Cryptanalysis of Simpira
نویسندگان
چکیده
Simpira is a recently proposed family of permutations, based on the AES round function. The design includes recommendations for using the Simpira permutations in block ciphers, hash functions, or authenticated ciphers. The security analysis is based on computer-aided bounds for the minimum number of active S-boxes. We show that the underlying assumptions of independence, and thus the derived bounds, are incorrect. For family member Simpira-4, we provide differential trails with only 40 (instead of 75) active S-boxes for the recommended 15 rounds. Based on these trails, we propose full-round collision attacks on the proposed Simpira-4 Davies-Meyer hash construction, with complexity 2 for the recommended full 15 rounds (truncated 256-bit hash value), and complexity 2 for 16 rounds (full 512-bit hash value). These attacks violate the designers’ security claims that there are no structural distinguishers below 2.
منابع مشابه
Cryptanalysis of Simpira v1
Simpira v1 is a recently proposed family of permutations, based on the AES round function. The design includes recommendations for using the Simpira permutations in block ciphers, hash functions, or authenticated ciphers. The designers’ security analysis is based on computer-aided bounds for the minimum number of active S-boxes. We show that the underlying assumptions of independence, and thus ...
متن کاملSPHINCS-Simpira: Fast Stateless Hash-based Signatures with Post-quantum Security
We introduce SPHINCS-Simpira, which is a variant of the SPHINCS signature scheme with Simpira as a building block. SPHINCS was proposed by Bernstein et al. at EUROCRYPT 2015 as a hash-based signature scheme with post-quantum security. At ASIACRYPT 2016, Gueron and Mouha introduced the Simpira family of cryptographic permutations, which delivers high throughput on modern 64-bit processors by usi...
متن کاملSimpira v2: A Family of Efficient Permutations Using the AES Round Function
This paper introduces Simpira, a family of cryptographic permutations that supports inputs of 128 × b bits, where b is a positive integer. Its design goal is to achieve high throughput on virtually all modern 64-bit processors, that nowadays already have native instructions for AES. To achieve this goal, Simpira uses only one building block: the AES round function. For b = 1, Simpira correspond...
متن کاملSimpira: A Family of Efficient Permutations Using the AES Round Function
This paper introduces Simpira, a family of cryptographic permutations that supports inputs of 128 × b bits, where b is a positive integer. Its design goal is to achieve high throughput on virtually all modern 64-bit processor architectures, that nowadays already have native instructions to support AES computations. To achieve this goal, Simpira uses only one building block: the AES round functi...
متن کاملInvariant subspaces in Simpira
In this short note we report on invariant subspaces in Simpira in the case of four registers. In particular, we show that the whole input space (respectively output space) can be partitioned into invariant cosets of dimension 56 over F 28 . These invariant subspaces are found by exploiting the non-invariant subspace properties of AES together with the particular choice of Feistel configuration....
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید
ثبت ناماگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید
ورودعنوان ژورنال:
- IACR Cryptology ePrint Archive
دوره 2016 شماره
صفحات -
تاریخ انتشار 2016