Skip to main content
SpringerLink
Log in

The Boomerang Attacks on BLAKE and BLAKE2

  • Conference paper
  • First Online:
Information Security and Cryptology (Inscrypt 2014)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 8957))

Included in the following conference series:

Abstract

In this paper, we study the security margins of hash functions BLAKE and BLAKE2 against the boomerang attack. We launch boomerang attacks on all four members of BLAKE and BLAKE2, and compare their complexities. We propose 8.5-round boomerang attacks on both BLAKE-512 and BLAKE2b with complexities \(2^{464}\) and \(2^{474}\) respectively. We also propose 8-round attacks on BLAKE-256 with complexity \(2^{198}\) and 7.5-round attacks on BLAKE2s with complexity \(2^{184}\). We verify the correctness of our analysis by giving practical 6.5-round Type I boomerang quartets for each member of BLAKE and BLAKE2. According to our analysis, some tweaks introduced by BLAKE2 have increased its resistance against boomerang attacks to a certain extent. But on the whole, BLAKE still has higher a secure margin than BLAKE2.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Wang, X., Yu, H.: How to break MD5 and other hash functions. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 19–35. Springer, Heidelberg (2005)

    Google Scholar 

  2. Wang, X., Yin, Y.L., Yu, H.: Finding collisions in the full SHA-1. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 17–36. Springer, Heidelberg (2005)

    Google Scholar 

  3. Bertoni, G., Daemen, J., Peeters, M., Assche, G.: The keccak reference. Submission to NIST (Round 3) 13 (2011)

    Google Scholar 

  4. Aumasson, J.P., Henzen, L., Meier, W., Phan, R.C.W.: SHA-3 proposal blake. Submission to NIST (2008)

    Google Scholar 

  5. Chang, S.j., Perlner, R., Burr, W.E., Turan, M.S., Kelsey, J.M., Paul, S., Bassham, L.E.: Third-round report of the SHA-3 cryptographic hash algorithm competition. Citeseer (2012)

    Google Scholar 

  6. Aumasson, J.-P., Neves, S., Wilcox-O’Hearn, Z., Winnerlein, C.: BLAKE2: Simpler, smaller, fast as MD5. In: Jacobson, M., Locasto, M., Mohassel, P., Safavi-Naini, R. (eds.) ACNS 2013. LNCS, vol. 7954, pp. 119–135. Springer, Heidelberg (2013)

    Google Scholar 

  7. Aumasson, J.-P., Guo, J., Knellwolf, S., Matusiewicz, K., Meier, W.: Differential and invertibility properties of BLAKE. In: Hong, S., Iwata, T. (eds.) FSE 2010. LNCS, vol. 6147, pp. 318–332. Springer, Heidelberg (2010)

    Google Scholar 

  8. Dunkelman, O., Khovratovich, D.: Iterative differentials, symmetries, and message modification in blake-256. In: ECRYPT2 Hash Workshop, vol. 2011 (2011)

    Google Scholar 

  9. Ji, L., Liangyu, X.: Attacks on round-reduced blake. Technical Report, Citeseer (2009)

    Google Scholar 

  10. Biryukov, A., Nikolić, I., Roy, A.: Boomerang attacks on BLAKE-32. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 218–237. Springer, Heidelberg (2011)

    Google Scholar 

  11. Leurent, G.: Arxtools: A toolkit for arx analysis. In: The Third SHA-3 Candidate Conference (2012)

    Google Scholar 

  12. Bai, D., Yu, H., Wang, G., Wang, X.: Improved boomerang attacks on round-reduced sm3 and blake-256 (2013). http://eprint.iacr.org/

  13. Guo, J., Karpman, P., Nikolić, I., Wang, L., Wu, S.: Analysis of BLAKE2. In: Benaloh, J. (ed.) CT-RSA 2014. LNCS, vol. 8366, pp. 402–423. Springer, Heidelberg (2014)

    Google Scholar 

  14. Wagner, D.: The boomerang attack. In: Knudsen, L.R. (ed.) FSE 1999. LNCS, vol. 1636, pp. 156–170. Springer, Heidelberg (1999)

    Google Scholar 

  15. Kelsey, J., Kohno, T., Schneier, B.: Amplified boomerang attacks against reduced-round MARS and serpent. In: Schneier, B. (ed.) FSE 2000. LNCS, vol. 1978, pp. 75–93. Springer, Heidelberg (2001)

    Google Scholar 

  16. Biham, E., Dunkelman, O., Keller, N.: The rectangle attack - rectangling the serpent. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 340–357. Springer, Heidelberg (2001)

    Google Scholar 

  17. Biham, E., Dunkelman, O., Keller, N.: Related-key boomerang and rectangle attacks. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 507–525. Springer, Heidelberg (2005)

    Google Scholar 

  18. Lamberger, M., Mendel, F.: Higher-order differential attack on reduced SHA-256. IACR Cryptology ePrint Archive 2011, 37 (2011)

    Google Scholar 

  19. Biryukov, A., Lamberger, M., Mendel, F., Nikolić, I.: Second-order differential collisions for reduced SHA-256. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 270–287. Springer, Heidelberg (2011)

    Google Scholar 

  20. Mendel, F., Nad, T.: Boomerang distinguisher for the SIMD-512 compression function. In: Bernstein, D.J., Chatterjee, S. (eds.) INDOCRYPT 2011. LNCS, vol. 7107, pp. 255–269. Springer, Heidelberg (2011)

