Welcome to the resource topic for 2024/052
Title:
Simple Vs Vectorial: Exploiting Structural Symmetry to Beat the ZeroSum Distinguisher Applications to SHA3, Xoodyak and Bash
Authors: SAHIBA SURYAWANSHI, Shibam Ghosh, Dhiman Saha, Prathamesh Ram
Abstract:Higher order differential properties constitute a very insightful tool at the hands
of a cryptanalyst allowing for probing a cryptographic primitive from an algebraic perspective. In FSE 2017, Saha et al. reported SymSum (referred to as
SymSum_Vec in this paper), a new distinguisher based on higher order vectorial
Boolean derivatives of SHA-3, constituting one of the best distinguishers on the
latest cryptographic hash standard. SymSum_Vec exploits the difference in the
algebraic degree of highest degree monomials in the algebraic normal form of
SHA-3 with regards to their dependence on round constants. Later in Africacrypt
2020, Suryawanshi et al. extended SymSum_Vec using linearization techniques and
in SSS 2023 also applied it to NIST-LWC finalist Xoodyak. However, a major
limitation of SymSum_Vec is the maximum attainable derivative (MAD) which is
less than half of the widely studied ZeroSum distinguisher. This is attributed
to SymSum_Vec being dependent on m−fold vectorial derivatives while ZeroSum
relies on m−fold simple derivatives. In this work we overcome this limitation
of SymSum_Vec by developing and validating the theory of computing SymSum_Vec
with simple derivatives. This gives us a close to 100% improvement in the MAD
that can be computed. The new distinguisher reported in this work can also be combined with one/two-round linearization to penetrate more rounds. Moreover, we identify an issue with the two-round linearization claim made by Suryawanshi et al. which renders it invalid and also furnish an algebraic fix at the cost of some additional constraints.
Combining all results we report SymSum_Sim , a new variant of the SymSum_Vec
distinguisher based on m−fold simple derivatives that outperforms ZeroSum by
a factor of 2^{257}, 2^{129} for 10-round SHA-3-384 and 9-round SHA-3-512 respectively while enjoying the same MAD as ZeroSum. For every other SHA-3 variant,
SymSum_Sim maintains an advantage of factor 2. Combined with one/two-round
linearization, SymSum_Sim improves upon all existing ZeroSum and SymSum_Vec
distinguishers on both SHA-3 and Xoodyak. As regards Keccak-p, the internal
permutation of SHA-3, we report the best 15-round distinguisher with a complexity of 2^{256} and the first better than birthday-bound 16-round distinguisher with
a complexity of 2^{512} (improving upon the 15/16-round results by Guo et al. in
Asiacrypt 2016). We also devise the best full-round distinguisher on the Xoodoo
internal permutation of Xoodyak with a practically verifiable complexity of 2^{32}
and furnish the first third-party distinguishers on the Belarushian hash function
Bash. All distinguishers furnished in this work have been verified through implementations whenever practically viable. Overall, with the MAD barrier broken,
SymSum_Sim emerges as a better distinguisher than ZeroSum on all fronts and
adds to the state-of-the-art of cryptanalytic tools investigating non-randomness
of crypto primitives.
ePrint: https://eprint.iacr.org/2024/052
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .