A Collision Attack on a Double-Block-Length Compression Function Instantiated with 8-/9-Round AES-256

作者：Chien, Jiageng; Hirose, Shoichi^*; Kuwakado, Hidenori; Miyaji, Atsuko

来源：IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2016, E99A(1): 14-21.

DOI：10.1587/transfun.E99.A.14

• double-block-length compression function
• free-start collision attack
• rebound attack
• AES-256

This paper presents the first non-trivial collision attack on the double-block-length compression function presented at FSE 2006 instantiated with round-reduced AES-256: f(0)(h(0)parallel to h(1), M)parallel to f(1)(h(0)parallel to h(1), M) such that
f(0)(h0 parallel to h(1), M) = Eh(1)parallel to(M)(h(0))circle plus h(0),
f(1)(h(0)parallel to h(1), M) = E-h1 parallel to(M)(h(0)circle plus c)circle plus h(0)circle plus c,
where parallel to represents concatenation, E is AES-256 and c is a 16-byte nonzero constant. The proposed attack is a free-start collision attack using the rebound attack proposed by Mendel et al. The success of the proposed attack largely depends on the configuration of the constant c: the number of its non-zero bytes and their positions. For the instantiation with AES-256 reduced from 14 rounds to 8 rounds, it is effective if the constant c has at most four non-zero bytes at some specific positions, and the time complexity is 2(64) or 2(96). For the instantiation with AES-256 reduced to 9 rounds, it is effective if the constant c has four non-zero bytes at some specific positions, and the time complexity is 2(120). The space complexity is negligible in both cases.

• 出版日期2016-1
• 单位华中师范大学