    Google Scholar 

  21. Sasaki, Y., Wang, L., Takasaki, Y., Sakiyama, K., Ohta, K.: Boomerang distinguishers for full HAS-160 compression function. In: Hanaoka, G., Yamauchi, T. (eds.) IWSEC 2012. LNCS, vol. 7631, pp. 156–169. Springer, Heidelberg (2012)

    Google Scholar 

  22. Sasaki, Y., Wang, L.: Distinguishers beyond three rounds of the RIPEMD-128/-160 compression functions. In: Bao, F., Samarati, P., Zhou, J. (eds.) ACNS 2012. LNCS, vol. 7341, pp. 275–292. Springer, Heidelberg (2012)

    Google Scholar 

  23. Leurent, G., Roy, A.: Boomerang attacks on hash function using auxiliary differentials. In: Dunkelman, O. (ed.) CT-RSA 2012. LNCS, vol. 7178, pp. 215–230. Springer, Heidelberg (2012)

    Google Scholar 

  24. Yu, H., Chen, J., Wang, X.: The boomerang attacks on the round-reduced skein-512. In: Knudsen, L.R., Wu, H. (eds.) SAC 2012. LNCS, vol. 7707, pp. 287–303. Springer, Heidelberg (2013)

    Google Scholar 

  25. Kircanski, A., Shen, Y., Wang, G., Youssef, A.M.: Boomerang and slide-rotational analysis of the SM3 hash function. In: Knudsen, L.R., Wu, H. (eds.) SAC 2012. LNCS, vol. 7707, pp. 304–320. Springer, Heidelberg (2013)

    Google Scholar 

  26. Bai, D., Yu, H., Wang, G., Wang, X.: Improved boomerang attacks on SM3. In: Boyd, C., Simpson, L. (eds.) ACISP. LNCS, vol. 7959, pp. 251–266. Springer, Heidelberg (2013)

    Google Scholar 

  27. Wagner, D.: A generalized birthday problem. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 288–304. Springer, Heidelberg (2002)

    Google Scholar 

Download references

Acknowledgement

This work has been supported by the National Natural Science Foundation of China (Grant No. 61133013) and by 973 Program (Grant No. 2013CB834205).

Author information

Authors and Affiliations

  1. Department of Computer Science and Technology, Tsinghua Universtiy, Beijing, 100084, China

    Yonglin Hao

Authors
  1. Yonglin Hao
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yonglin Hao .

Editor information

Editors and Affiliations

  1. SKLOIS, Institute of Engineering, Chinese Academy of Sciences, Beijing, China

    Dongdai Lin

  2. Computer Science Department, Columbia University, New York, New York, USA

    Moti Yung

  3. Infocomm Security Department, Institute for Infocomm Research, Singapore, Singapore

    Jianying Zhou

Appendices

A The Bottom and Top Differential Characteristics for BLAKE and BLAKE2

Table 4. The bottom characteristic for BLAKE-512. \(\varDelta ^b m_{11}=(63)\).
Full size table
Table 5. The bottom characteristic for BLAKE2b. \(\varDelta ^b m_{11}=(63)\).
Full size table
Table 6. The bottom characteristic for BLAKE-256. \(\varDelta ^b m_{11}=(31)\).
Full size table
Table 7. The bottom characteristic for BLAKE2s. \(\varDelta ^b m_{11}=(31)\).
Full size table
Table 8. The top characteristic for BLAKE-512. Message difference is \(\varDelta ^t m_{5}=(y)\) where \(y\in \mathbb {X}_{512}\)
Full size table
Table 9. The top characteristic for BLAKE2b. Message difference is \(\varDelta ^t m_{5}=(y)\) where \(y\in \mathbb {X}_{2b}\)
Full size table
Table 10. The top characteristic for BLAKE-256. Message difference is \(\varDelta ^t m_{5}=(y)\) where \(y\in \mathbb {X}_{256}\).
Full size table
Table 11. The top characteristic for BLAKE2s. Message difference is \(\varDelta ^t m_{5}=(y)\) where \(y\in \mathbb {X}_{2s}\).
Full size table

B 6.5-Round Examples for BLAKE and BLAKE2

The main difference between BLAKE-256 and BLAKE2s (BLAKE-512 and BLAKE2b) is at \(\varDelta ^t v^{3.5}_1\), where \(\varDelta ^t v^{3.5}_{1}=(29)\) for BLAKE-2s (\(\varDelta ^t v^{3.5}_{1}=(10)\) for BLAKE-2b) and \(\phi \) for BLAKE-256 (BLAKE-512). We specifically emphasize this part with bold dark format.

Table 12. Example for 6.5-round BLAKE-256 with \(y=28\in \mathbb {X}_{256}\bigcap \mathbb {X}_{2s}\).
Full size table
Table 13. Example for 6.5-round BLAKE2s with \(y=28\in \mathbb {X}_{256}\bigcap \mathbb {X}_{2s}\).
Full size table
Table 14. Example for 6.5-round BLAKE-512 with \(y=9\in \mathbb {X}_{512}\bigcap \mathbb {X}_{2b}\).
Full size table
Table 15. Example for 6.5-round BLAKE2b with \(y=9\in \mathbb {X}_{512}\bigcap \mathbb {X}_{2b}\).
Full size table

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer International Publishing Switzerland

About this paper

Cite this paper

Hao, Y. (2015). The Boomerang Attacks on BLAKE and BLAKE2. In: Lin, D., Yung, M., Zhou, J. (eds) Information Security and Cryptology. Inscrypt 2014. Lecture Notes in Computer Science(), vol 8957. Springer, Cham. https://doi.org/10.1007/978-3-319-16745-9_16

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-16745-9_16

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-16744-2

  • Online ISBN: 978-3-319-16745-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation