64 reputation
4
bio website
location
age
visits member for 10 months
seen Mar 4 at 22:23

Feb
7
comment Bicliques for permutations
6 linear equations for each column (we are matching through MixColumn), probability of $2^{-192}$ for a partial match of the 4 rightmost columns, I guess.
Feb
7
awarded  Commentator
Feb
7
accepted Bicliques for permutations
Feb
7
comment Bicliques for permutations
Thanks for everything.
Feb
6
comment Bicliques for permutations
The $2^{254}$ bicliques give us $2^{256}$ candidate matching pairs at the matching point. As we have 24 bytes matching variables, $2^{64}$ pairs are expected to partially match and only one of them is expected to fully match. How the attack deals with checking for this? do we collect partially matching pairs and then recheck for full match an so the complexity is negligible compared with the testing stage?
Feb
6
comment Bicliques for permutations
Suppose, we will be trying $2^{254}$ bicliques (as each one $=2^2$ states), all of them are derived from the same 4 differences (one biclique), after the SuperSbox construction, we store them? Memory complexity is $2^{256+3}$ states?
Feb
6
comment Bicliques for permutations
Thank you. I'll take your advice and ask :) At the matching point, we need the knowlage of the white bytes at the 4 rightmost columns (28 Sboxes at each direction at states #12 and #1). When we trace these Sboxes backwards to P and Q, we need to pass by 56 Sboxes at each direction too (states #10 and #3). Accordingly, $2(56+28) = 168$ Sbox recomputations are needed for each biclique, right?
Feb
5
comment Bicliques for permutations
Thanks for your help. But lets consider the case for one sliced biclique, i.e., $2^2$ states, after the Supersbox construction, we recompute 2 states only from each direction. Specifically, from state #8 to #12 forward and given the hash target, from state #5 to #13 backward. Why should we consider all the sboxes in the whole six rounds, if the two rounds in the middle are already accounted for during the biclique construction? and how is $194/384 \approx 2^{-2}$?
Feb
4
asked Bicliques for permutations
Feb
1
awarded  Supporter
Jan
28
comment Secret key model for a compression function cryptanalysis?
Thank you for your help.
Jan
28
accepted Secret key model for a compression function cryptanalysis?
Jan
28
comment Secret key model for a compression function cryptanalysis?
Consider the hash function $H$ and its compression function $F(IV,M)$ are used in a secret IV MAC scheme where the Tag $T= F(F(K,M),M_p)$, where $K$ is the MAC key and $M_p$ is the padded block. Can I say that if one observes the output of the inner compression function call i.e., $F(K,M)$ and retrieve $K$, then this is a certificational weekness of the underlying compression function?
Jan
26
comment Secret key model for a compression function cryptanalysis?
I'm sorry if the question doesn't make sense as I'm trying to understand the accepted cryptanalytic models. So what you're saying is this cannot be considered as a preimage attack for the compression function, if I'm chossing the input messages and collecting the oracle's responses then recovering the used chaining value? Thanks in advance.
Jan
25
asked Secret key model for a compression function cryptanalysis?
Jan
19
comment What is significance of recovering the chaining value of a hash compression function?
Thanks for your help.
Jan
18
accepted What is significance of recovering the chaining value of a hash compression function?
Jan
18
comment What is significance of recovering the chaining value of a hash compression function?
Thanks for the answer, I see its relavence in this situation, but is recovering the chaining value and not the message implies that the compression function is not preimage resistant? or like partially invertable. Does this property have a name?
Jan
18
asked What is significance of recovering the chaining value of a hash compression function?
Dec
17
awarded  Scholar