Timeline for Rationale for use of right-shift (rather than rotate) in SHA-2?
Current License: CC BY-SA 3.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 18, 2018 at 14:00 | comment | added | Maarten Bodewes♦ | Note to others: NSA designed it and the authors are unknown. | |
| Jun 1, 2017 at 9:39 | comment | added | Samuel Neves | The question is somewhat answered in this paper. Replacing the third rotation by the shift makes the techniques used for SHA-0 and SHA-1 to build trails not work anymore. Whether this was what the designers intended, we'll probably never know. | |
| Jun 1, 2017 at 8:51 | comment | added | e-sushi |
I guess that should be turned into an answer. -- Absolutely! Which is why I'm bluntly taking the freedom to remind that answering your own question is very well a valid option. ;)
|
|
| Jun 1, 2017 at 8:08 | comment | added | Richie Frame | @YuhongBao That statement may be true, however rotations can be done through shifting and OR/XOR. Also it in no way answers the question | |
| Jun 1, 2017 at 0:53 | comment | added | Yuhong Bao | Things like SSE2 and MMX only have shift and not rotate. | |
| Jun 11, 2015 at 5:52 | history | tweeted | twitter.com/#!/StackCrypto/status/608874478488199168 | ||
| Jun 11, 2015 at 4:40 | comment | added | fgrieu♦ | @Richie Frame: Indeed, the message schedule of SHA-1 is linear:$$W_t=\operatorname{ROTR}^{31}(W_{t-3}\boxplus W_{t-8}\boxplus W_{t-14}\boxplus W_{t-16})\;\text{ for }16\le t\le79$$and further a rotation in input translates to a corresponding rotation of output. Neither weakness holds for the message schedule of SHA-2, including modified to use only $\operatorname{ROTR}$. Still, reducing odds of the second property might be the motivation I'm asking for. $\;$ I guess that should be turned into an answer. | |
| Jun 11, 2015 at 1:03 | comment | added | Richie Frame | The followup on that, is that with modular addition the probability of a differential characteristic (for a specific attach on HMAC-SHA-1) depends on the position within the word, and rotating the characteristic doubles the probability. This type of attack would not work on the SHA-2 message schedule. eprint.iacr.org/eprint-bin/getfile.pl?entry=2006/… | |
| Jun 11, 2015 at 0:50 | comment | added | Richie Frame | @fgrieu actually I think he is spot on, from a paper describing attacks on SHA-1: "the linear code describing the SHA-1 message expansion is invariant with respect to word rotation". The linear code being $\sigma$. | |
| Jun 10, 2015 at 17:34 | comment | added | fgrieu♦ | @LightBit: that applies to a linear transformation. In SHA-2, the key schedule is not linear, thanks to the alternation of ⊕ in the σ functions, and ⊞ in the message schedule. Thus I do not think that the reasoning applies, at least to a comparable degree. Something on that tune would indeed apply if we changed ⊞ to ⊕, so perhaps the desire to better guard against an approximation of ⊞ by ⊕ may have been in the mind of the designers. $\;$ Thanks for the contribution! | |
| Jun 10, 2015 at 16:43 | comment | added | LightBit | Here is explanation for Serpent's linear layer: "Notice that if the linear transformation had used only rotates, then every characteristic could have 32 equiprobable rotated variants, with all the data words rotated by the same number of bits. This is the reason that we also use shift instructions, which avoid most of these rotated characteristics." cryptosoft.net/docs/Serpent.pdf | |
| Jun 10, 2015 at 15:20 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
More explicit title; fix notation
|
| Jun 10, 2015 at 12:44 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Simplify definition of SHR
|
| Jun 10, 2015 at 12:41 | history | edited | Richie Frame | CC BY-SA 3.0 |
fixed FIPS number
|
| Jun 10, 2015 at 11:59 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
polish
|
| Jun 10, 2015 at 11:48 | history | edited | fgrieu♦ | CC BY-SA 3.0 |
Give schedule
|
| Jun 10, 2015 at 10:19 | history | asked | fgrieu♦ | CC BY-SA 3.0 |