Welcome to the resource topic for 2022/734
Title:
Tight Preimage Resistance of the Sponge Construction
Authors: Charlotte Lefevre and Bart Mennink
Abstract:The cryptographic sponge is a popular method for hash function design. The construction is in the ideal permutation model proven to be indifferentiable from a random oracle up to the birthday bound in the capacity of the sponge. This result in particular implies that, as long as the attack complexity does not exceed this bound, the sponge construction achieves a comparable level of collision, preimage, and second preimage resistance as a random oracle. We investigate these state-of-the-art bounds in detail, and observe that while the collision and second preimage security bounds are tight, the preimage bound is not tight. We derive an improved and tight preimage security bound for the cryptographic sponge construction. The result has direct implications for various lightweight cryptographic hash functions. For example, the NIST Lightweight Cryptography finalist Ascon-Hash does not generically achieve 2^{128} preimage security as claimed, but even 2^{192} preimage security. Comparable improvements are obtained for the modes of Spongent, PHOTON, ACE, Subterranean 2.0, and QUARK, among others.
ePrint: https://eprint.iacr.org/2022/734
Talk: https://www.youtube.com/watch?v=X58bwUnqFuE
Slides: https://iacr.org/submit/files/slides/2022/crypto/crypto2022/37/slides.pdf
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .