Chapter

Advances in Cryptology – ASIACRYPT 2009

Volume 5912 of the series Lecture Notes in Computer Science pp 126-143

Rebound Distinguishers: Results on the Full Whirlpool Compression Function

  • Mario LambergerAffiliated withLancaster UniversityInstitute for Applied Information Processing and Communications, Graz University of Technology
  • , Florian MendelAffiliated withLancaster UniversityInstitute for Applied Information Processing and Communications, Graz University of Technology
  • , Christian RechbergerAffiliated withLancaster UniversityInstitute for Applied Information Processing and Communications, Graz University of Technology
  • , Vincent RijmenAffiliated withLancaster UniversityInstitute for Applied Information Processing and Communications, Graz University of TechnologyDepartment of Electrical Engineering ESAT/COSIC, Katholieke Universiteit LeuvenInterdisciplinary Institute for BroadBand Technology (IBBT)
  • , Martin SchläfferAffiliated withLancaster UniversityInstitute for Applied Information Processing and Communications, Graz University of Technology

Abstract

Whirlpool is a hash function based on a block cipher that can be seen as a scaled up variant of the AES. The main difference is the (compared to AES) extremely conservative key schedule. In this work, we present a distinguishing attack on the full compression function of Whirlpool. We obtain this result by improving the rebound attack on reduced Whirlpool with two new techniques. First, the inbound phase of the rebound attack is extended by up to two rounds using the available degrees of freedom of the key schedule. This results in a near-collision attack on 9.5 rounds of the compression function of Whirlpool with a complexity of 2176 and negligible memory requirements. Second, we show how to turn this near-collision attack into a distinguishing attack for the full 10 round compression function of Whirlpool. This is the first result on the full Whirlpool compression function.

Keywords

hash functions cryptanalysis near-collision distinguisher