6
$\begingroup$

For block ciphers, there are the very well designed schemes of Simple-DES and Simple-AES, which have been created not for security but for teaching the design principles of the real algorithms while maintaining the possibility to calculate them by hand and guarantee an easy demonstration.

Are there any such simplified functions for Merkle-Damgard compression functions or sponge functions available?

Improve this question
$\endgroup$
5
  • $\begingroup$ Would the simplest MD compression function just be a random s box of say 6 bits size so with 2 no. 3 bit inputs creating a 3 bit chaining value? $\endgroup$
    – Paul Uszak
    Commented Jul 22, 2017 at 15:07
  • $\begingroup$ Or would you be looking for a compression function too wide for a pre calculated s box? $\endgroup$
    – Paul Uszak
    Commented Jul 22, 2017 at 15:08
  • $\begingroup$ I'm looking for something that is close in style to the real functions (SHA-2, Keccak) but simpliefied to allow an easy presentation in a short timespan. S-AES has all the same steps as the real AES but reduced to a block size of 16 bit and uses only 2 rounds. $\endgroup$
    – mat
    Commented Jul 23, 2017 at 7:33
  • 1
    $\begingroup$ spritz is a lot simpler than sha3, though it still might be a bit much for paper... $\endgroup$
    – dandavis
    Commented Jul 24, 2017 at 5:00
  • $\begingroup$ I understand, but I'd add this. The MD construction is really a facilitator for hashing data wider than the native block width of the compression function. If you specifically want to illustrate the operation of the MD pattern, it doesn't require anything clever for the compression function itself. The I/O relationship of my 6 bit lookup table will behave similarly to that of a SHA-2 compression function. You'll even have avalanche effect. $\endgroup$
    – Paul Uszak
    Commented Jul 25, 2017 at 15:41

1 Answer 1

Reset to default
4
$\begingroup$

Many of the designs in the NIST SHA-3 competition came with toy variants for study. For example:

  • The winner of the competition, Keccak, has parameters for:
    • word size—the SHA-3 standard is 64-bit, but it is formally defined for 1-bit, 2-bit, 4-bit, 8-bit, 16-bit, and 32-bit words too, for study or for smaller variants like Ketje and Keyak; and
    • number of rounds—the SHA-3 standard is 24 rounds, but that is overkill, so KangarooTwelve uses 12 while still providing comfortable collision resistance, and Kravatte uses 6 without aiming for collision resistance.
  • The popular BLAKE2 was derived from BLAKE, one of the SHA-3 finalists, which uses HAIFA, which is similar to Merkle–Damgård and Davies–Meyer but with improvements, came with several toy versions: BLOKE, FLAKE, BLAZE, and BRAKE, each with simplifications on the real BLAKE. All admit reduced-round variants too, of course.

You could, of course, take any block cipher you like, and apply it with Davies–Meyer, or any of various block cipher constructions, and study the result. One easy target for cryptanalysis might use AES-256 in one of those forms, so that you could apply the Biryukov–Khovratovich related-key attacks.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.