A Uniform Class of Weak Keys for Universal Hash Functions

In this paper we investigate weak keys of universal hash functions (UHFs) from their combinatorial properties. We find that any UHF has a general class of keys, which makes the combinatorial properties totally disappear, and even compromises the security of the UHFbased schemes, such as the Wegman-Carter scheme, the UHF-then-PRF scheme, etc. By this class of keys, we actually get a general method to search weak-key classes of UHFs, which is able to derive all previous weak-key classes of UHFs found by intuition or experience. Moreover we give a weak-key class of the BRW polynomial function which was once believed to have no weak-key issue, and exploit such weak keys to implement a distinguish attack and a forgery attack against DTC a BRW-based authentication encryption scheme. Furthermore in Grain128a, with the linear structure revealed by weak-key classes of its UHF, we can recover any first (32 + b) bits of the UHF key, spending no more than 1 encryption and (2 + b) decryption queries.