a key-recovery attack against the envelop MAC by the same authors [32]. In particular, a series of attack against hash-based MAC [25,30,18,11] led to universal forgery attacks against long challenges, and key-recovery attacks when the hash function has an internal checksum (like the GOST family). Against PMAC, Lee et al. showed a universal forgery attack in 2006 [24]. Later, Fuhr, Leurent and Suder gave a key-recovery attack against the PMAC variant used in AEZv3 [17]. Issues with GCM authentication with truncated tags were also pointed out by Ferguson [14].

None of these attacks contradict the proof of security of the scheme they target, but they are important results to understand the security degradation after the birthday bound.

Organization of the paper. We introduce the CTR mode and the missing difference problem in Section 2, and present our algorithmic contributions in Section 3. Then we describe concrete attacks against the CTR mode in Section 4, and attacks against Carter-Wegman MACs in Section 5. At last we show detailed proofs and simulation results in Section 6.

2 Message Recovery Attacks on CTR mode

0 E k m 0 c 0 m 1 c 1 E k 1 m 2 c 2 E k 2 m 3 c 3 E k 3 Fig. 1. CTR mode 4 346
Symmetric Cryptanalysis Beyond Primitives

The CTR mode was first proposed by Diffie and Hellman in 1979 [10]. It was not included in the first series of standardized modes by NIST [16], but was added later [13]. The CTR mode essentially turns a block cipher into a stream cipher, by encrypting some non-repeating counter. It is now a popular mode of operation, thanks to its parallelizability, speed, and simple design. This led Phillip Rogaway to write in an evaluation of different privacy modes of operation talking about CTR [35]: "Overall, usually the best and most modern way to achieve privacy-only encryption". In particular, CTR is used as the basic of the authenticated encryption mode GCM, the most widely used mode in TLS today.

Setting and Notations

In the following we assume that the counter mode is implemented such that the input to the block cipher never repeats. For simplicity we consider a stateful variant of the counter mode with a global counter that is maintained across messages and initialized as 0 (as shown in Figure 1):

c i = E k (i) ⊕ m i ,
where E k is an n-bit block cipher, m i an n-bit block of plaintext and c i an n-bit block of ciphertext.

Our attacks do not depend on the details of how the input to the block cipher is constructed, and can also be applied to nonce-based variants1 ; we only require that all inputs are different. Note that some variants of the counter mode can have repetitions in the block cipher input2 , but this gives easy attacks because repetitions leak the xor of two plaintext blocks (as in the CBC mode).

We consider a message recovery attack, where the attacker tries to recover some secret message block S. Throughout the attack, the key k will be invariant so we will write E k (i) as a i to represent the i th block of CTR keystream. We can immediately notice that if we have partial knowledge of the plaintext, for every known block m i we can recover the associated a i as c i ⊕ m i = a i . Assume further that we have access to the repeated encryption b j of the secret S so that b j = a j ⊕S. The first property of the CTR mode is that E k (•) being a permutation, the keystream a i never repeats, thus we have the following inequalities:

i = j ⇒ a i = a j ⇒ a i ⊕ a j ⊕ S = S ⇒ a i ⊕ b j = S.
From now on we will always assume that we can observe and collect lists of many a i and b j and use them with the previous inequality to recover S. This setting is similar to the practical attack Sweet32 on the CBC mode mounted by Bhargavan and Leurent, using repeated encryptions of an authentication token to obtain many different ciphertext blocks for the same secret information [7].

Formally, let A ⊆ {0, 1} n be the set of observed keystream blocks, B ⊆ {0, 1} n the set of observed encryptions and S ⊆ {0, 1} n the set of possible secrets (corresponding to some already known information about S). We define the missing difference algorithmic problem in terms of set: Definition 1 (Missing Difference Problem). Given two sets A and B, and a hint S, find the value S ∈ S such that:

∀(a, b) ∈ A × B, S = a ⊕ b .
Alternatively, we can consider that the attacker is given oracle access to A and B though some functions f and g, so that its running time includes calls to f and g, and computations to recover S. This presentation corresponds to a more active attack, where the adversary can optimize the size of the sets.

Definition 2 (Missing Difference Problem with Functions). Given two functions f, g : X → {0, 1} n , and a hint S, find the value S ∈ S such that: ∀(x, y), S = f (x) ⊕ g(y) .

Previous Work

An attack can only be carried to the end if the secret S is the only value in S such that ∀(a, b) ∈ A × B, S = a ⊕ b, or else it will be indistinguishable from the other values that satisfy the same condition (those values could have produced the same sets with same probability). The coupon collector's problem predicts that N out of N different coupons are found after N • H N N ln N draws (with H N the N -th harmonic number), assuming uniform distribution of the draws. In our case we will assume that all the differences a ⊕ b are independent and uniformly distributed over {0, 1} n \ S, which is a reasonable approximation validated by our experiments. To carry the attack to the end we require to collect N = |S| -1 differences thus we will need O(|S| ln |S|) "draws". A draw is a couple (a, b) s.t. a ⊕ b ∈ |S|, otherwise we discard it; it happens with probability (|S| -1)/(2 n -1). Therefore we need to observe enough data to have |A| • |B| in the order of O(2 n ln |S|); this may be achieved by having both sets in the order of O(2 n/2 ln |S|). This size of the observed sets can be understood as the query complexity, that is the number of encrypted messages the attacker will have to intercept in order to carry out the attack. Notice that even for

|S| = O(2 n ), |A| = |B| = O( √ n • 2 n/2
) is quite close to the theoretical lower bound of O(2 n/2 ) given by the distinguishing attack and the security proof for the CTR mode. Therefore, message recovery attacks are possible with an (almost) optimal data complexity. The next question is to study the time complexity, i.e. how to efficiently recover S.

A first approach consists in computing all the impossible values of S from the large set of A × B and discard any new value we encounter as impossible until there's only one possible plaintext left. This is algorithm 1. This approach works but requires to actually compute O(2 n ln |S|) values and maintain in memory a sieve of size |S|. In the case where the key size is equal to the block size n, like AES-128, this attack is actually worse than a simple exhaustive search of the key.

Efficient Algorithms for the Missing Difference Problem

We now propose two new algorithms to solve the missing difference algorithmic problem more efficiently in two practically relevant different settings. Our first algorithm requires that the set S -or its linear span S -is a vector space of relatively small dimension, and has complexity Õ(2 n/2 + | S |). The second algorithm uses a larger query complexity of Õ(2 2n/3 ), to reduce the computation and memory usage to Õ(2 2n/3 ).

Known Prefix Sieving

In many concrete attack scenarios, an attacker knows some bits of the secret message in advance. For instance, an HTTP cookie typically uses ASCII printable characters, whose high order bit is always set to zero. More generally, we assume that S is (included in) an affine subspace of {0, 1} n of dimension nz for some natural z < n. In order to simplify the attack, we use a bijective affine function φ that maps S unto {0} z × {0, 1} n-z , and rewrite the problem as follows:

S = a ⊕ b ⇔ φ(S) = φ(a ⊕ b), as φ is a bijection. ⇔ φ(S) = φ(a) ⊕ φ(b) ⊕ φ(0),
as φ is affine Therefore, we can reduce the missing difference problem on A, B, S with dim( S ) = nz to the missing difference problem on A , B , S , where the secret is known to start with z zeroes:

S := {0} z × {0, 1} n-z A := {φ(a) | a ∈ A} B := {φ(b) ⊕ φ(0) | b ∈ B}
We now introduce a known prefix sieving algorithm (Algorithm 3) to solve this problem efficiently. The algorithm is quite straightforward; it looks for a prefix collision before sieving in the same way as before to recover S. The complexity depend on the dimension nz; the sieving requires O(2 n-z ) memory and O((nz) • 2 n-z ) XOR computations in expectation, while looking for collisions only requires to store the prefix keys and to go through one of the set. Looking for collisions allows us to skip the computations of many pairs (a, b) that would be irrelevant as a ⊕ b / ∈ S. The expected number of collisions required to isolate the secret is given by the coupon collector problem as ln(2 n-z )2 n-z = ln 2 • (nz) • 2 n-z . Therefore the total optimized complexity (with balanced sets A and B) to recover an nz bits secret with this algorithm is:

O √ n -z • 2 n/2 queries O 2 n-z + n √ n -z • 2 n/2 bits of memory (sieving & queries) O (n -z) • 2 n-z + √ n -z • 2 n/2 operations (sieving & collisions searching) 8
As we can see from the complexity, when z = 0 this is the naive algorithm with its original complexity. When z nears n, this performs similarly to McGrew's searching algorithm i.e. the cost of looking for collisions (or storing B so that the search is efficient) will dominate the overall cost of the algorithm therefore the time and query complexity will match. Actually, this algorithm improves over previous works for intermediate values of z. With z = n/2, we have an algorithm with complexity Õ(2 n/2 ), while McGrew's searching algorithm would require Õ(2 3n/4 ) computations in the same setting. The complexity therefore becomes tractable and we could implement and run this algorithm for n = 64 bits with success, as shown in Section 6.2.

Algorithm 3. Known prefix sieving algorithm

Input: n, z < n, A, B, S ⊆ {0} z × {0, 1} n-z Output: {s ∈ S | ∀(a, b) ∈ A × B, a ⊕ b = s} h B ← Empty hash table. for b in B do h B [b [0...(z-1)] ] ∪ ← {b [z...(n-1)] } end for for a in A do v a ← a [z...(n-1)] for v b in h B [a [0...(z-1)] ] do Remove 0 (v a ⊕ v b )
from S; end for end for return S

Fast Convolution Sieving

Alternatively, we can reduce the complexity of the sieving algorithm by using sets A and B of size 2 m 2 n/2 , rather than Õ(2 n/2 ) as required to uniquely identify S. If we consider all the values a ⊕ b for (a, b) in A × B, we expect that they are close to uniformly distributed over {0, 1} n \ S, so that every value except S is reached about 2 2m-n times, while S is never hit. Increasing m makes the gap more visible than with sets of size only Õ(2 n/2 ). Therefore, we can consider buckets of several candidates s, and accumulate the number of a ⊕ b in each bucket. If we consider buckets of 2 t values, each bucket receives 2 2m+t-n values on average, but the bucket containing S receives only 2 2m+t-n -2 2m-n values. If we model this number with random variables following a binomial distribution, the variance σ 2 is about 2 m+t/2-n/2 . Therefore, the bias will be detectable when: σ 2 2m-n , i.e. when t 2mn. Concretely, we use a truncation function T that keeps only nt bits of an n-bit word. We consider the values T (a ⊕ b) for all (a, b) ∈ A × B, and count how many times each value is reached. If m is large enough, the value with the lowest counter corresponds to T (S). This attack does not require any prior information on the secret; it can be used with S = {0, 1} n , and once T (S) is known, we can use known-prefix sieving to recover the remaining bits (looking for S in an affine space of dimension t).

We now show an algorithm to quickly count the number of occurrences for each combination. For a given multi-set X , we consider an array of counters C X , to represent how many times each value T (x) is reached:

C X [i] = x ∈ X T (x) = i .
Our goal is to compute C A⊕B efficiently from A and B, where A ⊕ B is the multi-set {a ⊕ b | (a, b) ∈ A × B}. We observe that:

C A⊕B [i] = |{(a, b) ∈ A × B | T (a ⊕ b) = i}| = a∈A |{b ∈ B | T (a ⊕ b) = i}| = a∈A |{b ∈ B | T (b) = i ⊕ T (a)}| = a∈A C B [i ⊕ T (a)] = j∈{0,1} n-t C A [j]C B [i ⊕ j]
This is a form of convolution that can be computed efficiently only using the Fast Walsh-Hadamard Transform (Algorithm 4), in the same way we use the Fast Fourier Transform to compute circular convolutions (see Algorithm 5). Therefore the full attack (shown in Algorithm 6) takes time Õ(2 n-t ) using lists of size 2 m with m (n + t)/2 and a sieve of 2 n-t elements. In order to optimize the attack, we select t = n/3 such that the time complexity, data complexity, and memory usage are all roughly 2 2n/3 . A detailed analysis in Section 6.1 shows that we reach a constant success rate with t = n/3 using lists of size O( √ n • 2 2n/3 ). This gives the following complexity for the full attack:

O( √ n • 2 2n/3 ) queries O(n • 2 2n/3 ) + O(n √ n • 2 n/2 ) bits of memory (counters + sieving) O(n • 2 2n/3 ) + O(n √ n • 2 n/2
) computations (fast Walsh-Hadamard + sieving)

As seen in Section 6.1, we performed experiments with n = 12, 24, 48, and the correct S was found with the lowest counter in at least 70% of our experiments, using list of size √ n2 2n/3 . This validates our approach and shows that the constant in the O notation is small. We could run this algorithm over n = 48 bits in a matter of minutes.

Optimizations. In order to increase the success rate of the algorithm, one can test several candidates for T (S) (using the lowest remaining counters), and use 10

j = 0 to 2 d-1 do C A [i • 2 d + j] ← C A [i • 2 d + j] + C A [i • 2 d + j + 2 d-1 ] C A [i • 2 d + j + 2 d-1 ] ← C A [i • 2 d + j] -2 • C A [i • 2 d + j + 2 d-1 ] end for end for end for return C A Algorithm 5. Fast convolution Input: C A , C B Output: C A⊕B {Perform fast Walsh-Hadamard transform in-place} FWHT(C A ); FWHT(C B ); for c = 0 to 2 n-t do C A⊕B [c] ← C A [c] • C B [c] end for {Perform fast Walsh-Hadamard transform in-place} FWHT(C A⊕B ); return C A⊕B Algorithm 6. Sieving with fast convolution Input: A, B, t ≤ n Output: S s.t. ∀(a, b) ∈ A × B, a ⊕ b = S C A , C B , C A⊕B ← arrays of 2 n-t integers initialized to 0; for a in A do Increment C A [a 0..(n-t-1) ] end for for b in B do Increment C B [b 0..(n-t-1) ] end for C A⊕B ← FastConvolution(C A , C B ) u ← argmin i C A⊕B [i]
Run known prefix sieving (Algorithm 3), knowing that T (S) = u the known-prefix sieving to detect whether the candidate is correct. Another option is to run multiple independent runs of the algorithm with different choices of the n/3 truncated bits. This would avoid some bad cases we have observed in simulations, where the right counter grows abnormally high and gets hidden in all of the other counters.

For the memory complexity, notice that we don't need to store all the data but simply to increment a counter. We only need to keep enough blocks for the second part of the algorithm so that the sieving yields a unique result. Initially the counters for C A and C B are quite small, √ n in expectation. However, C A⊕B will have much bigger entries, n • 2 2n/3 in expectation, so that we need O(n) bits to store each entry.

Application to the CTR Mode

We know show how to mount attacks against the counter mode using the new algorithms for the missing difference problem.

Attack using Fast Convolution

Use of the fast convolution algorithm to recover one block of CTR mode plaintext is straightforward. The attacker is completely passive and observes encryptions of S (gathered in set B), and keystream blocks recovered from the encryption of known message blocks (gathered in set A). When the lists are large enough, he runs the fast convolution algorithm on A and B to recover S.

Attacks using Known Prefix Sieving

Direct attack. There are many settings where unknown plaintext will naturally lie in some known affine subspace, and the known prefix sieving algorithm can be used directly. For instance a credit card number (or any number) could be encoded in 16 bytes of ASCII then encrypted. Because in ASCII the encoding of any digit starts by 0x3 (0x30 to 0x39), we know half of the bits of the plaintext, and we can use the known-prefix sieving with z = n/2. Other examples are information encoded by uuencode that uses ASCII values 0x20 to 0x5F (corresponding to two known bits) or HTML authentication cookies that are typically encoded to some subset of ASCII numbers and letters 3 .

Block splitting. We often assume that the secret is encrypted in its own block, but when the secret is part of the message, it can also be split across block boundaries, depending on how the plaintext is constructed and encrypted by the protocol. In particular, if a message block contains both known bytes and secret bytes, we can apply the known prefix sieving algorithm to this block and recover the secret bytes. In many protocols, messages start with some low entropy header that can be guessed by an attacker. Moreover, the attacker often has some degree of control over those headers. For instance, in the BEAST attack [12] against HTTPS, an attacker uses Javascript code to generate HTTPS requests, and he can choose the URL corresponding to the requests. Using this control of the length of the header, block splitting attacks have been shown in the BEAST model [12,20]. The attacker starts with a header length so that a small chunk of the secret message is encrypted together with known information, and recovers this secret chunk. Then he changes the length of the header to recover a second chunk of the message, using the fact that the first chunk is now known. Eventually, the full secret can be recovered iteratively.

In our case, the easiest choice is to recover chunks of n/2 bits of secret one by one, using the known-prefix sieving algorithm with z = n/2. We illustrate this attack in Table 1, assuming a two-block secret S = S 1 S 2 S 3 S 4 , and a protocol that lets the adversary query an encryption of the secret with an arbitrary chosen prefix:

1. The attacker makes two kind of queries -Q 1 with a known half-block header Alternatively, an attacker could recover the secret bit by bit. This leads to a more complex attack in practice, but the complexity is similar, and this variant could use McGrew's searching algorithm instead of our known-prefix sieving algorithm (because in this scenario, we have |S| = 2). We show a detailed analysis of this variant in Section 6.2, taking into account the n steps necessary for this attack.

H 1 (E([H 1 S 1 ] [S 2 S 3 ] [S 4 ])); -Q 2 with a known full-block header H 1 H 2 (E([H 1 H 2 ] [S 1 S 2 ] [S 3 S 4 ])). 2.

Use of CTR Mode in Communication Protocols

The CTR mode is widely used in internet protocols, in particular as part of the GCM authenticated encryption mode [29], with the AES block cipher. For instance, Mozilla telemetry data show that more than 90% of HTTPS connections from Firefox 58 use AES-GCM 4 . While attacks against modes with a 128-bit block cipher are not practical yet, it is important to limit the amount of data processed with a given key, in order to keep the probability of a successfull attack negligible, following the guidelines of Luykx and Paterson [26].

Surprisingly, there are also real protocols that use 64-bit block ciphers with the CTR mode (or variants of the CTR mode), as shown below. Attacks against those protocols would be (close to) practical, assuming a scenario where an attacker can generate the encryption of a large number of messages with some fixed secret.

SSH. Ciphersuites based on the CTR mode were added to SSHv2 in 2006 [4]. In particular, 3DES-CTR is one of the recommended ciphers, but actual usage of 3DES-CTR seems to be rather low [1]. In practice, 3DES-CTR is optionally supported by the dropbear server, but it is not implemented in OpenSSH. According to a scan of the full IPv4 space by Censys.io 5 , around 9% of SSH servers support 3DES-CTR, but actual usage is hard to estimate because it depends on client configuration.

The SSH specification requires to rekey after 1GB of data, but an attack is still possible, although the complexity increases.

3G telephony. The main encryption algorithm in UMTS telephony is based on the 64-bit blockcipher Kasumi. The mode of operation, denoted as f8, is represented in Figure 2. While this mode in not the CTR mode and was designed to avoid its weaknesses, our attack can be applied to the first block of ciphertext. Indeed the first block of message i is encrypted as

c i,0 = m i,0 ⊕ E k (E k (i))
, where the value E k (E k (i)) is unique for all the messages encrypted with a given key.

There is a maximum of 2 32 messages encrypted with a given key in 3G, but this only has a small effect on the complexity of attacks.

i E k 0 E k m i,0 c i,0 1 E k m i,1 c i,1 2 E k m i,2 c i,2 Fig. 2. f8 mode (i is a message counter)
Because of the low usage of 3DES-CTR in SSH, and the difficulty of mounting an attack against 3G telephony in practice, we did not attempt to demonstrate the attack in practice, but the setting and complexity of our attacks are comparable to recent results on the CBC mode with 64-bit ciphers [7].

Counter-measures.

As for many modes of operation, the common wisdom to counter this kind of attacks asks for rekeying before the birthday bound, i.e. before 2 n/2 blocks. However rekeying too close to the birthday bound may not be enough. For example let's consider an implementation of a CTR based mode of operation that rekeys every 2 n/2 blocks, Using the same model as previously, and a one-block secret, an optimal attack uses queries [H 1 S 1 ] [S 2 ] with a half-block header, and queries [H 1 H 2 ] [S 1 S 2 ] with a full-block header, where rekeying occurs after 2 n/2-2 queries of each type. To recover S 1 , we use the known prefix sieving algorithm as previously, but we can only use relations between ciphertext blocks encrypted with the same key. In each session of 2 n/2 blocks, we consider 2 n-4 pairs of ciphertext blocks; on average there are 2 n/2-4 pairs with the correct prefix used for sieving. Since we need n/2 • 2 n/2 draws to reduce the sieve to a single element with high probability, we use 8n sessions, i.e. 8n • 2 n/2 blocks of data in total. The same data can be reused to recover S 2 when S 1 is known. This should be compared with the previous data complexity of 4 n/2 • 2 n/2 in the absence of rekeying.

However, rekeying every 2 n/2-16 blocks makes the data complexity goes up to 2 35 n sessions or n • 2 19+n/2 blocks to recover the secret block. Notice that the security gain of rekeying is comparable with what is gained in CBC, where rekeying every 2 n/2-16 blocks forces increases the data complexity from 2 • 2 n/2 to 2 18 • 2 n/2 .

Application to Wegman-Carter MACs

Because the fast convolution algorithm requires fewer assumptions, it can be adapted to other modes of operation based on CTR and particularly to Wegman-Carter type of constructions for MAC. Wegman-Carter MACs use a keyed permutation E and a keyed universal hash function h, with k1 and k2 two private keys. The input is a message M and a nonce N , and the MAC is defined as:

MAC(N, M ) = h k1 (M ) + E k2 (N )
Again, the construction requires that all block cipher inputs are different. To apply our attack, we use two fixed message M and M , and we capture many values MAC(N, M ) in a list A and values MAC(N , M ) in a list B, all using unique nonces. Then we solve the missing difference problem to recover h k1 (M )-h k1 (M ) as we know that ∀N = N : E k2 (N ) -E k2 (N ) = 0. It is often sufficient to know this difference and the two messages M and M to recover the key k 1 . We give two examples with concrete MAC algorithms.

Galois/Counter Mode. GCM is an authenticated encryption mode with associated data, combining the CTR mode for encryption and a Wegman-Carter MAC based on polynomial evaluation in a Galois field for authentication. It takes as input a message M that is encrypted and authenticated, and some associated data A that is authenticated but not encrypted. When used with an empty message, the resulting MAC is known as GMAC. In our attack, we use an empty message with one block of authenticated data A, so that the tag is computed as:

MAC(N, A) = A • H 2 ⊕ H ⊕ E k (N ),
A • H 2 ⊕ H ⊕ A • H 2 ⊕ H = (A ⊕ A ) • H 2 .
We known A ⊕ A and the field is known so we invert that value and recover H 2 then compute the square root and recover the hash key H.

Comparison with previous attacks against GMAC. There are several known attacks against GCM and GMAC, but none of them seems to allow universal forgery with just 2 2n/3 blocks of data and 2 2n/3 computations. In particular, Handschuh and Preneel [19] gave a weak-key attack, that can also be used to recover the hash key without weak key assumptions, using roughly 2 n/2 messages of 2 n/2 blocks. Later work extended these weak key properties [36,33] but an attack still requires about 2 n blocks in total when no assumptions are made about the key. We also note that these attacks require access to a verification oracle, while our attack only uses a MAC oracle. Some earlier attacks use specific options of the GCM specifications to reach a lower complexity, but cannot be applied with standard-length IV, and tag: Ferguson [14] showed an attack when the tag is truncated, and Joux [23] gave an attack based on non-default IV lengths.

Poly1305. Poly1305 [6] is a MAC scheme following the Wegman-Carter construction, using polynomial evaluation modulo the prime number 2 130 -5. It uses a keyed 128-bit permutation (usually AES), and the hash function key, r, has 106 free bits (22 bits of the key are set to 0, including in particular the 4 most significant ones). The message blocks are first padded to 129-bit values c i . Then the MAC of a q-block message M with nonce N is defined as: T (M, N ) = (((c 1 r q + c 2 r q-1 + ... + c q r) mod 2 130 -5) + E k (N )) mod 2 128 .

With the same strategy as above, using two different messages M and M we recover the missing difference (((c 1c 1 )r q + (c 2c 2 )r q-1 + ... + (c qc q )r) mod 2 130 -5) mod 2 128 . Moreover, we chose M and M such that c ic i = 0 and c qc q = 1; since by design, r < 2 124 the value recovered is simply the hash key r.

Notice that Poly1305 doesn't use the XOR operation but a modular addition, and we have to adapt our algorithms to this case. Luckily, the fast convolution algorithm can easily be tweaked. First, we keep the 2n/3 least significant bits to avoid issues the carry, something the XOR operation doesn't have. Then, when the lists of counters are up, we need to compute their cyclic convolution, which is done with a fast convolution algorithm based on the fast Fourier transform (instead of fast Walsh-Hadamard). Then we verify the value suggested by the lowest counter by running the known prefix algorithm looking for collisions on the least significant bits and sieving the modular subtraction of the most significant bits. This adaptation has similar complexities and proofs than the one described earlier. Moreover, in the case of Poly1305, one can further adapt the algorithms to take into account the fact that 22 bits of the key r are fixed at 0 effectively reducing the dimension of S.

Proofs and Simulations

In this section we give some theoretical and simulation results that further support the claims we made thus far.

About the Fast Convolution Algorithm

Proof of query complexity for the claim made in Section 3.2. Consider, without loss of generality and for blocks of size n, that we possess a • 2 2n/3 blocks of keystream and the same number of blocks of encrypted secret S with a a function of n. So in this setting we have a 2 • 2 4n/3 different XORed-values possible between the two lists, that we will consider as independent and uniformly distributed over 2 n -1 values. We will then focus on the 2n/3 bits truncation, T (•), and ignore the rest. We count the number of occurrences for every truncated values and store them in two lists of size 2 2n/3 . Using the fast Walsh-Hadamard transform 3 times, Algorithm 5, we can therefore compute the same counters but for all the XORed-values. We hope that the counter for T (S), the good counter, will be lower than all of the other counters, the bad counters, with probability Ω(1). In which case we say the algorithm succeeds.

Let X c i represents the fact that the i th value truncates to c, so that X c i follows a Bernoulli distribution and any counter can be written as X c = a 2 2 4n/3 i=1 X c

i . Now we have to discriminate between the distributions of the good and bad counters:

Good case c = T (S):

Pr(X

T (S) i = 1) = (2 n/3 -1)/2 n = 2 -2n/3 -2 -n =⇒ E[X T (S) ] = 2 2n/3 a 2 -2 n/3 a 2 Bad case c = T (S): Pr(X c i = 1) = (2 n/3 )/2 n = 2 -2n/3 =⇒ E[X c ] = 2 2n/3 a 2
Now we are interested by the probability that a bad counter gets a value below E[X T (S) ] as a measure of how distinct the distributions are. Using Chernov Bound we get for all c = T (S):

Pr(X c < E[X T (S) ]) = Pr(X c < (1 -2 -n/3 )2 2n/3 a 2 ) = Pr(X c < (1 -2 -n/3 )E[X c ]) ≤ e -((2 -n/3 ) 2 •2 2n/3 a 2 )/2) = e -a 2 /2
And to compute the probability that no bad counter gets below E[X T (S) ] we will have to assume their independence, which is wrong, but we will come back later to discuss this assumption.

18

Pr(∀c = T (S) : X

c ≥ E[X T (S) ]) = c =T (S) 1 -Pr(X c < E[X T (S) ]) ≥ 1 -e -a 2 /2 2 2n/3
To conclude, we need to find an a = a(n) such that this probability remains greater than some positive value as n grows. This is clearly achieved with a = O( √ n) as for example taking a =

2 √ n √ 3•log 2 (e)
0.96 √ n we get:

Pr(∀c = T (S) : X c ≥ E[X T (S) ]) ≥ (1 -e -a 2 /2 ) 2 2n/3 ≥ (1 -2 -2n/3 ) 2 2n/3 ≥ 0.25, ∀n ≥ 3/2
Therefore we can bound the probability of success by the events 'X T (S) < E[X T (S) ]', probability 1/2, and '∀c = T (S) : X c ≥ E[X T (S) ]', probability at least 1/4. Then we indeed have a probability of at least 1/8 of having a successful algorithm. We can conclude that with O(n • 2 4n/3 ) XORed-values the algorithm has probability Ω(1) of succeeding.

Notice that this requires lists of size O( √ n • 2 2n/3 ) but for the proof we only need the total number of pairs between the two lists. So we can break the requirement that the two lists are of comparable sizes as long as the product of their sizes sum up to the order of required values. On the independence of the counters, this is obviously wrong as they are bound by the relation c X c = a 2 2 4n/3 . However this relation becomes looser and looser as n grows so the approximation obtained should still be correct asymptotically. Moreover, the covariances implied are negative i.e. knowing one draw is big makes the other draws smaller in expectation to compensate. Small negative covariances will make the distribution look more evenly distributed in the sense that we can't observe too many extreme events in a particular direction which is good for the success rate of the algorithm. So the assumption of independence may be a conservative one for this complexity analysis.

Simulation results. We ran simulations for block sizes n = 12, 24, 32 and 48 bits, so that we could do some statistical estimations of the success probability for this attack. We first create two lists of same size, one of raw keystream output and one XORed with an n-bit secret S. Then we pass the two lists in algorithm 5 counting over n = 2n/3 bits (unless specified otherwise) to get a list of counters for each possible XOR outputs on those n bits. Then the expected behaviour of the attack would be to look for a solution whose n first bits correspond to the position of the lowest counter and test this hypothesis with algorithm 3. If it returns a unique value then this is S and we are done, if it returns an empty set then test with the position of the second lowest counter, etc. We can therefore know the number of key candidates that would be required to recover S and, over many trials, have an estimation of the probability of success after a given number of candidates in these parameters.

For block sizes of 12 and 24 we simulated a permutation simply by shuffling a range into a list. For bigger sizes of 32 and 48 we used the Simon lightweight cipher from the NSA [3] as that is one of the rare block cipher who can act on 48-bit blocks. We could quickly gather 10 000 runs for each setting except for the 48-bit blocks simulation where we gathered 756 runs.

In general we observe in Figure 6 that the algorithm has a good chance of success with the first few candidates when using the suggested parameters. Moreover the sensibility with respect to the data complexity (Figure 4) and to the number of bits counted over (Figure 5) is fairly high. These results back up our complexity analysis and are a good indication that no big constant is ignored by the O() notation.

On the speed at which the probability increases we realized that, despite the log scale on the x axis, the curves take a straight (Figure 3) or concave shape (Figure 5 6). That means that the probability of success with the next key candidate decreases very quickly with the number of key candidates already tested and proved wrong. For example for n = 48 bits (Figure 6) over 756 trials the right key candidate was in the 2048 lowest counters in 98.1% of the time but the worst case found was 1 313 576 and these "very bad" cases push the mean rank of the right key candidate to 2287 and its sample variance to 2 336 937 008.

For n = 48 bits, one simulation took us 40 minutes over 10 cores (each step is highly parallelizable), and 64 gibibytes of RAM for the counters lists.

About the Known Prefix Sieving Algorithm

We consider two particular settings for the known prefix sieving algorithm and the corresping block splitting attack, with z = n/2 and z = 1.

Theoretical bound. We first give a theoretical lower bound to the probability of success of the sieving when dim(S) = n/2 (i.e. z = n/2), depending on the query complexity. Every partial collision found helps us to sieve. After collecting many blocks of keystream and encryption of S let |A| • |B| =: α2 n for some α. Thus we get α2 n /2 n/2 = α2 n/2 partial collisions in expectation. More precisely, the Chernoff bound gives us a lower bound for the probability of finding at least (1δ)α2 n/2 collisions:

p ≥ 1 - e -δ (1 -δ) (1-δ) α2 n/2
for any δ > 0.

We see one partial collision as a draw in the coupon collector problem. One can use the formula in [34] for the tail of coupon collector problem probability which is positive whenever β ≥ n/2 • ln(2). Therefore we bound the probability of success when collecting |A| • |B| = α2 n pairs as the probability of obtaining at least (1δ)α2 n/2 partial collisions multiplied by the probability of success after sieving (1δ)α2 n/2 values:

p ≥ 1 - e -δ (1 -δ) (1-δ) α2 n/2 • 1 -2 -(1-δ)•α/ ln(2)+n/2
In particular, with two lists of size n/2 • 2 n/2 (i.e. α = n/2), we get p ≥ 0.99 as long as n ≥ 32 (using δ = 2 -8 ). Observed among 3700 simulations. Fig. 7. Probability of success of the known prefix sieving knowing 2 32 encryptions of a 32-bit secret against the number of chunks of 2 32 keystream blocks of size n = 64 bits used.

Simulation results. We ran simulations with a block size n = 64 bits, and a secret S of size n/2 = 32 bits, using the Tiny Encryption Algorithm (TEA [37]) in CTR mode to encrypt the data. We create two lists, the keystream output list a i ∈ A, and the encryptions b j = a j ⊕ (0 S) ∈ B. We first produce and sort a list B with 2 32 elements then produce, sort and sieve iteratively several lists A with 2 32 elements, until the secret S is the only one remaining in the sieve. One simulation runs in around 20 minutes over 36 cores, as every steps are trivially parallelizable: encryption, sorting and sieving. We ran 3700 simulations 22 and tracked how many chunks of 2 n/2 = 2 32 keystream outputs were needed for sieving. The coupon collector problem predicts that one will need on average n/2 • ln(2) • 2 n/2 partial collisions which will be obtained after n/2 • ln(2) 22.18 < 23 rounds in expectation. And indeed the simulations showed a 64.5% probability of success after 23 iterations. Figure 7 shows the convergence between the theoretical lower bound and the simulated probabilities. We also noticed that the discrepancy in the number of rounds required is largely due to the last few candidates remaining in the sieve. If we decided the attack is successful when we are left with less than 1000 potential candidates for the secret then the algorithm successfully finishes after 16 rounds every time. In fact after 16 rounds the number of candidates left varies from 419 to 560 in all the simulations we have run.

Bit by bit secret recovery. We also want to study the complexity of recovering the secret S bit by bit as an extreme case of the block splitting scenario described in Section 4.2. For simplicity, we consider a setting where one query returns a block of keystream and the encryption of 0 s i with an unknown bit s i . We are interested in the query complexity for recovering n bits of secret one bit at a time; that is we need to know the first bit to ask for the second one, etc. Clearly this can be done in O(n • 2 n/2 ) queries by repeating n times the attack on one bit. But the intuition is that we may need less and less queries to uncover the next bit as we go forward and accumulate blocks of keystream.

Let:

U i ←The expected number of encryption of 0 s i to recover s i .

K i ←The expected number of raw keystream outputs to recover s i .

From the definition of a query, the above description and because each time we find a bit of secret we can deduce a range of keystream blocks for the next step we have the relations:

K 1 = U 1 (1)
K i+1 = K i + U i + U i+1 for i ≥ 1 (2)
K i • U i = 2 n (in expectation) (3)
We consider the following proposition:

P i : U i = 2 n/2 ( √ i - √ i -1),
and, using (2), when P k true for all k ≤ i we have:

K i = 2 i-1 k=1 U k + U i = 2 n/2 ( √ i + √ i -1).
Moreover (1) and (3) imply K 1 = U 1 = 2 n/2 so P 1 is true. Now suppose P k true for all k ≤ i, let's prove it holds for P i+1 :

K i+1 • U i+1 = 2 n by (3) =⇒ U 2 i+1 + (K i + U i ) • U i+1 -2 n = 0 by (2) =⇒ U 2 i+1 + 2 n/2 • 2 √ i • U i+1 -2 n = 0 by P i =⇒ U i+1 = 2 n/2 ( √ i + 1 - √ i) as U i+1 ≥ 0 =⇒ P i+1 is true.
Now that we have a closed form for U i we can deduce the expected number of queries needed to recover n bits of secret by summing over as

n i=1 U i = 2 n/2 √ n. Therefore the query complexity is really O( √ n • 2 n/2
) ignoring a constant depending on the length of a query. Notice that this complexity is the same as when sieving S as a whole showing that we don't grow the query complexity by more than a constant with this strategy.

Conclusion

In this work, we have studied the missing difference problem and its relation to the security of the CTR mode. We have given efficient algorithms for the missing difference problem in two practically relevant cases: with an arbitrary missing difference, and when the missing difference is known to be in some low-dimension vector space. These algorithms lead to a message-recovery attack against the CTR mode with complexity Õ(2 n/2 ), and a universal forgery attack against some Carter-Wegman MACs with complexity Õ(2 2n/3 ).

In particular, we show that message-recovery attacks against the CTR mode can be mounted with roughly the same requirements and the same complexity as attacks against the CBC mode. While both modes have similar security proofs, there was a folklore assumption that the security loss of the CTR mode with large amounts of data is slower than in the CBC mode, because the absence of collision in the CTR keystream is harder to exploit than CBC collisions [15, Section 4.8.2]. Our results show that this is baseless, and use of the CTR mode with 64-bit block ciphers should be considered unsafe (unless strict data limits are in place). As a counter-measure, we recommend to use larger block sizes, and to rekey well before 2 n/2 blocks of data. Concrete guidelines for 128-bit block ciphers have been given by Luykx and Paterson [26]. Alternatively, if the use of small block is required, we suggest using a mode with provable security beyond the birthday bound, such as CENC [21,22].

Our missing difference attacks against CTR and the collision attacks against CBC are two different possible failure of block cipher modes beyond the birthday bound. They exploit different properties of the modes but result in similar attacks. These techniques can be used against other modes of operations (OFB, CFB, . . . ), and most of them will be vulnerable to at least one the attacks, unless they have been specially designed to provide security beyond the birthday bound.

Introduction

Message authentication codes (or MACs) ensure the authenticity of messages in the secret-key setting. They are a core element of real-world security protocols such as TLS, SSH, or IPSEC. A MAC takes a message (and optionally a nonce) and a secret key to generate a tag that is sent with the message. Traditionally, they are classified into three types: deterministic, nonce-based, and probabilistic.

Deterministic MAC designs are the most popular, with widely used constructions based on block-cipher (CBC-MAC [13,4], OMAC [18], PMAC [5], LightMAC [29], . . . ) and hash functions (HMAC [2], NMAC [2], NI-MAC [1], . . . ). However, there is a generic forgery attack against all deterministic iterated MACs, using collisions in 1 370

Symmetric Cryptanalysis Beyond Primitives the internal state, due to Preneel and van Oorschot [37]. Therefore, these MACs only achieve security up to the birthday bound, i.e. when the number of queries by the adversary is bounded by 2 n/2 , with n the state size. This is equivalently called n/2-bit security. One way to increase the security is to use a nonce, a unique value provided by the user (in practice, the nonce is usually a counter). This approach has been pioneered by Wegman and Carter [41] based on an earlier work by Gilbert et al. [15]. Later a few follow ups like EDM and EWCDM [7], and Dual EDM [30] have been proposed to achieve beyond birthday security.

Alternatively, a probabilistic MAC uses a random coin for the extra value, which is usually called a salt, and must be transmitted with the MAC. Probabilistic MACs have the advantage that they can stay secure when called with the same input twice, and don't require a state to keep the nonce unique. Some popular probabilistic MAC constructions are XMACR [3], RMAC [22] and EHtM [31]. In particular, RMAC and EHtM have security beyond the birthday bound.

However, deterministic MACs are easier to use in practice, and there has been an important research effort to build deterministic MAC with security beyond the birthday bound, using an internal state larger than the primitive size. In particular, several constructions use a 2n-bit internal state so that collisions in the state are only expected after 2 n queries. Yasuda first proposed SUM-ECBC [42], a beyond birthday bound (BBB) secure deterministic MAC that achieves 2n/3bit security. However, this construction has rate 1/2 and later Yasuda himself proposed one of the most popular BBB secure MAC PMAC+ [43] achieving rate 1. Later several other constructions like 3kf9 [44], LightMAC+ [33], GCM-SIV2 [20], and single key PMAC+ [9] have been proposed. Interestingly, all the above designs share a common structure: a double-block universal hash function outputs a 2nbit hash value (seen as two n-bit halves), and a finalization function generates the tag by XORing encrypted values of the two n-bit hash values. This structure has been called double-block-hash-then-sum, and it will be the focus of our paper.

More recently, variants of PMAC+ based on tweakable block-cipher have also been proposed, such as PMAC_TBC [32], PMACx [27], ZMAC [21], and ZMAC+ [28].

Our results. We focus on the security of deterministic block-cipher based MACs with security beyond the birthday bound and double-block hash construction. Several previous works have been focused on security proofs, showing that they are secure up to 2 2n/3 queries [43,44,20,9,42,33]. For most of these constructions, the advantage of an adversary making q short queries is bounded by O(q 3 /2 2n ). Recently, Naito [34] gave an improved security proof for LighMAC+, with advantage at most O(q 2 t q v /2 2n ), with q t MAC queries and q v verification queries. In particular, this would prove security up to 2 n when the adversary can only do a single verification query.

In this work, we take the opposite approach and look for generic attacks against these modes. We use a cryptanalysis technique that can be seen as a generalisation of the collision attack of Preneel and van Oorschot [37]. Instead of looking for a pair of messages so that the full state collides, we look for a quadruple of messages, which can be seen either as two pairs colliding on the first Table 1. Summary of the security for studied modes and our main results. q is the number of queries, is maximum size of a query, σ is total number of processed blocks. The expected lower bound and attack complexity is in number of constant length queries ( = O(1)). We use "U" for universal forgeries, and "E" for existential forgeries.

Mode

Provable security bounds Attacks (this work)

Advantage

Queries Queries Time Type

SUM-ECBC [42] O( q 3 3 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) U O(2 6n/7 ) Õ(2 6n/7 ) U GCM-SIV2 [20] O( q 3 2 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) U O(2 6n/7 ) Õ(2 6n/7 ) U PMAC+ [43] O( q 3 3 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E LightMAC+ [33] O( q 3 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E 1kPMAC+ [9] O( σ 2 n + qσ 2 2 2n ) Ω(2 2n/3 ) O(2 3n/4 ) Õ(2 3n/2 ) E 3kf9 [44] O( q 3 3 2 2n + q 2 n ) Ω(2 2n/3 ) O( 4 √ n • 2 3n/4 ) Õ(2 5n/4 ) U 1kf9 [8] O( q 2 2 n + q 3 4 2 2n + q 4 4 2 3n + q 4 6 2 4n ) Ω(2 2n/3 ) O(2 n/2 ) Õ(2 n/2 ) U
half of the state, or two pairs colliding on the second half. Since the finalization function combines the halves with a sum, we can detect such a quadruple because the corresponding MACs sum to zero, and can usually amplify this filtering. Moreover, when the message are well constructed, the relations defining the four collisions create a linear system of rank only three, so that we expect one good quadruple out of 2 3n . Therefore, we only need four lists of 2 3n/4 queries, and we expect one good quadruple out of the 2 3n choices in the four lists.

Table 1 shows a summary of our main results and how they compare with their respective provable security claims. In particular, we have forgeries attacks with O(2 3n/4 ) MAC queries against SUM-ECBC, GCM-SIV2, PMAC+, LightMAC+, 1kPMAC+, and 3kf9. As far as we know, these are the first attacks with less than 2 n queries against these constructions. Our attack against LighMAC+ contradicts the recent security bound for LighMAC+ [34], because we have an attack with O(2 3n/4 ) MAC queries, and a single verification query. The other attacks do not contradict the security proofs, but they make an important step towards understanding the actually security of these modes: we now have a lower bound of 2 2n/3 queries from the proofs, and an upper bound of 2 3n/4 from our attacks.

The attacks have a complexity of 2 3n/4 in the information theoretic model (the model used for most MAC security proofs), but we note that an attacker needs more than 2 n operations to create a forgery. However, we have found a variant of our attack against SUM-ECBC and GCM-SIV2 with total complexity below 2 n , using O(2 6n/7 ) queries and Õ(2 6n/7 ) operations.

We have also found an attack with only O(2 n/2 ) queries and Õ(2 n/2 ) operations against 1kf9 [8], a single key variant of 3kf9 with claimed security up to 2 2n/3 queries. 1kf9 has been withdrawn due to issues with its security proof, but no attack was known previously.

Related works.

There has been extensive work on security proofs for modes of operations, with a recent focus on security beyond the birthday bound. An interesting example is the encryption mode CENC by Iwata [17]: the initial proof was only up to 2 2n/3 queries, but a later proof showed that it actually remains secure close to 2 n queries [19]. Our results show that in the case of double-blockhash-then-sum MACs, the security is lower than n-bit security.

Similarly, the initial proof of the randomized MAC EHtM only gave security up to 2 2n/3 , but a later proof showed security up to 2 3n/4 [11]. This result also includes a matching attack, using a technique similar to ours based on looking for quadruples. However in the case of EHtM the attacker can observe part of the state, which allows him to find a right quadruple in O(2 3n/4 ) time and memory. In our case we can't observe the internal state at all, thus we need to use different tricks tailored to each construction in order to amplify the filtering and avoid the many false-positives. In particular, this significantly increases the time and memory complexity.

There has also been intensive work on generic attacks to complement the security proof results. After the generic collision attack of Preneel and van Oorschot [37], more advanced attacks against MACs have been described, with stronger outcomes than existential forgeries, starting with a key-recovery attack against the envelop MAC by the same authors [38]. In particular, a series of attacks against hash-based MACs [26,36,16,10] led to universal forgery attacks against long challenges, and key-recovery attacks when the hash function has an internal checksum (like the GOST family). Against PMAC, Lee et al. showed a universal forgery attack in 2006 [25]. Later, Fuhr, Leurent and Suder gave a key-recovery attack against the PMAC variant used in AEZv3 [14]. Issues with GCM authentication with truncated tags were also pointed out by Ferguson [12]. These attacks don't contradict the security proofs of the schemes, but they are important results to understand the security degradation after the birthday bound.

Organization of the paper. We first explain our attack technique using quadruples of messages in Section 2, and give three concrete attacks using this technique: an attack against SUM-ECBC and GCM-SIV2 in Section 3, an attack against PMAC+ and related constructions in Section 4, and an attack against 3kf9 in Section 5. Finally, we show a variant of the technique using special properties of the single-key constructions of [8,9] in Section 6.

Notations. We denote the concatenation of messages blocks x and y as x y. When x and y fit together in one block, we use x|y to denote their concatenation. We use L[i] to denote element i of list L, x [i] to denote bit i of x, and x [i:j] to denote bits i to j -1. Finally, we use a curly brace for systems of equations.

Generic Attack against double-block-hash MACs

We first explain our attacks in a generic way, and leave the specific details to later sections focused on concrete MAC constructions.

We consider MACs where the 2n-bit internal state is divided in two n-bit parts, that we denote Σ and Θ, and the final MAC is computed as:

MAC(M ) = E Σ(M ) ⊕ E Θ(M ) ,
where E and E denote the block cipher with potentially different keys. The functions Σ and Θ can be seen as two n-bit universal hash functions computed on the message, hence the name double-block-hash-then-sum MAC.

Our attacks exploit the fact that the two halves are combined with a sum, where one side depends only on Σ, and the other side depends only on Θ. They do not seem applicable to constructions with more intricate finalization functions, such as LightMAC+2 [33], or the tweakable block-cipher based constructions PMAC_TBC [32], PMACx [27], ZMAC [21], or ZMAC+ [28].

Using Quadruples

Our strategy consists in looking for a quadruple of messages (X, Y, Z, T ) such that pairs of values collide for one half of the state. More precisely, we look for quadruples satisfying a relation R(X, Y, Z, T ) defined as:

R(X, Y, Z, T ) :=          Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T ) Θ(T ) = Θ(X)
In particular, since the MAC is computed as MAC(M ) = E Σ(M ) ⊕E Θ(M ) , it follows that: R(X, Y, Z, T ) =⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0.

(1)

In addition, if the messages X, Y, Z, T are well constructed, the relation R reduces to a linear system of rank only three, i.e.

Σ(X) = Σ(Y ) and Θ(Y ) = Θ(Z) and Σ(Z) = Σ(T ) =⇒ Θ(T ) = Θ(X).
Therefore, we expect to find one quadruple satisfying the relation out of 2 3n , and we can construct 2 3n quadruples with just 4 × 2 3n/4 queries. This gives an attack with data complexity O(2 3n/4 ).

In practice, we consider lists of 2 3n/4 messages, generated with two message injection functions φ and ψ. These functions are different in every attack, but they mostly correspond to adding two distinct prefixes, as in the following example:

φ(i) = 0 i ψ(i) = 1 i X = φ(x) = 0 x Y = ψ(y) = 1 y Z = φ(z) = 0 z T = ψ(t) = 1 t,
In particular, the pairs (X, Y ), (Y, Z), (Z, T ) and (T, X) that we consider always contain a message built with φ and message built with ψ. Therefore, we will have the required collisions in Σ or Θ if the difference introduced in the half-state by the second block cancels the difference found after processing the first block. This type of attack has some similarities with a higher order differential attack. Indeed, in the easiest case (e. g. our attack against SUM-ECBC), the relation R can be written as R(x, y, z, t) ⇐⇒ x⊕y = z⊕t = ∆ 1 and x⊕t = y⊕z = ∆ 3 for some secret values ∆ 1 and ∆ 3 . This idea of looking for quadruples is also very similar to the attack on EHtM [11], but the full attack will turn out quite different. Indeed, in the case of EHtM, the attacker can observe the salt R which represent half of the 2n-bit internal state. Here this would be the equivalent of observing Σ(m) for all processed messages m. This is clearly not possible for the studied constructions and we need something more to discriminate and find a good quadruple that satisfies R.

Detecting Quadruples: Generalized Birthday Algorithms

To finish the attack we usually need to locate one good quadruple. The relation MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0 in itself is too weak because we expect one quadruple out of 2 n to satisfy it randomly, but we can usually amplify the filtering using related quadruples that satisfy R simultaneously (the exact details depend on the MAC construction).

In most of our attacks, we can express the search for a quadruple as an instance of the 4-sum problem, and solve it using variants of Wagner's generalized birthday algorithm [40]. This reduces the time complexity of the attacks (compared to a naive search), and provides trade-offs between the query, memory and time complexities.

More precisely, our problem can be stated as follow:

Definition 1 (4-sum problem). Given four lists L 1 , L 2 , L 3 , L 4 of 2 s elements, with on average 2 p quadruples (x, y, z, t)

∈ L 1 × L 2 × L 3 × L 4 such that x ⊕ y ⊕ z ⊕ t = 0, find one of them.
Note that if the lists contain random n-bit words, we expect to have 2 p = 2 4s-n solutions, but in some of our instances there are more solutions because of the structure of the lists. We denote the join operator as ; it computes the pairwise sum of two lists, and keeps the initial values attached to the sum. In addition, the join operator with filtering α t only keeps values such that the t least significant bits of the sum agree with the value α:

A B = {(a ⊕ b, a, b) : (a, b) ∈ A × B} A α t B = (a ⊕ b, a, b) : (a, b) ∈ A × B, a [0:t] ⊕ b [0:t] = α
In particular, we have = 0 0 . We also denote as ∞ the joint operator with filtering over the full input values. The filtered joint operator is the basis of Wagner's algorithm, and it can be computed in almost linear time by sorting the two input lists, and stepping through them simultaneously.

1 L 2 L 3 L 4 α s L α 12 α s L α 34 ∞ for α ∈ {0, 1} s do L α 12 ← L 1 α s L 2 L α 34 ← L 3 α s L 4 L ← L α 12 ∞ L α 34 if L = ∅ then (0, (x, y), (z, t)) ← L[0]
return (x, y, z, t) end if end for return ⊥ Fig. 1. Generalized Birthday algorithm to find good quadruples.

Direct algorithm. While a naive algorithm for our 4-sum instances would take time 2 4s to examine all quadruples, there is a simple improvement with time and memory Õ(2 2s ). First, the attacker builds L 12 = L 1 L 2 and L 34 = L 3 L 4 . Then, he looks for a collision between the first component of L 12 and L 34 . A collision directly yields a solution. This always finds a solution if it exists in Õ(2 2s ) operations but it also takes O(2 2s ) memory.

Memory efficient algorithm.

We can reduce the memory complexity of the algorithm if we avoid constructing the full lists L 12 and L 34 . An algorithm with low memory complexity was first described by Chose et al. [6], but we use the description given by Wagner in the full version of [40].

Instead of building the full lists L 12 and L 34 , we filter values such that s least significant bits differ by some fixed value α. This reduces the expected size of the lists to only 2

s : E[|L α 34 |] = E[|L α 12 |] = |L 1 | • |L 2 |/2 s = 2 s
. If this algorithm is repeated for every s-bit value α, it will eventually find all solutions.

Actually, one run of the algorithm detects the solutions whose least significant bits of x ⊕ y are equal to α. If there are 2 p solutions in total, there is one such solution with probability 2 p-s , and this algorithm will find the first solution after trying 2 s-p values of α on average. Therefore, the expected time complexity of the algorithm given by Figure 1 is only Õ(2 2s-p ).

Related work.

In a 2016 work, Nikolic and Sasaki [35] investigate the 4-sum where we need to find 4 different inputs x, y, z, t to a function f such that f (x)⊕f (y)⊕f (z)⊕f (t) = 0. They also mention that their algorithm is adaptable to pairwise identical functions, i. e. f (x) ⊕ g(y) ⊕ f (z) ⊕ g(t) = 0.

Most of our attacks can be written in this way; concretely, they are equivalent to instances of random functions with 3n-bit outputs. In this setting our algorithm takes time Õ(2 3n/2 ) and memory O(2 3n/4 ), while Nikolic and Sasaki's work can reach Õ(2 9n/8 ) time and O(2 3n/4 ) memory. Unfortunately, their algorithm requires Õ(2 9n/8 ) queries to the functions; this would translate to Õ(2 9n/8 ) queries to the MAC, which is not interesting in our context.

1 E 1 m 1 E 3 m 2 E 1 m 2 E 3 m -1 E 1 ... m -1 E 3 ... m E 1 m E 3 E 2 E 4 MAC(m) Σ Θ Fig. 2.
Diagram for SUM-ECBC with a -block message.

Attacking SUM-ECBC-like constructions

We start with attacks against SUM-ECBC [42] and GCM-SIV2 [20]; while the constructions are quite different, they have a similar structure and the same attacks can be used in both cases. We give a universal forgery attack with O(2 3n/4 ) queries and Õ(2 3n/2 ) operations (using memory O(2 3n/4 )), and a variant with total complexity below 2 n , with O(2 6n/7 ) queries and Õ(2 6n/7 ) operations.

Attacking SUM-ECBC

SUM-ECBC was designed by Yasuda in 2010 [42], inspired by MAC constructions summing two CBC-MACs in the ISO 9797-1 standard. The scheme uses a block cipher keyed with four independent keys, denoted as E 1 , E 2 , E 3 , E 4 . The message M is first padded with 10 * padding, and divided into n-bit blocks. In the following we ignore the padding and consider the padded message as the input: this makes our description easier, and any padded message whose last block is non-zero can be "un-padded" to generate a valid input message. The construction is defined as follows (see also Figure 2):

Σ(M ) = σ σ 0 = 0 σ i = E 1 (σ i-1 ⊕ m i ) Θ(M ) = θ θ 0 = 0 θ i = E 3 (θ i-1 ⊕ m i ) MAC(M ) = E 2 (Σ(M )) ⊕ E 4 (Θ(M ))
Attack. Following the framework of Section 2, we consider quadruple of messages, built with two message injection functions:

φ(i) = 0 i ψ(i) = 1 i
In particular, we have

MAC(φ(i)) = E 2 E 1 i ⊕ E 1 (0) Σ 0 (i) ⊕ E 4 E 3 i ⊕ E 3 (0) Θ 0 (i) MAC(ψ(i)) = E 2 E 1 i ⊕ E 1 (1) Σ 1 (i) ⊕ E 4 E 3 i ⊕ E 3 (1) Θ 1 (i)
Next, we build quadruples of messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t),
and we look for a quadruple with partial state collisions for the underlying pairs, i. e. a quadruple following the relation:

R(x, y, z, t) :=          Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). We have R(x, y, z, t) ⇔          x ⊕ E 1 (0) = y ⊕ E 1 (1) z ⊕ E 3 (0) = y ⊕ E 3 (1) z ⊕ E 1 (0) = t ⊕ E 1 (1) x ⊕ E 3 (0) = t ⊕ E 3 (1) ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = E 1 (0) ⊕ E 1 (1) x ⊕ t = E 3 (0) ⊕ E 3 (1)
As promised in Section 2, R defines a 3n-bit relation. We can easily observe when x ⊕ y ⊕ z ⊕ t = 0, and we can also detect the relation on the sum of the MACs following Equation (1): R(x, y, z, t) ⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0 Moreover, we observe that R(x, y, z, t) is satisfied if and only if R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) is satisfied for any constant c. We use this relation to build several quadruples that satisfy R simultaneously:

R(x, y, z, t) ⇐⇒ ∀c, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) (2)
This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 2 3n/4 values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T with:

     x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0 MAC(φ(x ⊕ 1)) ⊕ MAC(ψ(y ⊕ 1)) ⊕ MAC(φ(z ⊕ 1)) ⊕ MAC(ψ(t ⊕ 1)) = 0. (3)
Because we need a fair distribution of values x ⊕ y and x ⊕ t to find the good quadruple we build the sets as:

X = x ∈ {0, 1} n : x [0:n/4] = 0 Y = x ∈ {0, 1} n : x [n/4:n/2] = 0 Z = x ∈ {0, 1} n : x [n/2:3n/4] = 0 T = x ∈ {0, 1} n : x [3n/4:n] = 0
With this construction, there is exactly one quadruple (x, y, z, t) ∈ X ×Y ×Z ×T that respects R, given by:

x = v 1 |w 2 |u 3 |0 y = w 1 |v 2 |0|u 4 z = u 1 |0|v 3 |w 4 t = 0|u 2 |w 3 |v 4 ,
where:

E 1 (0) ⊕ E 1 (1) =: u 1 |u 2 |u 3 |u 4 E 3 (0) ⊕ E 3 (1) =: v 1 |v 2 |v 3 |v 4 E 1 (0) ⊕ E 1 (1) ⊕ E 3 (0) ⊕ E 3 (1) =: w 1 |w 2 |w 3 |w 4 .
We expect on average one random quadruple satisfying (3) (with 2 3n potential quadruples, and a 3n-bit filtering), in addition to the quadruple satisfying R.

The correct quadruple can easily be checked with a few extra queries.

In practice, we use the generalized birthday algorithms of Section 2.2 in order to optimize the complexity of the attack. We consider four lists:

L 1 = {x MAC(φ(x)) MAC(φ(x ⊕ 1)) : x ∈ X } L 2 = {y MAC(ψ(y)) MAC(ψ(y ⊕ 1)) : y ∈ Y} L 3 = {z MAC(φ(z)) MAC(φ(z ⊕ 1)) : z ∈ Z} L 4 = { t MAC(ψ( t )) MAC(ψ( t ⊕ 1)) : t ∈ T }
Notice that we can build those lists with 5 • 2 3n/4 queries as, by construction, for any element i of Y, Z, T the element (i ⊕ 1) also belongs to Y, Z, T , respectively. We use the algorithm of Section 2.2 to find (x, y, z

, t) ∈ X × Y × Z × T such that L 1 [x] ⊕ L 2 [y] ⊕ L 3 [z] ⊕ L 4 [t] = 0 with Õ(2 3n/2
) operations, using a memory of size O(2 3n/4 ). After finding a collision, we verify that it is not a false positive by testing the relation for another value c. As there are on average O(1) random quadruples the attack is indeed using a total of 5 • 2 3n/4 + O(1) = O(2 3n/4 ) queries.

Universal Forgeries. This attack can be extended to a universal forgery. Indeed, the fixed prefix 0 and 1 can be replaced by v and v ⊕ 1 for any block v, and when we identify a right quadruple (x, y, z, t) we deduce the value

∆ 1 = E 1 (v) ⊕ E 1 (v ⊕ 1) and ∆ 3 = E 3 (v) ⊕ E 3 (v ⊕ 1). There is also a length extension property: if (x, y, z, t) is a right quadruple, then MAC(v x s) ⊕ MAC(v ⊕ 1 y s) ⊕ MAC(v z s) ⊕ MAC(v ⊕ 1 t s) = 0 for any suffix s.
Therefore if we want to forge a MAC for any message m of size ≥ 2 blocks we parse it as m = v w s (where s has zero, one, or several blocks) and perform the attack to recover ∆ 1 and ∆ 3 . Then we can forge using the previous relation, and Equation (2):

MAC(v w s) = MAC(v ⊕ 1 w ⊕ ∆ 1 s) ⊕ MAC(v w ⊕ ∆ 3 s) ⊕ MAC(v ⊕ 1 w ⊕ ∆ 1 ⊕ ∆ 3 s)
Optimizing the time complexity. Equation ( 2) can also be used to reduce the time complexity below 2 n , at the cost of more oracle queries. Indeed, if we consider a subset C of {0, 1} n , we have:

R(x, y, z, t) ⇔ ∀c ∈ C, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) ⇒ ∀c ∈ C, MAC(φ(x ⊕ c)) ⊕ MAC(ψ(y ⊕ c)) ⊕ MAC(φ(z ⊕ c)) ⊕ MAC(ψ(t ⊕ c)) = 0 ⇒ c∈C MAC(φ(x ⊕ c)) ⊕ c∈C MAC(ψ(y ⊕ c)) ⊕ c∈C MAC(φ(z ⊕ c)) ⊕ c∈C MAC(ψ(t ⊕ c)) = 0 (4)
If we select C as a linear subspace, then the last expression does not depend on the full (x, y, z, t), but only on their projection on the orthogonal of C. Concretely, we use C = x : x [3n/7:n] = 0 = x : x < 2 3n/7 , so that the value c∈C MAC(φ(x ⊕ c)) is independent of bits 0 to 3n/7 -1 of x. Therefore, we consider the rewritten MAC function MAC (v w) = c∈C MAC(v w ⊕ c), the following message injections, with a 4n/7-bit input

φ (i) = 0 i|0 ψ (i) = 1 i|0,
and a reduced relation over 4n/7-bit values:

R (x, y, z, t) :=          x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] y ⊕ z = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] z ⊕ t = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] t ⊕ x = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] x ⊕ t = (E 3 (0) ⊕ E 3 ( 1
)) [3n/7:n] Thanks to Equation 4, we still have:

R (x, y, z, t) ⇒ MAC (φ (x)) ⊕ MAC (ψ (y)) ⊕ MAC (φ (z)) ⊕ MAC (ψ (t)) = 0
Since the relation R is now only a 12n/7-bit condition, we can use shorter lists than before, with just 2 3n/7 elements. We can also increase the filtering using the same trick as previously, considering the following lists:

L 1 = x MAC (φ (x)) MAC (φ (x ⊕ 1)) : x ∈ {0, 1} 4n/7 , x [0:n/7] = 0 L 2 = y MAC (ψ (y)) MAC (ψ (y ⊕ 1)) : y ∈ {0, 1} 4n/7 , y [n/7:2n/7] = 0 L 3 = z MAC (φ (z)) MAC (φ (z ⊕ 1)) : z ∈ {0, 1} 4n/7 , z [2n/7:3n/7] = 0 L 4 = t MAC (ψ ( t )) MAC (ψ ( t ⊕ 1)) : t ∈ {0, 1} 4n/7 , t [3n/7:4n/7] = 0
Finally, using the algorithm of Section 2.2 with s = 3n/7 and p = 0, we can locate a right quadruple using Õ(2 6n/7 ) queries, Õ(2 6n/7 ) operations, and O(2 3n/7 ) memory. This recovers only 4n/7 bits of E 1 (0) ⊕ E 1 (1) and E 3 (0) ⊕ E 3 (1), but we can easily recover the remaining bits, either by brute force, or by repeating the attack with a different set C.

Attacking GCM-SIV2

GCM-SIV2 is an authenticated encryption mode designed by Iwata and Minematsu [20] as a double-block-hash version of GCM-SIV (in the following, we consider GCM-SIV2 with GHASH as the underlying universal hash function). For simplicity, we focus on the authentication part of GCM-SIV2, using inputs with a non-empty associated data, and an empty message. In this case, GCM-SIV2 becomes a nonce-based MAC. The message M (considered as associated data for the mode) is zero-padded, divided into n-bit blocks, and the length is appended in an extra block. Then the construction is defined as follows, with a finite field multiplication (see also Figure 3):

Σ(N, M ) = N ⊕ H 1 ⊕ i=1 m i H +2-i 1 Θ(N, M ) = N ⊕ H 2 ⊕ i=1 m i H +2-i 2 MAC(N, M ) = E 1 (Σ(M )) ⊕ E 2 (Θ(M )) E 3 (Σ(M )) ⊕ E 4 (Θ(M ))
Attack. The structure of the authentication part of GCM-SIV2 is essentially the same as the structure of SUM-ECBC, where the block cipher calls E 1 and E 3 are replaced by multiplication by H 1 and H 2 . The finalization function has a 2n-bit output MAC 1 , MAC 2 , but quadruples following R will collide on both outputs. Thus, we can essentially repeat the SUM-ECBC attack, but there is an important difference: GCM-SIV2 is a nonce-based MAC, rather than a deterministic one. Therefore, all queries must include a nonce N , and we should not query two different messages with the same nonce. We adapt the previous attack using message injection functions that output both a nonce and a message, so that we use two fixed messages, 0 and 1, with variable nonces:

φ(i) = (i, 0) ψ(i) = (i, 1) m 1 m 2 ... m N ... ... H 1 H 2 H 1 H 2 H 1 H 2 H 1 H 2 E 1 E 3 E 2 E 4 Σ Θ MAC 1 (m) MAC 2 (m)
Fig. 3. Diagram for authentication in GCM-SIV2 using GHASH with a -block message, a nonce N , hash keys H 1 and H 2 .

MAC(φ(

i)) = E 1 i ⊕ H 1 Σ 0 (i) ⊕ E 2 i ⊕ H 2 Θ 0 (i) E 3 Σ 0 (i) ⊕ E 4 Θ 0 (i) MAC(ψ(i)) = E 1 i ⊕ H 1 ⊕ H 2 1 Σ 1 (i) ⊕ E 2 i ⊕ H 2 ⊕ H 2 2 Θ 1 (i) E 3 Σ 1 (i) ⊕ E 4 Θ 1 (i) .
We consider quadruples of nonce/messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t),
and we have the same kind of relations as in the previous attack:

R(x, y, z, t) :=          Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = H 2 1 x ⊕ t = H 2 2 ⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0
Since the MAC output is 2n-bit long, we can directly build an attack with O(2 3n/4 ) queries: we consider four distinct sets X , Y, Z, T of 2 3n/4 values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T , such that

x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0 (5)
we expect to find one good quadruple that respects R along with O(1) quadruples that randomly satisfy the observable filter (5). This leads to an attack with O(2 3n/4 ) queries and time Õ(2 3n/2 ). Since we recover H 1 and H 2 (from H 2 1 = x ⊕ y and H 2 2 = x ⊕ t), we can do universal forgeries. In addition, we can also easily adapt the attack with O(2 6n/7 ) queries and time Õ(2 6n/7 ).

Attacking PMAC-like constructions

We now describe attacks against PMAC+ [43] and related constructions: 1kMAC+ [9], and LightMAC+ [33]. We have an existential forgery attack with O(2 3n/4 ) queries and Õ(2 3n/2 ) operations (using memory O(2 3n/4 )), with a range of time-memory trade-offs with O(2 t ) queries, with 3n/4 < t < n, and Õ(2 3n-2t ) operations (using memory O(2 t )).

Attacking PMAC+

PMAC+ was designed by Yasuda in 2011 [43], as a variant of PMAC [5] with a larger internal state. The scheme internally uses a tweakable block cipher construction inspired by the XE construction [39], that we denote as Ẽi . The message M is first padded with 10 * padding, and divided into n-bit blocks, but for simplicity we ignore the padding in our description. The construction is shown in Figure 4 3 :

Σ(M ) = i=1 Ẽi (m i ) Ẽi (x) = E 1 (x ⊕ 2 i ∆ 0 ⊕ 2 2i ∆ 1 ) Θ(M ) = i=1 2 -i Ẽi (m i ) ∆ 0 = E 1 (0) ∆ 1 = E 1 (1) MAC(M ) = E 2 (Σ(M )) ⊕ E 3 (Θ(M ))
Attack. As in the previous attack, we use message injection functions with two different prefixes, but we include an extra block u to define related quadruples:

φ u (i) = u 0 i ψ u (i) = u 1 i MAC(φ u (i)) = E 2 Ẽ1 (u) ⊕ Ẽ2 (0) ⊕ Ẽ3 (i) Σ u,0 (i) ⊕ E 3 4 Ẽ1 (u) ⊕ 2 Ẽ2 (0) ⊕ Ẽ3 (i) Θ u,0 (i) MAC(ψ u (i)) = E 2 Ẽ1 (u) ⊕ Ẽ2 (1) ⊕ Ẽ3 (i) Σ u,1 (i) ⊕ E 3 4 Ẽ1 (u) ⊕ 2 Ẽ2 (1) ⊕ Ẽ3 (i) Θ u,1 (i)
.

Next, we build quadruples of messages X, Y, Z, T with

X = φ u (x) Y = ψ u (y) Z = φ u (z) T = ψ u (t),
and we look for a quadruple with partial state collisions for the underlying pairs, i. e. a quadruple following the relation: We have

R(x, y, z, t) :=          Σ u,0 (x) = Σ u,1 (y) Σ u,0 (z) = Σ u,1 (t) Θ u,0 (z) = Θ u,1 (y) Θ u,0 (x) = Θ u,1 (t). m 1 2 • ∆ 0 2 2 • ∆ 1 E 1 Ẽ1 0 0 2 -1 m 2 2 2 • ∆ 0 2 4 • ∆ 1 E 1 Ẽ2 2 -2 ... ... ... m 2 • ∆ 0 2 2 • ∆ 1 E 1 Ẽ 2 0 E 2 E 3 Σ Θ MAC(m)
R(x, y, z, t) ⇔          Ẽ3 (x) ⊕ Ẽ2 (0) = Ẽ3 (y) ⊕ Ẽ2 (1) Ẽ3 (z) ⊕ Ẽ2 (0) = Ẽ3 (t) ⊕ Ẽ2 (1) Ẽ3 (y) ⊕ 2 Ẽ2 (1) = Ẽ3 (z) ⊕ 2 Ẽ2 (0) Ẽ3 (t) ⊕ 2 Ẽ2 (1) = Ẽ3 (x) ⊕ 2 Ẽ2 (0) ⇔      Ẽ3 (x) ⊕ Ẽ3 (y) ⊕ Ẽ3 (z) ⊕ Ẽ3 (t) = 0 Ẽ3 (x) ⊕ Ẽ3 (y) = Ẽ2 (0) ⊕ Ẽ2 (1) Ẽ3 (t) ⊕ Ẽ3 (x) = 2 Ẽ2 (0) ⊕ 2 Ẽ2 (1)
Again, R defines a 3n-bit relation, and we can detect it through the sum of the MACs following Equation (1):

R(x, y, z, t) ⇒ MAC(φ u (x)) ⊕ MAC(ψ u (y)) ⊕ MAC(φ u (z)) ⊕ MAC(ψ u (t)) = 0
In addition, the relation R is independent of the value u, so that we can easily build several quadruples that satisfy R simultaneously. This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 2 3n/4 random values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T , such that

∀u ∈ {0, 1, 2}, MAC(φ u (x)) ⊕ MAC(ψ u (y)) ⊕ MAC(φ u (z)) ⊕ MAC(ψ u (t)) = 0
We expect on average one random quadruple (with 2 3n potential quadruples, and a 3n-bit filtering), and one quadruple satisfying R (also a 3n-bit condition). The correct quadruple can easily be checked with a few extra queries.

In practice, we use the generalized birthday algorithms of Section 2.2 in order to optimize the complexity of the attack. We consider four lists:

L 1 = {MAC(φ 0 (x)) MAC(φ 1 (x)) MAC(φ 2 (x)) : x ∈ X } L 2 = {MAC(ψ 0 (y)) MAC(ψ 1 (y)) MAC(ψ 2 (y)) : y ∈ Y} L 3 = {MAC(φ 0 (z)) MAC(φ 1 (z)) MAC(φ 2 (z)) : z ∈ Z} L 4 = {MAC(ψ 0 ( t )) MAC(ψ 1 ( t )) MAC(ψ 2 ( t )) : t ∈ T } and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T such that L 1 [x] ⊕ L 2 [y] ⊕ L 3 [z] ⊕ L 4 [t] = 0.
This can be done with Õ(2 3n/2 ) operations, using a memory of size O(2 3n/4 ). Finally, once a quadruple (x, y, z, t) satisfying R(x, y, z, t) has been detected, it can be used to generate forgeries. Indeed, we can predict the MAC of a new message by making three new queries using Equation (1):

∀u, MAC(φ u (x)) = MAC(ψ u (y)) ⊕ MAC(ψ u (z)) ⊕ MAC(φ u (t))
Time-Query Trade-offs. As opposed to the SUM-ECBC attack, we don't have an analogue to Equation ( 2) that can be used to reduce the time complexity. However, the time complexity of the algorithm can be slightly reduced when using more than O(2 3n/4 ) queries. If we consider sets X , Y, Z, T of size 2 t with 3n/4 < t < n, the resulting 4-sum is slightly easier, because there are 2 4t-3n expected solutions. Using the algorithm of section 2.2, this can be solved in time Õ(2 3n-2t ), using a memory of size O(2 t ).

