NIST新HASH算法征集活动综述

随着SHA-1漏洞被发现,对新的HASH算法的需求日渐突出。NIST专门对此召开两次研讨会,并举办了新算法征集活动,旨在发展新的HASH函数。该文对有关活动进行了综述,特别是对新算法的质量要求进行了分析。     

On security arguments of the second round SHA-3 candidates

In 2007, the US National Institute for Standards and Technology (NIST) announced a call for the design of a new cryptographic hash algorithm in response to vulnerabilities like differential attacks identified in existing hash functions, such as MD5 and SHA-1. NIST received many submissions, 51 of which got accepted to the first round. 14 candidates were left in the second round, out of which five candidates have been recently chosen for the final round. An important criterion in the selection process is the SHA-3 hash function security. We identify two important classes of security arguments for the new designs: (1) the possible reductions of the hash function security to the security of its underlying building blocks and (2) arguments against differential attack on building blocks. In this paper, we compare the state of the art provable security reductions for the second round candidates and review arguments and bounds against classes of differential attacks. We discuss all the SHA-3 candidates at a high functional level, analyze, and summarize the security reduction results and bounds against differential attacks. Additionally, we generalize the well-known proof of collision resistance preservation, such that all SHA-3 candidates with a suffix-free padding are covered.     

BLAKE算法的硬件实现研究

随着对MD5和SHA1攻击方法的提出,美国国家标准技术研究所(NIST)组织启动了SHA-3的征集计划,目前已进入第3轮.BLAKE算法进入了最后一轮竞赛,文中首先综述了BLAKE算法从提交到目前为止在硬件评估方面的状况.在此基础上优化了BLAKE压缩函数在FPGA上实现的关键路径,并在FPGA平台上实现了BLAKE算法.和现有的BLAKE算法在FPGA上实现的吞吐率相比,文中实现结构的吞吐率又有提升.     

SHA-3候选算法Keccak的Matlab设计与实现

由KIST发起的新一代Hash函数标准SHA-3的全球公开征集过程目前已进入最后一轮筛选,Kcccak是进入最后一轮的J个候选者之一。介绍了Keccak算法及特点,给出了一种基于Matlab、带有图形界面GUI的Keccak程序设计与实现过程。本程序既可用于实际的Keccak Hash值运算,最重要的是为Keccak的教学与研究提供了一个方便直观的工具。     

可重构计算平台上SHA系列函数的优化实现

针对当前哈希函数算法标准和应用需求不同的现状,以及同一系统对安全性可能有着不同的要求,采用可重构的设计思想,在对SHA-1、SHA-256、SHA-512三种哈希函数的不同特征进行深入分析的基础上,总结归纳出统一的处理模型。根据不同的要求,每一种SHA(SHA-1、SHA-256、SHA-512)系列哈希函数都可以单独灵活地执行。使用流水线,并在关键路径进行加法器的优化,提高了算法的吞吐率。并且使用效能比的概念,与M3服务器对比,可重构平台的效能比比通用服务器高很多。     

Implementation of the SHA-2 Hash Family Standard Using FPGAs

The continued growth of both wired and wireless communications has triggered the revolution for the generation of new cryptographic algorithms. SHA-2 hash family is a new standard in the widely used hash functions category. An architecture and the VLSI implementation of this standard are proposed in this work. The proposed architecture supports a multi-mode operation in the sense that it performs all the three hash functions (256, 384 and 512) of the SHA-2 standard. The proposed system is compared with the implementation of each hash function in a separate FPGA device. Comparing with previous designs, the introduced system can work in higher operation frequency and needs less silicon area resources. The achieved performance in the term of throughput of the proposed system/architecture is much higher (in a range from 277 to 417%) than the other hardware implementations. The introduced architecture also performs much better than the implementations of the existing standard SHA-1, and also offers a higher security level strength. The proposed system could be used for the implementation of integrity units, and in many other sensitive cryptographic applications, such as, digital signatures, message authentication codes and random number generators.     

The NIST Cryptographic Workshop on Hash Functions

In light of recent breakthroughs on the cryptanalysis of hash functions, the US National Institute for Standards and Technology (NIST) organized a workshop to solicit input on the current status of the Secure Hash Algorithm-1 (SHA-1) family of hash functions.     

The parazoa family: generalizing the sponge hash functions

Sponge functions were introduced by Bertoni et?al. as an alternative to the classical Merkle-Damg?rd design. Many hash function submissions to the SHA-3 competition launched by NIST in 2007, such as CubeHash, Fugue, Hamsi, JH, Keccak and Luffa, derive from the original sponge design, and security guarantees from some of these constructions are typically based on indifferentiability results. Although indifferentiability proofs for these designs often bear significant similarities, these have so far been obtained independently for each construction. In this work, we introduce the parazoa family of hash functions as a generalization of “sponge-like” functions. Similarly to the sponge design, the parazoa family consists of compression and extraction phases. The parazoa hash functions, however, extend the sponge construction by enabling the use of a wider class of compression and extraction functions that need to satisfy certain properties. More importantly, we prove that the parazoa functions satisfy the indifferentiability notion of Maurer et?al. under the assumption that the underlying permutation is ideal. Not surprisingly, our indifferentiability result confirms the bound on the original sponge function, but it also carries over to a wider spectrum of hash functions and eliminates the need for a separate indifferentiability analysis.     

Cryptographic hash standards: where do we go from here?

Successful attacks against the two most commonly used cryptographic hash functions, MD5 and SHA-1, have triggered a kind of feeding frenzy in the cryptographic community. Many researchers are now working on hash function attacks, and we can expect new results in this area for the next several years. This article discusses the SHA-1 attack and the US National Institute of Standards and Technology's (NIST's) plans for SHA-1 and hash functions in general.     

Hardware implementation analysis of SHA-256 and SHA-512 algorithms on FPGAs

Hash functions are common and important cryptographic primitives, which are very critical for data integrity assurance and data origin authentication security services. Field programmable gate arrays (FPGAs) being reconfigurable, flexible and physically secure are a natural choice for implementation of hash functions in a broad range of applications with different area-performance requirements. In this paper, we explore alternative architectures for the implementation of hash algorithms of the secure hash standards SHA-256 and SHA-512 on FPGAs and study their area-performance trade-offs. As several 64-bit adders are needed in SHA-512 hash value computation, new architectures proposed in this paper implement modulo-64 addition as modulo-32, modulo-16 and modulo-8 additions with a view to reduce the chip area. Hash function SHA-512 is implemented in different FPGA families of ALTERA to compare their performance metrics such as area, memory, latency, clocking frequency and throughput to guide a designer to select the most suitable FPGA for an application. In addition, a common architecture is designed for implementing SHA-256 and SHA-512 algorithms.     

SM3哈希算法的硬件实现与研究

随着信息社会的进一步发展,哈希算法作为保护信息完整性的重要密码算法,它的应用越来越广泛。美国NIST组织已经顺利完成了哈希算法标准SHA0,SHA1和SHA2的征集工作,并且SHA-3的征集工作将于2012年结束。SM3作为国内商业应用中的国家标准哈希算法,于2010年12月公开。本文在硬件平台FPGA上实现了高吞吐率的SM3,经过优化处理SM3在Xilinxv5平台上的吞吐率可以达到1．5Gbps左右,并且就SM3在FPGA上的效率和SHA1,SHA2以及SHA-3的候选算法BLAKE在FPGA平台上的效率做了比较和分析。     

密码杂凑函数及其安全性分析

文章提出了针对密码杂凑函数及其安全性进行研究的重要意义,列举了单向杂凑函数、MD5、SHA-1等技术原理进行了技术分析,并从攻击手段入手,分析了密码杂凑函数的安全性,提出对SHA-1与MD-5的＂破解＂应客观看待的观点。     

基于Matlab的Hash算法BLAKE的设计与实现

Hash算法I3工AKE是新一代安全Hash标准SHA-3全球公开征集过程中进入最后一轮的5个候选者之一。 给出一种基于Matlab的带有图形界面GUI的BLAKE程序的设计与实现过程。本程序可用于实际的BLAKE Hash 值的运算,最重要的是为BLAKE的教学与实验提供了更方便直观的工具。     

Uforia: Universal forensic indexer and analyzer

Uforia is a simple, flexible and extensible framework for analysis and parsing of file metadata. It has been written in Python and is available under the GPLv2. Uforia traverses a file-system and triggers a configurable set of modules for every file it encounters. Out-of-the-box, Uforia conforms to the NIST standard for forensic hashing by storing the currently most common three cryptographic hashes for each file: the MD5, SHA-1 and SHA-256 hash. Uforia strives for optimal scaling of the metadata-analysis by offering an easily configurable threading model of both its Producers and Consumers. Additionally, the interface is written and intended to be as loosely coupled as possible, as to easily reduce, replace or increase the Producer’s and Consumer’s functionalities to match the specific needs of the user. Uforia also attempts to reduce database redundancy to a minimum in the same way, by only loosely coupling database tables and delegating the relevant parts of the data-model to be handled by the individual modules. Each of these modules will perform its tasks asynchronously of Uforia and is automatically detected, registered and called to handle its specific filetypes. Uforia does not yet come with a front-end interface for viewing the information stored in the database, but the database contents stored could theoretically already be applied to a wide variety of situations, such as searching for specific metadata or information during a forensic investigation, for filesystem-level deduplication or even for creating custom known file hash tables. The interface for creating new database handlers and modules has been simplified as much as possible, allowing for easy extensibility and tailoring to each use-case’s specific requirements.     

欧洲分组密码标准SHACAL-2算法的研究分析

由标准哈希算法SHA-2演变面来的SHACAL-2是新当选的3个欧洲分组密码标准算法中分组长度和密钥长度最长的算法，其安全强度被认为最高。提案沿袭单向哈希函数的形式来描述算法，文章以分组密码传统的规范形式刻画SHACAL-2算法的完整加密过程，指出算法扩散特性较差的缺点，给出分组密码算法加密过程与哈希算法压缩过程的对应关系，并提供了算法的详细解密过程和相应的加解密数据，为算法实现提供参照：补充了相应的轮常数；进一步研究了长分组长度和密钥长度的必要性。指出算法加解密结构不具有相似性。最后，对欧美4个分组密码标准进行了比较分析。     

Compact Keccak Hardware Architecture for Data Integrity and Authentication on FPGAs

ABSTRACT

Cryptographic hash functions play a crucial role in networking and communication security, including their use for data integrity and message authentication. Keccak hash algorithm is one of the finalists in the next generation SHA-3 hash algorithm competition. It is based on the sponge construction whose hardware performance is worth investigation. We developed an efficient hardware architecture for the Keccak hash algorithm on Field-Programmable Gate Array (FPGA). Due to the serialization exploited in the proposed architecture, the area needed for its implementation is reduced significantly accompanied by higher efficiency rate. In addition, low latency is attained so that higher operating frequencies can be accessed. We use the coprocessor approach which exploits the use of RAM blocks that exist in most FPGA platforms. For this coprocessor, a new datapath structure allowing parallel execution of multiple instructions is designed. Implementation results prove that our Keccak coprocessor achieves high performance in a small area.     

A Top-Down Design Methodology for Ultrahigh-Performance Hashing Cores

Many cryptographic primitives that are used in cryptographic schemes and security protocols such as SET, PKI, IPSec, and VPNs utilize hash functions, which form a special family of cryptographic algorithms. Applications that use these security schemes are becoming very popular as time goes by and this means that some of these applications call for higher throughput either due to their rapid acceptance by the market or due to their nature. In this work, a new methodology is presented for achieving high operating frequency and throughput for the implementations of all widely used—and those expected to be used in the near future—hash functions such as MD-5, SHA-1, RIPEMD (all versions), SHA-256, SHA-384, SHA-512, and so forth. In the proposed methodology, five different techniques have been developed and combined with the finest way so as to achieve the maximum performance. Compared to conventional pipelined implementations of hash functions (in FPGAs), the proposed methodology can lead even to a 160 percent throughput increase.     

Second order collision for the 42-step reduced DHA-256 hash function

At the Cryptographic Hash Workshop hosted by NIST in 2005, Lee et al. proposed the DHA-256 (Double Hash Algorithm-256) hash function. The design of DHA-256 builds upon the design of SHA-256, but introduces additional strengthening features such as optimizing the message expansion and step function against local collision attacks. Previously, DHA-256 was analyzed by J. Zhong and X. Lai, who presented a preimage attack on 35 steps of the compression function with complexity 2^239.6. In addition, the IAIK Krypto Group provided evidence that there exists a 9-step local collision for the DHA-256 compression function with probability higher than previously predicted. In this paper, we analyze DHA-256 in the context of higher order differential attacks. In particular, we provide a practical distinguisher for 42 out of 64 steps and give an example of a colliding quartet to validate our results.     

信息摘要算法MDA-192

提出了一种新的信息摘要提取算法MDA-192。应用该算法,可将任意长度小于264bit的信息压缩为固定长度(192bit)的输出(即信息摘要或数字指纹)。该算法执行速度比安全哈希算法SHA-1快一倍。可抗击生日攻击,并且具有良好的雪崩效应。可应用于信息完整性检验,检验信息是否被非法篡改。     

Multi-mode operator for SHA-2 hash functions

We propose an improved implementation of the SHA-2 hash family, with minimal operator latency and reduced hardware requirements. We also propose a high frequency version at the cost of only two cycles of latency per message. Finally we present a multi-mode architecture able to perform either a SHA-384 or SHA-512 hash or to behave as two independent SHA-224 or SHA-256 operators. Such capability adds increased flexibility for applications ranging from a server running multiple streams to independent pseudorandom number generation. We also demonstrate that our architecture achieves a performance comparable to separate implementations while requiring much less hardware.