Security Analysis of Even-Mansour Structure Hash Functions

Abstract

In this paper, we mainly focus on the security of Even-Mansour structure hash functions, including preimage attack resistance and multi-block collision attack resistance.

Firstly, we focus on the Even-Mansour structure hash function with two iterations. Basing on the permutation used in the Even-Mansour structure hash function we construct two new functions $f_{1}$ and $f_{2}$, and find the partial invariables of input-output in one function $f_{1}$. Then using the partial invariables of input-output and the meet-in-the-middle techniques, we present a preimage attack on the Even-Mansour structure hash function with two iterations, with the time complexity of ${2}^{{a(2^{a} - 1)}} { + 2}^{a} + {2}^{n - 2a}$ functional operations of $f_{1}$ or $f_{2}$ and the memory is ${2}^{a}$ a-bit values, where $a{2}^{a} \le n$ and n is the size of hash value.

Secondly, we extend the Even-Mansour structure hash function to the one with arbitrary iterations. Utilizing the property that the beginning and the ending of every iteration in the Even-Mansour structure both need XOR the message or the transform result of the message, we construct many chaining values with relations in each iteration, which makes that the number of the final chaining values is equal to the product of the number of output chaining values in each iteration, and thereby propose our multi-block collision attack on the Even-Mansour structure hash functions with the time complexity of $t2^{\frac{s}{2t}}$ queries of F permutation and memory complexity of $O(2^{s/2} )$, where t is the block number of collision message and s is the size of truncated hash value.