Attacking LightMAC+

LightMAC+ was designed by Naito [33] using ideas from PMAC+ [43] and LightMAC [29]. If we consider it as based on a tweakable block cipher Ẽ, it follows the same structure as PMAC+ (see Figure 5), but Ẽ takes a message block smaller than n bits:

Σ(M ) = i=1 Ẽi (m i ) Ẽi (x) = E 1 (i|x) Θ(M ) = i=1 2 -i Ẽi (m i ) MAC(M ) = E 2 (Σ(M )) ⊕ E 3 (Θ(M ))
Since the structure of LightMAC+ is the same as the structure of PMAC+, we can use the same attack. The only difference from our point of view is that the message blocks are shorter than the block-size. As long as one message block is big enough to fit 2 3n/4 different values, our attack will succeed. This attack violates the improved security proof recently published at CT-RSA [34], with a security bound of O(q 2 t q v /2 2n ) (with q t MAC queries and q v verification queries). Indeed, our attack reaches a constant success probability with q t = O(2 3n/4 ) and q v = 1. We have shared our attack with Naito and he agreed that his proof is flawed.

1 (1) z |0 E 1 0 0 2 -1 Ẽ1 0|m 2 (2) z |0 E 1 2 -2 Ẽ2 ... ... ... 0|m ( ) z |0 E 1 Ẽ E 2 E 3 Σ Θ MAC(m)

Attacking 1kPMAC+

1kPMAC+ is a single-key variant of PMAC+ [43] designed by Datta, Dutta, Nandi, Paul and Zhang [9], shown in Figure 8.

Since the structure of 1kPMAC+ is the same as the structure of PMAC+, we can use the same attack. Alternatively, we can take advantage of the fix functions to mount a more straightforward attack, as shown in Section 6.

Attacking f9-like constructions

Our third attack is applicable to 3kf9 [44] and similar constructions. We have a universal forgery attack with O(2 3n/4 ) queries and Õ(2 5n/4 ) operations using memory O(2 n ), with a possible time-memory trade-offs.

Attacking 3kf9

3kf9 [44], designed by Xhang, Wu, Sui and Wang, is a three-key variant of the f9 mode used in 3G telephony. While the original f9 does not have security beyond the birthday bound [24], 3kf9 is secure up to 2 2n/3 queries. We describe 3kf9 in Figure 6:

Σ(M ) = σ σ 0 = 0 σ i = E 1 (σ i-1 ⊕ m i ) Θ(M ) = i=1 σ i MAC(M ) = E 2 (Σ(M )) ⊕ E 3 (Θ(M ))
Attack. Our attack follows the same structure as the previous attacks. We start with messages of the form:

φ(i) = 0 i ψ(i) = 1 i,
and the corresponding MACs:

MAC(φ(i)) = E 2 E 1 x ⊕ E 1 (0) Σ 0 (x) ⊕ E 3 E 1 x ⊕ E 1 (0) ⊕ E 1 0 Θ 0 (x) MAC(ψ(i)) = E 2 E 1 x ⊕ E 1 (1) Σ 1 (x) ⊕ E 3 E 1 x ⊕ E 1 (1) ⊕ E 1 1 Θ 1 (x)
.

We use quadruples of messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t),
and we look for a quadruple with partial state collisions for the underlying pairs, i. e. a quadruple following the relation:

R(x, y, z, t) :=          Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). ⇔          x ⊕ E 1 (0) = y ⊕ E 1 (1) z ⊕ E 1 (0) = t ⊕ E 1 (1) E 1 (z ⊕ E 1 (0)) ⊕ E 1 (0) = E 1 (y ⊕ E 1 (1)) ⊕ E 1 (1) E 1 (x ⊕ E 1 (0)) ⊕ E 1 (0) = E 1 (t ⊕ E 1 (1)) ⊕ E 1 (1) ⇔      x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = E 1 (0) ⊕ E 1 (1) E 1 (x ⊕ E 1 (0)) ⊕ E 1 (t ⊕ E 1 (1)) = E 1 (0) ⊕ E 1 (1) ⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0.
As in the previous attacks, R defines a 3n-bit relation. Moreover, we can easily observe when x ⊕ y ⊕ z ⊕ t = 0, and the relation x ⊕ y = E 1 (0) ⊕ E 1 (1) can be verified across several quadruples. We don't have related quadruples satisfying R simultaneously as in the previous attacks, but we can use those properties to detect right quadruples. This leads to an attack with Õ(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 4 √ n × 2 3n/4 random values, and we look for quadruples (x, y, z, t) ∈ X × Y × Z × T , such that: Since this a 2n-bit condition, we expect on average n • 2 n quadruples (x, y, z, t) satisfying (6). In order to filter out the right ones, we look at the value x ⊕ y for all these quadruples. While the wrong quadruples should have a random x ⊕ y, the right ones have x ⊕ y = E 1 (0) ⊕ E 1 (1). Therefore, with high probability, the most frequent value for x⊕y is equal to E 1 (0)⊕E 1 (1), and quadruples satisfying this extra relation are right quadruples with probability 1 /2. More precisely, we expect on average n wrong quadruples for each value of x ⊕ y, and n right quadruples with x ⊕ y = E 1 (0) ⊕ E 1 (1).

x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0. ( 6
) m 1 E 1 m 2 E 1 m -1 E 1 ... ... m E 1 E 3 E 2 Σ Θ MAC(m)
Optimizing the time complexity. While the algorithm of Section 2.2 would take time Õ(2 3n/2 ) with Õ(2 3n/4 ) queries, we can reduce the time complexity using sets X , Y, Z, T with some structure. More precisely, we use:

X = Z = x ∈ {0, 1} n : x [0:n/4] = 0 Y = T = x ∈ {0, 1} n : x [n/4:n/2] = 0
so that quadruples can be written as

x =: x 3 |x 2 |x 1 |0 ∈ X y =: y 3 |y 2 |0|y 0 ∈ Y z =: z 3 |z 2 |z 1 |0 ∈ Z t =: t 3 |t 2 |0|t 0 ∈ T .
In particular, right quadruples satisfy x⊕y⊕z ⊕t = 0, therefore x 1 = z 1 , y 0 = t 0 , and

x 3 |x 2 ⊕ z 3 |z 2 = y 3 |y 2 ⊕ t 3 |t 2 .
We use these properties to adapt the algorithm of Section 2.2 and locate the quadruples efficiently. First we guess the n/2-bit value α 3 |α

2 := x 3 |x 2 ⊕ z 3 |z 2 = y 3 |y 2 ⊕ t 3 |t 3 . Then, for each x = x 3 |x 2 |x 1 |0, there is a single candidate z = (x 3 ⊕ α 3 )|(x 2 ⊕ α 2 )|x 1 |0
that could be part of a right quadruple. Similarly, every y = y 3 |y 2 |0|y 0 can be paired with a single t = (y 3 ⊕ α 3 )|(y 2 ⊕ α 2 )|0|y 0 . Therefore, we consider the two following lists:

L 1 = {MAC(φ(x 3 |x 2 |x 1 |0)) ⊕ MAC((x 3 ⊕ α 3 )|(x 2 ⊕ α 2 )|x 1 |0) : x 3 |x 2 |x 1 |0 ∈ X } L 2 = {MAC(φ(y 3 |y 2 |0|y 0 )) ⊕ MAC((y 3 ⊕ α 3 )|(y 2 ⊕ α 2 )|0|y 0 ) : y 3 |y 2 |0|y 0 ∈ Y}
After sorting the lists, we look for matches, and the corresponding quadruples

x, y, z, t are exactly the quadruples satisfying

     x ⊕ y ⊕ z ⊕ t = 0 (x ⊕ z) [n/2:n] = α 3 |α 2 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0. (7)
More precisely, a match We need Õ(2 3n/4 ) operations to generate those quadruples. We repeat this 2 n/2 times to exhaust all n/2-bit values α 3 |α 2 and generate all quadruples satisfying (6). Finally, we use an array to count the number of occurrences of each possible value of x ⊕ y. Each counter receives an average two values, but the counter corresponding to E 1 (0) ⊕ E 1 (1) will receive three values on average. After repeating all the operations O(n) times, with some arbitrary constants in place of the zero bits, the highest counter corresponds to E 1 (0) ⊕ E 1 (1) with high probability, as proved in Section 5.2. This gives an attack with Õ(2 3n/4 ) queries, Õ(2 5n/4 ) operations, and O(2 n ) memory 4 . Time-Memory Trade-offs. We can reduce the memory usage if we store only a subset of the counters, and repeat the whole algorithm until the whole set has been covered. Concretely, we store only the counters with a fixed value for bits [0 : n/8] and [n/4 : 3n/8] of x ⊕ y. Because of the way the lists L 1 and L 2 are constructed, we have actually fixed n/8 bits of y 0 and x 1 , and we can reduce the lists to size 2 5n/8 . Therefore we evaluate 2 3n/4 counters in time Õ(2 n/2 • 2 5n/8 ), using only O(2 3n/4 ) memory. We repeat iteratively over the full counter set, so we need time Õ(2 n/4 • 2 n/2 • 2 5n/8 ) = Õ(2 11n/8 ). More generally, we have a timememory trade-off with time Õ(2 5n/4+t/2 ) and memory O(2 n-t ) for 0 < t < n/4.

L 1 [x] = L 2 [y] suggests z = x ⊕ α 3 |α 2 |0|0
Forgeries. Once we found a quadruple (x, y, z, t) that respects R(x, y, z, t) we know that after processing message φ(x) = 0 x and ψ(t) = 1 t, there is no difference in the Θ part of the state (Θ 0 (x) = Θ 1 (t)). Moreover we have

Θ 0 (x) = Σ 0 (x) ⊕ E 1 (0) and Θ 1 (t) = Σ 1 (x) ⊕ E 1 ( 1
); this implies that there is a difference E 1 (0) ⊕ E 1 (1) = x ⊕ y in the Σ part of the state. Therefore, we can build a full state collision with message 0 x 0 and 1 t x ⊕ y. In particular, the following relation can be used to create forgeries with an arbitrary message m (of any length): MAC(0 x 0 m) = MAC(1 t x ⊕ y m).

Universal Forgeries. We can even forge the tag of an arbitrary message of length at least (2n + 2) blocks with complexity only n + 1 times the complexity of the simple forgery attack. The technique is more advanced and inspired by the multi-collision attack described by Joux [23]. For ease of notation we'll show how to forge the signature for a message starting with 2n + 2 blocks of zero, but this can be trivially adapted for any message. First, we find a quadruple (x 1 , y 1 , z 1 , t 1 ) as before. Then we consider messages 0 0 and 1 x 1 ⊕y 1 . Since x 1 ⊕y 1 = E 1 (0)⊕E 1 (1), we have Σ(0 0) = Σ(1 x 1 ⊕y 1 ), i. e. the Σ part of the state collides. Moreover, we know the difference in the Θ part:

Θ(0 0) ⊕ Θ(1 x 1 ⊕ y 1 ) = x 1 ⊕ y 1 .
More generally, at step i we use message injection functions

φ i (x) = 0 0 . . . 0 ×2(i-1) 0 x ψ i (x) = 0 0 . . . 0 ×2(i-1) 1 x,
to look for a quadruple of messages

X i = φ i (x i ) Y i = ψ i (y i ) Z i = φ i (z i ) T i = ψ i (t i ).
When a right quadruple (x i , y i , z i , t i ) has been identified, we can deduce that the MACs for 0 0 . . . 0 0 0 and 0 0 . . . 0 1 x i ⊕ y i will match on the Σ branch and differ by x i ⊕ y i in their Θ branch. After several iterations, we have actually built a multi-collision: all the messages h 1 h 2 . . . h n h n+1 with h i ∈ {(1 x i ⊕ y i ), (0 0)} collide on the Σ branch. In addition, we also know the difference in the Θ branch for those messages: it is equal to {i : h i =0 0} (x i ⊕ y i ).

After at most n + 1 steps, we can find a non empty subset I ⊆ [1 : n + 1] such that i∈I (x i ⊕ y i ) = 0 by simple linear algebra 5 . This gives a collision on the full state, using messages m 0 = 0 0 . . . 0 (with 2(n + 1) blocks) and h = h 1 h 2 . . . h n h n+1 with h i = 1 x i ⊕ y i if i ∈ I, h i = 0 0 otherwise. Since the full state collides, we have for any message m (of any length): MAC(h m) = MAC(m 0 m).

Detailed Complexity Analysis

We want to prove the claim that one will need to find O(n • 2 n ) quadruples in order to finish the attack on 3kf9 described in Section 5.1. We say the attack finishes when we recover the target value T = E(0) ⊕ E (1).

Assuming that each quadruple we find respects R with probability 1/2 n , we fill a list of counters for every suspected values of T ; a random quadruple gives two random values and a right one gives one value equal to T and one random value. Therefore we sum up the distribution of an observable value x as:

x $ ←-{0, 1} n with probability 1 -1/2 n+1 ←-T with probability 1/2 n+1
Let N be the number of observed values, and X c i represents the indicator that the i th value equals c (following a Bernoulli distribution), so that the counter corresponding to c is X c = N i=1 X c i . Now we have to discriminate between the distributions of X c with c = T , and the distribution of X T :

Pr(X T i = 1) = Pr(x = T ) = (1 -1/2 n+1 )/2 n + 1/2 n+1 = (3/2 -1/2 n+1 )/2 n =⇒ E[X T ] = N (3/2 -1/2 n+1 )/2 n Pr(X c i = 1) = Pr(x = c) = (1 -1/2 n+1 )/2 n =⇒ E[X c ] = N (1 -1/2 n+1 )/2 n =⇒ E[X T ] ≥ 3/2 • E[X c ]
We use the Chernoff bound to get a lower bound on the probability that a given counter is higher than the average value of X T :

Pr(X c ≥ E[X T ]) ≤ P r(X c ≥ 3/2 • E[X c ]) ≤ e -N (1-1/2 n+1 )/2 n+1
and assuming the counters are independent:

P r(X c < E[X T ]) ≥ 1 -e -N (1-1/2 n+1 )/2 n+1 P r(∀c = T : X c < E[X T ]) ≥ (1 -e -N (1-1/2 n+1 )/2 n+1 ) 2 n
This expression will asymptotically converge to a strictly positive constant when e -N (1-1/2 n+1 )/2 n+1 2 -n . Therefore, we use

N n ln(2) • 2 n+1 (1 -1/2 n+1 ) = O(n • 2 n ).
Since we observe 2 values per quadruples, this makes O(n • 2 n ) quadruples. Moreover, the event 'X T ≥ E[X T ]' has a probability close to 0.5, therefore after O(n • 2 n ) quadruples, we indeed have a Ω(1) probability that X T is greater than all of the other counters, which allows to recover the value T . Performing the attack until the end with probability Ω(1) also requires O(n • 2 n ) quadruples.

To get to this result some assumptions have been made, like the independence of the counters, but they all tend to be either conservative or asymptotically true.

Attacking 1kf9

1kf9 is a single-key variant of 3kf9 suggested in [8], and later withdrawn. Since the structure of 1kf9 is the same as the structure of 3kf9, we can use the same attack. However, in the next section, we give an attack with birthday complexity using properties of the fix functions. Zhang [8,9]. The fix functions just fix the least significant bit an n-bit value to zero or one, and are used for domain separation:

Attacks using collision in fix functions

fix0 : x → x [1:n] |0 fix1 : x → x [1:n] |1
Datta et al. used those function to build a single-key variant of PMAC+ called 1kPMAC+ [9], and a single-key variant of 3kf9 called 1kf9 [8], both with security up to 2 2n/3 queries. However, 1kf9 has been withdrawn because of issues in its security proof. In this section, we exploit trivial collisions in the fix functions to build colliding pairs or quadruples more easily:

fix0(x) = fix0(x ⊕ 1) fix1(x) = fix1(x ⊕ 1)
This allows a more straightforward attack against 1kPMAC+ with the same complexity as the attacks in Section 4, and an attack against 1kf9 [8] with birthday complexity, violating its security claims.

Attacking 1kf9

The 1kf9 mode uses the fix function for domain separation to build a single-key variant of 3kf9, as shown in Figure 7:

σ 0 = 0 σ i = E(σ i-1 ⊕ m i ) Σ (M ) = σ Σ(M ) = 2 fix0(Σ (M )) Θ (M ) = i=1 σ i Θ(M ) = 2 fix1(Θ (M )) MAC(M ) = E(Σ(M )) ⊕ E(Θ(M ))
Attack. Because of a mistake in the proof of 1kf9, we can use pairs of messages instead of quadruples. More precisely, instead of looking for a quadruple with pairwise collisions in Σ and Θ, we look for a pair of message X, Y colliding on Σ , and with a difference in Θ that will be absorbed by the fix1 function.

From this observation, we construct a birthday attack against 1kf9. We build two lists: L 0 = MAC(φ 0 (x)) : x < 2 n/2 L 1 = MAC(ψ 0 (y)) : y < 2 n/2 , and we look for a match between the lists. We expect on average one pair to match randomly, and one pair to match because of (8). Moreover, when we have a collision candidate L 0 [x], L 1 [y], we can verify whether it is a right pair by comparing MAC(x 1) and MAC(y d ⊕ 1). Therefore, we find a pair satisfying R(X, Y ) with complexity 2 n/2 , and this leads to simple forgeries using (8). This contradicts the security proof of 1kf9 given in [8]. Note that this attack is still valid if we use different multiplications for the two branches in the finalization function.

Attacking 1kPMAC+

The 1kPMAC+ mode uses the fix function for domain separation to build a singlekey variant of PMAC+, as shown in Figure 8. Attack. Since the fix functions used in the finalization have collisions, we can build a variant of the attacks from Section 4 using differences in Σ and/or Θ that are absorbed by the fix functions. More precisely, we use the following relation R on quadruple of messages: R(X, Y, Z, T ) :=

         Σ (X) = Σ(Y ) ⊕ 1 Θ (Y ) = Θ(Z) ⊕ 1 Σ (Z) = Σ(T ) ⊕ 1 Θ (T ) = Θ(X) ⊕ 1 ⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0.
We can find quadruple of messages satisfying R using a single message injection function: We can find a quadruple of four distinct values (x, y, z, t) such that L[x] ⊕ L[y] ⊕ L[z] ⊕ L[t] = 0 with Õ(2 3n/2 ) operations, using a memory of size O(2 3n/4 ), and this easily leads to forgeries.

φ u (i) = u i X = φ u (x) = u x Y = ψ u (y) = u y Z = φ u (z) = u z T = ψ u (t) = u t

Conclusion

In this paper we have introduced a cryptanalysis technique to attack doubleblock-hash MACs using quadruples of messages. We show three variants of the technique, with attacks with O(2 3n/4 ) queries against SUM-ECBC, GCM-SIV2, PMAC+, LightMAC+, 1kPMAC+ and 3kf9. All these modes have a security proof up to 2 2n/3 queries, but no attacks with fewer than 2 n queries were known before our work.

Our main attacks are in the information theoretic model, and an attacker would need more than 2 n operations to perform a forgery. On the other hand, we also have a variant of the attack against SUM-ECBC and GCM-SIV2 with time complexity Õ(2 6n/7 ). This opens the path for attack with total complexity below 2 n for other double-block-hash MACs.

We believe that studying generic attacks is important in order to understand the security of these MACs, and is needed in addition to security proofs. In particular our results show that they do not reach full security, and we invalidate a recent proof for LightMAC+. However, there is still a gap between the 2 2n/3 bound of the proofs, and our attacks with O(2 3n/4 ) queries. Further work is needed to determine whether the attacks can be improved, or whether better proofs are possible. Simon's algorithm requires the preparation of the uniform superposition of all n-bit strings, 1

√ 2 n
x |x |04 . For this input, the quantum encryption oracle returns 1

√ 2 n
x |x |O k (x) , the superposition of all possible pairs of plaintextciphertext. It might seem at first that this model gives an overwhelming power to the adversary and is therefore uninteresting. Note, however, that the laws of quantum mechanics imply that the measurement of such a 2n-qubit state can only reveal 2n bits of information, making this model nontrivial.

The simplicity of this model, together with the fact that it encompasses any reasonable model of quantum attacks makes it very interesting. For instance, [12] gave constructions of message authenticated codes that remain secure against superposition attacks. A similar approach was initiated by [19], who showed how to construct secure multiparty protocols when an adversary can corrupt the parties in superposition. A protocol that is proven secure in this model may truthfully be used in a quantum world.

Our work shows that superposition attacks, although they are not trivial, allow new powerful strategies for the adversary. Modes of operation that are provably secure against classical attacks can then be broken. There exist a few options to prevent the attacks that we present here. A possibility is to forbid all kind of quantum access to a cryptographic oracle. In a world where quantum resources become available, this restriction requires a careful attention. This can be achieved for example by performing a quantum measurement of any incoming quantum query to the oracle. But this task involves meticulous engineering of quantum devices whose outcome remains uncertain. Even information theoretically secure quantum cryptography remains vulnerable to attacks on their implementations, as shown by attacks on quantum key distribution [49,34,45].

A more realistic approach is to develop a set of protocols that remains secure against superposition attacks. Another advantage of this approach is that it also covers more advanced scenarios, for example when an encryption device is given to the adversary as an obfuscated algorithm. Our work shows how important it is to develop protocols that remain secure against superposition attacks.

Regarding symmetric cryptanalysis, we have already mentioned the protocol of Boneh and Zhandry for MACs that remains secure against superposition attacks. In particular, we answer negatively to their question asking wether CBC-MAC is secure in their model. Generic quantum attacks against symmetric cryptosystems have also been considered. For instance, [27] studies the security of iterated block ciphers, and Anand et al. investigated the security of various property testing for various applications of this algorithm [37]. We assume here a basic knowledge of the quantum circuit model. We denote the addition and multiplication in a field with 2 n elements by "⊕" and "•", respectively.

We consider that the access to the input of Simon's problem, a function f , is made by querying it. A classical query oracle is a function x → f (x). To run Simon's algorithm, it is required that the function f can be queried quantummechanically. More precisely, it is supposed that the algorithm can make arbitrary quantum superpositions of queries of the form |x |0 → |x |f (x) .

Simon's problem is the following:

Simon's problem: Given a Boolean function f : {0, 1} n → {0, 1} n and the promise that there exists s ∈ {0, 1} n such that for any (x, y) ∈ {0, 1} n , [f (x) = f (y)] ⇔ [x ⊕ y ∈ {0 n , s}], the goal is to find s.

This problem can be solved classically by searching for collisions. The optimal time to solve it is therefore Θ(2 n/2 ). On the other hand, Simon's algorithm solves this problem with quantum complexity O(n). Recall that the Hadamard transform H ⊗n applied on an n-qubit state |x for some x ∈ {0, 1} n gives H ⊗n |x = 1

5.

The vectors y such that y • s = 1 have amplitude 0. Therefore, measuring the state in the computational basis yields a random vector y such that y • s = 0.

By repeating this subroutine O(n) times, one obtains n -1 independent vectors orthogonal to s with high probability, and s can be recovered using basic linear algebra. Theorem 1 gives the trade-off between the number of repetitions of the subroutine and the success probability of the algorithm.

In most cases, our attacks correspond to a classical collision attack. In particular, the value s will usually be the difference in the internal state after processing a fixed pair of messages (α 0 , α 1 ), i.e. s = E(α 0 ) ⊕ E(α 1 ). The input of f will be inserted into the state with the difference s so that f (x) = f (x ⊕ s).

In our work, this function f is of the form:

f 1 :
x → P ( E(x) + E(x ⊕ s)) or,

f 2 : b, x → E(x) if b = 0, E(x ⊕ s) if b = 1,
where E is a simple function obtained from E k and P a permutation. It is immediate to see that f 1 and f 2 have periods s for f 1 or 1||s for f 2 .

In most applications, Simon's function satisfies f (x) = f (y) for y ⊕ x ∈ {0, s}, but also for additional inputs x, y. Theorem 1 extends Simon's algorithm precisely to this case. In particular, if the additional collisions of f are random, then Simon's algorithm is successful. When considering explicit constructions, we can not in general prove that the unwanted collisions are random, but rather that they look random enough. In practice, if the function ε(f, s) is not bounded, then some of the primitives used in the construction have are far from ideal. We can show that this happens with low probability, and would imply an classical attack against the system. Applying Theorem 1 is not trivial, but it stretches the range of application of Simon's algorithm far beyond its original version.

Construction of Simon's functions. To make our attacks as clear as possible, we provide the diagrams of circuits computing the function f . These circuits use a little number of basic building blocks represented in Figure 2.

In our attacks, we often use a pair of arbitrary constants α 0 and α 1 . The choice of the constant is indexed by a bit b. We denote by U α the gate that maps b to α b (See Figure 2.1). For simplicity, we ignore here the additional qubits required in practice to make the transform reversible through padding.

Although it is well known that arbitrary quantum states cannot be cloned, we use the CNOT gate to copy classical information. More precisely, a CNOT gate can copy states in the computational basis: CN OT : |x |0 → |x |x . This transform is represented in Figure 2.2.

Finally, any unitary transform U can be controlled by a bit b. This operation, denoted U b maps x to U (x) if b = 1 and leaves x unchanged otherwise. In the quantum setting, the qubit |b can be in a superposition of 0 and 1, resulting in a superposition of |x and |U (x) . The attacks that we present in the following sections only make use of this procedure when the attacker knows a classical description of the unitary to be controlled. In particular, we do not apply it to the cryptographic oracle.

When computing Simon's function, i.e. the function f on which Simon's algorithm is applied, the registers containing the value of f must be unentangled with any other working register. Otherwise, these registers, which might hinder the periodicity of the function, have to be taken into account in Simon's algorithm and the whole procedure could fail.

Previous works

Previous works have used Simon's algorithm to break the security of classical constructions in symmetric cryptography: the Even-Mansour construction and the 3-round Feistel scheme. We now explain how these attacks work with our terminology and extend two of the results. First, we show that the attack on the Feistel scheme can be extended to work with random functions, where the original analysis held only for random permutations. Second, using our analysis Simon's algorithm with approximate promise, we make the number of queries required to attack the Even-Mansour construction more precise. These observations have been independently made by Santoli and Schaffner [40]. They use a slightly different approach, which consists in analyzing the run of Simon's algorithm for these specific cases.

Applications to a three-round Feistel scheme

The Feistel scheme is a classical construction to build a random permutation out of random functions or random permutations. In a seminal work, Luby and Rackoff proved that a three-round Feistel scheme is a secure pseudo-random permutation [33].

A three-round Feistel scheme with input (x L , x R ) and output (y L , y R ) = E(x L , x R ) is built from three round functions R 1 , R 2 , R 3 as (see Figure 3): (u 0 , v 0 ) = (x L , x R ), (u i , v i ) = (v i-1 ⊕ R i (u i-1 ), u i-1 ), (y L , y R ) = (u 3 , v 3 ).

In order to distinguish a Feistel scheme from a random permutation in a quantum setting, Kuwakado and Morii [30] consider the case were the R i are permutations, and define the following function, with two arbitrary constants α 0 and α 1 such that α 0 = α 1 : In particular, this f satisfies f (b, x) = f (b ⊕ 1, x ⊕ R 1 (α 0 ) ⊕ R 1 (α 1 )). Moreover,

f : {0, 1} × {0, 1} n → {0,
f (b , x ) = f (b, x) ⇔ x ⊕ R 1 (α b ) = x ⊕ R 1 (α b ) ⇔ x ⊕ x = 0 if b = b x ⊕ x = R 1 (α 0 ) ⊕ R 1 (α 1 ) if b = b
Therefore, the function satisfies Simon's promise with s = 1 R 1 (α 0 ) ⊕ R 1 (α 1 ), and we can recover R 1 (α 0 ) ⊕ R 1 (α 1 ) using Simon's algorithm. This gives a distinguisher, because Simon's algorithm applied to a random permutation returns zero with high probability. This can be seen from Theorem 2, using the fact that with overwhelming probability [18], there is no value t = 0 such that Pr x [f (x ⊕ t) = f (x)] > 1/2 for a random permutation f . We can also verify that the value R 1 (α 0 )⊕R 1 (α 1 ) is correct with two additional classical queries (y L , y R ) = E(α 0 , x) and (y L , y R ) = E(α 1 , x ⊕ R 1 (α 0 ) ⊕ R 1 (α 1 )) for a random x. If the value is correct, we have y R ⊕ y R = α 0 ⊕ α 1 .

Note that in their attack, Kuwakado and Morii implicitly assume that the adversary can query in superposition an oracle that returns solely the left part y L of the encryption. If the adversary only has access to the complete encryption oracle E, then a query in superposition would return two entangled registers containing the left and right parts, respectively. In principle, Simon's algorithm requires the register containing the input value to be completely disentangled from the others.

Feistel scheme with random functions. Kuwakado and Morii [30] analyze only the case where the round functions R i are permutations. We now extend this analysis to random functions R i . The function f defined above still satisfies f (b, x) = f (b ⊕ 1, x ⊕ R 1 (α 0 ) ⊕ R 1 (α 1 )), but it doesn't satisfy the exact promise of Simon's algorithm: there are additional collisions in f , between inputs with random differences. However, the previous distinguisher is still valid: at the end of Simon's algorithm, there exist at least one non-zero value orthogonal to all the values y measured at each step: s. This would not be the case with a random permutation.

Moreover, we can show that ε(f, 1 s) < 1/2 with overwhelming probability, so that Simon's algorithm still recovers 1 s following Theorem 1. If ε(f, 1 s) > 1/2, there exists (τ, t) with (τ, t) ∈ {(0, 0), (1, s)} such that: Pr[f (b, x) = f (b ⊕ τ, x ⊕ t)] > 1/2. Assume first that τ = 0, this implies:

Pr[f (0, x) = f (0, x ⊕ t)] > 1/2 or Pr[f (1, x) = f (1, x ⊕ t)] > 1/2.
Therefore, for some b,

Pr[R 2 (x ⊕ R 1 (α b )) = R 2 (x ⊕ t ⊕ R 1 (α b ))] > 1/2, i.e. Pr[R 2 (x) = R 2 (x ⊕ t)] > 1/2. Similarly, if τ = 1, Pr[R 2 (x ⊕ R 1 (α 0 )) = R 2 (x ⊕ t ⊕ R 1 (α 1 ))] > 1/2, i.e. Pr[R 2 (x) = R 2 (x ⊕ t ⊕ R 1 (α 0 ) ⊕ R 1 (α 1 ))] > 1/2.
To summarize, if ε(f, 1 s) > 1/2, there exists u = 0 such that Pr[R 2 (x) = R 2 (x ⊕ u)] > 1/2. This only happens with negligible probability for a random choice of R 2 as shown in [18].

Application to the Even-Mansour construction

The Even-Mansour construction is a simple construction to build a block cipher from a public permutation [21]. For some permutation P , the cipher is:

E k 1 ,k 2 (x) = P (x ⊕ k 1 ) ⊕ k 2 .
Even and Mansour have shown that this construction is secure in the random permutation model, up to 2 n/2 queries, where n is the size of the input to P . However, Kuwakado and Morii [31] have shown that the security of this construction collapses if an adversary can query an encryption oracle with a superposition of states. More precisely, they define the following function:

f : {0, 1} n → {0, 1} n
x → E k 1 ,k 2 (x) ⊕ P (x) = P (x ⊕ k 1 ) ⊕ P (x) ⊕ k 2 .

11

In particular, f satisfies f (x ⊕ k 1 ) = f (x) (interestingly, the slide with a twist attack of Biryukov and Wagner [8] uses the same property). However, there are additional collisions in f between inputs with random differences. As in the attack against the Feistel scheme with random round functions, we use Theorem 1, to show that Simon's algorithm recovers k 1 5 . We show that ε(f, k 1 ) < 1/2 with overwhelming probability for a random permutation P , and if ε(f, k 1 ) > 1/2, then there exists a classical attack against the Even-Mansour scheme. Assume that ε(f, k 1 ) > 1/2, that is, there exists t with t ∈ {0, k 1 } such that Pr[f (x) = f (x ⊕ t)] > 1/2, i.e., p = Pr[P (x) ⊕ P (x ⊕ k 1 ) ⊕ P (x ⊕ t) ⊕ P (x ⊕ t ⊕ k 1 ) = 0] > 1/2. This correspond to higher order differential for P with probability 1/2, which only happens with negligible probability for a random choice of P . In addition, this would imply the existence of a simple classical attack against the scheme:

1. Query y = E k 1 ,k 2 (x) and y = E k 1 ,k 2 (x ⊕ t) 2. Then y ⊕ y = P (x) ⊕ P (x ⊕ t) with probability at least one half Therefore, for any instantiation of the Even-Mansour scheme with a fixed P , either there exist a classical distinguishing attack (this only happens with negligible probability with a random P ), or Simon's algorithm successfully recovers k 1 . In the second case, the value of k 2 can then be recovered from an additional classical query: k 2 = E(x) ⊕ P (x ⊕ k 1 ).

In the next sections, we give new applications of Simon's algorithm, to break various symmetric cryptography schemes.

Application to the LRW construction

We now show a new application of Simon's algorithm to the LRW construction. The LRW construction, introduced by Liskov, Rivest and Wagner [32], turns a block cipher into a tweakable block cipher, i.e. a family of unrelated block ciphers. The tweakable block cipher is a very useful primitive to build modes for encryption, authentication, or authenticated encryption. In particular, tweakable block ciphers and the LRW construction were inspired by the first version of OCB, and later versions of OCB use the tweakable block ciphers formalism. The LRW construction uses a (almost) universal hash function h (which is part of the key), and is defined as (see also Figure 7):

E t,k (x) = E k (x ⊕ h(t)) ⊕ h(t).
We now show that the LRW construction is not secure in a quantum setting. We fix two arbitrary tweaks t 0 , t 1 , with t 0 = t 1 , and we define the following function:

f : {0, 1} n → {0, 1} n x → E t 0 ,k (x) ⊕ E t 1 ,k (x) f (x) = E k x ⊕ h(t 0 ) ⊕ h(t 0 ) ⊕ E k x ⊕ h(t 1 ) ⊕ h(t 1 ).
Given a superposition access to an oracle for an LRW tweakable block cipher, we can build a circuit implementing this function, using the construction given in Figure 8. In the circuit, the cryptographic oracle E t,k takes two inputs: the block x to be encrypted and the tweak t. Since the tweak comes out of E t,k unentangled with the other register, we do not represent this output in the diagram. In practice, the output is forgotten by the attacker.

It is easy to see that this function satisfies f (x) = f (x ⊕ s) with s = h(t 0 ) ⊕ h(t 1 ). Furthermore, the quantity ε(f, s) = max t∈{0,1} n \{0,s} Pr[f (x) = f (x ⊕ t)] is bounded with overwhelming probability, assuming that E k behaves as a random permutation. Indeed if ε(f, s) > 1/2, there exists some t with t ∈ {0, s} such that Pr[f (x) = f (x ⊕ t)] > 1/2, i.e.,

Pr[E k x ⊕ E k x ⊕ s ⊕ E k x ⊕ t) ⊕ E k x ⊕ t ⊕ s = 0] > 1/2
This correspond to higher order differential for E k with probability 1/2, which only happens with negligible probability for a random permutation. Therefore, if E is a pseudo-random permutation family, ε(f, s) ≤ 1/2 with overwhelming probability, and running Simon's algorithm with the function f returns h(t 0 ) ⊕ h(t 1 ). The assumption that E behaves as a PRP family is required for the security proof of LRW, so it is reasonable to make the same assumption in an attack. More concretely, a block cipher with a higher order differential with probability 1/2 as seen above would probably be broken by classical attacks. The attack is not immediate because the differential can depend on the key, but it would seem to 13 indicate a structural weakness. In the following sections, some attacks can also be mounted using Theorem 2 without any assumptions on E.

In any case, there exist at least one non-zero value orthogonal to all the values y measured during Simon's algorithm: s. This would not be the case if f is a random function, which gives a distinguisher between the LRW construction and an ideal tweakable block cipher with O(n) quantum queries to E.

In practice, most instantiations of LRW use a finite field multiplication to define the universal hash function h, with a secret offset L (usually computed as L = E k (0)). Two popular constructions are:

-h(t) = γ(t) • L, used in OCB1 [39], OCB3 [29] and PMAC [10], with a Gray encoding γ of t, -h(t) = 2 t • L, the XEX construction, used in OCB2 [38].

In both cases, we can recover L from the value h(t 0 ) ⊕ h(t 1 ) given by the attack.

This attack is important, because many recent modes of operation are inspired by the LRW construction, and the XE and XEX instantiations, such as CAESAR candidates AEZ [24], COPA [4], OCB [29], OTR [36], Minalpher [41], OMD [17], and POET [1]. We will see in the next section that variants of this attack can be applied to each of these modes.

