Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications
Recently, many efficient cryptographic hash function design strategies have been explored, not least because of the SHA-3 competition. These designs are, almost exclusively, geared towards high performance on long inputs. However, various applications exist where the performance on short (fixed leng...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2017-02-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/563 |
| _version_ | 1818874189231161344 |
|---|---|
| author | Stefan Kölbl Martin M. Lauridsen Florian Mendel Christian Rechberger |
| author_facet | Stefan Kölbl Martin M. Lauridsen Florian Mendel Christian Rechberger |
| author_sort | Stefan Kölbl |
| collection | DOAJ |
| description | Recently, many efficient cryptographic hash function design strategies have been explored, not least because of the SHA-3 competition. These designs are, almost exclusively, geared towards high performance on long inputs. However, various applications exist where the performance on short (fixed length) inputs matters more. Such hash functions are the bottleneck in hash-based signature schemes like SPHINCS or XMSS, which is currently under standardization. Secure functions specifically designed for such applications are scarce. We attend to this gap by proposing two short-input hash functions (or rather simply compression functions). By utilizing AES instructions on modern CPUs, our proposals are the fastest on such platforms, reaching throughputs below one cycle per hashed byte even for short inputs, while still having a very low latency of less than 60 cycles. Under the hood, this results comes with several innovations. First, we study whether the number of rounds for our hash functions can be reduced, if only second-preimage resistance (and not collision resistance) is required. The conclusion is: only a little. Second, since their inception, AES-like designs allow for supportive security arguments by means of counting and bounding the number of active S-boxes. However, this ignores powerful attack vectors using truncated differentials, including the powerful rebound attacks. We develop a general tool-based method to include arguments against attack vectors using truncated differentials. |
| first_indexed | 2024-12-19T13:06:39Z |
| format | Article |
| id | doaj.art-9bf047de7c9740988f0e95607a029fe2 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-12-19T13:06:39Z |
| publishDate | 2017-02-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-9bf047de7c9740988f0e95607a029fe22022-12-21T20:20:02ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2017-02-0112910.13154/tosc.v2016.i2.1-29563Haraka v2 – Efficient Short-Input Hashing for Post-Quantum ApplicationsStefan Kölbl0Martin M. Lauridsen1Florian Mendel2Christian Rechberger3DTU Compute, Technical University of DenmarkInfoSec Global Ltd.IAIK, Graz University of TechnologyDTU Compute, Technical University of Denmark; IAIK, Graz University of TechnologyRecently, many efficient cryptographic hash function design strategies have been explored, not least because of the SHA-3 competition. These designs are, almost exclusively, geared towards high performance on long inputs. However, various applications exist where the performance on short (fixed length) inputs matters more. Such hash functions are the bottleneck in hash-based signature schemes like SPHINCS or XMSS, which is currently under standardization. Secure functions specifically designed for such applications are scarce. We attend to this gap by proposing two short-input hash functions (or rather simply compression functions). By utilizing AES instructions on modern CPUs, our proposals are the fastest on such platforms, reaching throughputs below one cycle per hashed byte even for short inputs, while still having a very low latency of less than 60 cycles. Under the hood, this results comes with several innovations. First, we study whether the number of rounds for our hash functions can be reduced, if only second-preimage resistance (and not collision resistance) is required. The conclusion is: only a little. Second, since their inception, AES-like designs allow for supportive security arguments by means of counting and bounding the number of active S-boxes. However, this ignores powerful attack vectors using truncated differentials, including the powerful rebound attacks. We develop a general tool-based method to include arguments against attack vectors using truncated differentials.https://tosc.iacr.org/index.php/ToSC/article/view/563Cryptographic hash functionssecond-preimage resistanceAES-NIhash-based signaturespost-quantum |
| spellingShingle | Stefan Kölbl Martin M. Lauridsen Florian Mendel Christian Rechberger Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications IACR Transactions on Symmetric Cryptology Cryptographic hash functions second-preimage resistance AES-NI hash-based signatures post-quantum |
| title | Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications |
| title_full | Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications |
| title_fullStr | Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications |
| title_full_unstemmed | Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications |
| title_short | Haraka v2 – Efficient Short-Input Hashing for Post-Quantum Applications |
| title_sort | haraka v2 efficient short input hashing for post quantum applications |
| topic | Cryptographic hash functions second-preimage resistance AES-NI hash-based signatures post-quantum |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/563 |
| work_keys_str_mv | AT stefankolbl harakav2efficientshortinputhashingforpostquantumapplications AT martinmlauridsen harakav2efficientshortinputhashingforpostquantumapplications AT florianmendel harakav2efficientshortinputhashingforpostquantumapplications AT christianrechberger harakav2efficientshortinputhashingforpostquantumapplications |