Ricoz
Reputation
Top tag
Next privilege 75 Rep.
Set bounties
 Feb7 comment Bicliques for permutations 6 linear equations for each column (we are matching through MixColumn), probability of $2^{-192}$ for a partial match of the 4 rightmost columns, I guess. Feb7 awarded Commentator Feb7 accepted Bicliques for permutations Feb7 comment Bicliques for permutations Thanks for everything. Feb6 comment Bicliques for permutations The $2^{254}$ bicliques give us $2^{256}$ candidate matching pairs at the matching point. As we have 24 bytes matching variables, $2^{64}$ pairs are expected to partially match and only one of them is expected to fully match. How the attack deals with checking for this? do we collect partially matching pairs and then recheck for full match an so the complexity is negligible compared with the testing stage? Feb6 comment Bicliques for permutations Suppose, we will be trying $2^{254}$ bicliques (as each one $=2^2$ states), all of them are derived from the same 4 differences (one biclique), after the SuperSbox construction, we store them? Memory complexity is $2^{256+3}$ states? Feb6 comment Bicliques for permutations Thank you. I'll take your advice and ask :) At the matching point, we need the knowlage of the white bytes at the 4 rightmost columns (28 Sboxes at each direction at states #12 and #1). When we trace these Sboxes backwards to P and Q, we need to pass by 56 Sboxes at each direction too (states #10 and #3). Accordingly, $2(56+28) = 168$ Sbox recomputations are needed for each biclique, right? Feb5 comment Bicliques for permutations Thanks for your help. But lets consider the case for one sliced biclique, i.e., $2^2$ states, after the Supersbox construction, we recompute 2 states only from each direction. Specifically, from state #8 to #12 forward and given the hash target, from state #5 to #13 backward. Why should we consider all the sboxes in the whole six rounds, if the two rounds in the middle are already accounted for during the biclique construction? and how is $194/384 \approx 2^{-2}$? Feb4 asked Bicliques for permutations Feb1 awarded Supporter Jan28 comment Secret key model for a compression function cryptanalysis? Thank you for your help. Jan28 accepted Secret key model for a compression function cryptanalysis? Jan28 comment Secret key model for a compression function cryptanalysis? Consider the hash function $H$ and its compression function $F(IV,M)$ are used in a secret IV MAC scheme where the Tag $T= F(F(K,M),M_p)$, where $K$ is the MAC key and $M_p$ is the padded block. Can I say that if one observes the output of the inner compression function call i.e., $F(K,M)$ and retrieve $K$, then this is a certificational weekness of the underlying compression function? Jan26 comment Secret key model for a compression function cryptanalysis? I'm sorry if the question doesn't make sense as I'm trying to understand the accepted cryptanalytic models. So what you're saying is this cannot be considered as a preimage attack for the compression function, if I'm chossing the input messages and collecting the oracle's responses then recovering the used chaining value? Thanks in advance. Jan25 asked Secret key model for a compression function cryptanalysis? Jan19 comment What is significance of recovering the chaining value of a hash compression function? Thanks for your help. Jan18 accepted What is significance of recovering the chaining value of a hash compression function? Jan18 comment What is significance of recovering the chaining value of a hash compression function? Thanks for the answer, I see its relavence in this situation, but is recovering the chaining value and not the message implies that the compression function is not preimage resistant? or like partially invertable. Does this property have a name? Jan18 asked What is significance of recovering the chaining value of a hash compression function? Dec17 awarded Scholar