Application to block cipher modes of operations

We now give new applications of Simon's algorithm to the security of block cipher modes of operations. In particular, we show how to break the most popular and widely used block-cipher based MACs, and message authentication schemes: CBC-MAC (including variants such as XCBC [9], OMAC [25], and CMAC [20]), GMAC [35], PMAC [10], GCM [35] and OCB [29]. We also show attacks against several CAESAR candidates. In each case, the mode is proven secure up to 2 n/2 in the classical setting, but we show how, by a reduction to Simon's problem, forgery attacks can be performed with superposition queries at a cost of O(n). Notations and preliminaries. We consider a block cipher E k , acting on blocks of length n, where the subscript k denotes the key. For simplicity, we only describe the modes with full-block messages, the attacks can trivially be extended to the more general modes with arbitrary inputs. In general, we consider a message M divided into n-bits block: M = m 1 . . . m . We also assume that the MAC is not truncated, i.e. the output size is n bits. In most cases, the attacks can be adapted to truncated MACS.

Deterministic MACs: CBC-MAC and PMAC

We start with deterministic Message Authentication Codes, or MACs. A MAC is used to guarantee the authenticity of messages, and should be immune against forgery attacks. The standard security model is that it should be hard to forge a message with a valid tag, even given access to an oracle that computes the MAC of any chosen message (of course the forged message must not have been queried to the oracle).

To translate this security notion to the quantum setting, we assume that the adversary is given an oracle that takes a quantum superposition of messages as input, and computes the superposition of the corresponding MAC.

CBC-MAC. CBC-MAC is one of the first MAC constructions, inspired by the CBC encryption mode. Since the basic CBC-MAC is only secure when the queries are prefix-free, there are many variants of CBC-MAC to provide security for arbitrary messages. In the following we describe the Encrypted-CBC-MAC variant [5], using two keys k and k , but the attack can be easily adapted to other variants [9,25,20]. On a message M = m 1 . . . m , CBC-MAC is defined as (see Figure 9): CBC-MAC is standardized and widely used. It has been proved to be secure up to the birthday bound [5], assuming that the block cipher is indistinguishable from a random permutation.

x 0 = 0 x i = E k (x i-1 ⊕ m i ) CBC-MAC(M ) = E k (x ) 0 m 1 E k m 2 E k m 3 E k E k τ
Attack. We can build a powerful forgery attack on CBC-MAC with very low complexity using superposition queries. We fix two arbitrary message blocks α 0 , α 1 , with α 0 = α 1 , and we define the following function:

f : {0, 1} × {0, 1} n → {0, 1} n b, x → CBC-MAC(α b x) = E k E k x ⊕ E k (α b ) .

15

The function f can be computed with a single call to the cryptographic oracle, and we can build a quantum circuit for f given a black box quantum circuit for CBC-MAC k . Moreover, f satisfies the promise of Simon's problem with s = 1 E k (α 0 ) ⊕ E k (α 1 ):

f (0, x) = E k (E k (x ⊕ E k (α 1 ))), f (1, x) = E k (E k (x ⊕ E k (α 0 ))), f (b, x) = f (b ⊕ 1, x ⊕ E k (α 0 ) ⊕ E k (α 1 )).
More precisely:

f (b , x ) = f (b, x) ⇔ x ⊕ E k (α b ) = x ⊕ E k (α b ) ⇔ x ⊕ x = 0 if b = b x ⊕ x = E k (α 0 ) ⊕ E k (α 1 ) if b = b
Therefore, an application of Simon's algorithm returns E k (α 0 ) ⊕ E k (α 1 ). This allows to forge messages easily:

1. Query the tag of α 0 m 1 for an arbitrary block m 1 ; 2. The same tag is valid for α 1 m 1 ⊕ E k (α 0 ) ⊕ E k (α 1 ).

In order to break the formal notion of EUF-qCMA security, we must produce q + 1 valid tags with only q queries to the oracle. Let q = O(n) denote the number of of quantum queries made to learn E k (α 0 ) ⊕ E k (α 1 ). The attacker will repeats the forgery step step q + 1 times, in order to produce 2(q + 1) messages with valid tags, after a total of 2q + 1 classical and quantum queries to the cryptographic oracle. Therefore, CBC-MAC is broken by a quantum existential forgery attack.

After some exchange at early stages of the work, an extension of this forgery attack has been found by Santoli and Schaffner [40]. Its main advantage is to handle oracles that accept input of fixed length, while our attack works for oracles accepting messages of variable length.

PMAC. PMAC is a parallelizable block-cipher based MAC designed by Rogway [38]. PMAC is based on the XE construction: the construction uses secret offsets ∆ i derived from the secret key to turn the block cipher into a tweakable block cipher. More precisely, the PMAC algorithm is defined as

c i = E k (m i ⊕ ∆ i ) PMAC(M ) = E * k m ⊕ c i
where E * is a tweaked variant of E. We omit the generation of the secret offsets because they are irrelevant to our attack.

First attack. When PMAC is used with two-block messages, it has the same structure as CBC-MAC: PMAC(m

1 m 2 ) = E * k (m 2 ⊕ E k (m 1 ⊕ ∆ 0 )
). Therefore we can use the attack of the previous section to recover E k (α 0 ) ⊕ E k (α 1 ) for arbitrary values of α 0 and α 1 . Again, this leads to a simple forgery attack. First, query the tag of α 0 m 1 m 2 for arbitrary blocks m 1 , m 2 . The same tag is valid for α 1 m 1 m 2 ⊕ E k (α 0 ) ⊕ E k (α 1 ). As for CBC-MAC, these two steps can be repeated t + 1 times, where t is the number of quantum queries issued. The adversary then produces 2(t + 1) messages after only 2t + 1 queries to the cryptographic oracle.

Second attack. We can also build another forgery attack on PMAC where we recover the difference between two offsets ∆ i , following the attack against LRW given in Section 4. More precisely, we use the following function:

f : {0, 1} n → {0, 1} n m → PMAC(m m 0 n ) = E * k (E k (m ⊕ ∆ 0 ) ⊕ E k (m ⊕ ∆ 1 )) .
In particular, it satisfies f (m ⊕ s) = f (m) with s = ∆ 0 ⊕ ∆ 1 . Furthermore, we can show that ε(f, s) ≤ 1/2 when E is a good block cipher6 , and we can apply Simon's algorithm to recover ∆ 0 ⊕ ∆ 1 . This allows to create forgeries as follows:

1. Query the tag of m 1 m 1 for an arbitrary block m 1 ; 2. The same tag is valid for

m 1 ⊕ ∆ 0 ⊕ ∆ 1 m 1 ⊕ ∆ 0 ⊕ ∆ 1 .
As mentioned in Section 4, the offsets in PMAC are defined as ∆ i = γ(i) • L, with L = E k (0) and γ a Gray encoding. This allows to recover L from ∆ 0 ⊕ ∆ 1 , as L = (∆ 0 ⊕ ∆ 1 ) • (γ(0) ⊕ γ(1))

-1 . Then we can compute all the values ∆ i , and forge arbitrary messages. We can also mount an attack without any assumption on ε(f, s), using Theorem 2. Indeed, with a proper choice of parameters, Simon's algorithm will return a value t = 0 that satisfies Pr x [f (x ⊕ t) = f (x)] ≥ 1/2. This value is not necessarily equal to s, but it can also be used to create forgeries in the same way, with success probability at least 1/2.

Randomized MAC: GMAC

GMAC is the underlying MAC of the widely used GCM standard, designed by McGrew and Viega [35], and standardized by NIST. GMAC follows the Carter-Wegman construction [16]: it is built from a universal hash function, using polynomial evaluation in a Galois field. As opposed to the constructions of the previous sections, GMAC is a randomized MAC; it requires a second input N , which must be non-repeating (a nonce). GMAC is essentially defined as: Attack. When the polynomial is evaluated with Horner's rule, the structure of GMAC is similar to that of CBC-MAC (see Figure 12). For a two-block message, we have GMAC(m 1 m 2 ) = (m 1 • H) ⊕ m 2 • H ⊕ E k (N 1). Therefore, we us the same f as in the CBC-MAC attack, with fixed blocks α 0 and α 1 :

f N : {0, 1} × {0, 1} n → {0, 1} n b, x → GMAC(N, α b x) = α b • H 2 ⊕ x • H ⊕ E k (N ||1).
In particular, we have:

f (b , x ) = f (b, x) ⇔ α b • H 2 ⊕ x • H = α b • H 2 ⊕ x • H ⇔ x ⊕ x = 0 if b = b x ⊕ x = (α 0 ⊕ α 1 ) • H if b = b
Therefore f N satisfies the promise of Simon's algorithm with s = 1 (α 0 ⊕ α 1 ) • H.

Role of the nonce.

There is an important caveat regarding the use of the nonce. In a classical setting, the nonce is chosen by the adversary under the constraint that it is non-repeating, i.e. the oracle computes N, M → GMAC(N, M ). However, in the quantum setting, we don't have a clear definition of non-repeating In particular, when the message is empty, GCM is just GMAC, and we can use the attack of the previous section to recover the hash key H. This immediately allows a forgery attack.

OCB. OCB is another popular authenticated encryption mode, with a very high efficiency, designed by Rogaway et al. [39,38,29]. Indeed, OCB requires only block cipher calls to process an -block message, while GCM requires block cipher calls, and finite field operations. OCB is build from the LRW construction discussed in Section 4. OCB takes as input a nonce N , a message M = m 1 . . . m , and associated data A = a 1 . . . a @ , and returns a ciphertext C = c 1 . . . c and a tag τ :

c i = E k (m i ⊕ ∆ N i ) ⊕ ∆ N i , τ = E k ∆ N ⊕ m i ⊕ b i , b i = E k (a i ⊕ ∆ i ).
Extending PMAC attack to OCB. In particular, when the message is empty, OCB reduces to a randomized variant of PMAC:

OCB k (N, ε, A) = φ k (N ) ⊕ b i , b i = E k (a i ⊕ ∆ i ).
Note that the ∆ i values used for the associated data are independent of the nonce N . Therefore, we can apply the second PMAC attack previously given, using the following function:

f N : {0, 1} n → {0, 1} n x → OCB k (N, ε, x x) f N (x) = E k (x ⊕ ∆ 0 ) ⊕ E k (x ⊕ ∆ 1 ) ⊕ φ k (N )
Again, this is a special case of the LRW attack of Section 4. The family of functions satisfies f N (a ⊕ ∆ 0 ⊕ ∆ 1 ) = f N (a), for any N , and ε(f N , ∆ 0 ⊕ ∆ 1 ) ≤ 1/2 with overwhelming probability if E is a PRP. Therefore we can use the variant of Simon's algorithm to recover ∆ 0 ⊕ ∆ 1 . Two messages with valid tags can then be generated by a single classical queries:

1. Query the authenticated encryption C, τ of M, a a for an arbitrary message M , and an arbitrary block a (under a random nonce N ). 2. C, τ is also a valid authenticated encryption of M, a ⊕ ∆ 0 ⊕ ∆ 1 a ⊕ ∆ 0 ⊕ ∆ 1 , with the same nonce N .

Repeating these steps lead again to an existential forgery attack.

Alternative attack against OCB. For some versions of OCB, we can also mount a different attack targeting the encryption part rather than the authentication part. The goal of this attack is also to recover the secret offsets, but we target the ∆ N i used for the encryption of the message. More precisely, we use the following function:

f i : {0, 1} n → {0, 1} n m → c 1 ⊕ c 2 , where (c 1 , c 2 , τ ) = OCB k (N, m m, ε) f i (m) = E k (m ⊕ ∆ N 1 ) ⊕ ∆ N 1 ⊕ E k (m ⊕ ∆ N 2 ) ⊕ ∆ N
Minalpher. Minalpher [41] is a permutation-based CAESAR candidate, where the permutation is used to build a tweakable block-cipher using the tweakable Even-Mansour construction. When the message is empty (or fixed), the authentication part of Minalpher is very similar to PMAC. With associated data A = a 1 . . . a @ , the tag is computed as:

b i = P (a i ⊕ ∆ i ) ⊕ ∆ i τ = φ k N, M, a @ ⊕ @-1 i=1 b i ∆ i = y i • L L = P (k 0) ⊕ (k 0)
where φ k is a permutation (we omit the description of φ k because it is irrelevant for our attack). Since the tag is a function of a @ ⊕ @-1 i=1 b i , we can use the same attacks as against PMAC. For instance, we define the following function:

f N : {0, 1} × {0, 1} n → {0, 1} n b, x → Minalpher(N, ε, α b x) = φ k (N, ε, P (α b ⊕ ∆ 1 ) ⊕ ∆ 1 ⊕ x).
In particular, we have:

f N (b , x ) = f N (b, x) ⇔ P (α b ⊕ ∆ 1 ) ⊕ x = P (α b ⊕ ∆ 1 ) ⊕ x ⇔ x ⊕ x = 0 if b = b x ⊕ x = P (α 0 ⊕ ∆ 1 ) ⊕ P (α 1 ⊕ ∆ 1 ) if b = b
Since s = P (α 0 ⊕ ∆ 1 ) ⊕ P (α 1 ⊕ ∆ 1 ) is independent of N , we can easily apply Simon's algorithm to recover s, and generate forgeries.

OMD. OMD [17] is a compression-function-based CAESAR candidate. The internal primitive is a keyed compression function denoted F k . Again, when the message is empty the authentication is very similar to PMAC. With associated data A = a 1 . . . a @ , the tag is computed as:

b i = F k (a i ⊕ ∆ i ) τ = φ k (N, M ) ⊕ b i
We note that the ∆ i used for the associated data do not depend on the nonce. Therefore we can use the second PMAC attack with the following function:

f N : {0, 1} n → {0, 1} n x → OMD(N, ε, x x) f N (x) = φ k (N, ε) ⊕ F k (x ⊕ ∆ 1 ) ⊕ F k (x ⊕ ∆ 2 )
This is the same form as seen when extending the PMAC attack to OCB, therefore we can apply the same attack to recover s = ∆ 1 ⊕ ∆ 2 and generate forgeries.

Simon's algorithm applied to slide attacks

In this section we show how Simon's algorithm can be applied to a cryptanalysis family: slide attacks. In this case, the complexity of the attack drops again output of Simon's subroutine. We will prove that for all t ∈ {0, 1} n \ {0, s}, the following inequality holds:

Pr u [u • t = 0] = 1 2 1 + Pr x [f (x) = f (x ⊕ t)] ≤ 1 2 (1 + ε(f, s)) ≤ 1 2 (1 + p 0 ). (3)
In Simon's algorithm, one can wait until the last step before measuring both registers. The final state before measurement can be decomposed as:

where we used Lemma 1 proven in the appendix in Eq. 4, and δ x,x = 1 if x = x and 0 otherwise.

B Proof of Theorem 2

Let t be a fixed value and p t = P r x [f (x ⊕ t = f (t)]. Following the previous analysis, the probability that the cn vectors u i are orthogonal to t can be written as Pr[u

1 • t = u 2 • t = • • • = u cn • t = 0] = 1+p t 2 cn .
In particular, we can bound the probability that Simon's algorithm returns a value t with p t < p 0 : Pr[p t < p 0 ] = t: p t <p 0

1 + p t 2 cn ≤ 2 n × 1 + p 0 2 cn 1 Introduction
The possible emergence of large-scale quantum computing devices in a near future has prompted a wide move towards post-quantum security, which takes into account the new security threats that they pose. In particular, the most popular asymmetric cryptosystems currently in use, such as RSA, can be broken A general presentation of the quantum circuit model can be found in [START_REF] Nielsen | Quantum computation and quantum information[END_REF]. The basic computation units are qubits, two-level quantum systems whose state is represented by a superposition α |0 + β |1 , with amplitudes α and β, which is a normalized vector in C 2 (of norm |α 2 | + |β 2 | = 1). The state of an n-qubit system belongs to C 2 n , its 2 n basis vectors (in the computational basis) are the 2 n n-bit strings.

A quantum algorithm is a sequence of unitary operators of C 2 n , partial measurements, and oracle calls. We say that a function f is queried in superposition if the following unitary operator O f is made available: |x |y → |x |y ⊕ f (x) . Indeed, this operator allows to query f on any quantum state, thus on any superposition of inputs x. This is the standard oracle, equivalent to the phase oracle O f,± which computes |x → (-1) f (x) |x .

One of the basic unitary operations of the quantum circuit model (quantum gates), and actually the most important one in the algorithms of Section 2.3, is the Hadamard gate H which maps a single qubit |b to 1 An important property is that the Hadamard transform is involutive. For better readability, we often omit global amplitude factors such as the 1 2 n/2 above, as quantum states are always normalized.

Given a quantum state of the form x α x |x , the measurement operation destroys the state and yields an element x with probability |α x | 2 . Partially measuring the state projects it on a smaller superposition of elements. For a quantum state of the form:

Quantum Algorithms

Our new attacks are based on well-known quantum algorithms: Deutsch's algorithm [26], which is a single-bit version of the Deutsch-Jozsa algorithm [27], the Bernstein-Vazirani algorithm [8], Simon's algorithm [START_REF] Simon | On the power of quantum computation[END_REF] and Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: Discrete logarithms and factoring[END_REF]. These algorithms have in common to be based on Fourier sampling, a process in which a quantum Fourier transform is applied before and after a single query to a superposition oracle. They are also amongst the earliest quantum algorithms proven to beat any classical algorithm, and as such are often presented in textbooks (see e.g. [START_REF] Nielsen | Quantum computation and quantum information[END_REF]). However, except for Shor's algorithm, their practical interest remained unclear for a long time. Deutsch's Algorithm. Deutsch's algorithm [26] solves Problem 1 with probability 1 using a single query to O f , whereas classically, two queries to f are needed for the same success probability. This constant speedup might seem anecdotal, but is crucial when the same function cannot be queried more than once. Deutsch's algorithm (Algorithm 1) is best presented with a phase oracle O f,± |b = (-1) f (b) |b . It can be seen that upon measurement, the algorithm actually yields the value f (0) ⊕ f (1) (although a single query has been made to f ) whose knowledge solves Problem 1. Bernstein-Vazirani Algorithm. The Bernstein-Vazirani algorithm [8] offers a polynomial speedup for finding the slope of an affine function over F n 2 .

Problem 2 (Bernstein-Vazirani). Given access to an oracle O f for an affine function f : {0, 1} n → {0, 1}, that is, f (x) = a • x ⊕ b for a, b unknown, find a.

Upon measurement in Algorithm 2, we obtain the unknown a with certainty, using a single query to O f,± , while n queries would be needed classically.

Remark 1. This algorithm can be seen as a generalization of Deutsch's algorithm. Indeed, in the case n = 1, there are only two types of affine functions: f (x) = x ⊕ b (a = 1) and f (x) = b (a = 0), and Bernstein-Vazirani allows to distinguish them in one query.

Simon's Algorithm. Simon's algorithm [START_REF] Simon | On the power of quantum computation[END_REF] solves the problem of distinguishing an injective function from a periodic one. Note that it was the first example of an exponential quantum speedup relatively to an oracle. Problem 3 (Simon). Given access to a function f : {0, 1} n → {0, 1} n for which there exists s such that: ∀x, y, f (x) = f (y) ⇐⇒ y ∈ {x, x ⊕ s}, find s.

In Algorithm 3, at Step 9 in the injective case, the value a obtained before has a single preimage x a . Thus, the current state is y ((-1) x a •y ) |y and we sample a uniformly random y ∈ {0, 1} n . After n + r such samples, the family Y Finally, another important case is when the output set is smaller than the input set. This was studied in [16] for Simon's algorithm and [48] for periodfinding in general. The results in [16] show that as long as the functions behave as random (but with the periodicity constraint), then for n input bits, the number of output bits required to run correctly without any cost increase is of order log 2 n. The results in [48] show that the output can be hashed down to a single bit, and the algorithms still work up to a constant increase in queries.

Shor's Algorithm. We will use Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: Discrete logarithms and factoring[END_REF] to solve the abelian hidden period problem. It will appear in a "black-box" manner in Section 5.4, and in Section 5.5. We will analyse in detail the behavior of the algorithm on Poly1305.

Problem 4 (Abelian hidden period). Let (G, +) be an abelian group, X a set. Given access to a function f : G → X which is either injective, or periodic (∃s ∈ G, f (s + •) = f (•)), then determine the case and / or find the period.

In particular, we consider G = Z M 1 ×. . .×Z M k the product of multiple cyclic groups of known order. For simplicity, and to prepare for Section 5.5, we present the algorithm in the case of Z 2 p for some prime p. Note that f is also periodic over Z p in each of its parameters. This is the typical situation when Shor's algorithm is used to solve the Discrete Logarithm Problem. The periods of f form a twodimensional integer lattice, which is generated by (p, 0) and (-1, s) for some s. In other words, the value of f (x, y) depends only on the value of xs + y mod p. We may assume for simplicity that the function xs + y mod p → f (x, y) is injective.

The algorithm only relies on an efficient implementation of the Quantum Fourier Transform over Z p : which we assume exact. We represent the elements of X on m bits. In Algorithm 4, at Step 4, we can only measure a vector |z, t having a nonzero amplitude. This means that we need:

p-1 x=0 exp 2iπ
(zst)x p = 0 , which happens only when (zst) = 0. In that case, the sum simply gives p.

After renormalization, all vectors |z, t with (z -st) = 0 have the same amplitude 1 √ p , and we will measure one of them taken uniformly at random. If t = 0, we compute s by s = zt -1 mod p. This occurs with probability 1 -1 p .

Attack Scenarios

We consider different attack scenarios throughout this paper. Q1 and Q2 setting. Following [40,33,17], we will adopt the Q1 / Q2 terminology to classify quantum attacks on symmetric schemes. Note that these models have alternative names, for example "quantum chosen-plaintext attack" (qCPA) is used for "Q2" in [34,22]. In the Q1 setting, the adversary is given only classical encryption or decryption query access to black-boxes. In the Q2 setting, the adversary is given quantum or superposition access, in the sense that a blackbox E K becomes a quantum oracle O E K . This is the case for all the attacks of this paper.

The study of quantum attacks on symmetric schemes in the Q2 setting was sparkled by seminal work of Kuwakado and Morii [44,45], who showed that the 3-round Luby-Rackoff construction and the Even-Mansour cipher became insecure if exposed to superposition queries. More precisely, they can use Simon's algorithm to respectively distinguish the construction and recover the key of the cipher in polynomial time, while classical proofs of security exist.

Attacks based on period-finding. Since these earlier results, many works have extended the reach of Q2 attacks [39,15,46,19,28,30]. However, the attack strategy has remained the same. A hidden structure is embedded in the construction to be attacked, so that f (E K (x), x) for some choice of combination f , is a periodic function of x; or that a shift exists between f (E K (x), x) and g(E K (x), x). The recovery of this hidden period or shift, which is secret material, then leads to a break. We can cite some examples: 9 K drawn uniformly at random, and a truly random function. It is shown respectively in [13] and [1] that a qPRF is also a quantum-secure deterministic MAC by the PO and BU definitions. Therefore, any function that is not POunforgeable is also not a secure qPRF. To the best of our knowledge, the only classical symmetric construction that has been proven quantum-secure as a deterministic MAC, the Cascade / NMAC / HMAC construction [START_REF] Song | Quantum security of NMAC and related constructions -PRF domain extension against quantum attacks[END_REF], is also a qPRF.

A Quantum Attack on OCB3

We detail the Q2 attack on the MAC of OCB3 from [39]. As the other previous works recalled above, this attack relies on a Boolean period-finding problem. Specification. OCB3 is an IV-based mode of authenticated encryption with associated data (AEAD), based on a block cipher [43]. As OCB stands for offset codebook, the scheme relies on the definition of offsets that are dependent on the key and change between each block. We will focus on the authentication tag of OCB3 (see Figure 1). Our considerations are independent on the exact value of the offsets, and apply to all versions of OCB, but we use OCB3 as a concrete example. Forgery Attack with Simon's Algorithm. Kaplan et al. showed in [39] how to forge authentication tags using Simon's algorithm. The idea is to query the tag of an empty message with two AD blocks A 0 , A 1 = x:

x

→ E K (∆ IV ) ⊕ E K (∆ 0 ⊕ x) ⊕ E K (∆ 1 ⊕ x) .
One can then remark that this function of x is periodic, of period ∆ 0 ⊕ ∆ 1 , independent of the IV, and only on the secret key K. Although the function changes at each query (since the IV changes), the period is always the same and Simon's algorithm allows to recover it with O (n) superposition queries. (For the same reason, we could use a non-empty message, and even different messages between the queries.) Once ∆ 0 ⊕ ∆ 1 has been obtained, one can then query the tag of any pair of AD blocks A 0 , A 1 and forge the tag of A 1 , A 0 .

Remark 2. It is easy to check that Equation ( 2) is satisfied in practice. If it wasn't, then the existence of an unwanted partial period t:

Pr x [f (x ⊕ t) = f (x)] ≥ 1 2 ,
would imply a higher-order differential of probability greater than 1 2 for E K , which is impossible if E K is a pseudorandom permutation (in other words, E K would suffer from a classical break).

The Quantum Linearization Attack: Algorithmic Ideas

In this section, we present the algorithmic ideas underlying our new quantum linearization attack. To that end, we keep the example of OCB3 [43] introduced in Section 2.5. We explain a new way to forge with Q2 queries. The extensions and applications of this new idea will be explored in the next sections.

Note that to the best of our knowledge, this is the first application of the Deutsch and Bernstein-Vazirani algorithms for forgery attacks.

Attack on ΘCB with Deutsch's Algorithm

The attack of Section 2.5 works only because of the offsets. In fact, the existence of a controlled value (here x) XORed to a secret (here the offsets) has been so far a prerequisite of all Q2 attacks.

Here we present a forgery attack against the mode ΘCB3 [START_REF] Rogaway | Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC[END_REF]43], which is a more abstract version of OCB3 in which the block cipher E K is replaced by a tweakable block cipher (a family of independent block ciphers E K,t indexed by a tweak t). This is shown in Figure 2.

Here, the tweaks t 0 , . . . , t j , t * form an arbitrary sequence of distinct values, that depend only on the block index; the tweak t is the only one dependent on the IV. Again, we consider an empty message, but this time a single AD block that is either 0 or 1. We define i functions which truncate the output of such a call to the ith bit:

F i : {0, 1} → {0, 1} b → Trunc i ( E K,t 0 (b) ⊕ E K,t (0))
.

The functions F i change at each new superposition query (because the IV intervenes in E K,t (0)). Thus we need the ability to compute a query to F i using a single query to the untruncated mode itself. This is fortunately easy to do so using the truncation technique of [33].

With this single query, Deutsch's algorithm allows to recover the value:

Trunc i ( E K,t 0 (0) ⊕ E K,t (0)) ⊕ Trunc i ( E K,t 0 (1) ⊕ E K,t (0))
= Trunc i ( E K,t 0 (0) ⊕ E K,t 0 (1)) , and within n queries and uses of the algorithm, we can obtain the full value E K,t 0 (0) ⊕ E K,t 0 (1).

We can now forge valid messages as follows: we query a message with 0 as the first block, we XOR E K,t 0 (0) ⊕ E K,t 0 (1) to the tag, and we have obtained the tag of the same message with 1 replacing the first block. This works for any block and for any pair of messages.

This attack shows that XORing with an IV-dependent value, although it provides sufficient protection against forgeries in the classical setting (since ΘCB has a security proof), does not in the quantum setting.

Interestingly, it is possible to protect against this attack by using the IV in the TBC calls, as done by Bhaumik et al. in [9]. While this simple modification has practically no incidence on the classical security of the mode, it is crucial to obtain unforgeability in the quantum setting.

Another Example: XOR-MACs. In [4], two XOR-MAC constructions are defined, which can be attacked with Deutsch's algorithm. They are both based on a pseudorandom function F K and an IV. The first one, XMACR (randomized XOR scheme), considers that the IV is drawn uniformly at random, and the second one, XMACC (counter-based XOR scheme) that it is maintained as a counter. Both compute:

MAC(m 1 , . . . , m ; IV ) = F K (0 IV ) ⊕ 1≤i≤ F K (1 i m i ) .
Then, since the contribution of the IV is only XORed, forgeries can be made.

Using the Bernstein-Vazirani algorithm

We propose here a generalization of the previous attack, with longer queries. We now consider functions of the form g 1 (x 1 ) ⊕ g 2 (x 2 ) ⊕ • • • ⊕ g (x ) ⊕ C 13 with, as before, a C that is independent from all x i . Now, we can choose some arbitrary α 0 i and α 1 i , and consider the function

F j : {0, 1} → {0, 1} (b 1 , . . . , b ) → Trunc j i=1 g i (α b i i ) ⊕ C ,
It is easy to see that this function is affine: indeed, if we change the value of b i , then we add Trunc j g i (α 0 i ) ⊕ g i (α 1 i ) to the output. Hence, if we apply the Berstein-Vazirani algorithm, in one query, we recover the values of the Trunc j g i (α 0 i ) ⊕ g i (α 1 i ) , for all i. Next, it suffices to repeat the algorithm for each bit of the output to obtain the value of all the g i (α 0 i ) ⊕ g i (α 1 i ). This technique can be applied to OCB3 / ΘCB3, as the tag is a function of the form

i g k i (AD i ) ⊕ f k (IV, M )
Hence, we can attack multiple blocks of associated data at once.

Attacking any XOR of permutations

The main limitation of the previous attacks is that they need a direct access to the linear combination of independent blocks. In this section, we overcome this limitation with an attack that leverages linear combinations of permutations in a more intrinsic way, using Simon's algorithm in a novel fashion. We consider a MAC construction that processes m > n message blocks x 1 , . . . , x m by pushing the x i through independent TBC calls E K,i , XORing the result and applying an IV-dependent function afterwards.

IV, (x 1 , . . . , x m ) → f K IV, 1≤i≤m E K,i (x i ) .

Remark 3. We write the attack with a TBC, i.e., a family of independent block ciphers E K,T indexed by a secret key K and a public tweak T . This is to emphasize the application of our attack to parallelizable MACs; however, the attack works in the same way if we replace the independent block ciphers by independent functions.

In the case of ΘCB, the definition of f K is simple, since it only XORs the IV-and the AD-dependent parts. But the attack of Section 3.2 does not apply anymore if f K is a pseudorandom function. This will be the case of our new attack, which is why it will apply to many MAC constructions. Quantum Attack. First of all, it is easy to see that if the E K,i are independent block ciphers, and if f K is a pseudorandom function family, then this construction is a classically unforgeable MAC: this is the security of ΘCB3.

Our attack in the quantum setting starts from the same idea as above (Section 3.2): we query the MAC with arbitrary blocks taking two values: x 1 = b 1 ||0 n-1 , . . . , x m = b m ||0 n-1 , where x = b 1 . . . b m forms an m-bit input (in the remaining of this paper, we will write the n -1 zeroes used for completion as a single 0). We will put x in superposition, and so, there will be only "one superposed bit" in each individual block input.

One then observes that E K,1 (x 1 ) ⊕ . . . ⊕ E K,m (x m ) is an affine function of x:

F (x) := E K,1 (x 1 ) ⊕ . . . ⊕ E K,m (x m ) = i b i E K,i (0) ⊕ E K,i (1) ⊕ E K,i (0)
.

More precisely, if we identify bit-strings with boolean column vectors, F (b 1 . . . b m ) is equal to:

( E K,1 (0) ⊕ E K,1 (1)) • • • ( E K,m (0) ⊕ E K,m (1)
)

M m ×    b 1 . . . b m    ⊕ i E K,i (0)
.

The matrix M m has n rows and m columns, so when m ≥ n + 1, its kernel is nontrivial. This means there will exist a non-zero m-bit boolean vector α such that: and for all such vectors α, seen as m-bit strings, we have:

( E K,1 (0) ⊕ E K,1 (1)) • • • ( E K,m (0) ⊕ E K,m (1)
F (x ⊕ α) = M m × (x ⊕ α) ⊕ i E K,i (0) = F (x) .
In other words, this function F hides a subgroup of (F 2 ) m generated by all the vectors α satisfying the condition above (it is easy to see that they indeed form a group). Thus, F satisfies the promise of Simon's algorithm: by making a single superposition query, we can find y such that y • α = 0 for such an α, and furthermore, as Brassard and Høyer showed [20], we can even recover the full subspace of periods with a polynomial number of quantum queries to F . However, in our model, we cannot query F directly and we have instead access to: f K (IV, F (x)), where IV changes at each query. The key remark is that the hidden subgroup is unchanged, since F is independent of the IV . This assumption is enough to allow Simon's algorithm and its extensions to work.

Remark 4 (Smaller m). Some period might still arise if m ≤ n. Indeed, if m = n, there will be a non-trivial period with probability around 1 -1/e. This quickly decays for smaller m.

Remark 5 (Unwanted collisions). Since the "inner" function F is affine, it does not contain any unwanted collisions. If F (x ⊕ α) = F (x) for some α and x, 15 parallelizable beyond birthday-bound (BBB) MACs, although they have a larger internal state. Here is a summary of MACs attacked in this section (usually in time quadratic in the internal state size n), whose previous best quantum attack was exponential:

LightMAC [47], LightMAC+ [START_REF] Naito | Blockcipher-based MACs: beyond the birthday bound without message length[END_REF], Deoxys [38], ZMAC [37],

PMAC TBC3k [START_REF] Naito | Full PRF-secure message authentication code based on tweakable block cipher[END_REF] On the contrary, here are some MACs on which, to the best of our knowledge, our attack does not apply: SUM-ECBC [START_REF] Yasuda | The sum of CBC MACs is a secure PRF[END_REF], 2K-ECBC-Plus [24], 3kf9 [START_REF] Zhang | 3kf9: Enhancing 3GPP-MAC beyond the birthday bound[END_REF]. The best Q2 attacks on these remain exponential-time (usually O 2 n/2 or O 2 k/2 where n is the internal block size, and k the key size).

First Examples

We will consider MAC designs with or without IVs or nonces. When there is no IV, then the attack of Section 3.3 breaks them in the PO notion. This also shows that even though they usually yield classical PRFs, these constructions are not quantum-secure PRFs. When there is an IV, the MAC may be insecure as a PRF but still secure as a MAC (since the IV is changed at each query, and not repeated). Despite that, our attack may still yield a break, as we showed in the example of ΘCB above. In that case, the period that is recovered with Simon's algorithm is independent of the IV, and can be reused to forge a new valid (message, tag) pair under any previously queried IV. LightMAC. LightMAC [47] is based on an n-bit block cipher and separates the message in blocks of ns bits, where s ≤ n/2 is some parameter that limits the maximal message size. The function is the following:

LightMAC(m 1 , . . . , m ) = Trunc t E K 2 (m 10 * ) ⊕ -1 i=1 E K 1 (i s m i )
,

where the i s are s-bit constants. Calling LightMAC with single-bit blocks and using Simon's algorithm, we immediately obtain a sequence of indices j 1 , . . . , j v such that E K 1 (i j 1 1) ⊕ . . . ⊕ E K 1 (i j v 1) = E K 1 (i j 1 0) ⊕ . . . ⊕ E K 1 (i j v 0) and thus, we can produce existential forgeries, and universal forgeries of messages with a linear number of blocks. Deoxys. Due to the similarity of its MAC with ΘCB, our attack applies to all versions of Deoxys-II [38], one of the finalists of the CAESAR competition (it also applies to Deoxys-I). Protected Counter Sums. In [5], Bernstein defined the protected counter sum construction, which uses a pseudorandom function f : {0, 1} d+c → {0, 1} c to build a pseudorandom function with message space of at most 2 c -1 blocks of length d: f (m 1 , . . . , m ) = f (0 f (1 m 1 ) ⊕ . . . ⊕ f ( m )) .

The quantum linearization attack essentially shows that this construction, while classically sound, does not yield a quantum-secure pseudorandom function (even if f itself is a qPRF).

Attacks on BBB MACs

We consider here a variant of the previous construction typically used to design Beyond Birthday MACs. We focus on deterministic MACs, but as before, the same forgery attacks apply if IVs are used in the final processing of the tag.

In the most generic setting, the input x 1 , . . . , x m is processed with a TBC E K,i , then combined in two different ways:

(x 1 , . . . , x m ) → f K i E K,i (x i ), i 2 i E K,i (x i ) .
Here f K is a function whose details are insignificant for our attack.

A similar observation as above applies. By calling the MAC in superposition with messages of the form x = b 1 ||0, . . . , b m ||0, we will obtain a periodic function. Indeed, there are now two matrices M m and M m with n rows and m columns, and two column vectors C, C such that:

F (x) = F (b 1 , . . . , b m ) := f K    M m ×    b 1 . . . b m    ⊕ C, M m ×    b 1 . . . b m    ⊕ C    ,
where the columns of M m correspond to E K,i (0) ⊕ E K,i (1) and the columns of This α is a boolean period of F , for which M AC(x ⊕ α) = M AC(x). Again, the further we increase m, the bigger the subspace of periods will become. This whole space can be recovered using Brassard and Høyer's extension of Simon's algorithm [20] in polynomial time. Related works. In [30], Guo, Wang, Hu and Ye used combinations of Simon's algorithm and Grover's algorithm to design forgery attacks on many BBB MACs, in the Q2 setting. With this technique, they found two things. First, staterecovery attacks of complexity O 2 n/2 where n is the block size of the underlying block cipher, and the internal state is 2n bits in total. This comes from the fact that the same input blocks are processed in two branches separately. The standard use of Simon's algorithm, where a controlled message block x is XORed to an uncontrolled value, allows only to recover this value in one of the branches.

