The hashing scheme SHA-256 (for instance) is based on Merkle-Damgård construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 has 80 rounds, per 512 bit block of data (which is inserted in the key input of the block cipher). As an alternative, one could use AES with 256 bit key (so the hashed data should be divided to 256 bit blocks, inserted as a key) and using Davies Meyer principle in the same way. Seemingly, this would be much more efficient, because AES-256 requires 14 rounds, or total 28 rounds in order to process 512 bit of data, while theSHACAL-2 requires 80 rounds. Is there any standard that does this?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ You can use AES to build a secure MAC (CBC MAC and its derivatives). Unlike your suggestion, these constructions use AES with a random key, which the attacker doesn't know. $\endgroup$– CodesInChaosApr 25, 2015 at 13:08
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
Using AES as a Davies Meyer compression function is a bad idea:
It has a block size of 128 bits, which limits its collision resistance to 64 bits, which is rather weak.
This limitation could be overcome by using Rijndael with a 256 bit block size, but then you'd need to use a higher number of rounds.
AES has been designed to work with randomly chosen keys, not with attacker chosen keys.
AES suffers from related key attacks. While I'm not aware of published a way to exploit this to find collisions, it certainly undermines my confidence is such a construction. You could increase the number of rounds to compensate for this, but that'd decrease performance.
See Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Block ciphers designed for use in hash functions have very cheap key setups. While AES isn't as expensive as Blowfish, changing the key still has a noticeable performance impact.
Fewer rounds doesn't necessarily mean more efficient:
Comparing the absolute number of rounds of different cryptographic primitives is meaningless. You can design a primitive to have many cheap and simple rounds or fewer more expensive and more complex rounds, resulting in similar performance.
See Why does SHA-1 have 80 rounds?
AES isn't that fast on a CPU without special instructions, like AES-NI, probably even slower than SHA-2 on some CPUs.
answered Apr 25, 2015 at 13:05
-
$\begingroup$ So, the performance of SHACAL-2 is better than the performance of AES in spite of the larger number of rounds? $\endgroup$ Apr 25, 2015 at 15:51
-
1$\begingroup$ @EvgeniVaknin Depends on the hardware. AES will probably be faster than SHACAL-2 on most processors. But on processors without AES-NI the difference will be smaller than the ratio of the number of rounds. You also need to keep in mind that a hash gives an attacker much more control over the inputs, so the same block cipher might need more rounds when used as hash compared to being used as encryption. $\endgroup$ Apr 25, 2015 at 16:11
-
2$\begingroup$ Also, you would need to do the key-schedule for each block again, which also adds to the execution time. $\endgroup$ Apr 25, 2015 at 19:35