Hash Functions from Defective Ideal Ciphers

Motivation • Cryptographic constructions based on lower-level primitives are often analyzed by modeling the primitive as an ideal object – Sometimes, impossible to construct based on standard assumptions – Here: hash functions from block ciphers • When instantiated, the primitive may have " defects " and be far from ideal Motivating example • Related-key attacks on block ciphers – Several such attacks on block ciphers are known – Does not contradict pseudorandomness • Such attacks have been used to attack primitives based on (ideal) ciphers – Collision attack on the hash function used in Microsoft Xbox due to related-key attack on TEA – Attack on the RMAC message authentication code This work • We define a " defective " ideal cipher model incorporating linear related-key attacks – Goal: better understand real-world security of constructions analyzed in the (traditional) ideal-cipher model • We analyze the classical Preneel-Govaerts-Vandewalle (PGV) constructions of hash functions from block ciphers in our model • A (block-cipher-based) compression function í µí±“: {0,1} í µí±›