M m correspond to 2 i ( E K,i (0)⊕ E K,i (1)
The n bits on the other branch have to be guessed with a Grover search, and so, the attack is a Grover-meets-Simon [46] instance. And next, partial key-recovery attacks for parallelizable MACs, of complexity O 2 k/2 , where k is the partial key size (the total key size ranges from 3k to 5k). They consist in guessing part of the key and breaking the MAC by using a symmetry of the branches. To these attacks correspond classical partial key-recoveries of complexity O 2 k . Our attack has completely different requirements and offers different results. We need longer messages (of roughly 2n blocks in this setting), but when it applies, the complexity is always polynomial. Note that there are constructions targeted by Guo et al., such as SUM-ECBC, that we cannot attack since the blocks are processed sequentially and not linearly in parallel as we require. LightMAC+. LightMAC+ [START_REF] Naito | Blockcipher-based MACs: beyond the birthday bound without message length[END_REF], as its name suggests, is a BBB extension of LightMAC.

As shown in Figure 3, it processes message blocks m 1 , . . . , m as follows:

LightMAC+(m 1 , . . . , m ) = E K 1 (E K (1 s m 1 ) ⊕ . . . ⊕ E K ( s m ))

⊕ E K 2 (2 -1 E K (1 s m 1 ) ⊕ . . . ⊕ 2 0 E K ( s m ) ,
where the multiplications are done in the finite field F 2 n . This falls into our framework and is thus forgeable in quadratic time (about 2n blocks are required to embed a vector space in both branches, and this can then be recovered in a linear number of queries). PMAC+. It is a double-block hash-then-sum construction similar to LightMAC+, which also falls into our framework. In full generality, there are three keys K 1 , K 2 , K 3 . The message blocks m 1 , . . . , m are processed as follows:

y i = m i ⊕ 2 i E K 1 (0) ⊕ 2 2i E K 1 (1)
and then:

PMAC+(m 1 , . . . , m ) = E K 2 (E K 1 (y 1 ) ⊕ . . . E K 1 (y )) ⊕ E K 3 2 E K 1 (y 1 ) ⊕ . . . 2 E K 1 (y ) .
The masking by 2 i E K 1 (0) ⊕ 2 2i E K 1 (1) simply makes the processing of each block different, but this is insignificant for our attack. By recovering a period, we can create forgeries and break PMAC+ as a qPRF. Note that both LightMAC+ and PMAC+ were classically proven secure up to 2 3n/4 queries [41]. Besides, increasing the number of parallel branches may have consequences on the bound, but only increases the complexity of our attack by a constant factor. We considered here three-key versions, but of course, the twoand one-key versions [24,25] are similarly broken.

Other MACs

LAPMAC. LAPMAC was defined in [START_REF] Minematsu | A lightweight alternative to PMAC[END_REF]. The definition depends on some parallelization parameter µ. Successive chunks of µ message blocks will be processed in parallel through the block cipher E K (except the last one), then some tweak function depending on their index in the chunk. The results are XORed and encrypted again, before being XORed to the next chunk of µ message blocks, etc. When µ ≥ n, LAPMAC applied to n message blocks becomes similar to LightMAC or PMAC, and there is sufficient parallelization to perform our attack. Whether a variant of the attack applies for smaller values of µ is an interesting question. ZMAC. ZMAC [37] is a MAC that uses a TBC. It is based on the ZHASH doubleblock hash construction followed by a finalization function. We can simply focus on the abstraction ZHASH (see Fig. 5 in [37]):

ZHASH(X 1 , X 1 r , . . . , X l , X l r ) = i 2 l+1-i E i,X i r K (X i ), i X i r ⊕ i E i,X i r K (X i ) ,
where E t K is E K called with a tweak t. If we make the tweak inputs constant, then the construction is similar to PMAC+ with a TBC, and different random keyed permutations for each block. Our attack applies as well. PMAC with a TBC. Naito [START_REF] Naito | Full PRF-secure message authentication code based on tweakable block cipher[END_REF] showed that PMAC+ used with a TBC could achieve full PRF security (up to O (2 n ) queries). In this variant, the message blocks are processed independently with different tweaks. This has no consequence on our attack, which requires only O (n) queries of about 2n blocks each.

Attacks on MACs based on Universal Hashing

In this section, we focus on some attacks on MACs based on universal hashing. In particular, we give polynomial-time attacks on PolyMAC [36], GCM-SIV2, and we give a superposition attack on Poly1305 requiring about 32 queries.

Overview

Universal hash functions were introduced by Carter and Wegman in 1977 [21] in order to build secure MACs, and are now used in many MAC constructions and security proofs. The first proposal by Wegman and Carter was to hash the message and to encrypt the result with a one-time-pad. This defines a MAC with information-theoretic security, but the use of a one-time-pad is impractical, and it was soon suggested to replace it with the output of a PRF, i.e., to replace the one-time-pad by counter-mode encryption. This results in the Wegman-Carter 20 construction used in GCM and Poly1305-AES: M → H K 1 (M ) ⊕ F K 2 (N ) where F is a secure pseudorandom function family, and H an almost-XOR-universal hash function family.

Universal hash functions and MAC constructions

An almost-XOR-universal hash function family is a family of function H from {0, 1} * to {0, 1} n indexed by a key K ∈ K such that:

∀m = m , ∀d ∈ {0, 1} n , #{K ∈ K : H K (m) ⊕ H K (m ) = d} ≤ ε#K
The most widely used universal hash function construction is polynomial hashing. The input message is interpreted as the coefficients of a polynomial in a field F, and the polynomial is evaluated on the hash key:

PolyHash K : F → F m 1 , m 2 , . . . m → i=1 K i m i
Block cipher-based constructions such as the OCB3 MAC can also be analysed as universal hashing-based, using i E K (A i ⊕ ∆ i ) as a universal hash function.

There are many different ways to turn a universal hash function into a MAC:

One-time-MAC: H K (M ). If the universal hash function satisfies extra properties (it must be strongly universal), it can be used directly as a MAC, if a new key is used for each message. This construction is used in ChaCha20-Poly1305, Grain128A and Grain128AEAD [32]. Wegman-Carter: H K 1 (M ) ⊕ F K 2 (N ). The Wegman-Carter construction is a nonce-based MAC using a universal hash function H and a PRF F . It authenticates several messages using the same key, as long as the nonce N is not repeated (the security is lost as soon as two different messages are authenticated with the same key). This construction is used in GMAC. More generally, the construction H(M ) F (N ) with a group operation and F almost--universal is a secure MAC. This construction is used in Poly1305-AES. Hash-then-PRF: F K 2 (H K 1 (M )). The hash-then-PRF construction builds a deterministic MAC from a universal hash function H and a PRF F . The PolyMAC construction discussed below follows this design. More generally, security proofs for several block cipher-based MACs consider the MAC as following the hash-then-PRF construction; in particular this is the case of double-block hash-then-sum constructions [24]. WMAC: F K 2 (H K 1 (M ) N ). WMAC [10] is a generalization of the hashthen-PRF construction using an additional nonce input N to the PRF. This requires a PRF with a larger input, but provides higher security when nonces are unique, without breaking down when they are repeated. EWCDM: E K 3 (E K 2 (N ) ⊕ N ⊕ H K 1 (M )). The Encrypted Wegman-Carter with Davies-Meyer construction [23] is an alternative construction offering high security with a nonce with graceful degradation when nonces are repeated. Instead of using a 2n-bit PRF as in WMAC, it uses two calls to an n-bit block cipher.

Attacking Wegman-Carter MACs

All MACs following the Wegman-Carter construction are exposed to the attack using Deutsch's algorithm that we presented in Section 3.1. More precisely, an IV-respecting quantum adversary can retrieve the value of H K 1 (M 1 ) ⊕ H K 1 (M 2 ) for an arbitrary pair of messages M 1 , M 2 . He can then repeatedly query the tag of M 1 under new nonces, and produce corresponding valid tags for M 2 . When using the generalization with a group operation instead of ⊕, this simple attack does not apply. In particular, Poly1305-AES uses a modular addition and cannot be broken with Deutsch's algorithm, but we will show a dedicated attack in Section 5.5, using the fact that it is based on polynomial hashing.

Attacking Algebraic Universal Hash Functions

We can apply our linearization attack to MACs that reuse the same hash key for several messages, whether deterministic (like hash-then-PRF), or nonce-based (like Wegman-Carter, WMAC, and EWCDM). Indeed, it is enough for us to linearize the function H, and the attack applies regardless of the security of the operations that are computed afterwards, even if they involve a nonce.

Many Universal Hash Functions based on algebraic operations have a strong linear structure. In particular, polynomial hashing is a linear function of the message, making it a natural target for Simon's algorithm (in characteristic 2) or Shor's algorithm (in general). We describe concrete attacks against a few constructions.

PolyMAC. PolyMAC [24] is a double block hash-then-sum construction based on polynomial hashing. The generic construction uses two hashing keys K 1 , K 2 and two encryption keys K 3 , K 4 . For an -block message m 1 , . . . , m , this gives:

PolyMAC(m 1 , . . . , m ) = E K 3 K 1 m ⊕ K 2 1 m -1 ⊕ . . . ⊕ K 1 m 1 ⊕ E K 4 K 2 m ⊕ K 2 2 m -1 ⊕ . . . ⊕ K 2 m 1 .
If a single branch is used, then this looks like the GMAC construction [START_REF] Mcgrew | The security and performance of the galois/counter mode (GCM) of operation[END_REF] (but without a nonce), using polynomial hashing. GMAC was already attacked in [39] due to its similarities with CBC-MAC, and the fact that the nonce did not influence the embedded hidden shift. However, we can use our attack here. By taking -block message inputs with blocks 0 or 1, we will recover with Simon's algorithm a period b 1 • • • b such that:

i b i K i 1 = 0 and i b i K i 2 = 0 .
This immediately allows a forgery attack, but also, we can recover multiple such periods and solve the corresponding equations to recover K 1 and K 2 .

PolyMAC with Modular Additions. Interestingly, our attack applies as well when the polynomial hashing does not use XORs, but modular additions (modulo some value M ). However, Simon's algorithm has to be replaced by Shor's algorithm. Note that this is specific to polynomial hashing, and does not apply to LightMAC or PMAC-style constructions in general.

We can define:

PolyMAC+(m 1 , . . . , m ) = E K 3 K 1 m + K 2 1 m -1 + . . . + K 1 m 1 mod M ⊕ E K 4 K 2 m + K 2 2 m -1 + . . . + K 2 m 1 mod M .
In that case, we can remark that there exists periods a 1 , . . . , a such that:

K 1 a 1 + . . . + K 1 a mod M = 0 and K 2 a 1 + . . . + K 2 a mod M = 0 .

More precisely, these periods form a lattice in Z M , and for all of them, we have: Thus, the generalization by Mosca and Ekert [START_REF] Mosca | The hidden subgroup problem and eigenvalue estimation on a quantum computer[END_REF] of Shor's algorithm allows to retrieve the full lattice of these periods: we can not only forge, but also recover the internal hashing keys. GCM-SIV2. This is a double-block variant of GCM-SIV defined in [36]. The tag generation combines two independent polynomial hashes (with two keys K 1 , K 2 ) with a keyed-dependent combination function F K , of which we shall not study the details. This mode is nonce-based. With an empty associated data, the tag is computed as follows:

GCM-SIV2 -MAC(N, m 1 , . . . , m ) = F K (N ⊕ H K 1 (m 1 , . . . , m ), N ⊕ H K 2 (m 1 , . . . , m )) , where H K 1 and H K 2 are polynomial hashes (this would be similar for the tag of an empty message, replacing M by the associated data). Thus, although the MAC is nonce-dependent, it falls into our framework since the periods of the polynomial hashes remain independent of N . Other algebraic hashing constructions. There are many alternatives to polynomial hashing based on field operations. Several constructions are linear, such as the dot product construction, and Toeplitz hashing [42]. 4Some other constructions can be linearized using specially crafted messages. NMH * [31]. The NMH * universal hash function is defined as:

NMH * (M ) = (m 2i + K 2i )(m 2i+1 + K 2i+1 ) mod p
If we consider messages with blocks with an even index set to arbitrary constants, we obtain a linear function of the odd message blocks. Therefore, Shor's algorithm can break MACs based on this hash function that reuse the hash key.

BRW Hashing [7]. The BRW universal hash function is based on a class of polynomials that can be evaluated with /2 multiplications with inputs, using a single key. The construction is defined recursively, depending on the input length: This construction can also be linearized by setting message blocks with an even index set to arbitrary constants.

• BRW K () = 0 • BRW K (m 1 ) = m 1 • BRW K (m 1 , m 2 ) = m 1 K + m 2 • BRW K (m 1 , m 2 , m 3 ) = (K + m 1 ) (K 2 + m 2 ) + m 3 • BRW K (m 1 ,

Period-Finding against Poly1305

Poly1305 [6] is a polynomial MAC with some specific constraints that force a dedicated analysis. It has already been cryptanalysed in [18], where the authors proposed an attack in 2 38 time and queries. The authors managed to overcome the specific constraints by leveraging a hidden shift structure. The attack we propose here is drastically more efficient, and uses a hidden period instead.

Poly1305 uses a hashing key r of 124 bits with at most 106 non-zero bits and a 128-bit cipher key K. The MAC of a message m 1 , . . . , m with the nonce N is computed as: Poly1305(m 1 , . . . , m ) = (c 1 r + c 2 r -1 + . . . + c r 1 ) mod 2 130 -5 + AES K (N ) mod 2 128 , where c 1 , . . . , c are the padded message blocks obtained from the message blocks m 1 , . . . , m . When message blocks are full 128-bit blocks, the c i are simply obtained from the m i by adding 2 128 .

Let us assume that we query with two message blocks. We have: where C 1 , C 2 are constants of our query that depend on r, K, N . Since the computation ends with a reduction modulo 2 128 , which is smaller than 2 130 -5, we must actually use a compressed instance of Shor's algorithm [48]. This increases mildly the number of queries, by less than a factor 2. Hence, the periods of the function Poly1305(m 1 , m 2 ) are solutions of m 1 r +m 2 = 0 mod 2 130 -5.

As the period is modulo 2 130 -5 but the input is 128-bit long, we cannot do the query expected by Shor's algorithm. Still, the fraction of inputs we can actually query is large enough so that we can still apply Shor's algorithm with a partial query, and recover efficiently the period.

The initial query is:

1 2 128 2 128 -1 m 1 ,m 2 =0 |m 1 |m 2 |Poly1305(m 1 , m 2 ) = 1 2 128 2 128 -1 m 1 ,m 2 =0 |m 1 |m 2 |f (m 1 r + m 2 ) .
Here, f is a function that depends on r, K, N . The only relevant point is that it does not depend on m 1 , m 2 directly, but only on m 1 r + m 2 . For simplicity, in the following we assume f is a permutation. We will now apply the QFT over Z/(2 130 -5) on the input registers. We note p = 2 130 -5. We obtain Thus, we measure a tuple (x, y) = (0, 0) with x = yr with probability at least 1/16. As 2 130 -5 is prime, one such tuple is enough to recover r. Hence, we need at most 16 queries on average to recover r, assuming f is a permutation. Here, as f is a function, we rely on [48] to bound the increase by a factor 2. Note that as we are only a few bits of output short of having a permutation, this is a very loose bound. Overall, the attack will require no more than 32 queries.

On Parallelizable Quantum PRFs

Let us take a broader point of view. The deterministic MACs that we attacked in this paper all have common points. Besides allowing inputs of any length (as should be expected of any MAC construction), they • process their input blocks independently; • compute one or more linear functions, with XORs, of these processed input blocks; • process the authentication tag from the outputs of these linear functions.

These characteristics are to be expected from any MAC that is: • of average rate one, meaning that there are as many primitive calls as there are blocks; • parallelizable; • having an internal state of size O (n), independent of the query length. Our attack is easily defeated if the blocks are processed sequentially by calling a compression function, as in the NMAC construction. However, the construction becomes unparallelizable.

It may be possible to obtain a quantum-secure parallelizable qPRF using a tree hashing, where the blocks are placed at the leaves of a binary tree, and each node is computed by calling a (keyed) compression function on its two children. However, such a construction requires an internal state greater than O (n), and that increases with the amount of data. Typically to traverse the binary tree, we will need to remember O (log m) nodes, where m is the number of leaves. Open Question. If we stand by the characteristics listed above (efficient, parallelizable, constant internal state size), then it seems that the only solution is to use modular additions in place of XORs in the constructions that we attacked. In that case, our attack does not seem to work anymore, due to the fact that modular additions, contrary to XORs, are not involutive. Thus changing one of the blocks in our n-block queries does not modify involutively the result, which breaks the periodicity property that we used with Simon's algorithm.

This makes this option worth investigating, both from a provable security and a cryptanalysis perspective. Note that the situation is different from most attacks with Simon's algorithm, where the replacement of XORs by + changes the attack complexity from polynomial to subexponential (see [2,18]). In our case, it is possible that using + allows an exponential security level.

Conclusion

In this paper, we introduced a novel way of using quantum period-finding to break parallelizable MAC constructions in the superposition query model, breaking most of them in this setting. In full generality, our attack makes use of multiple blocks to embed a hidden period, a surprisingly simple idea that might have other applications. We gave new polynomial-time forgery or partial keyrecovery attacks on LightMAC, LightMAC+, PolyMAC, Poly1305, GCM-SIV2, Deoxys, ZMAC, PMAC TBC3k. Our attack is not mitigated by the use of multiple parallel branches (as in double-block hash-then-sum MACs). It can be prevented for IV-based MACs if the non-reused IV intervenes in the processing of all message blocks (as done in [9]).

These results show that we cannot obtain a parallelizable quantum-secure PRF by processing independently the message blocks, XORing the results, and then hashing the output. If modular additions are used instead of XORs, our attack does not apply anymore (except on polynomial hashing, which has a simpler structure). Overcoming this limitation, or on the contrary, proving the security of such a PRF, is an interesting open question.

HelloHello,Figure 1 . 1 :

 11 Figure 1.1: TLS: an example of secure channel establishment.

Figure 1 . 2 :Figure 1 . 3 :

 1213 Figure 1.2: The man-in-the-browser setting. var url = "https://10.0.0.1/index.html"; var xhr = new XMLHttpRequest; while(true) { xhr.open("HEAD", url, false); xhr.withCredentials = true; xhr.send(); xhr.abort(); }

"-Figure 1 . 4 :

 14 Figure 1.4: Hash function usage in certificates from top websites (150 000 certificates). Source: [HBK+11] (2009-2011), https://www.ssllabs.com/ssl-pulse/ (after 2012).

3 Figure 1 . 5 :

 315 Figure 1.5: SSL/TLS versions supported by top websites (150 000 websites). Source: https://www.ssllabs.com/ssl-pulse/.

Figure 2 . 1 :

 21 Figure 2.1: Iterated hash function.

2 5 +Figure 2 . 3 :Figure 2 . 4 :

 52324 Figure 2.3: Kelsey and Schneier's expandable message.

Figure 2 . 5 :

 25 Figure 2.5: Kelsey and Kohno's diamond structure.

⇝ (a 0 , b 1 )Figure 2 . 6 :

 0126 Figure 2.6: A single switch: jump from (a 0 , b 0 ) to (a 0 , b 1 ) by using M ′ (dashed lines) instead of M (solid lines).

Figure 2 . 7 :

 27 Figure 2.7: Overview of an interchange structure.

Figure 2 . 8 :

 28 Figure 2.8: Using of the interchange structure to reach output (A 1 , B 2 ).

Figure 2 . 9 :

 29 Figure 2.9: Preimage attack on the XOR combiner based on cycles.

Figure 2 . 10 :

 210 Figure 2.10: Improved preimage attack on the XOR combiner based on cycles.

Figure 3 . 1 :Figure 3 . 2 :

 3132 Figure 3.1: Colliding certificates using an identical-prefix collision.

( 1 )

 1 O , . . . , δ (r) O (see Figure 3.5).

Figure 3 . 3 :

 33 Figure 3.3: 2-block collision attack using a linear trail δ I δ M ⇝ δ O and two non-linear trails 0 ⇝ δ I and δ O ⇝ -δ I . Green values between bracket represent differences in the state.

Figure 3 . 4 :Figure 3 . 5 :

 3435 Figure 3.4: Single-block chosen-prefix collision attack with a birthday stage. The linear trail δ I ⇝ δ O is relaxed to reach a set S of feasible differences.

0 δFigure 3 . 6 : 0 δFigure 3 . 7 : 0 Figure 3 . 8 :

 036037038 Figure 3.6: Graph search.

Figure 3 . 9 :

 39 Figure 3.9: Construction of colliding OpenPGP identity certificates.The colors correspond to the packets hashed when computing the signature: first, the public key packet public key packet (with header), then the UserID UserID or user attribute user attribute, and finally the signature packet and trailer signature packet and trailer. Arrows show when a value is chosen in one key and copied to the other. We use the following symbols: 01 Value fixed by the specifications, or chosen in advance (length of fields, UserID, ...) ?? Bytes determined by the chosen-prefix collision algorithm !! Bytes selected after finding the collision, to generate an RSA modulus .. Bytes that are copied from the other certificate ** Time-stamps chosen by the attacker $$ Time-stamp chosen by the signer Underlined values correspond to packet headers (type and length).

Figure 3 . 10 :

 310 Figure 3.10: SIGMA': A mutually-authenticated key exchange protocol.

Figure 3 . 11 :

 311 Figure 3.11: Man-in-the-middle credential forwarding attack on SIGMA'. The attacker creates a transcript collision by tampering with the messages shown in red. At the end of the protocol, the client and server have seemingly authenticated each other, but the attacker knows both connection keys, and hence can read or write any data.

  then the tags collide because the first two blocks processed by the hash function are the same as in the internal collision h

Figure 4 . 1 :

 41 Figure 4.1: Hash-based MAC. Only the initial value and the final transformation are keyed.

Figure 4 . 2 :

 42 Figure 4.2: Cycle-based collision.

x

  by comparing the tags of M ∥ b and M ∥ b ′ . Building the filter has complexity O(2 n/2 ) and using it has complexity O(|M |).

Figure 4 . 3 :

 43 Figure 4.3: Chain-based state recovery.We detect a match between the gray points ( ) using the diamond test built online.

Figure 4 . 5 :

 45 Figure 4.5: Trade-offs between the message length and the complexity for state-recovery attacks.

Figure 5 . 2 :

 52 Figure 5.2: CTR mode.

Chapter 7 . 1 τFigure 7 . 4 :

 7174 Figure 7.4: GMAC.

Figure 7 . 5 :

 75 Figure 7.5: ΘCB3 used as a MAC.

Fig. 4 .

 4 Fig. 4. Using of the interchange structure to reach output (A 1 , B 2 )

Fig. 7 .

 7 Fig. 7. Optimized interchange structure

Fig. 1 :

 1 Fig. 1: Narrow-pipe Merkle-Damgård hash function

2 M

 2 m L : Target message or computed preimage ( of L massage blocks) L : Length of M (measured in the number of blocks) : The binary logarithm of the length of the message M , i.e., denote L = : Computed second preimage L : Length of M (measured in the number of blocks) a 0 , . . . , a L : Sequence of internal states computed during the invocation of h 1 on M , a 0 = IV 1 b 0 , . . . , b L : Sequence of internal states computed during the invocation of h 2 on M , b 0 = IV 2 x, y : Computed internal states a j , b k : Chains of internal states for H 1 and H 2 , respectively. a j denotes a generic chain, while a j 0 denotes a particular chain A j , B k : End points (final states) of the chains n : Bit-size of the output of each underlying hash function (H 1 and H 2 ); In addition, we suppose their compression functions h 1 and h 2 have n-bit internal states (i.e., suppose the underlying hash functions are narrow-pipe) b : Bit-size of a message block N :

  and M are selected from M MC to generate a collision (defining the new b k1 ), then b k0 is evaluated using M .a If this is not the case, we build a new multi-collision. b We omit the illustration of step 3 for simplicity in the figure.

Algorithm 3 : 0 = 0 =

 300 Building and using a 2 t -interchange structure 1. Initialize the first chains with a 0 IV 1 , b 0 IV 2 , and set the other starting points randomly. 2. Build switches to jump for an already reachable pair ( a j 0 , b k 0 ) to a different pair ( a j 0 , b k 1 ) (or to ( a j 1 , b k 0 ), respectively). By using 2 2t -1 switches, we can make all pairs reachable. There are many ways to combine the switches; a simple one can be described as follows: (a) first, build switches from ( a 0 , b 0 ) to each of the ( a 0 , b k )'s; (b) then, for each k, build a series of switches from ( a 0 , b k ) to all the ( a j , b k )'s. To reach the chains ( a j , b k ), one would activate the k-th switch in the first part to jump from ( a 0 , b 0 ) to ( a 0 , b k ), and then the j-th switch in the k-th series of the second part to jump from ( a 0 , b k ) to ( a j , b k ).

Algorithm 5 :

 5 Expanding the functional graph of f 1. Initialize G = ∅ as a data structure of evaluated nodes. 2. Until G contains 2 t nodes:

  these messages, 2 C-1 are of length b (obtained by combining one of the 2 C-1 Joux's multi-collisions with m i ). We denote this set of messages by M shorti , where b = C. ii. Out of these messages, 2 C-1 are of length b (obtained by combining one of the 2 C-1 Joux's multi-collisions with [0] s m i ) and we denote this set of messages by M long i , where b

  (a) Select a random single-block message w. (b) Initialize a table T y as empty. (c) For each of the 2 r states y ∈ Y: -Compute y 0 = h 2 (y , w) -Derive the distance d ȳ of y 0 from the target node ȳ in FG f 2 (if it is undefined ⊥, go to Step 7a), store (y , d ȳ ) in T y . (d) For each of the 2 r states x ∈ X :

  d , and go to the next step. 60 8. Select a message fragment M E ∈ M SEM with a proper length q

68 -Step 1 - 2 - 3 - 4 - 5 - 6 - 8 -

 1234568 Step Step Step Step Step Step 7 ∼ Step

Fig. 14 :

 14 Fig. 14: Optimized interchange structure

Fig. 1 .Fig. 2 .

 12 Fig. 1. 2-block collision attack using a linear trail δ I δ M δ O and two non-linear trails 0 δ I and δ O -δ I . Green values between bracket represent differences in the state.

Figure 1 :

 1 Figure 1: 2-block collision attack using a linear trail δ I δ M δ O and two non-linear trails 0 δ I and δ O -δ I in the first 10∼15 steps. Green values between bracket represent differences in the state.

0 δFigure 4 : 0 δFigure 5 : 0 Figure 6 : 0 Figure 7 :

 04050607 Figure 4: Graph search.

14 SHA- 1

 141 is a Shambles

  0x0300 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← !! !! !! !! !! !! !! !! !! !! !! 00 11 01 00 01 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← d1 00 00 01 19 c0 57 01 10 00 01 01 00 00 00 00 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← 00 00 00 00 00 00 00 00 ff d8 ff db 00 43 00 ff .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0x0340 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← c0 00 0b 08 00 40 00 58 01 01 11 00 ff c4 00 28 0x0380 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← 00 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← 00 00 04 03 10 01 00 00 00 00 00 00 00 00 00 00 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← 00 00 00 00 00 00 ff da 00 08 01 01 00 00 3f 00 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← d0 4e a0 01 3a 80 04 ea 01 3a 80 04 e0 00 a0 13 0x03c0 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ← 8a 13 82 84 e2 84 e0 00 00 28 4e 00 0a 13 8a 13 .. .. .. .. .. .. .. .. .. .. .. .. .. !! !! !! ↔ a8 00 4e a1 3a 80 4e 28 4e 28 07 ff d9 .. .. .. !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! → .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! → .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 0x0400 !! !! !! !! !! !! !! !! !! !! !! 00 11 01 00 01 → .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. b4 00 00 00 19 41 6c 69 63 65 20 3c 61 6c 69 63 → .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 3e 04 10 → .. .. .. .. .. .. .. .. .. .. .. .. .. .. 04 10 01 02 00 06 05 02 .. .. .. .. 04 ff 00 00 00 0c ← 01 02 00 06 05 02 $$ $$ $$ $$ 04 ff 00 00 00 0c

Figure 8 :

 8 Figure 8: Construction of colliding OpenPGP identity certificates. The colour corresponds to the packets hashed when computing the signature: first, the public key packet (with header), then the UserID or user attribute , and finally the signature packet and trailer . Arrows show when a value is chosen in one key and copied to the other.

Figure 9 :

 9 Figure 9: Boomerangs' differential paths used for SHA-1 with the corresponding constraints forced in order to have probability one in the 16 first steps. The red one (perturbation

Figure 11 :

 11 Figure 11: Key A

Figure 13 :

 13 Figure 13: Chosen-prefix collision for SHA-1. The colors show the prefix , the birthday bits , and the near-collision blocks . Both messages lead to the same SHA-1 value: 8ac60ba76f1999a1ab70223f225aefdc78d4ddc0

Fig. 2 .

 2 Fig. 2. Man-in-the-middle credential forwarding attack on SIGMA'. The attacker creates a transcript collision by tampering with the messages shown in red. At the end of the protocol, the client and server have seemingly authenticated each other, but the attacker knows both connection keys, and hence can read or write any data.

Fig. 4 .

 4 Fig. 4. Man-in-the-middle client signature forwarding attack on TLS 1.2. The client C connects to a malicious server A and offers to authenticate with its certificate cert C . The attacker A computes a chosen-prefix collision on the client signature transcript hash(log 1 ), and uses it to impersonate the client at a different server S. Messages that the attacker controls are labeled in red. A sends a bogus Diffie-Hellman group (k 2k, k) to C; we use k = g here for simplicity. such that C 1 appears within the last distinguished name dn in SCR and C 2 appears within the last extension ex c in CH : hash(CH|SH |SC |SKE |SCR (C 1 |dn )) = hash(CH (n c , C 2 ex c

Fig. 5 .

 5 Fig. 5. TLS 1.3: A server-authenticated 1-RTT (EC)DHE handshake based on draft 10 of the specification. The client and server send their key shares within the hello messages and all subsequent handshake messages are encrypted. The server signs the current handshake transcript hash(log 2 ) in a new SCV message.

Fig. 6 .

 6 Fig. 6.Man-in-the-middle credential forwarding attack on tls-unique channel binding. The attack uses a transcript collision to impersonate the client to the server.

Figure 6

 6 Figure 6 depicts the attack. It follows the general pattern of the TLS 1.2 client authentication attack, except that it relies on a collision on the transcript MAC in the client finished message, rather than a collision in the hash function. The client C connects to the MitM A who then opens a new connection to S.The attacker sends a SKE to C that contains a bogus group (k 2 -1, k), thereby forcing the client to send k x mod (k 2 -1) = k in its client key exchange CKE. On the server side, the attacker can send its own CKE containing any Diffie-Hellman value. Hence, the MitM knows the master secrets ms c , ms s and connection keys on both connections.

11

 11

Fig. 7 .

 7 Fig. 7. IKEv2: A mutually-authenticated key exchange. Message parts colored in red can have arbitrary length.

Figure 11 in

 11 Figure 11 in Appendix depicts an attack on IKEv2 initiator authentication that relies on a transcript collision on this signature. The network attacker intercepts the SA INIT request from I to R and responds with a cookie ck. The initiator I restarts the key exchange by including ck in the new SA INIT request (m 1 ).However, the attacker has chosen ck in a way that the hash of m 1 is the same as the hash of a tampered SA INIT request m 1 that contains the attacker's Diffie-Hellman public value g x . The attacker sends this tampered request m 1 to the responder and upon receiving a response, it tampers with the response to replace R's Diffie-Hellman key g y with its own key g y . Note that the attacker does not tamper with the nonces n i , n r .

Fig. 8 .

 8 Fig. 8. SSH-2: Key exchange and user authentication.

(

  embedded in) ID i on the server side, until the PRF values on the two sides collide. It can then forward I's signature to R, even though it knows the Diffie-Hellman shared secret. When the PRF is HMAC-MD5, this generic collision attack costs about 2 * 2 64 HMAC computations per connection.

5 )

 5 Red Hat issued backported patches RHEL 6 and 7 to disable MD5 signatures in their version of OpenSSL version 1.0.1e. 6) NSS 3.21 (FireFox 43) disabled support for MD5 server signatures; MD5-based client signatures were already disabled. 7) GnuTLS 3.3.15 disabled MD5 signatures in the default configuration. 8) BouncyCastle Java 1.54 (C# 1.8.1) disabled

Fig. 11 .

 11 Fig. 11. Man-in-the-middle initiator impersonation attack on IKEv2.The initiator I connects to the responder R but a man-in-the-middle attacker A intercepts and tampers with some messages (shown in red). A pecomputes a collision (C1, C2) between the prefixes of two SA INIT messages that both begin with a cookie payload. Then by sending a carefully crafted cookie to I, A can trigger a transcript collision on the initiator signature, which it can then forward to R, thereby impersonating I on a connection that it controls.

Fig. 12 .

 12 Fig. 12. Man-in-the-middle downgrade attack on SSH-2. The client C connects to a server S, but a network attacker A tampers with the key exchange messages (shown in red) to downgrade them to a weak ciphersuite. To succeed, A must compute a chosen-prefix collision on the session hash H after receiving C's key exchange message.

17

 17

  276

Fig. 1 .

 1 Fig. 1. Hash-based MAC. Only the initial value and the final transformation are keyed.

Fig. 4 . 1

 41 Fig. 4. Functional graph of Keccak (SHA-3) with 8-bit input and 8-bit output.

Attack 1 :

 1 State-recovery attack against HMAC with HAIFA Complexity Õ(2 -s ), with s ≤ /5 (min: 2 4 /5 ) 1. (online) Fix a message C of length 2 s . Query the oracle with 2 u messages M i = [i] C. Build an online diamond filter for the set of unknown states X, obtained after M i . 2. (offline) Starting from 2 t arbitrary starting points, iterate the compression function with the fixed message C.

Attack 2 :

 2 Chain-based tradeoff for HMAC with Merkle-Damgård Complexity O(2 -s ), with s ≤ /3 (min: 2 2 /3 )

Attack 3 :

 3 Cycle-based tradeoff for HMAC with Merkle-Damgård Complexity O(2 2 -3s ), with s ≤ /2 (min: 2 /2 ) 1. (offline) Search for a cycle in the functional graph of f = h [0] , using the algorithm of Section 3.1 with chains of length 2 s . Denote the length of the cycle by L, and its entry point by x. Build a collision filter for x. 2. (online) For different values of the message block [b], query the MAC oracle with two messages

Attack 7 :

 7 Universal forgery attack using chains (first phase) Complexity Õ(2 -s ), with s ≤ /7 (min: 2 6 /7 ) Query length: O(2 2s ) 1. (online) Query the oracle with 2 s messages M i = C |i [0] 2 2s -i . Denote the set of (unknown) final states of the chains by Y . Build an online diamond filter for all states in Y . 2. (offline) Compute a structure of chains containing a total of 2 -s points.

Attack 8 :

 8 Universal forgery attack using collisions (first phase) Complexity O(2 -s/2 ), with s ≤ 2 /5 (min: 2 4 /5 ) Query length: O(2 s ) 1. (online) Query the oracle with 2 s messages

Algorithm 2 :

 2 Universal Forgery Attack (second phase) Complexity Õ(2 -s ), with s ≤ /2 32 Itai Dinur, Gaëtan Leurent

c 2016

 2016 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-4139-4/16/10. . . $15.00 DOI: http://dx.doi.org/10.1145/2976749.2978423

Figure 1 :

 1 Figure 1: The Beastly attacker model for HTTPS: A network attacker injects JavaScript on some window in the user's browser, which then makes cross-origin HTTPS requests to a target website. The browser attaches a secret cookie or HTTP BasicAuth password to authenticate each request. The attacker observes the encrypted traffic stream and tries to recover the secret.

Figure 2 :

 2 Figure 2: CBC mode cipher will admit attacks that employ σ = 2 n/2 blocks. [...]

Figure 3 :

 3 Figure 3: CTR mode

  GET /path/to/file HTTP/1.1 User-Agent: Mozilla/4.0 ... Host: domain.com Cookie: C=XXXXX Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: Keep-Alive

Algorithm 4 .

