I have studied linear cryptanalysis for block ciphers, but i did not understand how it works on hash functions. Can you give me an explanation of this attack on hash functions?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ Many hash functions—like MD5, SHA-1, SHA-2—are built out of block ciphers with compositions like Davies–Meyer. $\endgroup$– Squeamish OssifrageCommented Mar 18, 2019 at 3:33
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
The use of linear cryptanalysis for unkeyed hash functions seems to data back to the article (available here) below
Handschuh H, Knudsen LR, and Robshaw MJ, Analysis of SHA-1 in encryption mode, published in the Cryptographers' Track-RSA Conference, Naccache, D. (Ed.), LNCS 2020, Springer-Verlag, Berlin, pp.70-83, 2001
The authors state:
SHA was never defined to be used for encryption. However, the compression function can be used for encryption. Each of the 80 steps of SHA-1 (divided into four rounds, each of 20 steps) are invertible in the five A, B, C, D, and E variables used for compression. Therefore, if one inserts a secret key in the message and a plaintext as the initial value, one gets an invertible function from the compression function by simply skipping the last forward addition with the input. This is the encryption mode of SHA considered in this report. The resulting block cipher is named SHACAL and has been submitted to NESSIE by Naccache and the first author.
-
$\begingroup$ If the linked article contains the relevant information, don't forget to quote/explain it here in the answer. As-is, this currently reads like an answer to "what is the history of linear cryptanalysis of hash functions" rather than
Can you give me an explanation of this attack on hash functions. $\endgroup$ Commented Mar 18, 2019 at 0:25