 4 Fast Walsh-Hadamard Transform Input: C A , |C A | = 2 m Output: The Walsh-Hadamard transform of C A for d = m downto 0 do for i = 0 to 2 m-d do for

  with H the hash key and (•) the multiplication in a Galois Field defined by a public polynomial. So, for two different blocks of authenticated data A and A 16 358 Symmetric Cryptanalysis Beyond Primitives we collect O( √ n • 2 2n/3 ) MACs and perform the fast convolution algorithm to recover

20

 20

Fig. 3 .Fig. 4 .Fig. 5 . 48 Fig. 6 .

 345486 Fig. 3. Results for lists size of 3 • 2 2n/3

  with δ = 2-16

L

  m

Fig. 4 .

 4 Fig. 4. Diagram for PMAC+ with a -block message where ∆ 0 = E 1 (0) and ∆ 1 = E 1 (1).

  0|m

Fig. 5 .

 5 Fig. 5. Diagram for LightMAC+ with (nz)-bit blocks of a -block message where (v) z is the value v written over z bits.

Fig. 6 .

 6 Fig. 6. Diagram for 3kf9 with a -block message.

Finally, we showFig. 7 .

 7 Fig. 7. Diagram for 1kf9 with a -block message.

1 ⇒ 0 Σ

 10 Therefore, we define the relation R as:R(X, Y ) := Σ (X) = Σ (Y ) 2Θ (X) = 2Θ (Y ) ⊕ MAC(X) = MAC(Y ).We build the messages with different postfixes, parametrized by u:X = φ u (x) = x u Y = ψ u (y) = y u ⊕ d,where d is the inverse of 2 in the finite field. With this construction, we haveΣ (φ u (x)) = E u ⊕ E(x ⊕ E(0)) Θ (φ u (x)) = E u ⊕ E(x ⊕ E(0)) ⊕ E x ⊕ E(0) ⊕ E (ψ u (y)) = E u ⊕ d ⊕ E(y ⊕ E(0)) Θ (ψ u (y)) = E u ⊕ d ⊕ E(y ⊕ E(0)) ⊕ E y ⊕ E(0) ⊕ E 0In particular, we observeE(x ⊕ E(0)) ⊕ E(y ⊕ E(0)) = d ⇔ Σ (φ u (x)) = Σ (ψ u (y)) ⇒ Θ (φ u (x)) ⊕ Θ (ψ u (y)) = d⇒ MAC(φ u (x)) = MAC(ψ u (y)).

Σ

  (M ) = i=1 Ẽi (m i ) Σ(M ) = fix0(Σ (M )) Θ (M ) = i=1 2 +1-i Ẽi (m i ) Θ(M ) = fix1(Θ (M )) MAC(M ) = E(Σ(M )) ⊕ E(Θ(M ))

Fig. 8 .

 8 Fig. 8. Diagram for 1kPMAC+ with a -block message where ∆ 1 = E(1) and ∆ 2 = E(2).

1 2

 1 Indeed we haveMAC(φ u (i)) = E fix0 Ẽ1 (u) ⊕ Ẽ2 (x) Σ u (i) ⊕ E fix1 4 Ẽ1 (u) ⊕ 2 Ẽ2 (x) Θ u (i)We observe that:R(x, y, z, t) ⇔          Ẽ2 (x) = Ẽ2 (y) ⊕ 1 Ẽ2 (z) = Ẽ2 (t) ⊕ Ẽ2 (x) = 2 Ẽ2 (z) ⊕ 1 2 Ẽ2 (y) = 2 Ẽ2 (t) ⊕ 1 ) ⊕ Ẽ2 (y) ⊕ Ẽ2 (z) ⊕ Ẽ2 (t) = 0 Ẽ2 (x) = Ẽ2 (y) ⊕ 1 Ẽ2 (x) = Ẽ2 (z) ⊕ dTherefore, R defines a 3n-bit relation that is independent of the value u. This can be used for attacks in the same way as in the previous sections, using a single list L = MAC(φ 0 (x)) MAC(φ 1 (x)) MAC(φ 2 (x)) : x < 2 3n/4

Fig. 1 .

 1 Fig. 1. The quantum cryptographic oracle.

√ 2 n

 2 y∈{0,1} n (-1) x•y |y , where x • y := x 1 y 1 ⊕ • • • ⊕ x n y n .The algorithm repeats the following five quantum steps.1. Starting with a 2n-qubit state |0 |0 , one applies a Hadamard transform H ⊗nto the first register to obtain the quantum superposition

2. A quantum query to the function f maps this to the state 1

 1

3 . 4 .(- 1 )

 341 Measuring the second register in the computational basis yields a value f (z) and collapses the first register to the state:1 √ 2 (|z + |z ⊕ s ).Applying again the Hadamard transform H ⊗n to the first register gives: y•z (1 + (-1) y•s ) |y .

|b U α |α b 2 . 1 . 2 . 3 .

 2123 One-to-one mapping. Controlled Unitary.

Fig. 2 .

 2 Fig. 2. Circuit representation of basic building blocks.

Fig. 3 .Fig. 4 .

 34 Fig.3. Three-round Feistel scheme.

2 E k 1 Fig. 5 .Fig. 6 .

 2156 Fig. 5. Even-Mansour scheme.

1 .

 1 LRW construction.

7 . 2 .

 72 XEX construction.

7 . 3 .

 73 XE construction.

Fig. 7 .

 7 Fig. 7. The LRW construction, and efficient instantiations XEX (CCA secure) and XE (only CPA secure).

Fig. 8 .

 8 Fig. 8. Simon's function for LRW.

Fig. 9 .

 9 Fig. 9. Encrypt-last-block CBC-MAC.

Fig. 10 .Fig. 11 .

 1011 Fig. 10. Simon's function for CBC-MAC.

1 τFig. 12 .

 112 Fig. 12. GMAC

2 = 2 1 +

 221 n y∈{0,1} n (-1) x•y |y |f (x) =2 -n y∈{0,1} n s.t. y•t=0 x∈{0,1} n (-1) x•y |y |f (x) + 2 -n y∈{0,1} n s.t. y•t=1 x∈{0,1} n (-1) x•y |y |f (x) .The probability of obtaining u such that u • t = 0 is given byPr u [u • t = 0] = 2 -n y∈{0,1} n s.t. y•t=0 |y x∈{0,1} n (-1) x•y |f (x) -2n y∈{0,1} n s.t. y•t=0 x,x ∈{0,1} n (-1) (x⊕x )•y f (x )|f (x) = 2 -2n x,x ∈{0,1} n f (x )|f (x) y∈{0,1} n s.t. y•t=0 (-1) (x⊕x )•y = 2 -2n x,x ∈{0,1} n f (x )|f (x) 2 n-1 (δ x,x + δ x ,x⊕t ) Pr x [f (x) = f (x ⊕ t)]

√ 2 |0

 2 + (-1) b |1 . By applying Hadamard gates to each individual qubit of an n-bit input, we compute the Hadamard transform, a particular example of Quantum Fourier Transform:H ⊗n : |x → 1 2 n/2 y∈{0,1} n (-1) x•y |y .

1 √y

 1 x,y α xy |x |y , measuring the register |x yields a value x 0 with probability y |α x 0 y | 2 , and projects on the state |α x 0 y | 2 y α x 0 y |y .

3 : 4 : 2 :

 342 Apply O f,± (-1) f (0) |0 + (-1) f (1) |1 = (-1) f (0) |0 + (-1) f (0)⊕f (1) |1 Apply a Hadamard gate (-1) f (0) |f (0) ⊕ f (1) 5: Measure the state Algorithm 2 Bernstein-Vazirani algorithm 1: Start from |0 n |0 n Apply a Hadamard transform i |i 3: Apply O f,± i (-1) (a•i)⊕b |i 4: Apply a Hadamard transform 5: Measure the state (-1) b H ⊗n i (-1) a•i |i = (-1) b H ⊗n H ⊗n |a = (-1) b |a Problem 1 (Deutsch's problem). Given access to a quantum oracle O f for a function f : {0, 1} → {0, 1}, decide whether f is constant (f (0) = f (1)) or balanced (f (0) = f (1)).

Algorithm 4 Shor's algorithm 1 : 5 : 6 :

 4156 Start from |0, 0, 0 m |0, 0, 0 m 2: Apply a Quantum Fourier Transform on both input registers p-1 x,y=0 |x, y |0 m 3: Apply O f p-1 x,y=0 |x, y |f (x, y) 4: Measure the second register. The state collapses on a uniform superposition of all (x, y) such that xs + y = a mod p for some unknown a, meaning y = axs mod p: Apply a Quantum Fourier Transform again. The state becomes: Measure a |z, t and return s = zt -1 mod p.

M 0 ⊕Fig. 1 .

 01 Fig. 1. Computation of the tag in OCB3. Only the offset ∆ IV depends on the IV .

11

 11

A 0 E K,t 0 A 1 E

 001

M 0 ⊕TFig. 2 .

 02 Fig. 2. Computation of the tag in ΘCB3. Only the final tweak t depends on the IV.

17

 17

  ). Then, as soon as m ≥ 2n+1, the matrix: M m M m has 2n rows and at least 2n + 1 columns, and so, it has a non-trivial kernel. There exists a non-zero vector α such thatM m α = M m α =

∀m 1 ,

 1 . . . , m , PolyMAC+(m 1 + a 1 , . . . , m + a ) = PolyMAC+(m 1 , . . . , m ) .

Poly1305(m 1 , m 2 ) = m 1 + 2 128 • r 2 + m 2 + 2 128 • r mod 2 130 - 5 +

 12122225 AES K (N ) mod 2 128 = ((m 1 • r + m 2 ) • r + C 1 ) mod 2 130 -5 + C 2 mod 2 128 ,

Two inputs (m 1 5 ⇔ (m 1 -

 151 , m 2 ) and (m 1 , m 2 ) lead to the same tag ifm 1 r + m 2 = m 1 r + m 2 mod 2 130m 1 )r + (m 2m 2 ) = 0 mod 2 130 -5 .

xm 1 m 1 ,m 2 =0 m 1 r+m 2 =c exp 2iπ xm 1 + y(c -m 1 1 m 1 ,m 2 =0 m 1 r+m 2 =c exp 2iπ m 1 25 454#{0 ≤ m 1 , m 2 < 2 128 : m 1 r + m 2 = c} 2 Now, as x → x 2 2 . 2 = p -1 p2 256 1 p #{0 ≤ m 1 , m 2 < 2 128 } 2 =

 1121111212512222221122 + ym 2 p |x |y |f (m 1 r + m 2 ) . We can rewrite the state by regrouping components with identical m 1 r + m 2 : (xyr) p |x |y |f (c) Now, we can compute the probability to measure a nonzero tuple (x, y) with x = yr. Symmetric Cryptanalysis Beyond Primitives As there are p -1 such tuples, the overall probability is is a convex function, we can use Jensen's inequality: This allows us to lower bound the previous probability by p -1 p 2 2 256 p ≤ m 1 , m 2 < 2 128 : m 1 r + m 2 = c}

Table 3 . 1 :

 31 Complexity of collision attacks (SHA-1 equivalents on GTX 1060 GPU)

	Function	MD5 (n = 128)	SHA-1 (n = 160) previous § 3.2 (w/ multicollision) MD5 ∥ SHA-1
	Collision CP collision 2 39.1 [SSA+09] 2 77.1 [Ste13] 2 16 [SSA+09] 2 64.7 [SBK+17] 2 61.6 2 67.6 2 63.5 2 67.6

  8 ZB (2 73 bytes) in 2021 [Sta22b], and the global Internet traffic is estimated around 4 ZB (2 72 bytes) per year in 2022 [Sta22a].

  1,2 , Itai Dinur 3 , Jian Guo 1 , Gaëtan Leurent 4 , and Lei Wang5,6

	1 Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore baozhenzhen10@gmail.com, guojian@ntu.edu.sg 2 Strategic Centre for Research in Privacy-Preserving Technologies and Systems, Nanyang Technological University, Singapore 3 Department of Computer Science, Ben-Gurion University, Israel dinuri@cs.bgu.ac.il 4 Inria, France gaetan.leurent@inria.fr 5 Shanghai Jiao Tong University, Shanghai, China 6 Westone Cryptologic Research Center, Beijing, China wanglei_hb@sjtu.edu.cn

  Cycles in Functional GraphAll computational complexities of the attacks are presented ignoring the polynomial factors.

			0.5n -
	r : min(b, n)	L : 2nd preimage length	MC: Joux's Multi-Collisions
	EM: Kelsey and Schneier's Expandable Message DS: Diamond Structure
	IS: Interchange Structure	SEM: Simultaneous Expandable Message
	FGDI: Deep-Iterates in Functional Graph	FGMC: Multi-

Table 1 :

 1 Security status of various combiners of two narrow-pipe hashes

	12

Notations and Roadmap of the Rest of Paper Notations.

  We summarize below notations shared across various attacks.

	H 1 , IV 1 , h 1 , h * 1 ,	H 2 IV 2 h 2 h * 2	: Underlying hash functions in a hash combiner : Initialization vectors of H 1 and H 2 , respectively : Compression functions of H 1 and H 2 , respectively : Compression functions iterated over several blocks (in particular,

Preimage attack on XOR combiner based on deep iter- ates -Phase 1:

  Build a simultaneously expandable message M SEM for H 1 and H 2 , starting from the initial state pair (IV 1 , IV 2

	142	Symmetric Cryptanalysis Beyond Primitives
	Attack 2:
		32

of Attack 4: Finding a target state pair 1

  . Fix an arbitrary single-block value m and get f 1 (•)h 1 (•, m) and f 2 (•) h 2 (•, m).2. Expand FG f 1 using Alg. 5 with parameter g 1 . Store all encountered 2 n-g 1 -th iterates in a table T 1 . 3. Expand FG f 2 using Alg. 5 with parameter g 1 . Store all encountered 2 n-g 1 -th iterates in a table T 2 . 4. For single-block values m = 0, 1, . . ., perform the following steps:(a) For each node x ∈ T 1 , evaluate x = h 1 (x, m ) and store the matches x = a i with the a sequence a 1 , . . . , a L in a table T 1 , sorted according to the index i of a i . (b) Similarly, for each node y ∈ T 2 evaluate y = h 2 (y, m ) and look for matches y = b

m) and let g 1 ≥ n/2 be a parameter (to be determined later). Our goal is to find a pair of states (x, ȳ), a message block m and an index p such that the following two conditions hold: Phase 2 j with the sequence b 1 , . . . , b L . For each match with some b j , search for the index j in the table T 1 . If a match i = j is found, set p i (namely, (a p , b p ) (x , y )), m m and (x, ȳ) (x, y). This gives (x, ȳ) m -→ (a p , b p ), as required. Otherwise, (no match i = j is found), go back to Step 4.

Second-preimage attack on the Zipper hash -Phase 1:

  Get a cyclic node x (resp. ȳ) located in the largest component of FG f 1 (resp. FG f 2 ); Get the cycle length L 1 (resp. L 2 ), and compute the set of correctable distance bias D = {i • ∆L mod L 1 | i = 0, 1, . . . , #C}, where ∆L = L 2 mod L 1 and #C is the number of cycles to the maximum. After that, generate a Joux's multi-collision M MC1 (resp. M MC2 ) starting from x (resp. ȳ) and denote its final endpoints by x (resp. ŷ).-Phase 2: Build a cascade simultaneous expandable message M SEM across the two passes starting from x and denote its final endpoint by ỹ. -Phase 3: Find a message block m mapping the final endpoint ŷ of the second Joux's multi-collision M MC2 to one of the chaining states b p in the second pass of the original message; Then, in the first pass, use m to update the corresponding chaining state a p to a state x.

	Attack 5:
	attack.	and	←-M is the reverse of M . Here, we briefly list the main steps of the
			52

  Run the cycle search algorithm several times to locate the largest cycles C 1 and C 2 in FG f 1 and FG f 2 , get the cycle lengths L 1 and L 2 . Without loss of generality, assume L 1 ≤ L 2 . (b) Pick a cyclic node x located in C 1 and a cyclic node ȳ located in C 2 . (c) Compute the set of correctable distance bias D = {i • ∆L mod L 1 | i = 0, 1, . . . , #C} as in Step 2 of Attack 3.2. Run Alg. 5 with a parameter t to develop 2 t nodes in FG f 1 (resp. FG f 2 ), compute their distance from the target node x (resp. ȳ). Store these nodes in FG f 1 (resp. FG f 2 ) in a data structure G 1 (resp. G 2 ). 3. Build a 2 r -Joux's multi-collision M MC1 (resp. M MC2 ) starting from the cyclic node x (resp. ȳ) and denote its final endpoint by x (resp. ŷ). 4. Construct a simultaneous expandable message M SEM across the two hash functions that starts from the state x in the first pass, and denote its final endpoint by ỹ in the second pass. The details of constructing such an expandable message are provided in Sect. 7.3. 5. Find a single-block m mapping ŷ to some internal state b p in the second pass of the original message M . The search procedure is trivial and hence omitted. Then, use m updating the corresponding chaining state a p in the first pass to a state x, i.e., compute x = h 1 (a p , m). 6. For each message M 2 in M MC2 , (a) Compute x = h * 1 (x, M 2 ). (b) Compute a chain x by applying f 1 to update x iteratively until up to a maximum length 2 n-t or until it hits G 1 . In the latter case, compute the distance d 1 of x to x, and store (d 1 , M 2 ) in a table T 1 . 7. For each message M 1 in M MC1 , Compute a chain y by applying f 2 to update y up to a maximum length 2 n-t or until it hits G 2 . In the latter case, compute the distance d 2 of y to ȳ, and store (d 2 , M 1 ) in a table T 2 . 8. Find (d 1

	(a) Compute y = h * 2 (ỹ, M 1 ); (b)
	54

  The framework of this attack is sketched as follows. DS , compute the final state xL in the first pass with message fragment m m p+1 • • • m L .

Attack 6: Second-preimage attack on Hash-Twice -Phase 1: Generate a set of pairs of nodes S = {(x 1 , ȳ), (x 2 , ȳ), . . . , (x 2 s , ȳ)}, where xi 's are cyclic nodes randomly located in the largest cycle of FG f 1 , and ȳ is a cyclic node in the largest cycle of FG f 2 . In addition, like in Step 2 of Attack 3, compute the set of correctable distance bias D = {j • ∆L mod L 1 | j = 0, 1, . . . , #C} with parameters L 1 , L 2 and #C (where ∆L = L 2 mod L 1 , L 1 and L 2 are the two cycle lengths, #C is the number of cycles to the maximum). -Phase 2: Build a long Joux's multi-collision M MC starting from ȳ and denote its endpoint by ỹ. Then, by exploiting messages in M MC , build a diamond structure M DS with the cyclic nodes x1 , x2 , . . . , x2 s as leaves and denote its root by x. Find a message block m mapping the endpoint ỹ of Joux's multi-collision to one of the chaining states b p in the second pass of the original message. After finding m, starting from the root x of the diamond M -Phase 3: Build a simultaneous expandable message M SEM (with lengths covering roughly [n 2 , L]) starting from (IV, xL ). Denote its endpoints by (x, ŷ).

  1, . . . , #C} with parameters L 1 , L 2 and #C (where #C is the allowed maximum number of cycles and ∆L = L 2 mod L 1 ), as in Step 2 of Attack 3. 2. Develop 2 t nodes in FG f 1 (resp. FG f 2 ) by running Alg. 5, and record these together with their distances from a particular target node xi (resp. ȳ) in FG f 1 (resp. FG f 2 ) in a table T x (resp. T y ). Note that the distance of a node from all other target nodes xj can be directly deduced from the distance of it from the particular target node xi , as explained in Step 4c of Attack 3. 3. Build a long Joux's multi-collision M MC of length s•n/2 (blocks) starting from state ȳ, and denote its endpoint by ỹ. Then, by exploiting messages in M MC , build a diamond structure M DS starting from cyclic nodes x1 , x2 , . . . , x2 s (as leaves) and denote its root by x. 4. Find a message block m mapping the endpoint ỹ of Joux's multi-collision to one of the chaining values b p in the second pass of the original message, as done in the second-preimage attack on a single MD [KS05]. After finding m, starting from the root x of the diamond, directly compute a final state (denoted by xL ) in the first pass with message fragment m m p+1 • • • m L . The initial state in the second pass on the second preimage is then determined to be xL . 5. Build a parallel simultaneous expandable message M SEM starting from

end function Algorithm 5

  Expanding the functional graph of f (generating 2 t nodes in FG f )

	9: 10: 11: 12: 13: 14: 15: 16: 17: end function end for for each ml ∈ M long do yl ← h * 2 (y 0 , ml ) if yl ∈ Y short then (y 1 , ms, ml) ← (yl , ms , ml ) end if end for return (x 1 , y 1 , ms, ml)	ys , ms )
	18: function Collision2(h, x, x ) 19: T ← {} 20:
	22: 23: 24: 25: 26: 27: 28: 29:	end for loop m ← $, y ← h(x , m ) if T [y ] exists then return (y , T [y ], m ) end if end loop

for 1 ≤ i ≤ 2 n/2 do 21: m ← $, y ← h(x, m), T [y] ← m

Table 5 :

 5 a larger set Stevens et al. constraints [SBK + 17]

	Our constraints

Table 5 .

 5 32.97 ≈ 2 65.81 SHA-1 computations M = 2 65.81 /231 • 19 bytes ≈ 570 GB, and the cost to re-run the chains to locate collisions is only 2 32.97 •2•2 31 ≈ 2 64.97 . Finally, we can evaluate the complexity of the full attacks as: 2 65.81 + 2 64.97 + 3.0 • C block . 65.83 + 2.0 • C block 2.5 • C block 2 28.59 bits 0.65 2 31.03 2 32 2 34.84 2 66.84 + 2 64.03 + 2.5 • C block 3.0 • C block 2 30.95 98 bits 0.76 2 32.44 2 31 2 34.55 2 65.55 + 2 64.44 + 3.0 • C block 3.5 • C block 2 32.70 98 bits 0.76 2 30.70 2 30 2 34.68 2 64.68 + 2 61.70 + 3.5 • C block 4.0 • C block 2 33.48 98 bits 0.74 2 29.95 2 30 2 34.30 2 64.30 + 2 60.95 + 4.0 • C block 4.5 • C block 2 33.66 98 bits 0.74 2 29.77 2 30 2 34.21 2 64.21 + 2 60.77 + 4.5 • C block Trade-offs between the cost of birthday phase and the near-collision phase. • C block 2 9.17 2 16.30 2 19.92 2 22.05 2 23.13 2 23.95 2 24.44 2 24.55 2.5 • C block 2 10.17 2 16.62 2 21.04 2 23.76 2 25.50 2 26.58 2 27.38 2 27.92 3.0 • C block 2 10.17 2 17.10 2 21.76 2 24.66 2 26.58 2 27.95 2 28.96 2 29.71 3.5 • C block 2 12.53 2 17.89 2 22.47 2 25.62 2 27.70 2 29.18 2 30.29 2 31.22 4.0 • C block 2 12.53 2 18.60 2 22.97 2 26.34 ≥ 2 28.68 ≥ 2 30.35 ≥ 2 31.55 ≥ 2 32.15 5.0 • C block 2 12.53 2 19.65 2 24.18 2 27.44 ≥ 2 29.83 ≥ 2 31.64 ≥ 2 32.95 ≥ 2 33.04 6.0 • C block 2 12.53 2 19.79 2 24.81 2 28.26 ≥ 2 30.74 ≥ 2 32.55 ≥ 2 33.59 ≥ 2 33.59 7.0 • C block 2 13.09 2 20.37 2 25.30 2 28.82 ≥ 2 31.33 ≥ 2 32.93 ≥ 2 33.77 ≥ 2 33.77 8.0 • C block 2 13.09 2 20.62 2 25.72 2 29.27 ≥ 2 31.72 ≥ 2 33.09 ≥ 2 33.81 ≥ 233.81

	Set S		Birthday parameters
	Max cost	Size	Mask Proba # coll. Chain len. # chain	Attack cost
	2.0 • C block 2 24.66 bits 0.71 2 68.74 + 2 Max Cost 1 bl. 2 bl. 3 bl. 4 bl. 2 30.83 2 34 2 34.74 5 bl. 6 bl. 7 bl.	8 bl.
	2.0

Table 6 .

 6 Size of the set S with various limits on the maximum cost and on the number of near-collision blocks. We give a lower bound when we couldn't compute the full set.

		Set S		Birthday parameters
	Max bl. Max cost	Size	Mask Proba # coll. Chain len. # chain	Attack cost
	4 4 4 4 4 8 8 8 8	4.0 • Cblock 26.34 106 bits 0.48 5.0 • Cblock 27.44 102 bits 0.67 6.0 • Cblock 28.26 102 bits 0.65 7.0 • Cblock 28.82 102 bits 0.64 8.0 • Cblock 29.26 102 bits 0.63 2.0 • Cblock 24.55 106 bits 0.71 2.5 • Cblock 27.92 102 bits 0.63 3.0 • Cblock 29.71 98 bits 0.73 3.5 • Cblock 31.22 98 bits 0.72	2 29.70 2 32.14 2 31.35 2 30.82 2 30.39 2 30.94 2 31.75 2 33.73 2 32.23	2 33 2 32 2 32 2 32 2 32 2 34 2 32 2 31 2 30	2 35.18 2 35.40 2 35.00 2 34.74 2 34.52 2 34.80 2 35.20 2 35.19 2 35.44	2 68.18 + 2 63.70 + 4.0 • Cblock 2 67.40 + 2 65.14 + 5.0 • Cblock 2 67.00 + 2 64.35 + 6.0 • Cblock 2 66.74 + 2 63.82 + 7.0 • Cblock 2 66.52 + 2 63.39 + 8.0 • Cblock 2 68.80 + 2 65.94 + 2.0 • Cblock 2 67.20 + 2 64.75 + 2.5 • Cblock 2 66.19 + 2 65.73 + 3.0 • Cblock 2 65.44 + 2 63.23 + 3.5 • Cblock

  5 • C block , for a total complexity of 2 66.84 + 2 64.03 + 2.5 • C block ≈ 2 69.35 (using C block = 2 67.7 )

  63.82 + 7.0 • C block ≈ 2 68.3 (using C block = 2 64.7 ) 2 68.18 + 2 63.70 + 4.0 • C block ≈ 2 70.2 (using C block = 2 67.7 )

Table 1 :

 1 Comparison of previous and new cryptanalysis results on SHA-1. A free-start collision is a collision of the compression function only, where the attacker has full control on all the primitive's inputs. Complexities in the table are given in terms of SHA-1 equivalents on a GTX-970 GPU (when possible).

	Function Collision type	Complexity Ref.
	SHA-1	free-start collision collision	2 57.5 2 69 2 64.7 2 61.2	[24] [29] [22, 23] a

Table 3 :

 3 Boolean functions and constants of SHA-1

Table 4 :

 4 Cost of collision attacks. One collision requires on average 2 48.5 A 33 -solutions (those results include the boomerang on M 6[8]). Note: we use the hashrate from hashcat, which is slightly over-optimistic (i.e. attack cost in SHA-1 computations is overestimated).

	Collision (old)	Collision (new)

Table 5 :

 5 Size of the set S with various limits on the maximum cost and on the number of near-collision blocks (log 2 ). Max Cost 1 bl. 2 bl. 3 bl. 4 bl. 5 bl. 6 bl. 7 bl. 8 bl. 9 bl. 10 bl. C block 10.17 17.10 21.76 24.66 26.58 27.95 28.96 29.71 30.31 30.76 4 C block 12.53 18.60 22.97 26.34 28.68 30.35 31.56 32.54 33.29 33.88 5 C block 12.53 19.65 24.18 27.44 29.83 31.65 33.04 34.14 34.90 35.42 6 C block 12.53 19.79 24.81 28.26 30.74 32.62 34.05 35.08 35.67 36.03 7 C block 13.09 20.37 25.30 28.82 31.35 33.24 34.59 35.43 35.86 36.15 8 C block 13.09 20.62 25.72 29.27 31.81 33.65 34.81 35.54 35.92 36.19

	1 C block 2 C block 3	8.17 8.17 8.17 8.17 8.17 8.17 8.17 8.17 8.17 8.17 9.17 16.30 19.92 22.05 23.13 23.95 24.44 24.55 24.62 24.65

Table 6 :

 6 Timeline of the birthday phase.

	Date	Event	Complexity # collisions
	July 25 July 27 August 14 Step 2 unsuccessful Starting cluster setup Computation started August 20 Step 2 unsuccessful August 24 Step 2 unsuccessful August 30 Step 2 successful!	2 61.9 2 62.4 2 62.6 2 62.9	2 25.8 2 26.6 2 27.1 2 27.7

Table 7 :

 7 Timeline of the near-collision phase. C block corresponds to 2 19.17 A 61 -solutions, excepted for the last block where the use of an extra boomerang increases it to 2 19.58 Block 1 found a 2 16 0.11 C block September 09 Block 2 found 2 13.5 0.02 C block September 13 Block 3 found 2 16.9 0.21 C block September 14 Block 4 found 2 10.8 0.003 C block September 16 Block 5 found 2 15.5 0.08 C block September 18 Block 6 found 2 15.5 0.08 C block September 20 Block 7 found 2 16 0.11 C block September 21 Block 8 found 2 14.5 0.04 C block September 27 Block 9 found b 2 18.2 0.38 C block

	Date	Event	#A 61 -sol Complexity
	September 07

a Two solutions found b Using the M 6

[8]

boomerang

Table 8 :

 8 Resources used for the attack

	• 10 years for the last block

  27. Yu, H., Wang, X.: Full Key-Recovery Attack on the HMAC/NMAC Based on 3 and 4-Pass HAVAL. In Bao, F., Li, H., Wang, G., eds.: ISPEC. Volume 5451 of Lecture Notes in Computer Science., Springer (2009) 285-297

	A Additional Figures

  24. Peyrin, T., Wang, L.: Generic Universal Forgery Attack on Iterative Hash-Based MACs. In: Nguyen, P.Q., Oswald, E. (eds.) Advances in Cryptology -EUROCRYPT 2014 -33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Copenhagen, Denmark, May 11-15, 2014. Proceedings.

	Lecture Notes in
	Computer Science, vol. 8441, pp. 147-164. Springer (2014)
	25. Sako, K., Sarkar, P. (eds.): Advances in Cryptology -ASIACRYPT 2013 -19th Inter-
	national Conference on the Theory and Application of Cryptology and Information
	Security, Bengaluru, India, December 1-5, 2013, Proceedings, Part II, Lecture Notes in
	Computer Science, vol. 8270. Springer (2013)
	26. Tsudik, G.: Message authentication with one-way hash functions. SIGCOMM Comput.
	Commun. Rev. 22(5), 29-38 (Oct 1992)
	27. Yasuda, K.: "Sandwich" Is Indeed Secure: How to Authenticate a Message with Just
	One Hashing. In: Pieprzyk, J., Ghodosi, H., Dawson, E. (eds.) ACISP. Lecture Notes in
	Computer Science, vol. 4586, pp. 355-369. Springer (2007)

Table 1 :

 1 Block ciphers in popular versions of Internet protocols; 64-bit ciphers are shown in red

	1)/2
	Summary of Attack Scenario. With a fixed message of size 2 u repeatedly encrypted, an attacker that knows a
	fraction α of the message can recover the k missing blocks of plaintext (k = (1 -α) • 2 u ) by observing about log(k) • 2 u-1 collisions. This gives an attack with a data complexity of
	O encrypted blocks. With rekeying every 2 r blocks (r < n/2), log(k) • 2 (n+u-1)/2
	the complexity becomes:
	O log(k) • 2 u+n+2-r .

Table 2 :

 2 Cipher use for TLS connection from the Firefox web browser (percentage). The figures come from telemetry data available at https://telemetry. mozilla.org/ (we use the SSL_SYMMETRIC_CIPHER_FULL metric), and are gathered during the lifetime of a particular version. RC4 is fallback-only since version 36.

				AES
	# Release date RC4 3DES CBC GCM
	35 2015/01/13	20.4	0.15	27.5	51.9
	36 2015/02/24	0.20	1.81	45.5	52.5
	37 2015/03/31	0.13	1.81	41.7	56.4
	38 2015/05/12	0.09	1.82	36.0	62.1
	39 2015/07/02	0.08	1.81	31.6	66.5
	40 2015/08/11	0.08	1.68	29.7	68.6
	41 2015/09/22	0.08	1.44	27.9	70.6
	42 2015/11/03	0.08	1.26	27.9	70.7
	43 2015/12/15	0.05	1.19	28.6	70.2
	44 2016/01/26	-	1.17	28.3	70.5
	45 2016/03/08	-	1.13	28.1	70.8

Table 3

 3

	: 3DES support for HTTPS servers in
	Alexa's top website list. We count servers that sup-
	port 3DES, and servers that would select 3DES with
	common browsers: Android 5.0 integrated browser,
	Firefox 44, Internet Explorer 11, and Chrome 47.
	Scans performed on February 16 -18, 2016.
	Scanning the Top 1M Websites. We performed a scan
	of the top 1 million servers as listed by Alexa using the cipherscan tool 8 . We found that 86% of the servers that
	support TLS include 3DES as one of the supported ciphers.
	Moreover, using the ciphersuites sent by a modern client
	(Firefox 44, IE 11 or Chrome 47), we estimate that 1.2% will
	actually use a 3DES based ciphersuite. We report detailed
	figures in

Table 3 .

 3 Windows XP Clients and Windows 2003 Servers. The Windows XP and Windows Server 2003 operating systems do not support AES-based ciphersuites, although support for AES can be added with an optional hotfix. With the default configuration, they support only RC4, 3DES, DES, and RC2-40. While these operating systems are not supported anymore by Microsoft, they still have users, and this creates situations where the best available cipher is 3DES. If a client uses Internet Explorer on Windows XP or Windows Server 2003 to connect to a modern web server (with no RC4 ciphersuites), the connection will use 3DES or fail. Indeed, supporting Windows XP clients is the main stated reason for servers to continue supporting RC4 and 3DES.

Table 4 :

 4 . On Maximum connection lifetime for Alexa's top 10 servers (detected experimentally). The " †" symbol marks servers which accept at least one million requests in a single TLS connection.

	Website	connection closed after
	google.com	1 hour †
	facebook.com no limit detected †
	youtube.com	no limit detected †
	yahoo.com	no limit detected †
	live.com	up to one day †
	baidu.com	100 requests
	amazon.com	100 requests
	wikipedia.org 100 requests
	qq.com	2000 requests
	twitter.com	50 requests

Table 1 .

 1 Example of an attack on two blocks secret S = S 1 S 2 S 3 S 4 . Each step performs the known prefix sieving algorithm. Known information in blue, unknown information in red, attacked information in yellow.

	Queries Q 1 with half-block header	H 1	S 1	S 2	S 3	S 4
	Queries Q 2 with full-block header	H 1	H 2	S 1	S 2	S 3	S 4
	Reuse Q 1 with known S 1 , S 2	H 1	S 1	S 2	S 3	S 4
	Reuse Q 2 with known S 1 , S 2 , S 3	H 1	H 2	S 1	S 2	S 3	S 4

  He first recovers S 1 using the known-prefix sieving with the first block of each type of query. More precisely, he usesA = {E(H 1 H 2 )} and B = {E(H 1 S 1 )}, so that the missing difference is 0 (S 1 ⊕ H 2 ). 3.When S 1 is known, he can again use known prefix sieving to recover S 2 , with the first and second blocks of Q 2 queries: A = {E(H 1 H 2 )} and B = {E(S 1 S 2 )}, so that the missing difference is (S 1 ⊕ H 1 ) (S 2 ⊕ H 2 ). To improve the success rate of this step, he can also consider the first block of Q 1 queries as known keystream. 4. When S 2 is known, another round of known prefix sieving reveals S 3 , e.g. with A = {E(H 1 H 2 )} and B = {E(S 2 S 3 )}, the missing difference is (S 2 ⊕ H 1 ) (S 3 ⊕ H 2 ). 13 5. Finally, S 4 is recovered with a last round of known prefix sieving using A = {E(H 1 H 2 )} and B = {E(S 3 S 4 )}, with missing difference is (S 3 ⊕ H 1 ) (S 4 ⊕ H 2 ). × 2 32 queries with n = 64. More generally, we show that for n ≥ 32 the success probability of this attack is at least 99% with lists of size n/2 • 2 n/2 . With a one block secret, an optimal attack uses two lists of n/2 • 2 n/2 two-block queries: queries [H 1 S 1 ] [S 2 ] with a half-block header, and queries [H 1 H 2 ] [S 1 S 2 ] with a full-block header. This translates to a data complexity of 4 n/2 • 2 n/2 blocks. For comparison, an attack against the CBC mode requires on average 2 • 2 n/2 blocks of data in the ideal case.

	√ n2 n/2 ) to recover repeated This gives an algorithm with query complexity of O( encryption of a secret over multiple blocks in the BEAST attacker model. In
	Section 6.2, we analyze the constants in the O() and run experiments with n = 64 using locally encrypted data. In particular, we have a success probability higher
	than 80% using two lists of 5

  and t = y ⊕ α 3 |α 2 |0|0, but there are four corresponding quadruples: (x, y, z, t), (z, y, x, t), (x, t, z, y), (z, t, x, y), and two candidate values for E 1 (0) ⊕ E 1 (1): x ⊕ y and x ⊕ y ⊕ α 3 |α 2 |0|0.

  LightMAC+ with three keys K, K 1 , K 2 .

	1 s m 1	2 s m 2		s m
	E K	E K	. . .	E K
			. . .	E K 1	T
	2		2 . . .	E K 2
		Fig. 3.

  m 2 , . . . m ) = BRW K (m 1 , m 2 , . . . m t-1 ) (K t + m t )+ BRW K (m t+1 , m t+2 , . . . m )with t a power of 2, and 4 ≤ t ≤ n < 2t. For instance, with 8 inputs, we obtain (K+m 1 ) (K 2 +m 2 )+m 3 (K 4 +m 4 )+(K+m 5 ) (K 2 +m 6 )+m 7 (K 8 +m 8 )

https://csrc.nist.gov/projects/lightweight-cryptography

https://csrc.nist.gov/projects/post-quantum-cryptography

http://web.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt

This happens with probability 6/π

≈ 0.61 for random integers.

https://www.mitls.org/pages/attacks/SLOTH

https://sha-mbles.github.io

https://csrc.nist.gov/Projects/Hash-Functions/NIST-Policy-on-Hash-Functions

http://web.archive.org/web/20191227174651/https://censys.io/domain/report?field=443. https.tls.signature.hash_algorithm

http://web.archive.org/web/20191227174551/https://censys.io/domain?q=443.https.tls. signature.hash_algorithm%3Asha1

https://www.dns.cam.ac.uk/news/2020-02-14-sha-mbles.html

Our result can be generalized to a known prefix instead of zero prefix, and to S being an affine space of dimension n -1.

Indeed, we use a quantum security definition where N is a random classical value chosen by the oracle.

We note that this MD5/SHA-1 combiner has been replaced by primitives based on single hash function (e.g., SHA-256) since TLS v1.2[9].

If the two hash functions can be related, it is trivial that the XOR combiner is not security-preserving. For instance, let H 2 (M ) := H 1 (M ) ⊕ const, where const is a constant. If H 1 is ideally secure, then H 2 is also ideally secure. However, the XOR combiner H 1 (M ) ⊕ H 2 (M ) = const for any message M . 3

Symmetric Cryptanalysis Beyond Primitives

The attacks actually require only one of the functions to be narrow-pipe.

A mistake in the initial proof and construction was later fixed by Mennink and Preneel[29].5

Loosely speaking, a combiner is robust with respect to property α if it is (at least) as secure as the stronger underlying hash function for α.

If this is not the case, we build a new multicollision.

It takes O(t • 2 t ) operations by sorting the lists, but only 2 • 2 t using a hash table.

We only need to store the messages M and M

For instance, the attack is on the verge of practicality with n = 64; the time complexity is 258.3 and the memory complexity is 226.3 .

The backward interface may output ⊥ for some message block. To compensate it, for the other message blocks, we make multiple queries, since they may have more than one preimages. On average, the backward interface should produce one preimage for each query.

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

We note that this MD5/SHA-1 combiner has been replaced by primitives based on single hash function (e.g., SHA-256) since TLS v1.2 [DR08].

Here, we generalize the syntax of hash functions to also regard the initial value IV as an input parameter.

The original specification of Hash-Twice is HT (M ) H(H(IV, M ), M ), which processes the same message twice using a single hash function as shown in [ABDK09].

For simplicity of description, we omit the computation of the initial value IV n = h(IV, n, 0, 0), which is used to support variable hash size in the specification of HAIFA in[START_REF] Biham | A Framework for Iterative Hash Functions -HAIFA[END_REF]. This does not influence the attacks.4

Symmetric Cryptanalysis Beyond Primitives

For example, for n = 160 and message block of length 512 bits (as in SHA-1), the attack is faster than 2 160 for messages containing at least 2 46 blocks, or 2 52 bytes.

The complexity formulas do not take into account (small) constant factors, which are generally ignored throughout this paper.

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

A collision between x d-i and xD-i occurs if x d-i = x D-i but x d-i-1 = x D-i-1 .

A more accurate analysis would take into account the event that the chains collide before x d-i , but the probability of this is negligible.

This is a very low probability that the set contains repeated values, particularly when t is significantly small compared with L 1 . Here, we omit the discussion.

Symmetric Cryptanalysis Beyond Primitives

Note that for simplicity of description, we omit the description of the finalization transformation on the internal state with the padding block and refer to Sect. 3.2 for the formal description.

From now on, we will use "optimal complexity" to mean the minimized complexity under the optimal choice of parameters for each attack.

Symmetric Cryptanalysis Beyond Primitives

It takes O(t • 2 t ) operations by sorting the lists, but only 2 • 2 t using a hash table.

Note that + 2g 1n = n -< n -2 /3.34

Symmetric Cryptanalysis Beyond Primitives

The actual attack is slightly different, as it searches for deep iterates from which (a p , b p ) can be reached with a common message block.

Symmetric Cryptanalysis Beyond Primitives

Note that for > n/3, g 1 = 2/5 • (2n -) > 2n/3 > max(n/2, n -), as required.

g 1 • 1/L • 2 2n-2g 1 = 1/L • 2 2n-g 1 .Since the index p is uniformly distributed in the interval [1, L], we will assume that p = Θ(L).48

One may ask why we did not compute a larger set S, as we did in Phase 3 of Attack 2. The reason for this is that it can be shown that in this case, a set of size 1 is optimal.

One may also ask why we did not use cyclic nodes and multi-cycles to further improve this second-preimage attack on concatenation combiners as we did for the preimage attack on XOR combiners. The reason is that optimization on Phase 2 of Attack 4 has reached it limitation because of the limited number of candidate state pairs for (x, ȳ). Thus, the complexity of Phase 2 becomes the bottleneck and cannot be improved using cyclic nodes.

Symmetric Cryptanalysis Beyond Primitives

A large multi-collisions can be built with a cost of roughly 2 n/2 in a narrow-pipe function, but this costs almost 2 n for an ideal hash function.

However, the message length can be a problem with some hash functions that do not accept long inputs. For example, SHA-256 and SHA-224 are only defined for

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

200Symmetric Cryptanalysis Beyond Primitives

Using our attack, it would take a computation power similar to the full bitcoin network to compute a SHA-1 chosen-prefix collision within one minute, and some

206Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

Given by mask 0x7f800000, 0xfffc0001, 0x7ffff800, 0x7fffff80, 0x7fffffff

To store a chain, we use 40 bits for the starting point, 40 bits for the length, and 98 -31 = 67 bits for the output, i.e. 19 bytes in total.24

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

The largest graph suggested in[12] has size

33.7 .

Given by mask 0x7f000000, 0xfff80001, 0x7ffff000, 0x7fffffc0, 0x7fffffff

More precisely, US$ 209 per month for 6 GTX 1060 3GB: https://web.archive.org/web/ 20191229164814/https://www.gpuserversrental.com/

https://phys.org/news/2010-12-air-playstation-3s-supercomputer.html 240 Symmetric Cryptanalysis Beyond Primitives

https://blogs.nvidia.com/blog/2017/05/10/nvidia-accelerates-ai-launches-volta-dgxworkstation-robot-simulator-more/

Building a JPEG image smaller than 256 bytes is not easy, but it is possible244Symmetric Cryptanalysis Beyond Primitives

Some examples can be found by searching through certificate transparency logs: http://web.archive. org/web/20191227165750/https://censys.io/certificates?q=tags%3Atrusted+AND+parsed.signature. signature_algorithm.name%3ASHA1%2A+AND+parsed.validity.start%3A%5B2019-01-01+TO+%2A%5D

As seen in this scan: http://web.archive.org/web/20191227165038/https://censys.io/ipv4? q=443.https.tls.validation.browser_trusted%3AYes+AND+443.https.tls.certificate.parsed. signature_algorithm.name%3ASHA1%2A

http://web.archive.org/web/20191227174651/https://censys.io/domain/report?field=443. https.tls.signature.hash_algorithm

http://web.archive.org/web/20191227174551/https://censys.io/domain?q=443.https.tls. signature.hash_algorithm%3Asha1

See https://telemetry.mozilla.org/new-pipeline/dist.html#!measure=SSL_CIPHER_SUITE_FULL, were buckets 5, 61 and 63 correspond to HMAC-SHA-1 ciphersuites

http://web.archive.org/web/20191226134753/https://censys.io/domain/report?field=443. https.tls.cipher_suite.name.raw

In more details, since the boomerangs on M 11[4], M 11[5] and M 11[6] are very short and thus applied before boomerangs M 6[6], M 6[8] and M 9[7], we don't actually care if the last ones break conditions of the first ones since they have already been used.

https://securitypitfalls.wordpress.com/2015/12/07/november-2015-scan-results/

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

We elaborate on our complexity evaluation in the next Subsection.

More precisely, there are 2 2t-1 unordered pairs of chains. However, our analysis is correct up to small constants.

Once again, a lower bound on Pr[A] is easy to calculate assuming that 0.25 • 2 s ≤ i ≤ 0.75 • 2 s (which occurs with probability of about 1/2).

The first phase of the attacks of[11, 24] uses queries of length 2 /2 . Their algorithms are related to the cycle-based attack of[19] that is generalized is Section 6.2.

The only case in which the 2 2s -iterate (denoted by x) of a covered point y is not covered by the offline structure, is when this iterate goes through the disconnected edge from x to f (x) (namely, f (x) is on a path from y to x whose length is at most 2 2s ). This can only occur if x is on a cycle with less than 2 2s elements. Such (small) cycles are expected to belong to (small) connected components whose total size is O(2 2•2s ) = O(2 4s ) (see[9]). On the other hand, we evaluate a total of 2 -s nodes offline, and since 2 4s2 -s for s ≤ /7, it is unexpected that the covered point y will belong to such a small component.

This occurs with high probability, and can be shown by analyzing the cycle structure of the graph as in the previous attack.

Assuming that the time to recover each block follows a geometric law

https://wiki.mozilla.org/Security/Server Side TLS

https://blog.binaryedge.io/2015/11/10/ssh/

https://support.microsoft.com/en-us/kb/325158

http://www.jacco2.dds.nl/networking/openswanmacosx.html

 6 http://www.cisco.com/c/en/us/td/docs/ios/12 2/12 2z/ 12 2zj/feature/guide/gtaimvpn.html

https://github.com/jvehent/cipherscan

http://www.securityspace.com/s survey/sdata/201604/ servers.html

The setting is called MaxKeepAliveRequests for Apache, and keepalive_requests for Nginx.

We tested common sub-domains: www, m, secure, signin, auth, account, login

We have similar results with the stable version Firefox 48.0 which was released after we made our experiments.

The probability can be computed as 1e -2 32.2 2 32.2 /2 64 .Website

For instance, GCM concatenates a per-message nonce and a counter within a message.

For instance, the treatment of non-default-length nonces in GCM can lead to collisions[23].

Symmetric Cryptanalysis Beyond Primitives

Appendix I. The Missing Difference Problem

For example, wikipedia.org encodes cookies with lower case letters and digits, this corresponds to two known bits.12

https://mzl.la/2GY53Mc, accessedFebruary 8, 2018

https://censys.io/data/22-ssh-banner-full_ipv4, scan performedJuly 5, 2017

Symmetric Cryptanalysis Beyond Primitives

Symmetric Cryptanalysis Beyond Primitives

The algorithm and the figure given in[43] differ in the coefficients used to compute Θ. We use the algorithmic description because it matches later PMAC+ variants, but the attack can easily be adapted to the other case.

We can actually reduce the polynomial factors by fixing only (nlog 2 (n))/4 bits to zero, in order to have sets of size4 √ n • 2 3n/4 .

We construct the kernel of the linear function λ i → i λ i (x i ⊕ y i )

When there is no ambiguity, we write |0 for the state |0 . . . 0 of appropriate length.

Note that Kuwakado and Morii just assume that each step of Simon's algorithm gives a random vector orthogonal to k 1 . Our analysis is more formal and captures the conditions on P required for the algorithm to be successful.

Since this attack is just a special case of the LRW attack of Section 4, we don't repeat the detailed proof. 17

20Appendix K. Breaking Symmetric Cryptosystems Using Quantum Period Finding 419

http://competitions.cr.yp.to/

This is not the case for the related mode SILC, because the nonce is processed before the data in CBC-MAC.

Note that AEZ, COPA and POET also claim security when the nonce is misused, but our attacks are nonce-respecting.21

© IACR 2021. This article is the final version submitted by the authors to the IACR and to Springer-Verlag in September 2021.

Grain128A and Grain128AEAD[32] use Toeplitz hashing, but we can only attack them in the nonce-misuse setting because they use the one-time-MAC construction.23

Acknowledgments

Acknowledgements

The authors would like to thank the anonymous referees for their helpful comments. Lei Wang is supported by the Singapore National Research Foundation Fellowship 2012 (NRF-NRFF2012-06).

Acknowledgments

This research is supported by the National Research Foundation, Prime Minister's Office, Singapore under its Strategic Capability Research Centres Funding 73

Acknowledgements

The authors would like to thank the anonymous referees for their helpful comments. We also thanks Paul Wouters (Red Hat) and Marc Stevens (CWI) for additionnal comments. The second author is supported by Temasek Laboratories, Singapore.

Acknowledgements

The authors are grateful to the USENIX Security 2020 reviewers and shepherd for their insightful comments that improved the quality of the paper.

The authors would like to thank Vesselin Velichkov for his help with regards to an initial analysis of neutral bits applicability on SHA-1 and Werner Koch for his comments on the applicability of our attacks on PGP. The authors would also like to thank gpuserversrental.com for their efficient service regarding the GPU cluster renting. The second author is supported by Temasek Laboratories, Singapore.

A small part of the experiments presented in this paper were carried out using the Grid'5000 testbed, supported by a scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https: //www.grid5000.fr). Development and small scale experiments before launching the main computation were carried out on the rioc cluster from Inria. We use techniques similar to the cycle-detection technique proposed by Peyrin et al. at Asiacrypt 2012 to attack HMAC in the related-key model. However, our attacks works in the single-key model for both HMAC and NMAC, and without restriction on the key size. Key words: NMAC, HMAC, hash function, distinguishing-H, key recovery, GOST.

Acknowledgments

The authors would like to thank the anonymous referees for their helpful comments. Gaëtan Leurent is supported by the ERC project CRASH. Thomas Peyrin and Lei Wang are supported by the Singapore National Research Foundation Fellowship 2012 (NRF-NRFF2012-06).

Acknowledgement

Part of this work was supported by the French DGA, and the authors are partially supported by the French Agence Nationale de la Recherche through the BRUTUS project under Contract ANR-14-CE28-0015.

Acknowledgement

Mridul Nandi is supported by R.C.Bose Centre for Cryptology and Security. Part of this work was supported by the French DGA.

Acknowledgements

We would like to thank Thomas Santoli and Christian Schaffner for sharing an early stage manuscript of their work [40], Michele Mosca for discussions and LTCI for hospitality. This work was supported by the Commission of the European Communities through the Horizon 2020 program under project number 645622 PQCRYPTO. MK acknowledges funding through grants ANR-12-PDOC-0022-01 and ESPRC EP/N003829/1. Acknowledgments This project has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement no. 714294 -acronym QUASYModo). A.S. is supported by ERC-ADG-ALGSTRONGCRYPTO (project 740972).

Table 9: Differences in the state after each block, and output differences at the end of the trail (before the feed-forward). Block

State difference

Birthday -------------n----n---u--n-u-n-u ------------------n----n-u-n-u--u------------------------n-------------------------------

8 -------------------u-----u-n--u-------------------------u-----u---------------------------------------------------------------u-u-------------------------------Block 9 -------------------u--u--u-n--u-------------------------u--u--u---------------------------------------------------------------u-u-------------------------------

B Chosen-prefix Collision Example

-----BEGIN PGP PUBLIC KEY BLOCK-----mQQNBH/oF4ABIAD/S2V5IGlzIHBhcnQgb2YgYSBjb2xsaXNpb24hIEl0J3MgYSB0 cmFwIXnGGvCvzAVFFdknTnMHYksdx/sjmIu43otXXbp7nqsxwWdLbZdDeKgncy/1 hRx2ouYHcrWkfOHqxAu5k8EtjHDiSk+NX83twbMsnPGeMa8kKXWdQuTf2zFxn1h2 I+5VKTm23NxFn8pTVTtw+H7eMKJH6jr2x1mi8gsyDXYNtk/0eQhP08yzzdSDYtlq nEMGF8r/bDbGN+U/3ihBf2Jv7FTteUOkbl9XMPK7OPsd9uAJABDQDiSteL+SZBmT YI6NFYp4nzTEb+HmAn81pMv7gnB2xQ7KDot8ymm7LCt5Aln5v5Vw3Y1EN6MRX6/3 w8rAmtJSZgVcJxBHVReOrv+CWiyqKs+13mTOdkHcWaVBqfycdWdW4uI9xxPIwkyX kKprDjin9V8URSocooUN3ZVi/ZoYrUJJaqlwCPdGcvaO9GHriLCZM9YmtPkYdJzA J/3dbEJfxCFoNdATTRUoW6sst4Sk98u0+1FNS/D2I3zwCp6fEyuaBm5v0X9sQph0 eFhv9lGvlnR/tCa5hyuaiOQGP1m7M0zABlD4OoDEJ1G3GXTTAPwoGaLo8eMsG1HL GOa/xNubrvZ11Kr1sVdKBH+PbdLsFTqTQSKTl02Sj4jO2TY8/vl84udCvzTJa47z h1Z2/qXMqOX33qC6skE9TeAO5x7gHxYr220er9kl5q66rmo1TvF88gWkBPvbEvxF TUH92VzyRZZkoq0DLR2mCnMmQHXX8eDWwUA656DYYd8/5XBxiN1eB9FYm5+LZjBV P4/DUrPgwn2oC926TGQCDQYH9nQNLoASAgwRjxlZlJl+xnAClehPhvimlPrsylEs iZXJZuZjfmFlR1VUbBDRXshFngA85nlvVon7fAnZTYNiyM5PM5ZBHTH/9luEWef+ vMgBV5t3S1TZnD6dQpgStXi3kNZ77juY93ADOo64i5vmC8TONoSzg7AO+6KzQ2lR +zB0/AKu92MeHNcAEQEAAdEAAAEZwFcBEAABAQAAAAAAAAAAAAAAAP/Y/9sAQwD/ //////////////////////////////////////////////////////////////// /////////////////////8AACwgAQABYAQERAP/EACgAAQEBAAAAAAAAAAAAAAAA AAAEAxABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQAAPwDQTqABOoAE6gE6gATgAKAT ihOChOKE4AAAKE4AChOKE6gATqE6gE4oTigH/9lduLZvOS5WXb0QhggKNiGWIm/z IV/tc5s7KOrrL9gZCVAvnv1D5pEAuEqDOBDdABEBAAG0GUFsaWNlIDxhbGljZUBl eGFtcGxlLmNvbT6JBFQEEwEIAD4WIQRDzVxbBP9XQvoUGryp11WpY1SMeAUCf+gX gAIbLwUJAAFRgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCp11WpY1SMeJHD H/9jJj4FARmtNhFXqDhNcNV6C3mQAevQR1iCbFwWHXdd2yRfyFv9/dVY4Wa2Q16j BuCUhl7SDmO1IYlYBBo+91Kr11rDezL/y/POQsKzRp9nEo0r+QCVnIozjJ1DeP77 Xwxu77gRe1QkIql0aVUhP6vPRD+oFgViYUUWIdNgh4bBJGDMY43BJyeCxmuqRo8/ sHTWu7rmhuHpsQiTRd5valBPHXbZKAcS+TmgGM8dMv3N0ldq1wDZWDrWfD6vCmnP a4hH3UybM9G6kkkQ2xETt7hyW6XlsLXk9CtaZ2hz1kUUKtTa8LU1mj9T8dsLbTj0 qipYps/ry0Cro7gkaYiNGeeelNzPhfz8jXHrK47hZ0iZbcb7JUcR6WodGAWV6bFE +Jj02NOnX87QsWk1z5YdHsvDEbzbE9fQZ2r8hPEDsqEDXsSSw6h/FkhCcxwn9RV2 SGt5kZkU0qGP6chAITiGEEX40TcnfgyNvSJcHJ2iMaKGEaaQv5MfaefMRX9tGiz3 wmTYxSdUqkFiG2YtOkZWdCZDBKVL6Y8g7fM6G5DQc+/4alVqGdZ11TwAmKcZ142E 2JL6MAu9zfmjMcRkXytzUfkKGKa/kpAMPsn1cWYxlQe0PxxVAM8iZTPUSnBah13t Ec1fx9jJ1cJkHBW7w1AFS+kLKD0blX9rreTUDzBQLPkaXWqH5fLZvc+EGJpt6roL obVZ2mVDfmYNABYnw4nTDBGb2Vk60MpPh0k7pMMbXJA9kuwvgYa6VztyIZcyi8Mz L0Kbtwsog0S5KV01tOcKMGtXpni6Vsx/k1ydvtOBUuG7VjG8Y1EuGyOUzdIuXe1r UUTIV7GZfNpzxAumvoY2umKJQzpA/jG1yban05IViIIFotKCfA8cpKzY1roUtyjq FPgB0T2YOadFStarrypb+f3Snj0nK4UqyJ0YbJQiKbo/NVvY2cQdqR5wyBVKV7RR qjkNArxkHu0RUaBnywzyzwtOHNs0ojX3IyOeytLcIrbaKYJYaeZCwOWcNIWP5avq u4Lkfq+ariSGdbfHKBR1OJWBeD/Rne+E9rmwrvk2S8fd1pdx44R8RzIvWfCKUQeu wnfHBsP5BOZkjltSQnpBHsNSFnie0o5uSKnL8dyTbH3TtX1u3D7S95KZRley+n+5 hfQTTHWo8Xq/m6wr0TYxdA4DbaSJJ/wZFH0YaybXXkXhIQY3n3o+4mdgBQy3okIG enWdH6Jdty6xrDimgxMjOUIyQ0JTlHBksIIViqzaY52ATI2U5UBpK7DgNC+IzIFe QVWNIFVqT3Ifqcfd5iKZZvEEKt4QWDfIvc5bPkXraWV8Aqq3yl0iYiBFRVLVDBy3 AXrthG5XMjPFw/7TQEoIY5MYiQEcBBABAgAGBQJ/6VrwAAoJEK+7H+1pUalWFn0H /AmChC2A4mXbw6m6hIs/zWUTNRAM4I9daUst138jmNFKUz67zIxUvUeUuU2n6Lfj rerpVX8LuQbz2/e+g1AIcAKBRniBDyjzedWuya/faLW9rSpATUy/3Rv2G0T1QBSw fsQNlNT8oBbMYZl7ht0ylst2m9zJyI+XjktMiIIxfr8zlMjIpXU9xF0YPuSNM0Sm l38jeLHN9hHZpvsvsK2EmhCTF2KhHvozlFfJ8wr10cnWxdEzoYntx178Ty0KRgC+ oTLIccOSrNKjzkRuNnOsEEpAudFR6yxx8HLZatSXWpzitNdaG8APDwJiS5AHaqVQ yNnDiF8Aoz5caQEw4D8aDvk= =04wQ -----END PGP PUBLIC KEY BLOCK-----Symmetric Cryptanalysis Beyond Primitives

i,j␣=␣0,0 while␣i<len(L13)␣and␣j<len(L24): ␣␣if␣L13[i][0]␣==␣L24[j][0]: ␣␣␣␣if␣L13[i]␣!=␣L24[j]: ␣␣␣␣␣␣print␣"{:06x}␣{:06x}␣{:06x}␣{:06x}␣|␣{:06x}␣{:06x}".format( ␣␣␣␣␣␣␣␣L13[i][1],␣L13[i][2],␣L24[j][1],␣L24[j][2], ␣␣␣␣␣␣␣␣xor(L13[i][1],L13[i][2]),␣xor(L13[i][1],L24[j][2])) ␣␣␣␣if␣L13[i]␣<␣L24[j]: ␣␣␣␣␣␣i+=1 ␣␣␣␣else: ␣␣␣␣␣␣j+=1 ␣␣elif␣L13[i][0]␣<␣L24[j][0]: ␣␣␣␣i+=1 ␣␣else: ␣␣␣␣j+=1

SHA-1 is a Shambles *

First Chosen-Prefix Collision on SHA-1 and Application to the PGP Web of Trust

Gaëtan Leurent 1 and Thomas Peyrin 2,3

1 Inria, France 2 Nanyang Technological University, Singapore 3 Temasek Laboratories, Singapore gaetan.leurent@inria.fr, thomas.peyrin@ntu.edu.sg https://sha-mbles.github.io/ Abstract. The SHA-1 hash function was designed in 1995 and has been widely used during two decades. A theoretical collision attack was first proposed in 2004 [29], but due to its high complexity it was only implemented in practice in 2017, using a large GPU cluster [23]. More recently, an almost practical chosen-prefix collision attack against SHA-1 has been proposed [12]. This more powerful attack allows to build colliding messages with two arbitrary prefixes, which is much more threatening for real protocols. In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the complexity of collision attacks against SHA-1: on an Nvidia GTX 970, identical-prefix collisions can now be computed with a complexity (expressed in terms of SHA-1 equivalents on this GPU) of 2 61.2 rather than 2 64. 7 , and chosen-prefix collisions with a complexity of 2 63.4 rather than 2 67.1 . When renting cheap GPUs, this translates to a cost of US$ 11k for a collision, and US$ 45k for a chosen-prefix collision, within the means of academic researchers. Our actual attack required two months of computations using 900 Nvidia GTX 1060 GPUs (we paid US$ 75k because GPU prices were higher, and we wasted some time preparing the attack). Therefore, the same attacks that have been practical on MD5 since 2009 are now practical on SHA-1. In particular, chosen-prefix collisions can break signature schemes and handshake security in secure channel protocols (TLS, SSH), if generated extremely quickly. We strongly advise to remove SHA-1 from those type of applications as soon as possible. We exemplify our cryptanalysis by creating a pair of PGP/GnuPG keys with different identities, but colliding SHA-1 certificates. A SHA-1 certification of the first key can therefore be transferred to the second key, leading to an impersonation attack. This proves that SHA-1 signatures now offer virtually no security in practice. The legacy branch of GnuPG still uses SHA-1 by default for identity certifications, but after notifying the authors, the modern branch now rejects SHA-1 signatures (the issue is tracked as CVE-2019-14855). Theorem 3). Thus, assuming that the online phase succeeds, the α-node reached in the online phase is the root of the largest tree with asymptotic probability δ 1 /δ 2 ≈ 0.63. If we can locate the α-node of the online phase (i.e. we deduce its block index inside the queried message), we immediately get its corresponding internal state value from the offline computations. Since the average rho length is π2 l /2 we can not use a brute-force search to locate the α-node, but we can use a binary search instead. We denote the length of the cycle of the giant component as L, and the follow the distinguishing-H attack to reach the cycle. We choose a random message block m and we query the two messages

If the MAC collide, we know that the state reached after processing m [0] 2 l/2 is located inside the main cycle. We use a binary search to find the smallest X so that the state reached after m [0] X is in the cycle.

The first step of the binary search should decide whether the node reached after m [0] 2 l/2-1 is also inside the first online cycle or not. More precisely, we check if the two messages

also give a colliding tag. If it is the case, then the node after processing m 2 l/2-1 is surely inside the cycle, which implies that the α-node is necessarily located in the first 2 l/2-1 zero blocks. On the other hand, if the tags are not colliding, we cannot directly conclude that the α-node is located in the second half since there is a non-negligible probability that the α-node is in the first half but the [1] block is directing the paths in M 1 and M 2 to distinct components in the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] (in which case the tag are very likely to differ). Therefore, we have to test for collisions with several couples

, and if none of them collide we can safely deduce that the α-node is located in the second 2 l/2-1 zero blocks. Overall, one such step reduces the number of the candidate nodes by a half and we simply continue this binary search in order to eventually obtain the position of the α-node with log 2 (2 l/2 ) = l/2 iterations.

Detailed attack process

1. (offline) Search for a cycle in the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] and denote L its length. 2. (online) Find a message block m such that querying the two messages

leads to the same HMAC output. Let X 1 and X 2 be two integer variables, initialized to the values 0 and 2 l/2 respectively.

(online) Let

and for each of them query the HMAC output for messages

2 ) pairs leads to a colliding HMAC output, then set X 2 = X . Otherwise, set X 1 = X . We use β = 4.5 as explained later. 4. (online) If X 1 + 1 = X 2 holds, output X 2 as the block index of the α-node.

Otherwise, go back to the previous step.

12 288 Symmetric Cryptanalysis Beyond Primitives

Complexity and success probability analysis

Complexity. We would like to evaluate the complexity of the attack. The first step will require about 2 l/2 offline computations to find the cycle. Again, it is important to note that we can run this first step several times in order to ensure that we are using the cycle from the biggest component of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] . The second step repeats the execution of the distinguishing-H attack from Section 4, which requires 6 • 2 l/2 computations for a success probability of 0.14, until it finds a succeeding message block m. Therefore, after trying a few m values, we have probability very close to 1 to find a valid one. The third and fourth steps will be executed about l/2 times (for the binary search), and each iteration of the third step performs 2 • β log(l) queries of about 2 l/2 + 2 l/2 + L 3 • 2 l/2 message blocks each. Therefore, the overall complexity of the attack is about 3β

Success probability. Next we evaluate the success probability that the attacker recovers the internal state and this depends on the success probability of the binary search steps. We start with the case where the node after m [0] X is inside the first online cycle. The third step will succeed as long as at least one of the (M u 1 , M u 2 ) pairs collide on the output (we can omit the false positive collisions which happen with negligible probability). One pair (M u 1 , M u 2 ) will indeed collide if:

• The random block [u] sends both messages to the main component of the functional graph of h [START_REF]␣for␣a␣in␣L1␣for␣b␣in␣L3) L24␣=␣sorted[END_REF] . Since it has an expected size of δ 2 •2 l (see Theorem 3), this is the case with probability δ 2 2 . • The 2 l/2 [0] message blocks concatenated after [u] are enough to reach the cycle, i.e. the tail length when reaching the second cycle is smaller than 2 l/2 . Since the average tail length is smaller than 2 l/2 elements, this will happen with probability 1/2 for each message.

After trying β log(l) pairs, the probability that at least one pair collides is 1 -

5, this gives a probability of 1 -1/l. On the other hand, if the node after m [0] X is not inside the cycle, the third step will succeed when no random collision occurs among the β log(l) tries, and such collisions happen with negligible probability. Overall, since there are l/2 steps in the binary search, the average success probability of the binary search is (1 -1/l) l/2 ≥ e -1/2 ≈ 0.6.

Finally, the attack succeeds if the α-node is actually the root of the giant tree, as computed in the offline phase. This is the case with probability δ 1 /δ 2 , and the success probability of the full state recovery attack is δ 1 /δ 2 • e -1/2 ≈ 0.38.

Internal state recovery with shorter messages

In the full version of the paper, we give a an alternative internal-state recovery attack using shorter messages, that can also be used as a distinguishing-H attack Abstract The security of HMAC (and more general hash-based MACs) against state-recovery and universal forgery attacks was shown to be suboptimal, following a series of results by Leurent et al. and Peyrin et al.. These results have shown that such powerful attacks require significantly less than 2 computations, contradicting the common belief (where denotes the internal state size). In this work, we revisit and extend these results, with a focus on concrete hash functions that limit the message length, and apply special iteration modes.

We begin by devising the first state-recovery attack on HMAC with a HAIFA hash function (using a block counter in every compression function call), with complexity 2 4 /5 . Then, we describe improved tradeoffs between the message length and the complexity of a state-recovery attack on HMAC with a Merkle-Damgård hash function. Consequently, we obtain improved attacks on several HMAC constructions used in practice, in which the hash functions limits the maximal message length (e.g., SHA-1 and SHA-2). Finally, we present the first universal forgery attacks, which can be applied with short message queries to the MAC oracle. In particular, we devise the first universal forgery attacks applicable to SHA-1 and SHA-2.

Despite their theoretical interest, our attacks do not seem to threaten the practical security of the analyzed concrete HMAC constructions. (such as [22]), namely, that the collisions found by such algorithms are likely to belong to a restricted set of a surprisingly small size. Then, based on our proofs, we describe several new algorithms with various improved tradeoffs between the message length and the complexity as shown in Figure 1. As many concrete hash functions restrict the message size, we obtain improved attacks in many cases: for instance, we reduce the complexity of a state-recovery attack against HMAC-SHA-1 from 2 120 to 2 107 and HMAC-Whirlpool from 2 384 to 2 283 (see Table 1).

Finally, we focus on universal forgery attacks, where the previous attacks of [11,24] are much more efficient than exhaustive search, but require in an inherent way to query the MAC oracle with very long messages of about 2 /2 blocks. Thus, these attacks cannot be applied to many concrete hash functions that limit the message size. On the other hand, our techniques give rise to attacks that can be efficiently applied with much shorter queries to the MAC oracle, and therefore are more widely applicable to concrete hash functions. In particular, we devise the first universal forgery attack applicable to HMAC with SHA-1 and SHA-2 (see Table 1).

Framework of the attacks

In order to recover an internal state computed by the MAC oracle during the processing of some message (namely, mount a state-recovery attack), we use a framework which is similar to the one of [19]. Namely, we match states that are computed offline with (unknown) states that are computed online (during the processing of messages by the MAC oracle). However, as arbitrary states colliding points of the chains by (x i , x i ), so that f (x i ) = f (x i ) = x, with x i = x i . Fixing (x 0 , x 0 ), we now calculate Pr[A], namely the probability that 2 new chains of length 2 s , starting from arbitrary points (y 0 , y 0 ), also collide on x. This occurs if y 0 , y 1 , . . . , y 2 s -i collides with x 0 , x 1 , . . . , x i , and y 0 , y 1 , . . . , y 2 s -i collides with x 0 , x 1 , . . . , x i (or vise-versa). Clearly, Pr[A] = O(2 2(2s-) ), as all 4 chains are of length O(2 s ). Hence, to conclude the proof, we need to show that Pr[A] = Ω(2 2(2s-) ).

In order to simplify the proof, we assume in the following that 0.25 • 2 s ≤ i ≤ 0.75 • 2 s and denote this event by I. We have Pr[I] ≈ 1/2 since the offset of the collision x is roughly uniformly distributed in the interval [0, 2 s ]. This can be shown using Lemma 1, as increasing the length of the chains increases the collision probability (at a common offset) by the same multiplicative factor.

We have Pr[A|I] = Θ(2 2(2s-) ), since when 0.25 • 2 s ≤ i ≤ 0.75 • 2 s , all 4 chains (y 0 , y 1 , . . . , y 2 s -i , x 0 , x 1 , . . . , x i , y 0 , y 1 , . . . , y 2 s -i , x 0 , x 1 , . . . , x i ) are of length Θ(2 s ). Therefore,

Lemma 4 Let x and ŷ be two arbitrary same-offset collisions found, respectively, at offsets i and j by a collision search algorithm using 2 t chains of fixed length 2 s , with independent -bit random functions f i , such that s + t < . Then Pr [(x, i) = (ŷ, j)] = Θ(2 s-). Furthermore, when i = j, we have Pr [x = ŷ] = Θ(2 2s-).

Proof The proof follows essentially the same line of arguments as the proof of Lemma 3. We fix the collision x and denote by A the event that chains starting from arbitrary points (y 0 , y 0 ) collide on x at offset i, and by B the event that the chains starting from (y 0 , y 0 ) collide at an arbitrary offset j. We have Pr[B] = Θ(2 s-) (see Lemma 1) and Pr[A] = Θ(2 2(s-) ). 3 When assuming that i = j, we need to change the definition of event B such that the chains starting from (y 0 , y 0 ) collide at the fixed offset i. This gives Pr

Lemma 5 Let x be the entry point of an arbitrary cycle found by the cycle search algorithm for a fixed -bit function f , using chains of fixed length 2 s such that s ≤ /2. Let y 0 be an arbitrary point, and define the chain y i+1 = f (y i ) for i ∈ {0, 1, . . . , 2 s -1}. Then the probability that the chain y i finds the same cycle and entry point

Proof We denote the starting point of the chain found by the cycle search algorithm which collides (cycles) on x by x 0 , and the corresponding collision by (x i , x j ), with i < j, x i = x j and f (x i ) = f (x j ) = x. In the following, we assume that 0.25

The message is a global parameter

Compare z 2 to a message node using a filter return Search(z 2 , i)

We have

In a 2012 work, McGrew [28] described this sieving algorithm and noticed that when the set S is small, the sieving wastes a lot of time computing useless values. Therefore he proposed a second algorithm, algorithm 2, to test and eliminate values of S one by one. This algorithm loops over S and A to efficiently test whether s ⊕ a ∈ B; if yes then we sieve the value s out of S.

Both algorithms act on a sieving set S to reduce it, so McGrew proposed a hybrid algorithm switching from one algorithm to the other in order to reduce the searching space as quickly as possible. This improves the attack when A and B are fixed, but if the adversary can choose the sizes of A and B (in particular, if he actually has oracle access to functions f and g), then the searching algorithm allows better trade-offs. Indeed, the searching algorithm has a complexity of O(|B|+|A|•|S|), and is successful as soon as

To optimize the complexity, we use |B| = |A| • |S| to obtain an overall complexity of O(2 n/2 |S| ln |S|) in both time and queries. In particular for small S (of size polynomial in n) this algorithm is (almost) optimal, reaching the birthday bound Õ(2 n/2 ).

Starting from these observations we will show improved algorithms to recover a block of secret information without big exhaustive searches in the next section.

A SageMath Implementation

In order to verify that the algorithm is correct, we have implemented the attack against SUM-ECBC with complexity Õ(2 6n/7 ) given in Section 3. Abstract. Due to Shor's algorithm, quantum computers are a severe threat for public key cryptography. This motivated the cryptographic community to search for quantum-safe solutions. On the other hand, the impact of quantum computing on secret key cryptography is much less understood. In this paper, we consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in it.

We study applications of a quantum procedure called Simon's algorithm (the simplest quantum period finding algorithm) in order to attack symmetric cryptosystems in this model. Following previous works in this direction, we show that several classical attacks based on finding collisions can be dramatically sped up using Simon's algorithm: finding a collision requires Ω(2 n/2 ) queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only O(n) queries in the quantum model. We obtain attacks with very strong implications. First, we show that the most widely used modes of operation for authentication and authenticated encryption (e.g. CBC-MAC, PMAC, GMAC, GCM, and OCB) are completely broken in this security model. Our attacks are also applicable to many CAESAR candidates: CLOC, AEZ, COPA, OTR, POET, OMD, and Minalpher. This is quite surprising compared to the situation with encryption modes: Anand et al. show that standard modes are secure with a quantum-secure PRF. Second, we show that Simon's algorithm can also be applied to slide attacks, leading to an exponential speed-up of a classical symmetric cryptanalysis technique in the quantum model.

Keywords: post-quantum cryptography, symmetric cryptography, quantum attacks, block ciphers, modes of operation, slide attack.

Introduction

The goal of post-quantum cryptography is to prepare cryptographic primitives to resist quantum adversaries, i.e. adversaries with access to a quantum computer.

Indeed, cryptography would be particularly affected by the development of large-scale quantum computers. While currently used asymmetric cryptographic primitives would suffer from devastating attacks due to Shor's algorithm [42], the status of symmetric ones is not so clear: generic attacks, which define the security of ideal symmetric primitives, would get a quadratic speed-up thanks to Grover's algorithm [23], hinting that doubling the key length could restore an equivalent ideal security in the post-quantum world. Even though the community seems to consider the issue settled with this solution [6], only very little is known about real world attacks, that determine the real security of used primitives. Very recently, this direction has started to draw attention, and interesting results have been obtained. New theoretical frameworks to take into account quantum adversaries have been developed [11,12,19,22,15,2]. Simon's algorithm [43] is central in quantum algorithm theory. Historically, it was an important milestone in the discovery by Shor of his celebrated quantum algorithm to solve integer factorization in polynomial time [42]. Interestingly, Simon's algorithm has also been applied in the context of symmetric cryptography. It was first used to break the 3-round Feistel construction [30] and then to prove that the Even-Mansour construction [31] is insecure with superposition queries. While Simon's problem (which is the problem solved with Simon's algorithm) might seem artificial at first sight, it appears in certain constructions in symmetric cryptography, in which ciphers and modes typically involve a lot of structure.

These first results, although quite striking, are not sufficient for evaluating the security of actual ciphers. Indeed, the confidence we have on symmetric ciphers depends on the amount of cryptanalysis that was performed on the primitive. Only this effort allows researchers to define the security margin which measures how far the construction is from being broken. Thanks to the large and always updated cryptanalysis toolbox built over the years in the classical world, we have solid evaluations of the security of the primitives against classical adversaries. This is, however, no longer the case in the post-quantum world, i.e. when considering quantum adversaries.

We therefore need to build a complete cryptanalysis toolbox for quantum adversaries, similar to what has been done for the classical world. This is a fundamental step in order to correctly evaluate the post-quantum security of current ciphers and to design new secure ciphers for the post-quantum world.

Our results. We make progresses in this direction, and open new surprising and important ranges of applications for Simon's algorithm in symmetric cryptography:

1. The original formulation of Simon's algorithm is for functions whose collisions happen only at some hidden period. We extend it to functions that have more collisions. This leads to a better analysis of previous applications of Simon's algorithm in symmetric cryptography. 2. We then show an attack against the LRW construction, used to turn a blockcipher into a tweakable block cipher [32]. Like the results on 3-round Feistel and Even-Mansour, this is an example of construction with provable security in the classical setting that becomes insecure against a quantum adversary.

3. Next, we study block cipher modes of operation. We show that some of the most common modes for message authentication and authenticated encryption are completely broken in this setting. We describe forgery attacks against standardized modes (CBC-MAC, PMAC, GMAC, GCM, and OCB), and against several CAESAR candidates, with complexity only O(n), where n is the size of the block. In particular, this partially answers an open question by Boneh and Zhandry [13]: "Do the CBC-MAC or NMAC constructions give quantum-secure PRFs?". Those results are in stark contrast with a recent analysis of encryption modes in the same setting: Anand et al. show that some classical encryption modes are secure against a quantum adversary when using a quantum-secure PRF [3].

Our results imply that some authentication and authenticated encryption schemes remain insecure with any block cipher. 4. The last application is a quantization of slide attacks, a popular family of cryptanalysis that is independent of the number of rounds of the attacked cipher. Our result is the first exponential speed-up obtained directly by a quantization of a classical cryptanalysis technique, with complexity dropping from O(2 n/2 ) to O(n), where n is the size of the block.

These results imply that for the symmetric primitives we analyze, doubling the key length is not sufficient to restore security against quantum adversaries. A significant effort on quantum cryptanalysis of symmetric primitives is thus crucial for our long-term trust in these cryptosystems.

The attack model. We consider attacks against classical cryptosystems using quantum resources. This general setting broadly defines the field of post-quantum cryptography. But attacking specific cryptosystems requires a more precise definition of the operations the adversary is allowed to perform. The simplest setting allows the adversary to perform local quantum computation. For instance, this can be modeled by the quantum random oracle model, in which the adversary can query the oracle in an arbitrary superposition of the inputs [11,14,48,44].

A more practical setting allows quantum queries to the hash function used to instantiate the oracle on a quantum computer.

We consider here a much stronger model in which, in addition to local quantum operations, an adversary is granted an access to a possibly remote cryptographic oracle in superposition of the inputs, and obtains the corresponding superposition of outputs. In more detail, if the encryption oracle is described by a classical function O k : {0, 1} n → {0, 1} n , then the adversary can make standard quantum queries |x |y → |x |O k (x) ⊕ y , where x and y are arbitrary n-bit strings and |x , |y are the corresponding n-qubit states expressed in the computational basis. A circuit representing the oracle is given in Figure 1. Moreover, any superposition x,y λ x,y |x |y is a valid input to the quantum oracle, who then returns x,y λ x,y |x |y ⊕O k (x) . In previous works, these attacks have been called superposition attacks [19], quantum chosen message attacks [13] or quantum security [47].

3 modes of operations for encryption against superposition attacks [3]. They show that OFB and CTR remain secure, while CBC and CFB are not secure in general (with attacks involving Simon's algorithm), but are secure if the underlying PRF is quantum secure. Recently, [28] considers symmetric families of cryptanalysis, describing quantum versions of differential and linear attacks.

Cryptographic notions like indistinguishability or semantic security are well understood in a classical world. However, they become difficult to formalize when considering quantum adversaries. The quantum chosen message model is a good framework to study these [22,15,2].

In this paper, we consider forgery attacks: the goal of the attacker is to forge a tag for some arbitrary message, without the knowledge of the secret key. In a quantum setting, we follow the EUF-qCMA security definition that was given by Boneh and Zhandry [12]. A message authentication code is broken by a quantum existential forgery attack if after q queries to the cryptographic oracle, the adversary can generate at least q + 1 valid messages with corresponding tags.

Organization. The paper is organized as follows. First, Section 2 introduces Simon's algorithm and explains how to modify it in order to handle functions that only approximately satisfy Simon's promise. This variant seems more appropriate for symmetric cryptography and may be of independent interest. Section 3 summarizes known quantum attacks against various constructions in symmetric cryptography. Section 4 presents the attack against the LRW constructions. In Section 5, we show how Simon's algorithm can be used to obtain devastating attacks on several widely used modes of operations: CBC-MAC, PMAC, GMAC, GCM, OCB, as well as several CAESAR candidates. Section 6 shows the application of the algorithm to slide attacks, providing an exponential speed-up. The paper ends in Section 7 with a conclusion, pointing out possible new directions and applications.

Simon's algorithm and attack strategy

In this section, we present Simon's problem [43] and the quantum algorithm for efficiently solving it. The simplest version of our attacks directly exploits this algorithm in order to recover some secret value of the encryption algorithm. Previous works have already considered such attacks against 3-round Feistel schemes and the Even-Mansour construction (see Section 3 for details).

Unfortunately, it is not always possible to recast an attack in terms of Simon's problem. More precisely, Simon's problem is a promise problem, and in many cases, the relevant promise (that only a structured class of collisions can occur) is not satisfied, far from it in fact. We show in Theorem 1 below that, however, these additional collisions do not lead to a significant increase of the complexity of our attacks.

Simon's problem and algorithm

We first describe Simon's problem, and then the quantum algorithm for solving it. We refer the reader to the recent review by Montanaro and de Wolf on quantum 5

Dealing with unwanted collisions

In our cryptanalysis scenario, it is not always the case that the promise of Simon's problem is perfectly satisfied. More precisely, by construction, there will always exist an s such that f (x) = f (x ⊕ s) for any input x, but there might be many more collisions than those of this form. If the number of such unwanted collisions is too large, one might not be able to obtain a full rank linear system of equations from Simon's subroutine after O(n) queries. Theorem 1 rules this out provided that f does not have too many collisions of the form f (x) = f (x ⊕ t) for some t ∈ {0, s}.

For

This parameter quantifies how far the function is from satisfying Simon's promise. For a random function, one expects ε(f, s) = Θ(n2 -n ), following the analysis of [18]. On the other hand, for a constant function, ε(f, s) = 1 and it is impossible to recover s.

The following theorem, whose proof can be found in Appendix A, shows the effect of unwanted collisions on the success probability of Simon's algorithm.

Theorem 1 (Simon's algorithm with approximate promise). If ε(f, s) ≤ p 0 < 1, then Simon's algorithm returns s with cn queries, with probability at least 1 -2 1+p 0 2 c n .

In particular, choosing c ≥ 3/(1p 0 ) ensures that the error decreases exponentially with n. To apply our results, it is therefore sufficient to prove that ε(f, s) is bounded away from 1.

Finally, if we apply Simon's algorithm without any bound on ε(f, s), we can not always recover s unambiguously. Still if we select a random value t orthogonal to all vectors u i returned by each step of the algorithm, t satisfy f (x ⊕ t) = f (x) with high probability.

Theorem 2 (Simon's algorithm without promise). After cn steps of Simon's algorithm, if t is orthogonal to all vectors u i returned by each step of the algorithm, then Pr

In particular, choosing c ≥ 3/(1p 0 ) ensures that the probability is exponentially close to 1.

Attack strategy

The general strategy behind our attacks exploiting Simon's algorithm is to start with the encryption oracle E k : {0, 1} n → {0, 1} n and exhibit a new function f that satisfies Simon's promise with two additional properties: the adversary should be able to query f in superposition if he has quantum oracle access to E k , and the knowledge of the string s should be sufficient to break the cryptographic scheme. In the following, this function is called Simon's function.

7

if the nonce can be in superposition. To sidestep the issue, we use a weaker security notion where the nonce is chosen at random by the oracle, rather than by the adversary (following the IND-qCPA definition of [13]). The oracle is then M → (r, GMAC(r, M )). If we can break the scheme in this model, the attack will also be valid with any reasonable CPA security definition.

In this setting we can access the function f N only for a random value of N . In particular, we cannot apply Simon's algorithm as is, because this requires O(n) queries to the same function f N . However, a single step of Simon's algorithm requires a single query to the f N function, and returns a vector orthogonal to s, for any random choice of N . Therefore, we can recover (α 0 ⊕ α 1 ) • H after O(n) steps, even if each step uses a different value of N . Then, we can recover H easily, and it is easy to generate forgeries when H is known:

1. Query the tag of N, m 1 m 2 for arbitrary blocks m 1 , m 2 (under a random nonce N ). 2. The same tag is valid for m 1 ⊕ 1 m 2 ⊕ H (with the same nonce N ).

As for CBC-MAC, repeating these two steps leads to an existential forgery attack.

Classical Authenticated Encryption Schemes: GCM and OCB

We now give applications of Simon's algorithm to break the security of standardized authenticated encryption modes. The attacks are similar to the attacks against authentication modes, but these authenticated encryption modes are nonce-based. Therefore we have to pay special attention to the nonce, as in the attack against GMAC. In the following, we assume that the nonce is randomly chosen by the MAC oracle, in order to avoid issues with the definition of non-repeating nonce in a quantum setting.

Extending MAC attacks to authenticated encryption schemes. We first present a generic way to apply MAC attacks in the context of an authenticated encryption scheme. More precisely, we assume that the tag of the authenticated encryption scheme is computed as f (g(A), h(M, N )), i.e. the authentication of the associated data A is independent of the nonce N . This is the case in many practical schemes (e.g. GCM, OCB) for efficiency reasons.

In this setting, we can use a technique similar to our attack against GMAC: we define a function M → f N (M ) for a fixed nonce N , such that for any nonce N , f N (M ) = f N (M ⊕ ∆) for some secret value ∆. Next we use Simon's algorithm to recover ∆, where each step of Simon's algorithm is run with a random nonce, and returns a vector orthogonal to ∆. Finally, we can recover ∆, and if f N was carefully built, the knowledge of ∆ is sufficient for a forgery attack.

The CCM mode is a notable exception, where all the computations depend on the nonce. In particular, there is no obvious way to apply our attacks to CCM.

Extending GMAC attack to GCM. GCM is one of the most widely used authenticated encryption modes, designed by McGrew and Viega [35]. GMAC is the composition of the counter mode for encryption with GMAC (computed over the associated data and the ciphertext) for authentication.

This function satisfies f

, with the same arguments as previously. Moreover, in OCB1 and OCB3, the offsets are derived as

for some function Φ (based on the block cipher E k ). In particular, ∆ N 1 ⊕ ∆ N 2 is independent of N :

Therefore, we can apply Simon's algorithm to recover ∆ N 1 ⊕ ∆ N 2 . Again, this leads to a forgery attack, by repeating the following two steps:

1. Query the authenticated encryption c 1 c 2 , τ of m m, A for an arbitrary block m, and arbitrary associated data A (under a random nonce N ). 2.

A with the same nonce N . The forgery is valid because we swap the inputs of the first and second block ciphers. In addition, we have m i = m i , so that the tag is still valid.

New Authenticated Encryption Schemes: CAESAR Candidates

In this section, we consider recent proposals for authenticated encryption, submitted to the ongoing CAESAR competition. Secret key cryptography has a long tradition of competitions: AES and SHA-3 for example, were chosen after the NIST competitions organized in 1997 and 2007, respectively. The CAESAR competition 7 aims at stimulating research on authenticated encryption schemes, and to define a portfolio of new authenticated encryption schemes. The competition is currently in the second round, with 29 remaining algorithms. First, we point out that the attacks of the previous sections can be used to break several CAESAR candidates:

-CLOC [26] uses CBC-MAC to authenticate the message, and the associated data is processed independently of the nonce. Therefore, the CBC-MAC attack can be extended to CLOC 8 . -AEZ [24], COPA [4], OTR [36] and POET [1] use a variant of PMAC to authenticate the associated data. In both cases, the nonce is not used to process the associated data, so that we can extend the PMAC attack as we did against OCB 9 . -The authentication of associated data in OMD [17] and Minalpher [41] are also variants of PMAC (with a PRF that is not block cipher), and the attack can be applied.

In the next section, we show how to adapt the PMAC attack to Minalpher and OMD, since the primitives are different. exponentially, from O(2 n/2 ) to O(n) and therefore becomes much more dangerous. To the best of our knowledge this is the first symmetric cryptanalytic technique that has an exponential speed-up in the post-quantum world.

The principle of slide attacks In 1999, Wagner and Biryukov introduced the technique called slide attack [7]. It can be applied to block ciphers made of r applications of an identical round function R, each one parametrized by the same key K. The attack works independently of the number of rounds, r. Intuitively, for the attack to work, R has to be vulnerable to known plaintext attacks.

The attacker collects 2 n/2 encryptions of plaintexts. Amongst these couples of plaintext-ciphertext, with large probability, he gets a "slid" pair, that is, a pair of couples (P 0 , C 0 ) and (P 1 , C 1 ) such that R(P 0 ) = P 1 . This immediately implies that R(C 0 ) = C 1 . For the attack to work, the function R needs to allow for an efficient recognition of such pairs, which in turns makes the key extraction from R easy. A trivial application of this attack is the key-alternate cipher with blocks of n bits, identical subkeys and no round constants. The complexity is then approximately 2 n/2 . The speed-up over exhaustive search given by this attack is then quadratic, similar to the quantum attack based on Grover's algorithm.

This attack is successful, for example, to break the TREYFER block cipher [46], with a data complexity of 2 32 and a time complexity of 2 32+12 = 2 44 (where 2 12 is the cost of identifying the slid pair by performing some key guesses). Comparatively, the cost for an exhaustive search of the key is 2 64 . Exponential quantum speed-up of slide attacks We consider the attack represented in Figure 13. The unkeyed round function is denoted P and the whole encryption function E k . We define the following function:

The slide property shows that all x satisfy P (E k (x)) ⊕ k = E k (P (x ⊕ k)). This implies that f satisfies the promise of Simon's problem with s = 1 k:

In order to apply Theorem 1, we bound ε(f, 1 k), assuming that both E k • P and

Let us assume τ = 0. This implies

which is equivalent to

In particular, there is a differential in P • E k or E k • P with probability 1/2. Otherwise, τ = 1. This implies

Again, it means there is a differential in E k • P with probability 1/2. Finally we conclude that ε(f, 1 k) ≤ 1/2, unless E k • P or P • E k have differentials with probability 1/2. If E k behave as a random permutation, E k • P and P • E k also behave as random permutations, and these differential are only found with negligible probability. Therefore, we can apply Simon's algorithm, following Theorem 1, and recover k.

Conclusion

We have been able to show that symmetric cryptography is far from ready for the post quantum world. We have found exponential speed-ups on attacks on symmetric cryptosystems. In consequence, some cryptosystems that are believed to be safe in a classical world become vulnerable in a quantum world.

With the speed-up on slide attacks, we provided the first known exponential quantum speed-up of a classical attack. This attack now becomes very powerful. An interesting follow-up would be to seek other such speed-ups of generic techniques. For authenticated encryption, we have shown that many modes of operations that are believed to be solid and secure in the classical world, become completely broken in the post-quantum world. More constructions might be broken following the same ideas.

A Proof of Theorem 1

The proof of Theorem 1 is based of the following lemma. Lemma 1. For t ∈ {0, 1} n , consider the function g(x) := 2 -n y∈t ⊥ (-1) x•y , where t ⊥ = {y ∈ {0, 1} n s.t. y • t = 0}. for any x, it satisfies

Proof. If t = 0 then g(x) = y∈{0,1} n (-1) x•y = δ(x, 0), which proves the claim. From now on, assume that t = 0. It is straightforward to check that g(0) = g(t) = 1 2 because all the terms of the sum are equal to 1 and there are 2 n-1 vectors y orthogonal to t. Since x∈{0,1} n g(x) = 1, it is sufficient to prove that g(x) ≥ 0 to establish the claim in the case t = 0. For this, decompose g(x) into two terms:

where E i := {y ∈ {0, 1} n s.t. y • x = i and y • y = 0} for i = 0, 1. Simple counting shows that:

We are now ready to prove Theorem 1. Each call to the main subroutine of Simon's algorithm will return a vector u i . If cn calls are made, one obtains cn vectors u 1 , . . . , u cn . By construction, f is such that f (x) = f (x ⊕ s) and consequently, the cn vectors u 1 , . . . , u cn are all orthogonal to s. The algorithm is successful provided one can recover the value of s unambiguously, which is the case if the cn vectors span the (n -1)-dimensional space orthogonal to s. (Let us note that if the space is (nd)-dimensional for some constant d, one can still recover s efficiently by testing all the vectors orthogonal to the subspace.) In other words, the failure probability p fail is

where the second inequality results from the union bound and the third inequality follows from the fact that the results of the cn subroutines are independent.

In order to establish the theorem, it is now sufficient to show that Pr[u • t = 0] is bounded away from 1 for all t, where u is the vector corresponding to the 29

Quantum Linearization Attacks

Xavier Bonnetain 1,2 , Gaëtan Leurent 2 , María Naya-Plasencia 2 , and André Schrottenloher 3

1 Institute for Quantum Computing, Department of Combinatorics and Optimization, University of Waterloo, Waterloo, ON, Canada 2 Inria, Paris, France 3 Cryptology Group, CWI, Amsterdam, The Netherlands Abstract. Recent works have shown that quantum period-finding can be used to break many popular constructions (some block ciphers such as Even-Mansour, multiple MACs and AEs. . . ) in the superposition query model. So far, all the constructions broken exhibited a strong algebraic structure, which enables to craft a periodic function of a single input block. Recovering the secret period allows to recover a key, distinguish, break the confidentiality or authenticity of these modes. In this paper, we introduce the quantum linearization attack, a new way of using Simon's algorithm to target MACs in the superposition query model. Specifically, we use inputs of multiple blocks as an interface to a function hiding a linear structure. Recovering this structure allows to perform forgeries. We also present some variants of this attack that use other quantum algorithms, which are much less common in quantum symmetric cryptanalysis: Deutsch's, Bernstein-Vazirani's, and Shor's. To the best of our knowledge, this is the first time these algorithms have been used in quantum forgery or key-recovery attacks. Our attack breaks many parallelizable MACs such as LightMac, PMAC, and numerous variants with (classical) beyond-birthday-bound security (LightMAC+, PMAC+) or using tweakable block ciphers (ZMAC). More generally, it shows that constructing parallelizable quantum-secure PRFs might be a challenging task.

by an adversary capable of successfully implementing Shor's algorithm [START_REF] Shor | Algorithms for quantum computation: Discrete logarithms and factoring[END_REF]. An ongoing standardization project led by the NIST [56] has structured the efforts of the (asymmetric) cryptographic community on this question.

As symmetric primitives do not rely on a trapdoor, they seemed for a long time to avoid the cases where quantum computers bring an exponential speedup over the best classical algorithms. In fact, most problems in symmetric cryptography, such as the search for the secret key of a black-box cipher, seem to admit a quadratic speedup at best, given by Grover's quantum search algorithm [29]. Although this speedup is significant, it could be countered by increasing the parameters of symmetric cryptosystems, e.g., doubling the size of secret keys.

However, in the past few years, a series of works have shown the insecurity of some symmetric cryptosystems against quantum adversaries entitled to superposition queries. That is, some primitives become broken if they can be queried inside a quantum algorithm. This started with the 3-round Feistel distinguisher proposed by Kuwakado and Morii [44]. Later, they found a polynomial-time keyrecovery attack on the Even-Mansour cipher [45], which was the first quantum key-recovery on a classically secure symmetric construction. These results rely crucially on the fact that many popular designs in symmetric cryptography have a strong algebraic structure, as they are built by combining smaller primitives (such as permutations or block ciphers) using cheap operations such as XORs. Kaplan et al. [39] showed that many other constructions exhibited a structure exploitable by a quantum adversary, and designed the first forgery attacks on MACs (notably CBC-MAC [11], OMAC [35], PMAC [12]) and authenticated encryption schemes (e.g., OCB3 [43], GCM [49]).

In this paper, we will focus on idealized MAC constructions that authenticate messages of arbitrary size using smaller primitives such as permutations, block ciphers or tweakable block ciphers (TBCs) of block size n. These constructions have classical proofs of security showing either that the MAC behaves as a pseudo-random function, or that it is unforgeable, up to some exponential bound in n. We will exhibit polynomial-time quantum attacks on constructions that were not vulnerable to previous Simon's attacks (like those of [39,[START_REF] Santoli | Using Simon's algorithm to attack symmetric-key cryptographic primitives[END_REF]). Previous Attacks. Although there have been many of them, all the quantum forgery attacks known so far follow the same paradigm. They query the MAC with a constant number of blocks, using usually a single block of message x in superposition. Inside the MAC, this block of message x is XORed to some unknown value α depending on other blocks: thus, the result is MAC(x ⊕ α).

Having two different values α 0 , α 1 , we then have access to two functions f (x) = MAC(x ⊕ α 0 ) and g(x) = MAC(x ⊕ α 1 ), such that f (x) = g(x ⊕ α 0 ⊕ α 1 ). From there, we can use Simon's Boolean hidden shift algorithm [START_REF] Simon | On the power of quantum computation[END_REF] as a black box. It recovers α 0 ⊕ α 1 in quantum polynomial time, whereas any classical algorithm would require exponentially many queries to f and g (thus to the MAC). The recovery of the internal shift α 0 ⊕ α 1 then enables the adversary to forge new messages, and in some cases to recover secret-key material.

Let us point out the following important remark:

If the message blocks are not directly XORed to internal values (keys, offsets, encryption of other blocks. . . ), then the previous attacks based on Simon's algorithm do not apply.

Contributions. In this paper, we present the quantum linearization attack, which is a new family of quantum attacks on classically unforgeable MACs when superposition queries are allowed. Thanks to the novelty of our approach, we are able to attack many MACs that resisted previous cryptanalysis, as they do not not exhibit the property recalled above (a message block XORed to an internal state value). In particular, our attack usually circumvents the use of TBCs instead of block ciphers. It is also the first case of a quantum polynomialtime attack on MACs with beyond-birthday security, where the internal state has a bigger size. As an example, we break LightMAC with a linear number of queries, and we can attack LightMAC+ with only twice as much. Overview. Our attack starts with the following remark. Consider a function of blocks x 1 , . . . , x of the form: G(x 1 , . . . , x ) = g 1 (x 1 ) ⊕ . . . ⊕ g (x ) ⊕ C , where C is an independent constant, and the g i are independent random functions to which the adversary does not have access. Then classically, this function cannot be distinguished from random with a single query, though as little as four would be enough: we make x 3 , . . . , x constant, we query for every x 1 ∈ {0, 1} and x 2 ∈ {0, 1}: the XOR of the four results is zero.

Our key idea is to linearize the function G by restricting the block inputs so that the output is an affine function. Similarly to the simple classical distinguisher, we make the blocks x 1 , . . . , x take only one-bit values and emulate a function of an -bit input: F (x) = F (b 1 . . . b ) = G(0 n-1 b 1 , . . . , 0 n-1 b ). Now, we will remark that F is an affine function of b 1 , . . . , b . As the g i are XORed; flipping a bit b i in the input XORs g i (0) ⊕ g i (1) to the output.

It is well known that the Bernstein-Vazirani algorithm allows to distinguish an affine function from a random one with a single quantum query. This shows that, thanks to a multi-block input, we can access new vulnerabilities of cryptographic constructions. But the power of our attack is clearly demonstrated when we make G go through a new random function:

All the functions g 1 , . . . , g , g are unknown to the adversary, so she cannot find the affine structure of the internal G. In fact, this function would be classically secure as a MAC. However, when linearizing, we obtain: G (x) = g(F (x)) where F is an affine function of x = b 1 . . . b . Thus, G embeds a hidden Boolean period, and Simon's algorithm can recover it in polynomial time.

Applications. In Section 4 and Section 5, we detail the applications of our algorithm. We obtain the first polynomial-time attacks against the following MACs:

ΘCB3 [START_REF] Rogaway | Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC[END_REF]43], LightMAC [47], LightMAC+ [START_REF] Naito | Blockcipher-based MACs: beyond the birthday bound without message length[END_REF], Deoxys [38], ZMAC [37], PMAC TBC3k [START_REF] Naito | Full PRF-secure message authentication code based on tweakable block cipher[END_REF], PolyMAC [36], GCM-SIV2 [36] In addition, we provide attacks on the XOR-MACs of [4], on MACs based on universal hashing (e.g., NMH * [31] and BRW Hashing [7]) and, in Section 5.5,

a new superposition forgery attack against Poly1305 [6]. A previous quantum attack was given in [18], using a hidden shift structure. Using Shor's algorithm instead, we reduce the number of superposition queries from 2 38 to about 32. On Parallelizable MACs. The quantum linearization attack leaves only little space for quantum-secure parallelizable PRFs. Indeed, we are able to break any PRF with extendable domain, where at least ≥ n independent input blocks of ≤ n bits are processed independently, then XORed. This works as well for any operation that is linear on (F 2 ) n . It is still possible to obtain an unforgeable IVor nonce-based MAC of this form, as shown in [9], but the security then relies on the non-repetition of IVs. We do not know if an attack applies when we use a modular addition instead of a XOR in (1). If this was the case, then it would clearly mean that one has to rely on sequentiality or on nonlinear operations.

Organization. We start in Section 2 by reviewing some quantum computing notions, the quantum algorithms used in this paper (Deutsch's algorithm, Bernstein-Vazirani, Simon's algorithm, Shor's algorithm), the Q1 / Q2 attack scenarios and notions of quantum unforgeability. In Section 3, we detail our new algorithmic ideas. In Section 4, we apply our attack to many parallelizable MAC constructions. We dedicate Section 5 to MACs based on universal hashing. We discuss the implications of our attacks in Section 6 and conclude the paper in Section 7.

Preliminaries

In this section, we give some preliminaries about quantum computing, quantum attacker models and the well-known quantum algorithms that will be used throughout this paper. We elaborate about the Q2 attacker model and the notion of quantum unforgeability for MACs, with or without IVs. Note that some details of quantum computing will appear in this section. They are intended for the interested reader. In the rest of this paper (with the exception of Section 5.5), we will use the algorithms of this section as black boxes.

Notation

We consider n-bit string values, sometimes as elements of F 2 n , sometimes as elements of F n 2 . This shall be clear from context. We let ⊕ denote the XOR (addition in F n 2 ), denote multiplication in F 2 n , and + modular addition. We let • denote the scalar product of bit-strings seen as n-bit vectors.

On Quantum Computing

Although we choose to present in detail the quantum algorithms that we will use for our attacks, most of our results can be obtained by applying them as black boxes. Thus we stress that our results, similarly as other structural attacks on symmetric cryptosystems [45,39], can be understood from a high-level perspective, and our attacks do not require specific knowledge of quantum computing. Further details are only required to prove the correctness of the algorithms. return "injective case" 13: else if Y is of rank n -1 then 14:

return "periodic case" and the s orthogonal to Y 15: else 16:

return "failure" 17: end if will grow to a full-rank family. In the periodic case, the value a has exactly two preimages x a and x a ⊕ s which interfere with each other. The current state is

and only the vectors y orthogonal to s have a non-zero amplitude. Thus, the family Y grows to span the euclidean subspace orthogonal to s. Computing the rank of Y allows to detect the period and solving the linear system Y s = 0 n allows to recover it. Generalizations. Although the original Simon's problem concerns functions without random collisions (that is, we cannot have f (x) = f (y) if x ⊕ y / ∈ {0, s}), it can be shown that the algorithm works as well for random functions having a period, which models the cryptographic problems that we are interested in.

The following simple condition was given in [39]. For Simon's algorithm to run as expected (i.e., with O (n) queries), it is sufficient for the periodic function f , of period s, to satisfy the following condition:

That is, f should not admit another "unwanted partial period" t. In the examples studied in this paper, the condition (2) will be easy to check.

Note that if we had f (x ⊕ t) = f (x) for all x, then t would simply turn the set of periods of f into a vector space of dimension 2. In general, the space of periods could be a vector space of any dimension. An extended version of Simon's algorithm by Brassard and Høyer [20] allows to recover this whole space in polynomial time.

7

Against the Even-Mansour construction [45]: E K (x) = K 2 ⊕ Π(x ⊕ K 1 ) for a random public permutation Π and two keys K 1 , K 2 . One has:

which leads to a recovery of K 1 in O (n) queries and O n 3 computations. Against CBC-MAC with two blocks [39]: It can be defined as:

where K and K are two keys that will remain unknown to the adversary. Due to the structure of CBC-MAC, one can take two arbitrary values α 0 , α 1 , and define the function:

We have then that F (b, x) = F (b ⊕ 1, x ⊕ E K (α 0 ) ⊕ E K (α 1 )). Thus F has a hidden boolean period 1 E K (α 0 ) ⊕ E K (α 1 ). Having obtained the internal value E K (α 0 ) ⊕ E K (α 1 ), we can query the tag of any message starting with block α 0 , and then forge a message starting with α 1 with the same tag.

Constructions based on IVs. We consider two types of constructions with quantum access: some make use of an initialization value (IV, sometimes also named a nonce) and some do not. In the IV case, we consider that the IV is a classical value, chosen randomly before each oracle query, and not repeated. This model follows from the idea that the IV is not controlled by the adversary, and it can serve as an intermediate between the classical setting and a (much) stronger model in which the adversary would completely (and quantumly) control the IVs.

In fact, the latter case does not seem to have been studied so far in quantum security. Well-known notions such as IND-qCPA [14] rely on classical randomness, and many modes of operation have been proven secure in this model [3,9].

In the classical setting, many MAC constructions have a security that relies on the non-repetition of IVs, for example the MAC of OCB [43]. The same happens in the quantum setting, since the MAC of QCB [9] has been proven secure under quantum queries with classical non-repeated IVs. Unforgeability. The first notion of quantum unforgeability for MACs was defined by Boneh and Zhandry [13]. We will name it plus-one unforgeability (PO), following [1]. The idea is that an adversary making q quantum queries to the construction, where q is polynomial, should not be able to produce q + 1 valid {message, tag} pairs. A more recent definition is blind-unforgeability (BU), proposed in [1]. It is strictly stronger than PO-unforgeability. In this paper, we will give several quantum forgery attacks that break the PO notion, thereby also breaking BU. Quantum PRFs. A quantum pseudorandom function (qPRF) is a family of functions F K , indexed by a key space K, such that no quantum adversary making queries to an oracle O f can distinguish efficiently between a function F K , with then this holds as well for all x. However, unwanted collisions might occur in f K (IV, •).

Assuming that M m is full rank, we can express the probability of unwanted partial periods for f K (IV, F (•)) as the probability of such unwanted collisions for f K (IV, •):

Even if the output is truncated to less than n bits, p ≤ 1 2 follows trivially from the fact that f K (IV, •) should not admit a differential of such high probability. To conclude, it is precisely the fact that the termination function f K (IV, •) is a good PRF, and does not admit an interfering period, that allows to apply easily Simon's algorithm in our case. Thus, by making a polynomial number of Q2 queries to the MAC construction, we can obtain such an α. This allows to create forgeries as follows. Forgeries without IVs. We first make n queries to find a valid α with Simon's algorithm (with constant probability of success). Then, the knowledge of this α allows us, for each tag x queried, to output a forged tag x ⊕ α. Thus we can double the number of tags that we produce compared to the number of queries we make. This breaks the PO notion as soon as, making r + n queries, we have 2r ≥ r + 1 + n tags, thus with 2n + 2 queries in total. Note that by breaking PO, we are actually showing that the MAC construction is not a qPRF (if it were, it would be PO-secure). Forgeries with IVs. As long as the IV (or nonce) is used only in the keyed post-processing, we can recover a value α and run the attack as above. We will indeed output more triples {IV, message, tag} than the number of queries made, although some IVs are repeated in the outputs. Universal Forgeries. Instead of taking the arbitrary values b i ||0 in message blocks, we can take any pair of values for each of them. That way, we can even start from any m-block message y 1 , . . . , y m , and then define a function of x = b 1 . . . b m that inputs y i in block i if b i = 1 and an arbitrary value 0 otherwise. Using Simon's algorithm, we will find a subset of the y i such that the E K,i (y i ) have the same XOR as the E K,i (0). Hence, we can produce a new message having the same tag as y 1 , . . . , y m . This works as soon as m ≥ n (there just needs to be enough message blocks for our attack).

Applications to Parallelizable MACs

In this section, we apply the quantum linearization attack to many parallelizable MACs of the literature. In particular, we show that the attack can be extended to